@zudojs/permissions 1.4.3 → 1.5.0

package/dist/ability/ability.core.d.ts

@@ -27,4 +27,3 @@ export interface Ability {
  * Create an Ability for an actor.
  */
 export declare function createAbility(actor: PermissionActor, evaluatorOptions: EvaluatorOptions, emitter?: PermissionEventEmitter): Ability;
-//# sourceMappingURL=ability.core.d.ts.map

package/dist/ability/ability.core.js

@@ -40,4 +40,3 @@ export function createAbility(actor, evaluatorOptions, emitter) {
         },
     };
 }
-//# sourceMappingURL=ability.core.js.map

package/dist/ability/index.d.ts

@@ -4,4 +4,3 @@
  * @module ability
  */
 export { createAbility, type Ability } from "./ability.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/ability/index.js

@@ -4,4 +4,3 @@
  * @module ability
  */
 export { createAbility } from "./ability.core.js";
-//# sourceMappingURL=index.js.map

package/dist/actor/actor.core.d.ts

@@ -25,4 +25,3 @@ export declare function actorHasPermission(actor: PermissionActor, permission: s
  * Check if an actor is a system/service actor.
  */
 export declare function isSystemActor(actor: PermissionActor): boolean;
-//# sourceMappingURL=actor.core.d.ts.map

package/dist/actor/actor.core.js

@@ -37,4 +37,3 @@ export function actorHasPermission(actor, permission) {
 export function isSystemActor(actor) {
     return actor.type === "system" || actor.type === "service";
 }
-//# sourceMappingURL=actor.core.js.map

package/dist/actor/index.d.ts

@@ -4,4 +4,3 @@
  * @module actor
  */
 export { createPermissionActor, actorHasRole, actorHasPermission, isSystemActor, } from "./actor.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/actor/index.js

@@ -4,4 +4,3 @@
  * @module actor
  */
 export { createPermissionActor, actorHasRole, actorHasPermission, isSystemActor, } from "./actor.core.js";
-//# sourceMappingURL=index.js.map

package/dist/cache/cache.actorDigest.d.ts

@@ -23,4 +23,3 @@ export declare const MAX_ACTOR_DIGEST_LENGTH = 4096;
  * description.
  */
 export declare function actorCacheDigest(actor: PermissionActor): string | undefined;
-//# sourceMappingURL=cache.actorDigest.d.ts.map

package/dist/cache/cache.actorDigest.js

@@ -87,4 +87,3 @@ export function actorCacheDigest(actor) {
         return undefined;
     return digest.length > MAX_ACTOR_DIGEST_LENGTH ? undefined : digest;
 }
-//# sourceMappingURL=cache.actorDigest.js.map

package/dist/cache/cache.core.d.ts

@@ -40,4 +40,3 @@ export interface MemoryPermissionCacheOptions {
 export declare function createMemoryPermissionCache(optionsOrTtl?: MemoryPermissionCacheOptions | number): PermissionCache & {
     size(): number;
 };
-//# sourceMappingURL=cache.core.d.ts.map

package/dist/cache/cache.core.js

@@ -112,4 +112,3 @@ export function createMemoryPermissionCache(optionsOrTtl = {}) {
         },
     };
 }
-//# sourceMappingURL=cache.core.js.map

package/dist/cache/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { createMemoryPermissionCache, permissionCacheKey, type MemoryPermissionCacheOptions, } from "./cache.core.js";
 export { actorCacheDigest, MAX_ACTOR_DIGEST_LENGTH, } from "./cache.actorDigest.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cache/index.js

@@ -5,4 +5,3 @@
  */
 export { createMemoryPermissionCache, permissionCacheKey, } from "./cache.core.js";
 export { actorCacheDigest, MAX_ACTOR_DIGEST_LENGTH, } from "./cache.actorDigest.js";
-//# sourceMappingURL=index.js.map

package/dist/conditions/conditions.core.d.ts

@@ -53,4 +53,3 @@ export declare function tenantIsolation(actorTenantField?: string, resourceTenan
 export declare function metadataEquals(key: string, expected: unknown): PermissionConditionFn;
 /** Check that the resource field matches the expected value. */
 export declare function resourceEquals(field: string, expected: unknown): PermissionConditionFn;
-//# sourceMappingURL=conditions.core.d.ts.map

package/dist/conditions/conditions.core.js

@@ -115,4 +115,3 @@ export function resourceEquals(field, expected) {
         return context.resource[field] === expected;
     };
 }
-//# sourceMappingURL=conditions.core.js.map

package/dist/conditions/index.d.ts

@@ -4,4 +4,3 @@
  * @module conditions
  */
 export { allOf, anyOf, not, always, never, isOwner, tenantIsolation, metadataEquals, resourceEquals, } from "./conditions.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/conditions/index.js

@@ -4,4 +4,3 @@
  * @module conditions
  */
 export { allOf, anyOf, not, always, never, isOwner, tenantIsolation, metadataEquals, resourceEquals, } from "./conditions.core.js";
-//# sourceMappingURL=index.js.map

package/dist/evaluator/authorizationEngine.d.ts

@@ -151,4 +151,3 @@ export interface PermissionEngine {
  * Create a permission engine.
  */
 export declare function createPermissionEngine(options?: PermissionEngineOptions): PermissionEngine;
-//# sourceMappingURL=authorizationEngine.d.ts.map

package/dist/evaluator/authorizationEngine.js

@@ -195,4 +195,3 @@ export function createPermissionEngine(options) {
         },
     };
 }
-//# sourceMappingURL=authorizationEngine.js.map

package/dist/evaluator/engineSupport/authorizationEngine.validation.d.ts

@@ -34,4 +34,3 @@ export declare function validatePolicy(policy: PermissionPolicyDefinition): void
 export declare function validateRole(role: RoleDefinition): void;
 /** Validate a role list, rejecting duplicates as well. */
 export declare function validateRoles(roles: readonly RoleDefinition[]): void;
-//# sourceMappingURL=authorizationEngine.validation.d.ts.map

package/dist/evaluator/engineSupport/authorizationEngine.validation.js

@@ -87,4 +87,3 @@ export function validateRoles(roles) {
         seen.add(role.name);
     }
 }
-//# sourceMappingURL=authorizationEngine.validation.js.map

package/dist/evaluator/engineSupport/evaluator.cacheKey.d.ts

@@ -25,4 +25,3 @@ import type { EvaluatorOptions } from "../evaluator.pipeline.js";
  *   change.
  */
 export declare function decisionCacheKey(actor: PermissionActor, permissionStr: string, resource: unknown, options: EvaluatorOptions, authOptions?: AuthorizationOptions): string | undefined;
-//# sourceMappingURL=evaluator.cacheKey.d.ts.map

package/dist/evaluator/engineSupport/evaluator.cacheKey.js

@@ -67,4 +67,3 @@ export function decisionCacheKey(actor, permissionStr, resource, options, authOp
     }
     return permissionCacheKey(actor.id, permissionStr, resourceId, `${generation}${digest}`);
 }
-//# sourceMappingURL=evaluator.cacheKey.js.map

package/dist/evaluator/engineSupport/evaluator.observed.d.ts

@@ -15,4 +15,3 @@ export declare function resourceTypeOf(resource: unknown): string | undefined;
  * cache entries that later checks are served from.
  */
 export declare function observed<T>(emitter: PermissionEventEmitter | undefined, actor: PermissionActor, permission: string, resource: unknown, run: () => Promise<T>, decisionOf: (result: T) => PermissionDecision): Promise<T>;
-//# sourceMappingURL=evaluator.observed.d.ts.map

package/dist/evaluator/engineSupport/evaluator.observed.js

@@ -46,4 +46,3 @@ export async function observed(emitter, actor, permission, resource, run, decisi
         });
     }
 }
-//# sourceMappingURL=evaluator.observed.js.map

package/dist/evaluator/engineSupport/index.d.ts

@@ -7,4 +7,3 @@
 export { invalidRulePattern, validatePolicy, validateRole, validateRoles, validateRule, } from "./authorizationEngine.validation.js";
 export { decisionCacheKey } from "./evaluator.cacheKey.js";
 export { observed, resourceTypeOf } from "./evaluator.observed.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/evaluator/engineSupport/index.js

@@ -7,4 +7,3 @@
 export { invalidRulePattern, validatePolicy, validateRole, validateRoles, validateRule, } from "./authorizationEngine.validation.js";
 export { decisionCacheKey } from "./evaluator.cacheKey.js";
 export { observed, resourceTypeOf } from "./evaluator.observed.js";
-//# sourceMappingURL=index.js.map

package/dist/evaluator/evaluator.core.d.ts

@@ -32,4 +32,3 @@ export declare function evaluate(actor: PermissionActor, permissionStr: string,
  * other than the one that was made.
  */
 export declare function evaluateWithTrace(actor: PermissionActor, permissionStr: string, resource: unknown, options: EvaluatorOptions, authOptions?: AuthorizationOptions): Promise<ExplainResult>;
-//# sourceMappingURL=evaluator.core.d.ts.map

package/dist/evaluator/evaluator.core.js

@@ -261,4 +261,3 @@ export async function evaluateWithTrace(actor, permissionStr, resource, options,
         decision,
     });
 }
-//# sourceMappingURL=evaluator.core.js.map

package/dist/evaluator/evaluator.explain.d.ts

@@ -12,4 +12,3 @@ import type { EvaluatorOptions } from "./evaluator.pipeline.js";
  * Evaluate with a full explain trace.
  */
 export declare function evaluateWithExplain(actor: PermissionActor, permissionStr: string, resource: unknown, options: EvaluatorOptions, authOptions?: AuthorizationOptions): Promise<ExplainResult>;
-//# sourceMappingURL=evaluator.explain.d.ts.map

package/dist/evaluator/evaluator.explain.js

@@ -13,4 +13,3 @@ import { evaluateWithTrace } from "./evaluator.core.js";
 export async function evaluateWithExplain(actor, permissionStr, resource, options, authOptions) {
     return evaluateWithTrace(actor, permissionStr, resource, options, authOptions);
 }
-//# sourceMappingURL=evaluator.explain.js.map

package/dist/evaluator/evaluator.pipeline.d.ts

@@ -112,4 +112,3 @@ export declare function evaluatePolicies(context: PermissionContext, policies: r
  * Pass `undefined` to disable.
  */
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number | undefined, policyName?: string): Promise<T>;
-//# sourceMappingURL=evaluator.pipeline.d.ts.map

package/dist/evaluator/evaluator.pipeline.js

@@ -269,4 +269,3 @@ export async function withTimeout(promise, timeoutMs, policyName = "policy") {
             clearTimeout(timer);
     }
 }
-//# sourceMappingURL=evaluator.pipeline.js.map

package/dist/evaluator/index.d.ts

@@ -7,4 +7,3 @@ export { evaluate, evaluateWithTrace } from "./evaluator.core.js";
 export { evaluateWithExplain } from "./evaluator.explain.js";
 export { resolveActorGrants, resolveActorPermissions, evaluatePolicies, selectPolicies, withTimeout, toMetadataMap, assertNotAborted, type EvaluatorOptions, type ResolvedGrants, type PolicyOutcome, } from "./evaluator.pipeline.js";
 export { createPermissionEngine, type PermissionEngine, type PermissionEngineOptions, } from "./authorizationEngine.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/evaluator/index.js

@@ -7,4 +7,3 @@ export { evaluate, evaluateWithTrace } from "./evaluator.core.js";
 export { evaluateWithExplain } from "./evaluator.explain.js";
 export { resolveActorGrants, resolveActorPermissions, evaluatePolicies, selectPolicies, withTimeout, toMetadataMap, assertNotAborted, } from "./evaluator.pipeline.js";
 export { createPermissionEngine, } from "./authorizationEngine.js";
-//# sourceMappingURL=index.js.map

package/dist/http/httpHelpers.d.ts

@@ -52,4 +52,3 @@ export declare function createNotFoundResponse(options?: NotFoundResponseOptions
  * Create a JSON response.
  */
 export declare function createJsonResponse(status: number, body: unknown): PermissionHttpResponse;
-//# sourceMappingURL=httpHelpers.d.ts.map

package/dist/http/httpHelpers.js

@@ -56,4 +56,3 @@ export function createNotFoundResponse(options) {
 export function createJsonResponse(status, body) {
     return createGuardResponse({ status, body, headers: JSON_HEADERS });
 }
-//# sourceMappingURL=httpHelpers.js.map

package/dist/http/httpMiddleware.core.d.ts

@@ -98,4 +98,3 @@ export interface RequirePermissionsMiddlewareOptions extends AuthorizeMiddleware
  * permission list denies in either mode.
  */
 export declare function createRequirePermissionsMiddleware(engine: PermissionEngine, permissions: readonly string[], options?: RequirePermissionsMiddlewareOptions): HttpMiddleware;
-//# sourceMappingURL=httpMiddleware.core.d.ts.map

package/dist/http/httpMiddleware.core.js

@@ -144,4 +144,3 @@ export function createRequirePermissionsMiddleware(engine, permissions, options
         return next();
     };
 }
-//# sourceMappingURL=httpMiddleware.core.js.map

package/dist/http/httpResource.helper.d.ts

@@ -70,4 +70,3 @@ export interface MissingResourceRefusal {
  * @returns The refusal to send, or `undefined` to evaluate as usual.
  */
 export declare function refuseMissingResource(extract: ResourceExtractor | undefined, resource: unknown, options: MissingResourceOptions & DeniedResponseOptions): MissingResourceRefusal | undefined;
-//# sourceMappingURL=httpResource.helper.d.ts.map

package/dist/http/httpResource.helper.js

@@ -56,4 +56,3 @@ export function refuseMissingResource(extract, resource, options) {
         : createForbiddenResponse(decision, options);
     return { decision, response };
 }
-//# sourceMappingURL=httpResource.helper.js.map

package/dist/http/httpTypes.d.ts

@@ -65,4 +65,3 @@ export interface HttpMiddlewareState {
     get<T = unknown>(key: string): T | undefined;
     set<T = unknown>(key: string, value: T): void;
 }
-//# sourceMappingURL=httpTypes.d.ts.map

package/dist/http/httpTypes.js

@@ -7,4 +7,3 @@
  * @module http/httpTypes
  */
 export {};
-//# sourceMappingURL=httpTypes.js.map

package/dist/http/index.d.ts

@@ -14,4 +14,3 @@ export { createActorMiddleware, createRequirePermissionMiddleware, authorize, cr
 export { createForbiddenResponse, createUnauthorizedResponse, createJsonResponse, createNotFoundResponse, type DeniedResponseOptions, type NotFoundResponseOptions, type PermissionHttpResponse, } from "./httpHelpers.js";
 export { loadResource, refuseMissingResource, RESOURCE_ERROR_DECISION, RESOURCE_NOT_FOUND_DECISION, type MissingResourceMode, type MissingResourceOptions, type MissingResourceRefusal, type ResourceExtractor, type ResourceOutcome, } from "./httpResource.helper.js";
 export type { HttpRequestBag, HttpMiddleware, HttpMiddlewareOutcome, HttpMiddlewareContext, HttpRequestContext, HttpResponseContext, HttpMiddlewareState, } from "./httpTypes.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/http/index.js

@@ -13,4 +13,3 @@
 export { createActorMiddleware, createRequirePermissionMiddleware, authorize, createRequirePermissionsMiddleware, ACTOR_STATE_KEY, DECISION_STATE_KEY, DECISIONS_STATE_KEY, } from "./httpMiddleware.core.js";
 export { createForbiddenResponse, createUnauthorizedResponse, createJsonResponse, createNotFoundResponse, } from "./httpHelpers.js";
 export { loadResource, refuseMissingResource, RESOURCE_ERROR_DECISION, RESOURCE_NOT_FOUND_DECISION, } from "./httpResource.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/index.d.ts

@@ -25,4 +25,3 @@ export * from "./observability/index.js";
 export * from "./utils/index.js";
 export * from "./http/index.js";
 export type { RoleSource, PolicySource, } from "./evaluator/authorizationEngine.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -24,4 +24,3 @@ export * from "./cache/index.js";
 export * from "./observability/index.js";
 export * from "./utils/index.js";
 export * from "./http/index.js";
-//# sourceMappingURL=index.js.map

package/dist/observability/index.d.ts

@@ -4,4 +4,3 @@
  * @module observability
  */
 export { createPermissionEventEmitter, withObservability, type PermissionCheckEvent, type PermissionEventHandler, type PermissionEventEmitter, type PermissionEventEmitterOptions, } from "./observability.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/observability/index.js

@@ -4,4 +4,3 @@
  * @module observability
  */
 export { createPermissionEventEmitter, withObservability, } from "./observability.core.js";
-//# sourceMappingURL=index.js.map

package/dist/observability/observability.core.d.ts

@@ -58,4 +58,3 @@ export declare function createPermissionEventEmitter(options?: PermissionEventEm
  * instruments every check the engine makes.
  */
 export declare function withObservability<TArgs extends readonly unknown[]>(emitter: PermissionEventEmitter, fn: (...args: TArgs) => Promise<PermissionDecision>): (...args: TArgs) => Promise<PermissionDecision>;
-//# sourceMappingURL=observability.core.d.ts.map

package/dist/observability/observability.core.js

@@ -72,4 +72,3 @@ export function withObservability(emitter, fn) {
         }
     };
 }
-//# sourceMappingURL=observability.core.js.map

package/dist/permission/index.d.ts

@@ -3,6 +3,5 @@
  *
  * @module permission
  */
-export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
+export { parsePermission, parsePermissionSafe, isValidPermission, toPermissionString, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
 export { createPermissionRegistry, type PermissionRegistry, type PermissionRegistryOptions, type RegisteredPermission, } from "./permissionRegistry.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/permission/index.js

@@ -3,6 +3,5 @@
  *
  * @module permission
  */
-export { parsePermission, parsePermissionSafe, isValidPermission, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
+export { parsePermission, parsePermissionSafe, isValidPermission, toPermissionString, matches, matchesPermission, permissionsOverlap, formatPermission, } from "./permission.core.js";
 export { createPermissionRegistry, } from "./permissionRegistry.js";
-//# sourceMappingURL=index.js.map

package/dist/permission/permission.core.d.ts

@@ -3,7 +3,7 @@
  *
  * @module permission/permission
  */
-import type { Permission } from "../permissionTypes/index.js";
+import type { Permission, TypedPermissionString } from "../permissionTypes/index.js";
 /**
  * Parse a permission string into a structured Permission.
  *
@@ -14,8 +14,17 @@ import type { Permission } from "../permissionTypes/index.js";
 export declare function parsePermission(permission: string): Permission;
 /**
  * Check if a permission string is valid without throwing.
+ *
+ * Narrows to {@link TypedPermissionString} on success.
+ */
+export declare function isValidPermission(permission: string): permission is TypedPermissionString;
+/**
+ * Validate a runtime string and return it typed as a
+ * {@link TypedPermissionString}.
+ *
+ * @throws InvalidPermissionError if the string is not a valid permission
  */
-export declare function isValidPermission(permission: string): boolean;
+export declare function toPermissionString(permission: string): TypedPermissionString;
 /**
  * Check if a permission pattern matches a target permission.
  *
@@ -50,4 +59,3 @@ export declare function permissionsOverlap(a: string, b: string): boolean;
 export declare function parsePermissionSafe(permission: string): Permission | null;
 /** Build a permission string from a resource and an action. */
 export declare function formatPermission(resource: string, action: string): string;
-//# sourceMappingURL=permission.core.d.ts.map

package/dist/permission/permission.core.js

@@ -30,10 +30,24 @@ export function parsePermission(permission) {
 }
 /**
  * Check if a permission string is valid without throwing.
+ *
+ * Narrows to {@link TypedPermissionString} on success.
  */
 export function isValidPermission(permission) {
     return PERMISSION_REGEX.test(permission);
 }
+/**
+ * Validate a runtime string and return it typed as a
+ * {@link TypedPermissionString}.
+ *
+ * @throws InvalidPermissionError if the string is not a valid permission
+ */
+export function toPermissionString(permission) {
+    if (!isValidPermission(permission)) {
+        throw new InvalidPermissionError(permission);
+    }
+    return permission;
+}
 /**
  * Check if a permission pattern matches a target permission.
  *
@@ -96,4 +110,3 @@ export function parsePermissionSafe(permission) {
 export function formatPermission(resource, action) {
     return `${resource}:${action}`;
 }
-//# sourceMappingURL=permission.core.js.map

package/dist/permission/permissionRegistry.d.ts

@@ -67,4 +67,3 @@ export interface PermissionRegistry {
  * ```
  */
 export declare function createPermissionRegistry(options?: PermissionRegistryOptions): PermissionRegistry;
-//# sourceMappingURL=permissionRegistry.d.ts.map

package/dist/permission/permissionRegistry.js

@@ -116,4 +116,3 @@ export function createPermissionRegistry(options) {
         },
     };
 }
-//# sourceMappingURL=permissionRegistry.js.map

package/dist/permissionErrors/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { PermissionError } from "./permissionError.base.js";
 export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.types.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/permissionErrors/index.js

@@ -5,4 +5,3 @@
  */
 export { PermissionError } from "./permissionError.base.js";
 export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.types.js";
-//# sourceMappingURL=index.js.map

package/dist/permissionErrors/permissionError.access.d.ts

@@ -60,4 +60,3 @@ export declare class DuplicateRoleError extends PermissionError {
 export declare class DuplicatePolicyError extends PermissionError {
     constructor(policy: string);
 }
-//# sourceMappingURL=permissionError.access.d.ts.map

package/dist/permissionErrors/permissionError.access.js

@@ -82,4 +82,3 @@ export class DuplicatePolicyError extends PermissionError {
         });
     }
 }
-//# sourceMappingURL=permissionError.access.js.map

package/dist/permissionErrors/permissionError.base.d.ts

@@ -16,4 +16,3 @@ export declare class PermissionError extends AuthorizationError {
         readonly cause?: unknown;
     });
 }
-//# sourceMappingURL=permissionError.base.d.ts.map

package/dist/permissionErrors/permissionError.base.js

@@ -18,4 +18,3 @@ export class PermissionError extends AuthorizationError {
         });
     }
 }
-//# sourceMappingURL=permissionError.base.js.map

package/dist/permissionErrors/permissionError.types.d.ts

@@ -3,4 +3,3 @@
  */
 export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, } from "./permissionError.access.js";
 export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
-//# sourceMappingURL=permissionError.types.d.ts.map

package/dist/permissionErrors/permissionError.types.js

@@ -3,4 +3,3 @@
  */
 export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, } from "./permissionError.access.js";
 export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
-//# sourceMappingURL=permissionError.types.js.map

package/dist/permissionErrors/permissionError.validation.d.ts

@@ -44,4 +44,3 @@ export declare class PermissionResolverError extends PermissionError {
 export declare class AuthorizationAbortedError extends PermissionError {
     constructor();
 }
-//# sourceMappingURL=permissionError.validation.d.ts.map

package/dist/permissionErrors/permissionError.validation.js

@@ -75,4 +75,3 @@ export class AuthorizationAbortedError extends PermissionError {
         super("Authorization aborted", { code: ErrorCode.OPERATION_CANCELLED });
     }
 }
-//# sourceMappingURL=permissionError.validation.js.map

package/dist/permissionTypes/index.d.ts

@@ -3,7 +3,6 @@
  *
  * @module permissionTypes
  */
-export { type PermissionActor, type Permission, type PermissionString, } from "./permissionActor.js";
+export { type PermissionActor, type Permission, type PermissionString, type TypedPermissionString, } from "./permissionActor.js";
 export { type RuleEffect, type RuleCombiningAlgorithm, type RuleEvaluation, type PermissionRule, type PermissionConditionFn, type PermissionContext, type PermissionDecision, } from "./ruleTypes.js";
 export { type RoleDefinition, type PermissionResolver, type RoleResolver, type PermissionCache, type PermissionPolicyDefinition, type PolicyEffect, type ExplainStep, type ExplainResult, type AuthorizationOptions, } from "./policyTypes.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/permissionTypes/index.js

@@ -6,4 +6,3 @@
 export {} from "./permissionActor.js";
 export {} from "./ruleTypes.js";
 export {} from "./policyTypes.js";
-//# sourceMappingURL=index.js.map

package/dist/permissionTypes/permissionActor.d.ts

@@ -23,6 +23,21 @@ export interface Permission {
     /** Action being performed (e.g. "read", "update", "*"). */
     readonly action: string;
 }
-/** Permission string format: "resource:action" or wildcards like "post:*", "*:*". */
+/**
+ * Permission string format: "resource:action" or wildcards like "post:*",
+ * "*:*".
+ *
+ * Kept as a plain `string` so existing call sites (values read from
+ * configuration, databases or tokens) keep compiling. Use
+ * {@link TypedPermissionString} where you want the compiler to insist on the
+ * `resource:action` shape, and `toPermissionString()` / `isValidPermission()`
+ * to move a runtime string into it.
+ */
 export type PermissionString = string;
-//# sourceMappingURL=permissionActor.d.ts.map
+/**
+ * A permission string whose `resource:action` shape is checked by the
+ * compiler: `"post:read"` and `"billing.*:refund"` are accepted,
+ * `"postread"` is a type error. The full grammar (segment alphabet, no
+ * partial wildcards) is still enforced at runtime by `parsePermission()`.
+ */
+export type TypedPermissionString = `${string}:${string}`;

package/dist/permissionTypes/permissionActor.js

@@ -4,4 +4,3 @@
  * @module permissionTypes/permissionActor
  */
 export {};
-//# sourceMappingURL=permissionActor.js.map

package/dist/permissionTypes/policyTypes.d.ts

@@ -116,4 +116,3 @@ export interface AuthorizationOptions {
     /** Identifies the resource for caching. Falls back to `resource.id`. */
     readonly resourceId?: string;
 }
-//# sourceMappingURL=policyTypes.d.ts.map

package/dist/permissionTypes/policyTypes.js

@@ -4,4 +4,3 @@
  * @module permissionTypes/policyTypes
  */
 export {};
-//# sourceMappingURL=policyTypes.js.map

package/dist/permissionTypes/ruleTypes.d.ts

@@ -80,4 +80,3 @@ export interface RuleEvaluation {
     /** Rules that matched the target and whose condition passed. */
     readonly applicable: readonly PermissionRule[];
 }
-//# sourceMappingURL=ruleTypes.d.ts.map

package/dist/permissionTypes/ruleTypes.js

@@ -4,4 +4,3 @@
  * @module permissionTypes/ruleTypes
  */
 export {};
-//# sourceMappingURL=ruleTypes.js.map

package/dist/policy/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { createPolicyRegistry, type PolicyRegistry, type PolicyRegistryOptions, } from "./policyRegistry.js";
 export { DEFAULT_POLICY_EFFECT, policyGrants } from "./policyEffect.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.js

@@ -5,4 +5,3 @@
  */
 export { createPolicyRegistry, } from "./policyRegistry.js";
 export { DEFAULT_POLICY_EFFECT, policyGrants } from "./policyEffect.core.js";
-//# sourceMappingURL=index.js.map

package/dist/policy/policyEffect.core.d.ts

@@ -39,4 +39,3 @@ export type ResolvedPolicyMode = "constrain" | "grant" | "legacyGrant";
  * @param defaultEffect - The engine's `defaultPolicyEffect`.
  */
 export declare function resolvePolicyMode(policy: PermissionPolicyDefinition, defaultEffect?: PolicyEffect): ResolvedPolicyMode;
-//# sourceMappingURL=policyEffect.core.d.ts.map

package/dist/policy/policyEffect.core.js

@@ -33,4 +33,3 @@ export function resolvePolicyMode(policy, defaultEffect = DEFAULT_POLICY_EFFECT)
         return "constrain";
     return defaultEffect === "grant" ? "legacyGrant" : "constrain";
 }
-//# sourceMappingURL=policyEffect.core.js.map

package/dist/policy/policyRegistry.d.ts

@@ -38,4 +38,3 @@ export interface PolicyRegistry {
  * Pass it straight to `createPermissionEngine({ policies: registry })`.
  */
 export declare function createPolicyRegistry(options?: PolicyRegistryOptions): PolicyRegistry;
-//# sourceMappingURL=policyRegistry.d.ts.map

package/dist/policy/policyRegistry.js

@@ -78,4 +78,3 @@ export function createPolicyRegistry(options) {
         },
     };
 }
-//# sourceMappingURL=policyRegistry.js.map

package/dist/resolvers/index.d.ts

@@ -4,4 +4,3 @@
  * @module resolvers
  */
 export { createMemoryPermissionResolver, createMemoryRoleResolver, createStaticPermissionResolver, createStaticRoleResolver, } from "./resolvers.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/resolvers/index.js

@@ -4,4 +4,3 @@
  * @module resolvers
  */
 export { createMemoryPermissionResolver, createMemoryRoleResolver, createStaticPermissionResolver, createStaticRoleResolver, } from "./resolvers.core.js";
-//# sourceMappingURL=index.js.map

package/dist/resolvers/resolvers.core.d.ts

@@ -20,4 +20,3 @@ export declare function createStaticPermissionResolver(rules: readonly Permissio
  * Static role resolver — always returns the same roles.
  */
 export declare function createStaticRoleResolver(roles: readonly string[]): RoleResolver;
-//# sourceMappingURL=resolvers.core.d.ts.map

package/dist/resolvers/resolvers.core.js

@@ -43,4 +43,3 @@ export function createStaticRoleResolver(roles) {
         },
     };
 }
-//# sourceMappingURL=resolvers.core.js.map

package/dist/role/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { createRoleRegistry, type RoleRegistry, type RoleRegistryOptions, } from "./roleRegistry.js";
 export { resolveRolePermissions, memoizeRoleLookup, type RoleResolution, type RoleResolutionOptions, } from "./roleHierarchy.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/role/index.js

@@ -5,4 +5,3 @@
  */
 export { createRoleRegistry, } from "./roleRegistry.js";
 export { resolveRolePermissions, memoizeRoleLookup, } from "./roleHierarchy.js";
-//# sourceMappingURL=index.js.map

package/dist/role/roleHierarchy.d.ts

@@ -42,4 +42,3 @@ export declare function memoizeRoleLookup(getRole: (name: string) => RoleDefinit
     readonly lookup: (name: string) => RoleDefinition | undefined;
     readonly invalidate: () => void;
 };
-//# sourceMappingURL=roleHierarchy.d.ts.map

package/dist/role/roleHierarchy.js

@@ -70,4 +70,3 @@ export function memoizeRoleLookup(getRole) {
         invalidate: () => cache.clear(),
     };
 }
-//# sourceMappingURL=roleHierarchy.js.map

package/dist/role/roleRegistry.d.ts

@@ -51,4 +51,3 @@ export declare function freezeRoleDefinition(definition: RoleDefinition): RoleDe
  * Pass it straight to `createPermissionEngine({ roles: registry })`.
  */
 export declare function createRoleRegistry(options?: RoleRegistryOptions): RoleRegistry;
-//# sourceMappingURL=roleRegistry.d.ts.map

package/dist/role/roleRegistry.js

@@ -104,4 +104,3 @@ export function createRoleRegistry(options) {
         },
     };
 }
-//# sourceMappingURL=roleRegistry.js.map

package/dist/rule/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { ruleMatches, patternStrMatches, evaluateRules, evaluateRulesSync, } from "./rule.core.js";
 export { compileRules, findMatchingRules, type RuleIndex, } from "./ruleCompiler.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rule/index.js

@@ -5,4 +5,3 @@
  */
 export { ruleMatches, patternStrMatches, evaluateRules, evaluateRulesSync, } from "./rule.core.js";
 export { compileRules, findMatchingRules, } from "./ruleCompiler.js";
-//# sourceMappingURL=index.js.map

package/dist/rule/rule.core.d.ts

@@ -42,4 +42,3 @@ export declare function evaluateRules(rules: readonly PermissionRule[], target:
 export declare function evaluateRulesSync(rules: readonly PermissionRule[], target: Permission, options?: {
     readonly algorithm?: RuleCombiningAlgorithm;
 }): RuleEvaluation;
-//# sourceMappingURL=rule.core.d.ts.map

package/dist/rule/rule.core.js

@@ -96,4 +96,3 @@ export function evaluateRulesSync(rules, target, options) {
         (rule.condition === undefined || rule.effect === "deny"));
     return combineApplicable(applicable, algorithm);
 }
-//# sourceMappingURL=rule.core.js.map

package/dist/rule/rule.pattern.d.ts

@@ -41,4 +41,3 @@ export declare function ruleOverlaps(rule: PermissionRule, target: Permission):
 export declare function ruleBearsOn(rule: PermissionRule, target: Permission): boolean;
 /** Whether a permission names more than one concrete permission. */
 export declare function isWildcardTarget(target: Permission): boolean;
-//# sourceMappingURL=rule.pattern.d.ts.map

package/dist/rule/rule.pattern.js

@@ -69,4 +69,3 @@ export function ruleBearsOn(rule, target) {
 export function isWildcardTarget(target) {
     return target.resource.includes("*") || target.action.includes("*");
 }
-//# sourceMappingURL=rule.pattern.js.map

package/dist/rule/ruleCompiler.d.ts

@@ -33,4 +33,3 @@ export declare function compileRules(rules: readonly PermissionRule[]): RuleInde
  * count twice when the decision is combined.
  */
 export declare function findMatchingRules(index: RuleIndex, target: Permission): readonly PermissionRule[];
-//# sourceMappingURL=ruleCompiler.d.ts.map

package/dist/rule/ruleCompiler.js

@@ -89,4 +89,3 @@ export function findMatchingRules(index, target) {
 function normalizeToArray(value) {
     return Array.isArray(value) ? [...value] : [value];
 }
-//# sourceMappingURL=ruleCompiler.js.map

package/dist/utils/index.d.ts

@@ -4,4 +4,3 @@
  * @module utils
  */
 export { createCacheKey, extractResource, extractAction, buildPermission, createActor, } from "./utils.helper.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.js

@@ -4,4 +4,3 @@
  * @module utils
  */
 export { createCacheKey, extractResource, extractAction, buildPermission, createActor, } from "./utils.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/utils/utils.helper.d.ts

@@ -42,4 +42,3 @@ export declare function createActor(id: string, options?: {
     readonly permissions?: readonly string[];
     readonly deniedPermissions?: readonly string[];
 }): PermissionActor;
-//# sourceMappingURL=utils.helper.d.ts.map

package/dist/utils/utils.helper.js

@@ -49,4 +49,3 @@ export function buildPermission(resource, action) {
 export function createActor(id, options) {
     return createPermissionActor(id, options);
 }
-//# sourceMappingURL=utils.helper.js.map

package/dist/utils/utils.notifier.d.ts

@@ -16,4 +16,3 @@ export interface ChangeNotifier {
 }
 /** Create a {@link ChangeNotifier}. */
 export declare function createChangeNotifier(): ChangeNotifier;
-//# sourceMappingURL=utils.notifier.d.ts.map

package/dist/utils/utils.notifier.js

@@ -28,4 +28,3 @@ export function createChangeNotifier() {
         },
     };
 }
-//# sourceMappingURL=utils.notifier.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/permissions",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "description": "Generic authorization engine with RBAC, ABAC, resource authorization, wildcards, role hierarchy, policies, and abilities.",
   "license": "MIT",
   "author": {
@@ -26,8 +26,8 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.3.2",
-    "@zudojs/middleware": "1.1.2"
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/middleware": "1.1.3"
   },
   "engines": {
     "node": ">=24.0.0"