@zudojs/permissions 1.3.0 → 1.4.0

package/README.md

@@ -153,33 +153,95 @@ denies when either is missing. It is only as good as the value you pass: fill
 the tenant `@zudojs/tenancy` resolved), **never from a request header** — a
 caller would set the header to the resource's tenant and pass.
 
+Enforce it as a **deny** rule, `not(tenantIsolation())`:
+
+```typescript
+import { createPermissionEngine, not, tenantIsolation } from "@zudojs/permissions";
+
+const engine = createPermissionEngine({
+  roles: [{ name: "accountant", permissions: ["invoice:read"] }],
+  rules: [
+    {
+      name: "tenant-isolation",
+      effect: "deny",
+      resource: "invoice",
+      action: "*",
+      condition: not(tenantIsolation()), // other tenant, or no tenant → deny
+    },
+  ],
+});
+```
+
+A conditional **allow** rule with `tenantIsolation()` only adds a way in: a
+role that grants `invoice:read` allows the check whatever the condition says,
+so that role reads every tenant's invoices. The deny form refuses cross-tenant
+access even for roles that hold the permission, and no policy can override it.
+
 ## Policies
 
-A policy is a named, prioritised hook that runs alongside the rules.
+A policy is a named, prioritised hook that runs alongside the rules. By
+default it is an **extra condition on top of RBAC/ABAC**: it can take access
+away, never hand it out.
 
 ```typescript
 const engine = createPermissionEngine({
-  roles,
+  roles: [{ name: "staff", permissions: ["task:*"] }],
   policyTimeout: 250,
   policies: [
     {
       name: "business-hours",
-      permissions: ["post:*"], // wildcards work here too
+      permissions: ["task:*"], // wildcards work here too
       priority: 10, // higher runs first
       cacheable: false, // depends on the clock, so never cache it
-      evaluate: (context) =>
+      evaluate: () =>
         isBusinessHours()
-          ? { allowed: true }
+          ? { allowed: true } // "no objection" — the role still has to grant
           : { allowed: false, reason: "outside_business_hours" },
     },
   ],
 });
+
+await engine.can(staff, "task:delete"); // true in hours, false after
+await engine.can(guest, "task:delete"); // false: no role grants it
 ```
 
+> **Warning — a policy's `allowed: true` is not a grant.** Before 1.4 it was:
+> an allowing policy granted the permission even to an actor with no roles, so
+> the "business-hours" policy above handed `task:delete` to everyone during
+> office hours. A policy now only constrains, unless it opts in with
+> `effect: "grant"`.
+
 Policies run highest priority first and stop at the first denial. A policy
-that throws, or exceeds `policyTimeout`, denies. A denying policy always wins;
-an allowing one can grant access the rules did not decide, but never overrides
-a denial — from another policy or from a deny rule that applied.
+that throws, or exceeds `policyTimeout`, denies. A denying policy always wins.
+An allowing policy grants nothing by itself: the actor's roles, direct
+permissions or rules must still grant the permission.
+
+### Policies that grant
+
+A policy that establishes the right on its own — ownership is the usual one —
+says so with `effect: "grant"`:
+
+```typescript
+const engine = createPermissionEngine({
+  roles,
+  policies: [
+    {
+      name: "author-can-edit",
+      permissions: ["post:update"],
+      effect: "grant", // an allow here grants, even with no role
+      evaluate: ({ actor, resource }) => ({
+        allowed: (resource as { authorId?: string })?.authorId === actor.id,
+      }),
+    },
+  ],
+});
+```
+
+A granting policy still never overrides a denial — from another policy, an
+explicit deny, or a deny rule that applied. Only the exact value `"grant"`
+grants; a typo constrains. `createPermissionEngine({ defaultPolicyEffect:
+"grant" })` restores the pre-1.4 behaviour for every policy that sets no
+`effect` — prefer marking the individual policies.
 
 `policyTimeout: 0` means "expire immediately", not "no timeout" — omit it to
 disable.
@@ -428,7 +490,11 @@ const guard = authorize(engine, "post:update", {
 - The guard extracts the actor itself when one is not already in state, so it
   works without a separate actor middleware.
 - No actor → **401** with `WWW-Authenticate`. Actor but not permitted →
-  **403**.
+  **403**. The refusal is a `GuardResponse` (`createGuardResponse` from
+  `@zudojs/middleware`), which `@zudojs/http` sends with that status, body and
+  headers. It used to be a plain `{ status, body, headers }` object, which a
+  route middleware's return ignored: the handler did not run, but the client
+  got `200`.
 - The 403 body carries `decision.publicReason`, never the internal reason:
   `policy_error:<name>` names your policies and does not belong in a
   response. Pass `deniedResponse` to shape the body — it receives the real
@@ -444,7 +510,18 @@ const guard = authorize(engine, "post:update", {
 
 The middleware composes with the real `@zudojs/http` pipeline without
 depending on it: the HTTP types are mirrored structurally (headers, params and
-query may be plain objects, as `@zudojs/http` provides them, or maps).
+query may be plain objects, as `@zudojs/http` provides them, or maps), and
+`HttpMiddleware` is assignable to `@zudojs/http`'s own `HttpMiddleware` — pass
+a guard straight to a route, no `as never`:
+
+```typescript
+router.put("/posts/:id", updatePost, { middleware: [guard] });
+```
+
+A middleware of your own typed as this package's `HttpMiddleware` answers a
+refusal with `createGuardResponse({ status, body })`; returning a plain
+`{ status, body, headers }` object is no longer typed, because
+`@zudojs/http` never sent it as a response.
 
 ## Errors
 

package/dist/evaluator/authorizationEngine.d.ts

@@ -3,7 +3,7 @@
  *
  * @module evaluator/authorizationEngine
  */
-import type { PermissionActor, PermissionDecision, ExplainResult, PermissionRule, PermissionPolicyDefinition, PermissionCache, PermissionResolver, RoleResolver, RoleDefinition, RuleCombiningAlgorithm, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { PermissionActor, PermissionDecision, ExplainResult, PermissionRule, PermissionPolicyDefinition, PolicyEffect, PermissionCache, PermissionResolver, RoleResolver, RoleDefinition, RuleCombiningAlgorithm, AuthorizationOptions } from "../permissionTypes/index.js";
 import { type Ability } from "../ability/ability.core.js";
 import type { PermissionEventEmitter } from "../observability/observability.core.js";
 /**
@@ -57,6 +57,16 @@ export interface PermissionEngineOptions {
     readonly rules?: readonly PermissionRule[];
     /** Default timeout for async policy evaluation (ms). */
     readonly policyTimeout?: number;
+    /**
+     * Effect of a policy that sets no `effect` of its own. Default:
+     * `"constrain"` — an allowing policy is an extra condition and cannot
+     * grant a permission the actor's roles, permissions or rules do not.
+     *
+     * `"grant"` restores the behaviour before 1.4, where every allowing policy
+     * was an independent grant. Prefer `effect: "grant"` on the individual
+     * policies that really establish the right on their own.
+     */
+    readonly defaultPolicyEffect?: PolicyEffect;
     /** How competing rules combine. Default: `"deny-overrides"`. */
     readonly algorithm?: RuleCombiningAlgorithm;
     /** Caches decisions. Create one with `createMemoryPermissionCache()`. */

package/dist/evaluator/authorizationEngine.js

@@ -144,6 +144,7 @@ export function createPermissionEngine(options) {
         },
         rules: options?.rules,
         policyTimeout: options?.policyTimeout,
+        defaultPolicyEffect: options?.defaultPolicyEffect,
         algorithm: options?.algorithm,
         cache: options?.cache,
         cacheTtlMs: options?.cacheTtlMs,

package/dist/evaluator/evaluator.core.js

@@ -185,7 +185,7 @@ export async function evaluate(actor, permissionStr, resource, options, authOpti
             });
         }
     }
-    const decision = combine(ruleResult, outcome.decision, permissionStr);
+    const decision = combine(ruleResult, outcome.decision, outcome.grants, permissionStr);
     /* ── Cache write ─────────────────────────────────────────────────────── */
     // A decision forced by a condition that threw describes the failure, not
     // the actor, and must not outlive it.
@@ -204,15 +204,18 @@ export async function evaluate(actor, permissionStr, resource, options, authOpti
 /**
  * Combine the rule outcome with the policy outcome.
  *
- * A denying policy always wins. An allowing policy can grant access the rules
- * did not, which is what makes a policy an ABAC escape hatch rather than a
- * filter — but it can never override a denial, and that includes a denial
- * the *rules* produced. "The rules did not allow" covers two cases: no rule
- * matched, and a deny rule matched. Treating them alike let an allowing
- * policy for `post:*` cancel a `deny post:update` rule — the exact inversion
- * of `deny-overrides`.
+ * A denying policy always wins. An allowing policy is, by default, only an
+ * extra condition: the actor's roles, permissions or rules must still grant
+ * the permission. It used to grant on its own, so a "business-hours" policy
+ * handed `task:delete` to an actor with no roles at all. Only a policy with
+ * `effect: "grant"` (or an engine with `defaultPolicyEffect: "grant"`) can
+ * grant access the rules did not — and even then it never overrides a
+ * denial, including one the *rules* produced. "The rules did not allow"
+ * covers two cases: no rule matched, and a deny rule matched. Treating them
+ * alike let an allowing policy for `post:*` cancel a `deny post:update` rule
+ * — the exact inversion of `deny-overrides`.
  */
-function combine(ruleResult, policyDecision, permissionStr) {
+function combine(ruleResult, policyDecision, policyGrants, permissionStr) {
     if (policyDecision && !policyDecision.allowed)
         return policyDecision;
     const denyRule = !ruleResult.allowed && ruleResult.matchedRule?.effect === "deny"
@@ -232,7 +235,7 @@ function combine(ruleResult, policyDecision, permissionStr) {
             ...(policyDecision?.policy ? { policy: policyDecision.policy } : {}),
         });
     }
-    if (policyDecision?.allowed)
+    if (policyDecision?.allowed && policyGrants)
         return policyDecision;
     return denied("no_matching_rule");
 }

package/dist/evaluator/evaluator.pipeline.d.ts

@@ -3,7 +3,7 @@
  *
  * @module evaluator/evaluator.pipeline
  */
-import type { PermissionActor, PermissionContext, PermissionDecision, PermissionPolicyDefinition, PermissionRule, PermissionCache, PermissionResolver, RoleDefinition, RoleResolver, RuleCombiningAlgorithm, AuthorizationOptions } from "../permissionTypes/index.js";
+import type { PermissionActor, PermissionContext, PermissionDecision, PermissionPolicyDefinition, PermissionRule, PermissionCache, PermissionResolver, RoleDefinition, RoleResolver, RuleCombiningAlgorithm, AuthorizationOptions, PolicyEffect } from "../permissionTypes/index.js";
 /** Configuration for the evaluator. */
 export interface EvaluatorOptions {
     /** Function to look up a role definition by name. */
@@ -14,6 +14,8 @@ export interface EvaluatorOptions {
     readonly rules?: readonly PermissionRule[];
     /** Default timeout for async policy evaluation (ms). */
     readonly policyTimeout?: number;
+    /** Effect of a policy that sets none. Default: `"constrain"`. */
+    readonly defaultPolicyEffect?: PolicyEffect;
     /** How competing rules combine. Default: `"deny-overrides"`. */
     readonly algorithm?: RuleCombiningAlgorithm;
     /** Decision cache. */
@@ -80,6 +82,13 @@ export interface PolicyOutcome {
     /** Whether every policy that ran allows the result to be cached. */
     readonly cacheable: boolean;
     readonly evaluated: readonly string[];
+    /**
+     * Whether the allow may grant on its own: every applicable policy allowed
+     * and at least one of them has the `"grant"` effect. `false` for a denial,
+     * and for an allow from constraining policies only, which then needs a
+     * role, permission or rule to grant.
+     */
+    readonly grants: boolean;
 }
 /**
  * Evaluate policies for a context.

package/dist/evaluator/evaluator.pipeline.js

@@ -3,6 +3,7 @@
  *
  * @module evaluator/evaluator.pipeline
  */
+import { policyGrants } from "../policy/policyEffect.core.js";
 import { resolveRolePermissions } from "../role/roleHierarchy.js";
 import { matches, permissionsOverlap, parsePermissionSafe, } from "../permission/permission.core.js";
 import { isWildcardTarget } from "../rule/rule.pattern.js";
@@ -153,13 +154,13 @@ function narrowerPolicies(policies, applicable, permissionStr) {
  */
 export async function evaluatePolicies(context, policies, options, authOptions) {
     if (policies.length === 0) {
-        return { decision: null, cacheable: true, evaluated: [] };
+        return { decision: null, cacheable: true, evaluated: [], grants: false };
     }
     const permissionStr = `${context.permission.resource}:${context.permission.action}`;
     const applicable = selectPolicies(policies, permissionStr);
     const denyOnly = narrowerPolicies(policies, applicable, permissionStr);
     if (applicable.length === 0 && denyOnly.length === 0) {
-        return { decision: null, cacheable: true, evaluated: [] };
+        return { decision: null, cacheable: true, evaluated: [], grants: false };
     }
     // The per-call timeout wins, but the engine-level default is what makes a
     // configured timeout mean anything at all.
@@ -183,6 +184,7 @@ export async function evaluatePolicies(context, policies, options, authOptions)
                     }),
                     cacheable,
                     evaluated,
+                    grants: false,
                 };
             }
         }
@@ -200,20 +202,23 @@ export async function evaluatePolicies(context, policies, options, authOptions)
                 }),
                 cacheable: false,
                 evaluated,
+                grants: false,
             };
         }
     }
     if (applicable.length === 0) {
-        return { decision: null, cacheable, evaluated };
+        return { decision: null, cacheable, evaluated, grants: false };
     }
+    const grants = applicable.some((policy) => policyGrants(policy, options.defaultPolicyEffect));
     return {
         decision: Object.freeze({
             allowed: true,
-            reason: "policy_allow",
+            reason: grants ? "policy_allow" : "policy_pass",
             policy: applicable.map((policy) => policy.name).join(","),
         }),
         cacheable,
         evaluated,
+        grants,
     };
 }
 /**

package/dist/http/httpHelpers.d.ts

@@ -3,6 +3,7 @@
  *
  * @module http/httpHelpers
  */
+import { type GuardResponse } from "@zudojs/middleware";
 import type { PermissionDecision } from "../permissionTypes/index.js";
 /** Options for creating denied responses. */
 export interface DeniedResponseOptions {
@@ -16,12 +17,12 @@ export interface DeniedResponseOptions {
     /** Value for the `WWW-Authenticate` header on a 401. */
     readonly authenticateChallenge?: string;
 }
-/** A framework-agnostic response. */
-export interface PermissionHttpResponse {
-    readonly status: number;
-    readonly body: unknown;
-    readonly headers: Readonly<Record<string, string>>;
-}
+/**
+ * A framework-agnostic response: a `GuardResponse` from `@zudojs/middleware`,
+ * which `@zudojs/http` sends with its own status. It still has the
+ * `status`, `body` and `headers` fields this type always had.
+ */
+export type PermissionHttpResponse = GuardResponse;
 /**
  * Create a 403 Forbidden JSON response for a decision.
  *

package/dist/http/httpHelpers.js

@@ -3,6 +3,7 @@
  *
  * @module http/httpHelpers
  */
+import { createGuardResponse } from "@zudojs/middleware";
 const JSON_HEADERS = { "content-type": "application/json" };
 /**
  * Create a 403 Forbidden JSON response for a decision.
@@ -18,11 +19,7 @@ export function createForbiddenResponse(decision, options) {
             error: "Forbidden",
             message: decision.publicReason ?? "Access denied",
         };
-    return Object.freeze({
-        status: 403,
-        body,
-        headers: JSON_HEADERS,
-    });
+    return createGuardResponse({ status: 403, body, headers: JSON_HEADERS });
 }
 /**
  * Create a 401 Unauthorized JSON response.
@@ -34,23 +31,19 @@ export function createUnauthorizedResponse(options) {
     const body = options?.unauthenticatedResponse
         ? options.unauthenticatedResponse()
         : { error: "Unauthorized", message: "Authentication required" };
-    return Object.freeze({
+    return createGuardResponse({
         status: 401,
         body,
-        headers: Object.freeze({
+        headers: {
             ...JSON_HEADERS,
             "www-authenticate": options?.authenticateChallenge ?? "Bearer",
-        }),
+        },
     });
 }
 /**
  * Create a JSON response.
  */
 export function createJsonResponse(status, body) {
-    return Object.freeze({
-        status,
-        body,
-        headers: JSON_HEADERS,
-    });
+    return createGuardResponse({ status, body, headers: JSON_HEADERS });
 }
 //# sourceMappingURL=httpHelpers.js.map

package/dist/http/httpTypes.d.ts

@@ -6,8 +6,23 @@
  *
  * @module http/httpTypes
  */
-/** HTTP middleware signature from @zudojs/http. */
-export type HttpMiddleware = (context: HttpMiddlewareContext, next: () => Promise<HttpResponseContext>) => void | Response | HttpResponseContext | Promise<void | Response | HttpResponseContext>;
+import type { GuardResponse } from "@zudojs/middleware";
+/**
+ * What a permission middleware returns: nothing, a web `Response`, a
+ * `GuardResponse` refusing the request, or whatever `next()` produced.
+ */
+export type HttpMiddlewareOutcome<Downstream> = void | Response | GuardResponse | Downstream;
+/**
+ * HTTP middleware signature, structurally assignable to `@zudojs/http`'s
+ * `HttpMiddleware` without a cast.
+ *
+ * Generic over what `next()` resolves to, so a middleware hands back the
+ * real pipeline's response unchanged. A refusal is a `GuardResponse`
+ * (`createGuardResponse` from `@zudojs/middleware`), which `@zudojs/http`
+ * sends with its own status; a plain `{ status, body, headers }` object is
+ * not a response.
+ */
+export type HttpMiddleware = <Downstream extends HttpResponseContext>(context: HttpMiddlewareContext, next: () => Promise<Downstream>) => HttpMiddlewareOutcome<Downstream> | Promise<HttpMiddlewareOutcome<Downstream>>;
 /** HTTP middleware context from @zudojs/http. */
 export interface HttpMiddlewareContext {
     readonly request: HttpRequestContext;

package/dist/http/index.d.ts

@@ -13,5 +13,5 @@
 export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, DECISIONS_STATE_KEY, type AuthorizeMiddlewareOptions, type ActorMiddlewareOptions, type RequirePermissionMiddlewareOptions, type RequirePermissionsMiddlewareOptions, } from "./httpMiddleware.core.js";
 export { createForbiddenResponse, createUnauthorizedResponse, createJsonResponse, type DeniedResponseOptions, type PermissionHttpResponse, } from "./httpHelpers.js";
 export { loadResource, RESOURCE_ERROR_DECISION, type ResourceExtractor, type ResourceOutcome, } from "./httpResource.helper.js";
-export type { HttpRequestBag, HttpMiddleware, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
+export type { HttpRequestBag, HttpMiddleware, HttpMiddlewareOutcome, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/permissionTypes/index.d.ts

@@ -5,5 +5,5 @@
  */
 export { type PermissionActor, type Permission, type PermissionString, } from "./permissionActor.js";
 export { type RuleEffect, type RuleCombiningAlgorithm, type RuleEvaluation, type PermissionRule, type PermissionConditionFn, type PermissionContext, type PermissionDecision, } from "./ruleTypes.js";
-export { type RoleDefinition, type PermissionResolver, type RoleResolver, type PermissionCache, type PermissionPolicyDefinition, type ExplainStep, type ExplainResult, type AuthorizationOptions, } from "./policyTypes.js";
+export { type RoleDefinition, type PermissionResolver, type RoleResolver, type PermissionCache, type PermissionPolicyDefinition, type PolicyEffect, type ExplainStep, type ExplainResult, type AuthorizationOptions, } from "./policyTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/permissionTypes/policyTypes.d.ts

@@ -42,9 +42,27 @@ export interface PermissionCache {
     /** Drops every entry. */
     clear?(): Promise<void>;
 }
+/**
+ * What an allowing policy means.
+ *
+ * - `"constrain"` (the default): the policy is an extra condition on top of
+ *   RBAC/ABAC. Its allow means "no objection"; the actor's roles, direct
+ *   permissions or rules must still grant the permission. Its deny denies.
+ * - `"grant"`: the policy is an independent grant. Its allow grants the
+ *   permission even when no role or rule does — an ownership check, say.
+ *   Use it only for a policy that establishes the right on its own.
+ */
+export type PolicyEffect = "constrain" | "grant";
 /** A named authorization policy. */
 export interface PermissionPolicyDefinition {
     readonly name: string;
+    /**
+     * Whether this policy's allow can grant a permission the actor's roles do
+     * not include. Default: the engine's `defaultPolicyEffect`, which is
+     * `"constrain"` — a policy only ever narrows access. Any value other than
+     * `"grant"` constrains.
+     */
+    readonly effect?: PolicyEffect;
     /**
      * Permissions this policy applies to. Wildcards are honoured, so
      * `["post:*"]` covers `post:update` — the same matching grants use.

package/dist/policy/index.d.ts

@@ -4,4 +4,5 @@
  * @module policy
  */
 export { createPolicyRegistry, type PolicyRegistry, type PolicyRegistryOptions, } from "./policyRegistry.js";
+export { DEFAULT_POLICY_EFFECT, policyGrants } from "./policyEffect.core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.js

@@ -4,4 +4,5 @@
  * @module policy
  */
 export { createPolicyRegistry, } from "./policyRegistry.js";
+export { DEFAULT_POLICY_EFFECT, policyGrants } from "./policyEffect.core.js";
 //# sourceMappingURL=index.js.map

package/dist/policy/policyEffect.core.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Policy effect resolution: whether an allowing policy may grant access on
+ * its own or only constrains what RBAC/ABAC already granted.
+ *
+ * @module policy/policyEffect.core
+ */
+import type { PermissionPolicyDefinition, PolicyEffect } from "../permissionTypes/index.js";
+/** The effect a policy without its own `effect` has. */
+export declare const DEFAULT_POLICY_EFFECT: PolicyEffect;
+/**
+ * Whether a policy's allow is an independent grant.
+ *
+ * Only the exact value `"grant"` grants. A typo, a missing value or anything
+ * else falls back to constraining, so a mistake narrows access instead of
+ * widening it.
+ *
+ * @param policy - The policy that allowed.
+ * @param defaultEffect - The engine's `defaultPolicyEffect`.
+ */
+export declare function policyGrants(policy: PermissionPolicyDefinition, defaultEffect?: PolicyEffect): boolean;
+//# sourceMappingURL=policyEffect.core.d.ts.map

package/dist/policy/policyEffect.core.js

@@ -0,0 +1,22 @@
+/**
+ * Policy effect resolution: whether an allowing policy may grant access on
+ * its own or only constrains what RBAC/ABAC already granted.
+ *
+ * @module policy/policyEffect.core
+ */
+/** The effect a policy without its own `effect` has. */
+export const DEFAULT_POLICY_EFFECT = "constrain";
+/**
+ * Whether a policy's allow is an independent grant.
+ *
+ * Only the exact value `"grant"` grants. A typo, a missing value or anything
+ * else falls back to constraining, so a mistake narrows access instead of
+ * widening it.
+ *
+ * @param policy - The policy that allowed.
+ * @param defaultEffect - The engine's `defaultPolicyEffect`.
+ */
+export function policyGrants(policy, defaultEffect = DEFAULT_POLICY_EFFECT) {
+    return (policy.effect ?? defaultEffect) === "grant";
+}
+//# sourceMappingURL=policyEffect.core.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/permissions",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Generic authorization engine with RBAC, ABAC, resource authorization, wildcards, role hierarchy, policies, and abilities.",
   "license": "MIT",
   "author": {
@@ -26,14 +26,15 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.2.0"
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/middleware": "1.1.0"
   },
   "engines": {
     "node": ">=24.0.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "publishConfig": {
     "access": "public"
@@ -45,7 +46,7 @@
     "authorization",
     "permissions"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-permissions",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },