@zudojs/permissions 0.0.1

package/dist/role/roleRegistry.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Central registry for role definitions.
+ *
+ * @module role/roleRegistry
+ */
+import type { RoleDefinition } from "../permissionTypes/index.js";
+/** Options for the role registry. */
+export interface RoleRegistryOptions {
+    /** Allow overwriting existing roles. Defaults to false. */
+    readonly allowOverride?: boolean;
+}
+/**
+ * Create a role registry.
+ */
+export declare function createRoleRegistry(options?: RoleRegistryOptions): {
+    /**
+     * Register a role definition.
+     */
+    define(definition: RoleDefinition): void;
+    /**
+     * Get a role by name.
+     */
+    get(name: string): RoleDefinition | undefined;
+    /**
+     * Check if a role exists.
+     */
+    has(name: string): boolean;
+    /**
+     * Get all registered role names.
+     */
+    names(): readonly string[];
+    /**
+     * Get all registered role definitions.
+     */
+    all(): readonly RoleDefinition[];
+    /**
+     * Remove a role from the registry.
+     */
+    remove(name: string): boolean;
+    /**
+     * Clear all registered roles.
+     */
+    clear(): void;
+};
+//# sourceMappingURL=roleRegistry.d.ts.map

package/dist/role/roleRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleRegistry.d.ts","sourceRoot":"","sources":["../../src/role/roleRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAMlE,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,mBAAmB;IAK5D;;OAEG;IACH,MAAM,aAAa,cAAc,GAAG,IAAI;IAiBxC;;OAEG;IACH,GAAG,OAAO,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;OAEG;IACH,GAAG,OAAO,MAAM,GAAG,OAAO;IAI1B;;OAEG;IACH,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B;;OAEG;IACH,GAAG,IAAI,SAAS,cAAc,EAAE;IAIhC;;OAEG;IACH,MAAM,OAAO,MAAM,GAAG,OAAO;IAI7B;;OAEG;IACH,KAAK,IAAI,IAAI;EAIhB"}

package/dist/role/roleRegistry.js

@@ -0,0 +1,67 @@
+/**
+ * Central registry for role definitions.
+ *
+ * @module role/roleRegistry
+ */
+import { DuplicateRoleError, InvalidRoleError, } from "../permissionErrors/index.js";
+/**
+ * Create a role registry.
+ */
+export function createRoleRegistry(options) {
+    const roles = new Map();
+    const allowOverride = options?.allowOverride ?? false;
+    return {
+        /**
+         * Register a role definition.
+         */
+        define(definition) {
+            if (!definition.name || definition.name.trim() === "") {
+                throw new InvalidRoleError("Role name cannot be empty");
+            }
+            if (!definition.permissions || definition.permissions.length === 0) {
+                throw new InvalidRoleError(`Role "${definition.name}" must have at least one permission`);
+            }
+            if (roles.has(definition.name) && !allowOverride) {
+                throw new DuplicateRoleError(definition.name);
+            }
+            roles.set(definition.name, Object.freeze({ ...definition }));
+        },
+        /**
+         * Get a role by name.
+         */
+        get(name) {
+            return roles.get(name);
+        },
+        /**
+         * Check if a role exists.
+         */
+        has(name) {
+            return roles.has(name);
+        },
+        /**
+         * Get all registered role names.
+         */
+        names() {
+            return Array.from(roles.keys());
+        },
+        /**
+         * Get all registered role definitions.
+         */
+        all() {
+            return Array.from(roles.values());
+        },
+        /**
+         * Remove a role from the registry.
+         */
+        remove(name) {
+            return roles.delete(name);
+        },
+        /**
+         * Clear all registered roles.
+         */
+        clear() {
+            roles.clear();
+        },
+    };
+}
+//# sourceMappingURL=roleRegistry.js.map

package/dist/role/roleRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleRegistry.js","sourceRoot":"","sources":["../../src/role/roleRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AAQtC;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,KAAK,CAAC;IAEtD,OAAO;QACL;;WAEG;QACH,MAAM,CAAC,UAA0B;YAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,gBAAgB,CACxB,SAAS,UAAU,CAAC,IAAI,qCAAqC,CAC9D,CAAC;YACJ,CAAC;YAED,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjD,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED;;WAEG;QACH,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED;;WAEG;QACH,GAAG,CAAC,IAAY;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED;;WAEG;QACH,KAAK;YACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAED;;WAEG;QACH,GAAG;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;QAED;;WAEG;QACH,MAAM,CAAC,IAAY;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED;;WAEG;QACH,KAAK;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rule/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Rule matching, evaluation, and compilation for permission decisions.
+ *
+ * @module rule
+ */
+export { ruleMatches, evaluateRules } from "./rule.core.js";
+export { compileRules, findMatchingRules } from "./ruleCompiler.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/rule/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rule/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/rule/index.js

@@ -0,0 +1,8 @@
+/**
+ * Rule matching, evaluation, and compilation for permission decisions.
+ *
+ * @module rule
+ */
+export { ruleMatches, evaluateRules } from "./rule.core.js";
+export { compileRules, findMatchingRules } from "./ruleCompiler.js";
+//# sourceMappingURL=index.js.map

package/dist/rule/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rule/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/rule/rule.core.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Rule matching and compilation for permission evaluation.
+ *
+ * @module rule/rule
+ */
+import type { PermissionRule, Permission } from "../permissionTypes/index.js";
+/**
+ * Check if a rule matches a target permission.
+ *
+ * A rule matches if its resource and action patterns match the target,
+ * considering wildcard support.
+ */
+export declare function ruleMatches(rule: PermissionRule, target: Permission): boolean;
+/**
+ * Evaluate a set of rules against a target permission.
+ *
+ * Returns the effective decision after applying deny-overrides and priority.
+ * Default: deny.
+ */
+export declare function evaluateRules(rules: readonly PermissionRule[], target: Permission): {
+    readonly allowed: boolean;
+    readonly matchedRule?: PermissionRule;
+};
+//# sourceMappingURL=rule.core.d.ts.map

package/dist/rule/rule.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.core.d.ts","sourceRoot":"","sources":["../../src/rule/rule.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAK7E;AA4CD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,MAAM,EAAE,UAAU,GACjB;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAA;CAAE,CAuBtE"}

package/dist/rule/rule.core.js

@@ -0,0 +1,79 @@
+/**
+ * Rule matching and compilation for permission evaluation.
+ *
+ * @module rule/rule
+ */
+/**
+ * Check if a rule matches a target permission.
+ *
+ * A rule matches if its resource and action patterns match the target,
+ * considering wildcard support.
+ */
+export function ruleMatches(rule, target) {
+    return (resourceMatches(rule.resource, target.resource) &&
+        actionMatches(rule.action, target.action));
+}
+/**
+ * Check if a rule's resource pattern matches a target resource.
+ */
+function resourceMatches(pattern, target) {
+    if (Array.isArray(pattern)) {
+        return pattern.some((p) => patternStrMatches(p, target));
+    }
+    return patternStrMatches(pattern, target);
+}
+/**
+ * Check if a rule's action pattern matches a target action.
+ */
+function actionMatches(pattern, target) {
+    if (Array.isArray(pattern)) {
+        return pattern.some((p) => patternStrMatches(p, target));
+    }
+    return patternStrMatches(pattern, target);
+}
+/**
+ * Check if a single pattern string matches a target, supporting wildcards.
+ */
+function patternStrMatches(pattern, target) {
+    if (pattern === "*")
+        return true;
+    if (pattern === target)
+        return true;
+    // Namespace wildcard: "billing.*" matches "billing.invoice"
+    if (pattern.endsWith(".*")) {
+        const prefix = pattern.slice(0, -2);
+        return target === prefix || target.startsWith(`${prefix}.`);
+    }
+    return false;
+}
+/**
+ * Evaluate a set of rules against a target permission.
+ *
+ * Returns the effective decision after applying deny-overrides and priority.
+ * Default: deny.
+ */
+export function evaluateRules(rules, target) {
+    const matching = rules.filter((r) => ruleMatches(r, target));
+    if (matching.length === 0) {
+        return { allowed: false };
+    }
+    // Sort by priority descending; same priority: deny wins (deny has higher effective priority)
+    const sorted = [...matching].sort((a, b) => {
+        const priA = a.priority ?? 0;
+        const priB = b.priority ?? 0;
+        if (priA !== priB)
+            return priB - priA;
+        // Same priority: deny wins
+        if (a.effect === "deny" && b.effect !== "deny")
+            return -1;
+        if (b.effect === "deny" && a.effect !== "deny")
+            return 1;
+        return 0;
+    });
+    const top = sorted[0];
+    return {
+        allowed: top.effect === "allow",
+        matchedRule: top,
+    };
+}
+//# sourceMappingURL=rule.core.js.map

package/dist/rule/rule.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule.core.js","sourceRoot":"","sources":["../../src/rule/rule.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,MAAkB;IAClE,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC/C,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CACtB,OAAmC,EACnC,MAAc;IAEd,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAiB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,OAAmC,EACnC,MAAc;IAEd,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAiB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEpC,4DAA4D;IAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAgC,EAChC,MAAkB;IAElB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,6FAA6F;IAC7F,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,GAAG,IAAI,CAAC;QACtC,2BAA2B;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO;QAC/B,WAAW,EAAE,GAAG;KACjB,CAAC;AACJ,CAAC"}

package/dist/rule/ruleCompiler.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Rule compiler — indexes rules for fast lookup during authorization.
+ *
+ * @module rule/ruleCompiler
+ */
+import type { PermissionRule, Permission } from "../permissionTypes/index.js";
+/** Compiled rule index for O(1) lookup by resource:action. */
+interface RuleIndex {
+    /** Exact matches: "post:update" → rules. */
+    readonly exact: ReadonlyMap<string, readonly PermissionRule[]>;
+    /** Resource wildcards: "post:*" → rules. */
+    readonly resourceWildcard: ReadonlyMap<string, readonly PermissionRule[]>;
+    /** Action wildcards: "*:read" → rules. */
+    readonly actionWildcard: ReadonlyMap<string, readonly PermissionRule[]>;
+    /** Global wildcards: "*:*" → rules. */
+    readonly globalWildcard: readonly PermissionRule[];
+}
+/**
+ * Compile a set of rules into an optimized index.
+ */
+export declare function compileRules(rules: readonly PermissionRule[]): RuleIndex;
+/**
+ * Find all rules from the compiled index that match a target permission.
+ */
+export declare function findMatchingRules(index: RuleIndex, target: Permission): readonly PermissionRule[];
+export {};
+//# sourceMappingURL=ruleCompiler.d.ts.map

package/dist/rule/ruleCompiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleCompiler.d.ts","sourceRoot":"","sources":["../../src/rule/ruleCompiler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9E,8DAA8D;AAC9D,UAAU,SAAS;IACjB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC;IAC/D,4CAA4C;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC;IAC1E,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC;IACxE,uCAAuC;IACvC,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;CACpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAsCxE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,UAAU,GACjB,SAAS,cAAc,EAAE,CAoB3B"}

package/dist/rule/ruleCompiler.js

@@ -0,0 +1,76 @@
+/**
+ * Rule compiler — indexes rules for fast lookup during authorization.
+ *
+ * @module rule/ruleCompiler
+ */
+/**
+ * Compile a set of rules into an optimized index.
+ */
+export function compileRules(rules) {
+    const exact = new Map();
+    const resourceWildcard = new Map();
+    const actionWildcard = new Map();
+    const globalWildcard = [];
+    for (const rule of rules) {
+        const resources = normalizeToArray(rule.resource);
+        const actions = normalizeToArray(rule.action);
+        for (const resource of resources) {
+            for (const action of actions) {
+                if (resource === "*" && action === "*") {
+                    globalWildcard.push(rule);
+                }
+                else if (resource === "*") {
+                    const key = action;
+                    if (!actionWildcard.has(key))
+                        actionWildcard.set(key, []);
+                    actionWildcard.get(key).push(rule);
+                }
+                else if (action === "*") {
+                    const key = resource;
+                    if (!resourceWildcard.has(key))
+                        resourceWildcard.set(key, []);
+                    resourceWildcard.get(key).push(rule);
+                }
+                else {
+                    const key = `${resource}:${action}`;
+                    if (!exact.has(key))
+                        exact.set(key, []);
+                    exact.get(key).push(rule);
+                }
+            }
+        }
+    }
+    const index = {
+        exact,
+        resourceWildcard,
+        actionWildcard,
+        globalWildcard,
+    };
+    return index;
+}
+/**
+ * Find all rules from the compiled index that match a target permission.
+ */
+export function findMatchingRules(index, target) {
+    const results = [];
+    const key = `${target.resource}:${target.action}`;
+    // 1. Exact matches
+    const exactRules = index.exact.get(key);
+    if (exactRules)
+        results.push(...exactRules);
+    // 2. Resource wildcard: "post:*" matches "post:update"
+    const resWildcard = index.resourceWildcard.get(target.resource);
+    if (resWildcard)
+        results.push(...resWildcard);
+    // 3. Action wildcard: "*:read" matches "post:read"
+    const actWildcard = index.actionWildcard.get(target.action);
+    if (actWildcard)
+        results.push(...actWildcard);
+    // 4. Global wildcard: "*:*"
+    results.push(...index.globalWildcard);
+    return results;
+}
+function normalizeToArray(value) {
+    return Array.isArray(value) ? [...value] : [value];
+}
+//# sourceMappingURL=ruleCompiler.js.map

package/dist/rule/ruleCompiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleCompiler.js","sourceRoot":"","sources":["../../src/rule/ruleCompiler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3D,MAAM,cAAc,GAAqB,EAAE,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,QAAQ,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;qBAAM,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,MAAM,CAAC;oBACnB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC1D,cAAc,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC;oBACrB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC9D,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;oBACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACxC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAc;QACvB,KAAK;QACL,gBAAgB;QAChB,cAAc;QACd,cAAc;KACf,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgB,EAChB,MAAkB;IAElB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAElD,mBAAmB;IACnB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAE5C,uDAAuD;IACvD,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAE9C,mDAAmD;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAE9C,4BAA4B;IAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAEtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC/D,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Utility helpers for the permissions package.
+ *
+ * @module utils
+ */
+export { createCacheKey, extractResource, extractAction, buildPermission, createActor, } from "./utils.helper.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC"}

package/dist/utils/index.js

@@ -0,0 +1,7 @@
+/**
+ * Utility helpers for the permissions package.
+ *
+ * @module utils
+ */
+export { createCacheKey, extractResource, extractAction, buildPermission, createActor, } from "./utils.helper.js";
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC"}

package/dist/utils/utils.helper.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Utility helpers for the permissions package.
+ *
+ * @module utils/utils
+ */
+import type { PermissionActor } from "../permissionTypes/index.js";
+/**
+ * Create a permission check cache key.
+ */
+export declare function createCacheKey(actorId: string, permission: string, resourceId?: string): string;
+/**
+ * Extract the resource type from a permission string.
+ *
+ * @example extractResource("post:update") → "post"
+ * @example extractResource("billing.invoice:refund") → "billing.invoice"
+ */
+export declare function extractResource(permission: string): string;
+/**
+ * Extract the action from a permission string.
+ *
+ * @example extractAction("post:update") → "update"
+ */
+export declare function extractAction(permission: string): string;
+/**
+ * Build a permission string from resource and action.
+ */
+export declare function buildPermission(resource: string, action: string): string;
+/**
+ * Create a quick actor object.
+ */
+export declare function createActor(id: string, options?: {
+    readonly type?: string;
+    readonly roles?: readonly string[];
+    readonly permissions?: readonly string[];
+    readonly deniedPermissions?: readonly string[];
+}): PermissionActor;
+//# sourceMappingURL=utils.helper.d.ts.map

package/dist/utils/utils.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.helper.d.ts","sourceRoot":"","sources":["../../src/utils/utils.helper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CAGR;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,GACA,eAAe,CAQjB"}

package/dist/utils/utils.helper.js

@@ -0,0 +1,50 @@
+/**
+ * Utility helpers for the permissions package.
+ *
+ * @module utils/utils
+ */
+/**
+ * Create a permission check cache key.
+ */
+export function createCacheKey(actorId, permission, resourceId) {
+    const base = `${actorId}:${permission}`;
+    return resourceId ? `${base}:${resourceId}` : base;
+}
+/**
+ * Extract the resource type from a permission string.
+ *
+ * @example extractResource("post:update") → "post"
+ * @example extractResource("billing.invoice:refund") → "billing.invoice"
+ */
+export function extractResource(permission) {
+    const lastColon = permission.lastIndexOf(":");
+    return lastColon > 0 ? permission.slice(0, lastColon) : permission;
+}
+/**
+ * Extract the action from a permission string.
+ *
+ * @example extractAction("post:update") → "update"
+ */
+export function extractAction(permission) {
+    const lastColon = permission.lastIndexOf(":");
+    return lastColon > 0 ? permission.slice(lastColon + 1) : "";
+}
+/**
+ * Build a permission string from resource and action.
+ */
+export function buildPermission(resource, action) {
+    return `${resource}:${action}`;
+}
+/**
+ * Create a quick actor object.
+ */
+export function createActor(id, options) {
+    return Object.freeze({
+        id,
+        type: options?.type,
+        roles: options?.roles,
+        permissions: options?.permissions,
+        deniedPermissions: options?.deniedPermissions,
+    });
+}
+//# sourceMappingURL=utils.helper.js.map

package/dist/utils/utils.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.helper.js","sourceRoot":"","sources":["../../src/utils/utils.helper.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,UAAkB,EAClB,UAAmB;IAEnB,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAc;IAC9D,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,EAAU,EACV,OAKC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,KAAK,EAAE,OAAO,EAAE,KAAK;QACrB,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;KAC9C,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@zudojs/permissions",
+  "version": "0.0.1",
+  "description": "Generic authorization engine with RBAC, ABAC, resource authorization, wildcards, role hierarchy, policies, and abilities.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@zudojs/errors": "workspace:*",
+    "@zudojs/constants": "workspace:*"
+  },
+  "peerDependencies": {
+    "@zudojs/http": "workspace:*"
+  },
+  "peerDependenciesMeta": {
+    "@zudojs/http": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "zudojs",
+    "rbac",
+    "abac",
+    "authorization",
+    "permissions"
+  ],
+  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/oyinlola-tech/zudo"
+  }
+}