@zudojs/permissions 1.1.0 → 1.2.0

package/dist/http/index.d.ts

@@ -2,14 +2,16 @@
  * HTTP middleware adapter for @zudojs/permissions.
  *
  * The HTTP types are mirrored locally in `httpTypes.ts` so this package has no
- * hard dependency on @zudojs/http, which is an optional peer. The mirror is
- * structural: anything satisfying the real `HttpMiddlewareContext` satisfies
- * the local one, so the middleware composes with the real pipeline. Keep the
- * two in step when @zudojs/http changes — nothing here can check it for you.
+ * dependency on @zudojs/http at all — http sits in a higher architecture tier,
+ * so it cannot be a dependency or a peer. The mirror is structural: anything
+ * satisfying the real `HttpMiddlewareContext` satisfies the local one, so the
+ * middleware composes with the real pipeline. A test runs the guard inside
+ * the real `HttpMiddlewarePipeline` to keep the two in step.
  *
  * @module http
  */
 export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, DECISIONS_STATE_KEY, type AuthorizeMiddlewareOptions, type ActorMiddlewareOptions, type RequirePermissionMiddlewareOptions, type RequirePermissionsMiddlewareOptions, } from "./httpMiddleware.core.js";
 export { createForbiddenResponse, createUnauthorizedResponse, createJsonResponse, type DeniedResponseOptions, type PermissionHttpResponse, } from "./httpHelpers.js";
-export type { HttpMiddleware, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
+export { loadResource, RESOURCE_ERROR_DECISION, type ResourceExtractor, type ResourceOutcome, } from "./httpResource.helper.js";
+export type { HttpRequestBag, HttpMiddleware, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -2,13 +2,15 @@
  * HTTP middleware adapter for @zudojs/permissions.
  *
  * The HTTP types are mirrored locally in `httpTypes.ts` so this package has no
- * hard dependency on @zudojs/http, which is an optional peer. The mirror is
- * structural: anything satisfying the real `HttpMiddlewareContext` satisfies
- * the local one, so the middleware composes with the real pipeline. Keep the
- * two in step when @zudojs/http changes — nothing here can check it for you.
+ * dependency on @zudojs/http at all — http sits in a higher architecture tier,
+ * so it cannot be a dependency or a peer. The mirror is structural: anything
+ * satisfying the real `HttpMiddlewareContext` satisfies the local one, so the
+ * middleware composes with the real pipeline. A test runs the guard inside
+ * the real `HttpMiddlewarePipeline` to keep the two in step.
  *
  * @module http
  */
 export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, DECISIONS_STATE_KEY, } from "./httpMiddleware.core.js";
 export { createForbiddenResponse, createUnauthorizedResponse, createJsonResponse, } from "./httpHelpers.js";
+export { loadResource, RESOURCE_ERROR_DECISION, } from "./httpResource.helper.js";
 //# sourceMappingURL=index.js.map

package/dist/permission/index.d.ts

@@ -3,6 +3,6 @@
  *
  * @module permission
  */
-export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, formatPermission, } from "./permission.core.js";
+export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
 export { createPermissionRegistry, type PermissionRegistry, type PermissionRegistryOptions, type RegisteredPermission, } from "./permissionRegistry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/index.js

@@ -3,6 +3,6 @@
  *
  * @module permission
  */
-export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, formatPermission, } from "./permission.core.js";
+export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
 export { createPermissionRegistry, } from "./permissionRegistry.js";
 //# sourceMappingURL=index.js.map

package/dist/permission/permission.core.d.ts

@@ -32,6 +32,18 @@ export declare function matches(pattern: string, target: string): boolean;
  * Check if a permission pattern matches a structured Permission object.
  */
 export declare function matchesPermission(pattern: string, permission: Permission): boolean;
+/**
+ * Check if two permission patterns can name a common permission.
+ *
+ * This is the test a *deny* needs. For a concrete target it is exactly
+ * {@link matches}; for a wildcard target such as `post:*` it also holds when
+ * the deny is narrower (`post:delete`), which `matches` does not see.
+ *
+ * @example permissionsOverlap("post:delete", "post:*") → true
+ * @example permissionsOverlap("*:delete", "post:*") → true
+ * @example permissionsOverlap("post:delete", "post:read") → false
+ */
+export declare function permissionsOverlap(a: string, b: string): boolean;
 /**
  * Parse a permission string, returning null on invalid format instead of throwing.
  */

package/dist/permission/permission.core.js

@@ -4,7 +4,7 @@
  * @module permission/permission
  */
 import { InvalidPermissionError } from "../permissionErrors/index.js";
-import { patternStrMatches } from "../rule/rule.core.js";
+import { patternStrMatches, patternsOverlap } from "../rule/rule.pattern.js";
 /**
  * Valid permission format: `resource:action`.
  *
@@ -62,6 +62,25 @@ export function matchesPermission(pattern, permission) {
     return (patternStrMatches(parsed.resource, permission.resource) &&
         patternStrMatches(parsed.action, permission.action));
 }
+/**
+ * Check if two permission patterns can name a common permission.
+ *
+ * This is the test a *deny* needs. For a concrete target it is exactly
+ * {@link matches}; for a wildcard target such as `post:*` it also holds when
+ * the deny is narrower (`post:delete`), which `matches` does not see.
+ *
+ * @example permissionsOverlap("post:delete", "post:*") → true
+ * @example permissionsOverlap("*:delete", "post:*") → true
+ * @example permissionsOverlap("post:delete", "post:read") → false
+ */
+export function permissionsOverlap(a, b) {
+    const left = parsePermissionSafe(a);
+    const right = parsePermissionSafe(b);
+    if (!left || !right)
+        return false;
+    return (patternsOverlap(left.resource, right.resource) &&
+        patternsOverlap(left.action, right.action));
+}
 /**
  * Parse a permission string, returning null on invalid format instead of throwing.
  */

package/dist/policy/policyRegistry.d.ts

@@ -8,6 +8,12 @@ import type { PermissionPolicyDefinition } from "../permissionTypes/index.js";
 export interface PolicyRegistryOptions {
     /** Allow overwriting an existing policy. Defaults to false. */
     readonly allowOverride?: boolean;
+    /**
+     * Reject permission patterns that are not `resource:action`. Defaults to
+     * true — a policy scoped to a pattern that never matches never runs, so a
+     * mistyped lockdown would deny nothing.
+     */
+    readonly validatePermissions?: boolean;
 }
 /** A policy registry, usable directly as the engine's `policies` source. */
 export interface PolicyRegistry {
@@ -19,6 +25,12 @@ export interface PolicyRegistry {
     all(): readonly PermissionPolicyDefinition[];
     remove(name: string): boolean;
     clear(): void;
+    /**
+     * Be told whenever the policy set changes. Returns an unsubscribe function.
+     * An engine built on this registry subscribes itself, so a policy change
+     * is not bypassed by a cached decision.
+     */
+    subscribe(listener: () => void): () => void;
 }
 /**
  * Create a policy registry.

package/dist/policy/policyRegistry.js

@@ -5,6 +5,8 @@
  */
 import { DuplicatePolicyError } from "../permissionErrors/index.js";
 import { selectPolicies } from "../evaluator/evaluator.pipeline.js";
+import { validatePolicy } from "../evaluator/engineSupport/index.js";
+import { createChangeNotifier } from "../utils/utils.notifier.js";
 /**
  * Create a policy registry.
  *
@@ -13,6 +15,8 @@ import { selectPolicies } from "../evaluator/evaluator.pipeline.js";
 export function createPolicyRegistry(options) {
     const policies = new Map();
     const allowOverride = options?.allowOverride ?? false;
+    const validatePermissions = options?.validatePermissions ?? true;
+    const changes = createChangeNotifier();
     return {
         /**
          * Register a policy.
@@ -20,8 +24,12 @@ export function createPolicyRegistry(options) {
          * Re-registering a name is rejected unless `allowOverride` was set: a
          * second `define("owner-only", …)` used to replace the first in silence,
          * which is an authorization rule vanishing without a trace.
+         *
+         * @throws {InvalidPermissionError} when a permission pattern is malformed.
          */
         define(definition) {
+            if (validatePermissions)
+                validatePolicy(definition);
             if (policies.has(definition.name) && !allowOverride) {
                 throw new DuplicatePolicyError(definition.name);
             }
@@ -31,6 +39,7 @@ export function createPolicyRegistry(options) {
                 ...definition,
                 permissions: Object.freeze([...definition.permissions]),
             }));
+            changes.notify();
         },
         get(name) {
             return policies.get(name);
@@ -55,10 +64,17 @@ export function createPolicyRegistry(options) {
             return [...policies.values()];
         },
         remove(name) {
-            return policies.delete(name);
+            const removed = policies.delete(name);
+            if (removed)
+                changes.notify();
+            return removed;
         },
         clear() {
             policies.clear();
+            changes.notify();
+        },
+        subscribe(listener) {
+            return changes.subscribe(listener);
         },
     };
 }

package/dist/role/roleRegistry.d.ts

@@ -26,6 +26,15 @@ export interface RoleRegistry {
     all(): readonly RoleDefinition[];
     remove(name: string): boolean;
     clear(): void;
+    /**
+     * Be told whenever the role set changes (`define`, a `remove` that removed
+     * something, `clear`). Returns an unsubscribe function.
+     *
+     * An engine built on this registry subscribes itself, which is what makes
+     * revoking a role take effect on the next check instead of whenever
+     * somebody remembers to call `engine.invalidateRoles()`.
+     */
+    subscribe(listener: () => void): () => void;
 }
 /**
  * Copy a role definition so it no longer shares arrays with the caller.

package/dist/role/roleRegistry.js

@@ -5,6 +5,8 @@
  */
 import { DuplicateRoleError, InvalidRoleError, RoleNotFoundError, } from "../permissionErrors/index.js";
 import { isValidPermission } from "../permission/permission.core.js";
+import { invalidRulePattern } from "../evaluator/engineSupport/index.js";
+import { createChangeNotifier } from "../utils/utils.notifier.js";
 /**
  * Copy a role definition so it no longer shares arrays with the caller.
  *
@@ -32,6 +34,7 @@ export function createRoleRegistry(options) {
     const roles = new Map();
     const allowOverride = options?.allowOverride ?? false;
     const validatePermissions = options?.validatePermissions ?? true;
+    const changes = createChangeNotifier();
     return {
         /**
          * Register a role definition.
@@ -54,11 +57,19 @@ export function createRoleRegistry(options) {
                             `valid "resource:action" permission`);
                     }
                 }
+                for (const rule of definition.rules ?? []) {
+                    const invalid = invalidRulePattern(rule);
+                    if (invalid !== undefined) {
+                        throw new InvalidRoleError(`Role "${definition.name}" has a rule on "${invalid}", which is ` +
+                            `not a valid "resource:action" pattern`);
+                    }
+                }
             }
             if (roles.has(definition.name) && !allowOverride) {
                 throw new DuplicateRoleError(definition.name);
             }
             roles.set(definition.name, freezeRoleDefinition(definition));
+            changes.notify();
         },
         get(name) {
             return roles.get(name);
@@ -79,10 +90,17 @@ export function createRoleRegistry(options) {
             return [...roles.values()];
         },
         remove(name) {
-            return roles.delete(name);
+            const removed = roles.delete(name);
+            if (removed)
+                changes.notify();
+            return removed;
         },
         clear() {
             roles.clear();
+            changes.notify();
+        },
+        subscribe(listener) {
+            return changes.subscribe(listener);
         },
     };
 }

package/dist/rule/rule.core.d.ts

@@ -4,23 +4,7 @@
  * @module rule/rule
  */
 import type { PermissionRule, Permission, PermissionContext, RuleCombiningAlgorithm, RuleEvaluation } from "../permissionTypes/index.js";
-/**
- * Check if a rule matches a target permission.
- *
- * Matching is about resource and action only. Whether the rule *applies* also
- * depends on its condition, which needs a context and is therefore evaluated
- * by {@link evaluateRules}.
- */
-export declare function ruleMatches(rule: PermissionRule, target: Permission): boolean;
-/**
- * Check if a single pattern string matches a target, supporting wildcards.
- *
- * Two forms are supported, and they are the same two the permission matcher
- * supports, so a pattern means the same thing wherever it is written:
- *   `*`           — matches anything
- *   `billing.*`   — matches `billing` and any `billing.…` namespace
- */
-export declare function patternStrMatches(pattern: string, target: string): boolean;
+export { ruleMatches, patternStrMatches } from "./rule.pattern.js";
 /**
  * Evaluate a set of rules against a target permission.
  *
@@ -29,9 +13,15 @@ export declare function patternStrMatches(pattern: string, target: string): bool
  * has to mean "owners may", not "anyone may". Conditions are async, so this
  * function is too.
  *
- * A condition that throws is treated as unmet — an authorization check fails
- * closed. A rule that carries a condition when no context was supplied is
- * skipped for the same reason.
+ * A condition that cannot be evaluated fails closed, and what "closed" means
+ * depends on the rule's effect. An allow whose condition throws, or that has
+ * a condition but no context, does not apply. A *deny* in the same position
+ * does apply: treating it as unmet dropped the deny and let the role's allow
+ * win, so a missing resource or a blocklist service that was down granted
+ * the very access the deny existed to refuse.
+ *
+ * A deny also applies when its patterns merely overlap a wildcard target —
+ * `can(actor, "post:*")` is refused by a deny on `post:delete`.
  *
  * Default combining algorithm: `deny-overrides`. Any applicable deny wins,
  * whatever its priority.
@@ -44,8 +34,10 @@ export declare function evaluateRules(rules: readonly PermissionRule[], target:
  * Evaluate rules that carry no conditions.
  *
  * Synchronous, for callers that build their own condition-free rule sets.
- * Any rule with a condition is skipped, because there is no way to evaluate
- * one without awaiting it — use {@link evaluateRules} for those.
+ * A conditional rule cannot be evaluated without awaiting it — use
+ * {@link evaluateRules} for those — so it fails closed the same way an
+ * unevaluable condition does there: a conditional allow is skipped, and a
+ * conditional deny applies.
  */
 export declare function evaluateRulesSync(rules: readonly PermissionRule[], target: Permission, options?: {
     readonly algorithm?: RuleCombiningAlgorithm;

package/dist/rule/rule.core.js

@@ -3,42 +3,34 @@
  *
  * @module rule/rule
  */
+import { ruleBearsOn } from "./rule.pattern.js";
+export { ruleMatches, patternStrMatches } from "./rule.pattern.js";
 /**
- * Check if a rule matches a target permission.
- *
- * Matching is about resource and action only. Whether the rule *applies* also
- * depends on its condition, which needs a context and is therefore evaluated
- * by {@link evaluateRules}.
+ * Sort key for `priority` combining: higher priority first, and at equal
+ * priority a deny before an allow.
  */
-export function ruleMatches(rule, target) {
-    return (patternListMatches(rule.resource, target.resource) &&
-        patternListMatches(rule.action, target.action));
-}
-/** Check if any pattern in a rule field matches a target segment. */
-function patternListMatches(pattern, target) {
-    if (Array.isArray(pattern)) {
-        return pattern.some((entry) => patternStrMatches(entry, target));
-    }
-    return patternStrMatches(pattern, target);
+function byPriority(a, b) {
+    const priorityA = a.priority ?? 0;
+    const priorityB = b.priority ?? 0;
+    if (priorityA !== priorityB)
+        return priorityB - priorityA;
+    if (a.effect === "deny" && b.effect !== "deny")
+        return -1;
+    if (b.effect === "deny" && a.effect !== "deny")
+        return 1;
+    return 0;
 }
-/**
- * Check if a single pattern string matches a target, supporting wildcards.
- *
- * Two forms are supported, and they are the same two the permission matcher
- * supports, so a pattern means the same thing wherever it is written:
- *   `*`           — matches anything
- *   `billing.*`   — matches `billing` and any `billing.…` namespace
- */
-export function patternStrMatches(pattern, target) {
-    if (pattern === "*")
-        return true;
-    if (pattern === target)
-        return true;
-    if (pattern.endsWith(".*")) {
-        const prefix = pattern.slice(0, -2);
-        return target === prefix || target.startsWith(`${prefix}.`);
+function combineApplicable(applicable, algorithm) {
+    if (applicable.length === 0)
+        return { allowed: false, applicable: [] };
+    if (algorithm === "deny-overrides") {
+        const deny = applicable.find((rule) => rule.effect === "deny");
+        if (deny)
+            return { allowed: false, matchedRule: deny, applicable };
+        return { allowed: true, matchedRule: applicable[0], applicable };
     }
-    return false;
+    const top = [...applicable].sort(byPriority)[0];
+    return { allowed: top.effect === "allow", matchedRule: top, applicable };
 }
 /**
  * Evaluate a set of rules against a target permission.
@@ -48,9 +40,15 @@ export function patternStrMatches(pattern, target) {
  * has to mean "owners may", not "anyone may". Conditions are async, so this
  * function is too.
  *
- * A condition that throws is treated as unmet — an authorization check fails
- * closed. A rule that carries a condition when no context was supplied is
- * skipped for the same reason.
+ * A condition that cannot be evaluated fails closed, and what "closed" means
+ * depends on the rule's effect. An allow whose condition throws, or that has
+ * a condition but no context, does not apply. A *deny* in the same position
+ * does apply: treating it as unmet dropped the deny and let the role's allow
+ * win, so a missing resource or a blocklist service that was down granted
+ * the very access the deny existed to refuse.
+ *
+ * A deny also applies when its patterns merely overlap a wildcard target —
+ * `can(actor, "post:*")` is refused by a deny on `post:delete`.
  *
  * Default combining algorithm: `deny-overrides`. Any applicable deny wins,
  * whatever its priority.
@@ -59,78 +57,43 @@ export async function evaluateRules(rules, target, context, options) {
     const algorithm = options?.algorithm ?? "deny-overrides";
     const applicable = [];
     for (const rule of rules) {
-        if (!ruleMatches(rule, target))
+        if (!ruleBearsOn(rule, target))
             continue;
         if (rule.condition) {
-            if (!context)
+            const failClosed = rule.effect === "deny";
+            if (!context) {
+                if (failClosed)
+                    applicable.push(rule);
                 continue;
-            let met = false;
+            }
+            let met;
             try {
                 met = await rule.condition(context);
             }
             catch (error) {
                 options?.onConditionError?.(rule, error);
-                met = false;
+                met = failClosed;
             }
             if (!met)
                 continue;
         }
         applicable.push(rule);
     }
-    if (applicable.length === 0) {
-        return { allowed: false, applicable: [] };
-    }
-    if (algorithm === "deny-overrides") {
-        const deny = applicable.find((rule) => rule.effect === "deny");
-        if (deny)
-            return { allowed: false, matchedRule: deny, applicable };
-        return { allowed: true, matchedRule: applicable[0], applicable };
-    }
-    const sorted = [...applicable].sort((a, b) => {
-        const priorityA = a.priority ?? 0;
-        const priorityB = b.priority ?? 0;
-        if (priorityA !== priorityB)
-            return priorityB - priorityA;
-        // Same priority: deny wins.
-        if (a.effect === "deny" && b.effect !== "deny")
-            return -1;
-        if (b.effect === "deny" && a.effect !== "deny")
-            return 1;
-        return 0;
-    });
-    const top = sorted[0];
-    return { allowed: top.effect === "allow", matchedRule: top, applicable };
+    return combineApplicable(applicable, algorithm);
 }
 /**
  * Evaluate rules that carry no conditions.
  *
  * Synchronous, for callers that build their own condition-free rule sets.
- * Any rule with a condition is skipped, because there is no way to evaluate
- * one without awaiting it — use {@link evaluateRules} for those.
+ * A conditional rule cannot be evaluated without awaiting it — use
+ * {@link evaluateRules} for those — so it fails closed the same way an
+ * unevaluable condition does there: a conditional allow is skipped, and a
+ * conditional deny applies.
  */
 export function evaluateRulesSync(rules, target, options) {
     const algorithm = options?.algorithm ?? "deny-overrides";
-    const applicable = rules.filter((rule) => rule.condition === undefined && ruleMatches(rule, target));
-    if (applicable.length === 0)
-        return { allowed: false, applicable: [] };
-    if (algorithm === "deny-overrides") {
-        const deny = applicable.find((rule) => rule.effect === "deny");
-        if (deny)
-            return { allowed: false, matchedRule: deny, applicable };
-        return { allowed: true, matchedRule: applicable[0], applicable };
-    }
-    const sorted = [...applicable].sort((a, b) => {
-        const priorityA = a.priority ?? 0;
-        const priorityB = b.priority ?? 0;
-        if (priorityA !== priorityB)
-            return priorityB - priorityA;
-        if (a.effect === "deny" && b.effect !== "deny")
-            return -1;
-        if (b.effect === "deny" && a.effect !== "deny")
-            return 1;
-        return 0;
-    });
-    const top = sorted[0];
-    return { allowed: top.effect === "allow", matchedRule: top, applicable };
+    const applicable = rules.filter((rule) => ruleBearsOn(rule, target) &&
+        (rule.condition === undefined || rule.effect === "deny"));
+    return combineApplicable(applicable, algorithm);
 }
 //# sourceMappingURL=rule.core.js.map

package/dist/rule/rule.pattern.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Pattern matching shared by rules, grants, denies and policies.
+ *
+ * @module rule/rule.pattern
+ */
+import type { Permission, PermissionRule } from "../permissionTypes/index.js";
+/**
+ * Check if a single pattern string matches a target, supporting wildcards.
+ *
+ * Two forms are supported, and they are the same two the permission matcher
+ * supports, so a pattern means the same thing wherever it is written:
+ *   `*`           — matches anything
+ *   `billing.*`   — matches `billing` and any `billing.…` namespace
+ */
+export declare function patternStrMatches(pattern: string, target: string): boolean;
+/**
+ * Whether two segment patterns can name a common segment.
+ *
+ * For a concrete `target` this is exactly {@link patternStrMatches}. For a
+ * wildcard target it is what a *deny* has to test: `can(actor, "post:*")`
+ * asks about everything under `post`, so a deny of `post:delete` bears on it
+ * although `post:delete` does not match `post:*` as a pattern.
+ */
+export declare function patternsOverlap(a: string, b: string): boolean;
+/**
+ * Check if a rule matches a target permission.
+ *
+ * Matching is about resource and action only. Whether the rule *applies* also
+ * depends on its condition, which needs a context and is therefore evaluated
+ * by `evaluateRules`.
+ */
+export declare function ruleMatches(rule: PermissionRule, target: Permission): boolean;
+/** Check if a rule's patterns overlap a (possibly wildcard) target. */
+export declare function ruleOverlaps(rule: PermissionRule, target: Permission): boolean;
+/**
+ * Whether a rule bears on a target: allows by matching, denies by overlap.
+ *
+ * An allow must cover the whole target to grant it; a deny needs only to
+ * touch it. For a concrete target the two are the same test.
+ */
+export declare function ruleBearsOn(rule: PermissionRule, target: Permission): boolean;
+/** Whether a permission names more than one concrete permission. */
+export declare function isWildcardTarget(target: Permission): boolean;
+//# sourceMappingURL=rule.pattern.d.ts.map

package/dist/rule/rule.pattern.js

@@ -0,0 +1,72 @@
+/**
+ * Pattern matching shared by rules, grants, denies and policies.
+ *
+ * @module rule/rule.pattern
+ */
+/**
+ * Check if a single pattern string matches a target, supporting wildcards.
+ *
+ * Two forms are supported, and they are the same two the permission matcher
+ * supports, so a pattern means the same thing wherever it is written:
+ *   `*`           — matches anything
+ *   `billing.*`   — matches `billing` and any `billing.…` namespace
+ */
+export function patternStrMatches(pattern, target) {
+    if (pattern === "*")
+        return true;
+    if (pattern === target)
+        return true;
+    if (pattern.endsWith(".*")) {
+        const prefix = pattern.slice(0, -2);
+        return target === prefix || target.startsWith(`${prefix}.`);
+    }
+    return false;
+}
+/**
+ * Whether two segment patterns can name a common segment.
+ *
+ * For a concrete `target` this is exactly {@link patternStrMatches}. For a
+ * wildcard target it is what a *deny* has to test: `can(actor, "post:*")`
+ * asks about everything under `post`, so a deny of `post:delete` bears on it
+ * although `post:delete` does not match `post:*` as a pattern.
+ */
+export function patternsOverlap(a, b) {
+    return patternStrMatches(a, b) || patternStrMatches(b, a);
+}
+function patternList(pattern) {
+    return Array.isArray(pattern)
+        ? pattern
+        : [pattern];
+}
+/**
+ * Check if a rule matches a target permission.
+ *
+ * Matching is about resource and action only. Whether the rule *applies* also
+ * depends on its condition, which needs a context and is therefore evaluated
+ * by `evaluateRules`.
+ */
+export function ruleMatches(rule, target) {
+    return (patternList(rule.resource).some((entry) => patternStrMatches(entry, target.resource)) &&
+        patternList(rule.action).some((entry) => patternStrMatches(entry, target.action)));
+}
+/** Check if a rule's patterns overlap a (possibly wildcard) target. */
+export function ruleOverlaps(rule, target) {
+    return (patternList(rule.resource).some((entry) => patternsOverlap(entry, target.resource)) &&
+        patternList(rule.action).some((entry) => patternsOverlap(entry, target.action)));
+}
+/**
+ * Whether a rule bears on a target: allows by matching, denies by overlap.
+ *
+ * An allow must cover the whole target to grant it; a deny needs only to
+ * touch it. For a concrete target the two are the same test.
+ */
+export function ruleBearsOn(rule, target) {
+    return rule.effect === "deny"
+        ? ruleOverlaps(rule, target)
+        : ruleMatches(rule, target);
+}
+/** Whether a permission names more than one concrete permission. */
+export function isWildcardTarget(target) {
+    return target.resource.includes("*") || target.action.includes("*");
+}
+//# sourceMappingURL=rule.pattern.js.map

package/dist/utils/utils.notifier.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Minimal change notifier for the live registries.
+ *
+ * @module utils/utils.notifier
+ */
+/** A set of change listeners. */
+export interface ChangeNotifier {
+    /** Register a listener. Returns an unsubscribe function. */
+    subscribe(listener: () => void): () => void;
+    /**
+     * Call every listener. All of them run even if one throws; the first
+     * error is rethrown afterwards, so one broken subscriber cannot stop an
+     * engine further down the list from dropping its stale decisions.
+     */
+    notify(): void;
+}
+/** Create a {@link ChangeNotifier}. */
+export declare function createChangeNotifier(): ChangeNotifier;
+//# sourceMappingURL=utils.notifier.d.ts.map