@authup/access 1.0.0-beta.29 → 1.0.0-beta.32

package/dist/index.mjs

@@ -1,6 +1,9 @@
 import { AuthupError, ErrorCode } from '@authup/errors';
+import { buildPermissionBindingKey, mergePermissionBindings } from '@authup/core-kit';
+export { buildPermissionBindingKey, isPermissionBindingEqual, mergePermissionBindings } from '@authup/core-kit';
 import { defineIssueItem, defineIssueGroup, Container } from 'validup';
-import { isObject, flattenObject, hasOwnProperty } from '@authup/kit';
+import { isObject, flattenObject, DecisionStrategy, hasOwnProperty } from '@authup/kit';
+export { DecisionStrategy } from '@authup/kit';
 import { createValidator } from '@validup/adapter-zod';
 import { z } from 'zod';
 import { guard } from '@ucast/mongo2js';
@@ -51,51 +54,30 @@ class PermissionError extends AuthupError {
     }
 }
 
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function buildPermissionItemKey(input) {
-    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function isPermissionItemEqual(a, b) {
-    if (a.name !== b.name) {
-        return false;
+class PermissionMemoryProvider {
+    items = {};
+    constructor(items = []){
+        this.setMany(items);
     }
-    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
-        return a.realmId === b.realmId;
+    async findOne(options) {
+        const entry = this.items[buildPermissionBindingKey({
+            name: options.name,
+            client_id: options.clientId,
+            realm_id: options.realmId
+        })];
+        if (entry) {
+            return entry;
+        }
+        return null;
     }
-    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
-        return a.clientId === b.clientId;
+    setMany(input) {
+        this.items = mergePermissionBindings(input).reduce((prev, current)=>{
+            prev[buildPermissionBindingKey(current.permission)] = current;
+            return prev;
+        }, {});
     }
-    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
 }
 
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
-    /**
-     * One or more positive
-     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
-    /**
-     * All positive
-     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
-    /**
-     * More positive than negative
-     */ DecisionStrategy["CONSENSUS"] = "consensus";
-    return DecisionStrategy;
-}({});
-
 /*
  * Copyright (c) 2024-2024.
  * Author Peter Placzek (tada5hi)
@@ -151,20 +133,20 @@ class PolicyError extends AuthupError {
     }
     registerEvaluators(evaluators) {
         const keys = Object.keys(evaluators);
-        for(let i = 0; i < keys.length; i++){
-            this.registerEvaluator(keys[i], evaluators[keys[i]]);
+        for (const key of keys){
+            this.registerEvaluator(key, evaluators[key]);
         }
     }
     /**
      * @param policy
      * @param ctx
      */ async evaluate(policy, ctx) {
-        if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.indexOf(policy.type) !== -1) {
+        if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.includes(policy.type)) {
             return {
                 success: maybeInvertPolicyOutcome(true, policy.invert)
             };
         }
-        if (ctx.include && ctx.include.length > 0 && ctx.include.indexOf(policy.type) === -1) {
+        if (ctx.include && ctx.include.length > 0 && !ctx.include.includes(policy.type)) {
             return {
                 success: maybeInvertPolicyOutcome(true, policy.invert)
             };
@@ -193,7 +175,7 @@ class PolicyError extends AuthupError {
                     ...ctx.evaluators || {}
                 }
             });
-        } catch (e) {
+        } catch  {
             issues.push(defineIssueItem({
                 path: [
                     policy.type
@@ -366,6 +348,14 @@ class AttributeNamesPolicyValidator extends Container {
      */ BuiltInPolicyType["PERMISSION_BINDING"] = "permissionBinding";
     return BuiltInPolicyType;
 }({});
+const SystemPolicyName = {
+    DEFAULT: 'system.default',
+    IDENTITY: 'system.identity',
+    PERMISSION_BINDING: 'system.permission-binding',
+    REALM_MATCH: 'system.realm-match',
+    REALM_BOUND: 'system.realm-bound',
+    REALM_OR_GLOBAL: 'system.realm-or-global'
+};
 
 class AttributesPolicyValidator extends Container {
     initialize() {
@@ -417,15 +407,14 @@ class AttributesPolicyEvaluator {
     }
     fixQuery(query) {
         if (Array.isArray(query)) {
-            for(let i = 0; i < query.length; i++){
-                this.fixQuery(query[i]);
+            for (const element of query){
+                this.fixQuery(element);
             }
             return;
         }
         if (isObject(query)) {
             const keys = Object.keys(query);
-            for(let i = 0; i < keys.length; i++){
-                const key = keys[i];
+            for (const key of keys){
                 const value = query[key];
                 if (isObject(value) || Array.isArray(value)) {
                     this.fixQuery(value);
@@ -468,15 +457,15 @@ class AttributeNamesPolicyEvaluator {
         const attributes = flattenObject(data);
         const keys = Object.keys(attributes);
         const issues = [];
-        for(let i = 0; i < keys.length; i++){
-            const index = policy.names.indexOf(keys[i]);
+        for (const key of keys){
+            const index = policy.names.indexOf(key);
             if (index === -1) {
                 issues.push(definePolicyIssueItem({
                     code: PolicyIssueCode.EVALUATION_DENIED,
-                    message: `The attribute ${keys[i]} is not included`,
+                    message: `The attribute ${key} is not included`,
                     path: [
                         ...ctx.path,
-                        keys[i]
+                        key
                     ]
                 }));
             }
@@ -491,7 +480,7 @@ class AttributeNamesPolicyEvaluator {
 class CompositePolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('decisionStrategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+        this.mount('decision_strategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
         this.mount('children', createValidator(z.array(z.looseObject({
             type: z.string().min(3)
         }))));
@@ -508,7 +497,7 @@ class CompositePolicyEvaluator {
         // todo: catch errors + transform to issue(s)
         const policy = await this.validator.run(value);
         let count = 0;
-        const decisionStrategy = policy.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+        const decision_strategy = policy.decision_strategy ?? DecisionStrategy.UNANIMOUS;
         const engine = new PolicyEngine(ctx.evaluators);
         const issues = [];
         for(let i = 0; i < policy.children.length; i++){
@@ -522,7 +511,7 @@ class CompositePolicyEvaluator {
                 path
             });
             if (outcome.success) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                if (decision_strategy === DecisionStrategy.AFFIRMATIVE) {
                     return {
                         success: maybeInvertPolicyOutcome(true, policy.invert),
                         issues: []
@@ -537,7 +526,7 @@ class CompositePolicyEvaluator {
                         path
                     }));
                 }
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                if (decision_strategy === DecisionStrategy.UNANIMOUS) {
                     return {
                         success: maybeInvertPolicyOutcome(false, policy.invert),
                         issues: [
@@ -696,7 +685,7 @@ class IdentityPolicyEvaluator {
                 success: maybeInvertPolicyOutcome(true, policy.invert)
             };
         }
-        const typeAllowed = policy.types.indexOf(data.type) !== -1;
+        const typeAllowed = policy.types.includes(data.type);
         if (typeAllowed) {
             return {
                 success: maybeInvertPolicyOutcome(typeAllowed, policy.invert)
@@ -736,11 +725,11 @@ class PermissionBindingPolicyEvaluator {
 class RealmMatchPolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('decisionStrategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-        this.mount('attributeName', createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
-        this.mount('attributeNameStrict', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-        this.mount('attributeNullMatchAll', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-        this.mount('identityMasterMatchAll', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('decision_strategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+        this.mount('attribute_name', createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
+        this.mount('attribute_name_strict', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('attribute_null_match_all', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('identity_master_match_all', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
         this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
@@ -783,19 +772,19 @@ class RealmMatchPolicyEvaluator {
                 ]
             };
         }
-        const identityMasterMatchAll = policy.identityMasterMatchAll ?? true;
+        const identityMasterMatchAll = policy.identity_master_match_all ?? true;
         if (identityMasterMatchAll && identity.realmName && identity.realmName === 'master') {
             return {
                 success: maybeInvertPolicyOutcome(true, policy.invert)
             };
         }
         let keys;
-        if (policy.attributeName) {
-            if (Array.isArray(policy.attributeName)) {
-                keys = policy.attributeName;
+        if (policy.attribute_name) {
+            if (Array.isArray(policy.attribute_name)) {
+                keys = policy.attribute_name;
             } else {
                 keys = [
-                    policy.attributeName
+                    policy.attribute_name
                 ];
             }
         } else {
@@ -805,22 +794,22 @@ class RealmMatchPolicyEvaluator {
                 'realmId',
                 'realmName'
             ];
-            policy.decisionStrategy = DecisionStrategy.CONSENSUS;
+            policy.decision_strategy = DecisionStrategy.CONSENSUS;
         }
-        const attributeNameStrict = policy.attributeNameStrict ?? true;
-        if (!attributeNameStrict) {
+        const attribute_name_strict = policy.attribute_name_strict ?? true;
+        if (!attribute_name_strict) {
             const resourceKeys = Object.keys(attributes);
             const keysToAdd = [];
-            for(let i = 0; i < resourceKeys.length; i++){
+            for (const resourceKey of resourceKeys){
                 let contains = false;
-                for(let j = 0; j < keys.length; j++){
-                    if (resourceKeys[i] !== keys[j] && resourceKeys[i].includes(keys[j])) {
+                for (const key of keys){
+                    if (resourceKey !== key && resourceKey.includes(key)) {
                         contains = true;
                         break;
                     }
                 }
                 if (contains) {
-                    keysToAdd.push(resourceKeys[i]);
+                    keysToAdd.push(resourceKey);
                 }
             }
             if (keysToAdd.length > 0) {
@@ -828,26 +817,28 @@ class RealmMatchPolicyEvaluator {
             }
         }
         let count = 0;
-        for(let i = 0; i < keys.length; i++){
-            if (!hasOwnProperty(attributes, keys[i])) {
+        let evaluated = false;
+        for (const key of keys){
+            if (!hasOwnProperty(attributes, key)) {
                 continue;
             }
+            evaluated = true;
             let outcome = false;
-            const attributeValue = attributes[keys[i]];
-            if (attributeValue === null && policy.attributeNullMatchAll) {
+            const attributeValue = attributes[key];
+            if (attributeValue === null && policy.attribute_null_match_all) {
                 outcome = true;
             } else if (attributeValue === identity.realmId || attributeValue === identity.realmName) {
                 outcome = true;
             }
             if (outcome) {
-                if (policy.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                if (policy.decision_strategy === DecisionStrategy.AFFIRMATIVE) {
                     return {
                         success: maybeInvertPolicyOutcome(true, policy.invert)
                     };
                 }
                 count++;
             } else {
-                if (policy.decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                if (policy.decision_strategy === DecisionStrategy.UNANIMOUS) {
                     return {
                         success: maybeInvertPolicyOutcome(false, policy.invert)
                     };
@@ -855,6 +846,11 @@ class RealmMatchPolicyEvaluator {
                 count--;
             }
         }
+        if (!evaluated) {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
+        }
         return {
             success: maybeInvertPolicyOutcome(count > 0, policy.invert)
         };
@@ -887,9 +883,9 @@ function isIntervalForDayOfYear(interval) {
 class TimePolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
-        this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
-        this.mount('dayOfYear', createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
+        this.mount('day_of_week', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
+        this.mount('day_of_month', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
+        this.mount('day_of_year', createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
         this.mount('start', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
         this.mount('end', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
         this.mount('interval', createValidator(z.enum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
@@ -956,26 +952,26 @@ class TimePolicyEvaluator {
             }
         }
         if (policy.interval) {
-            if (isIntervalForDayOfWeek(policy.interval) && policy.dayOfWeek) {
-                if (now.getDay() !== policy.dayOfWeek) {
+            if (isIntervalForDayOfWeek(policy.interval) && policy.day_of_week) {
+                if (now.getDay() !== policy.day_of_week) {
                     return {
                         success: maybeInvertPolicyOutcome(false, policy.invert)
                     };
                 }
             }
-            if (isIntervalForDayOfMonth(policy.interval) && policy.dayOfMonth) {
-                if (now.getDate() !== policy.dayOfMonth) {
+            if (isIntervalForDayOfMonth(policy.interval) && policy.day_of_month) {
+                if (now.getDate() !== policy.day_of_month) {
                     return {
                         success: maybeInvertPolicyOutcome(false, policy.invert)
                     };
                 }
             }
-            if (isIntervalForDayOfYear(policy.interval) && policy.dayOfYear) {
+            if (isIntervalForDayOfYear(policy.interval) && policy.day_of_year) {
                 const start = new Date(now.getFullYear(), 0, 0);
                 const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
                 const oneDay = 1000 * 60 * 60 * 24;
                 const dayOfYear = Math.floor(diff / oneDay);
-                if (dayOfYear !== policy.dayOfYear) {
+                if (dayOfYear !== policy.day_of_year) {
                     return {
                         success: maybeInvertPolicyOutcome(false, policy.invert)
                     };
@@ -1011,58 +1007,7 @@ const PolicyDefaultEvaluators = {
     [BuiltInPolicyType.TIME]: new TimePolicyEvaluator()
 };
 
-function mergePermissionItems(input) {
-    const grouped = input.reduce((previous, current)=>{
-        const key = buildPermissionItemKey(current);
-        if (!previous[key]) {
-            previous[key] = [];
-        }
-        previous[key].push(current);
-        return previous;
-    }, {});
-    const output = [];
-    const keys = Object.keys(grouped);
-    for(let i = 0; i < keys.length; i++){
-        const [permission, ...permissions] = grouped[keys[i]];
-        if (permissions.length > 0) {
-            const policy = {
-                type: BuiltInPolicyType.COMPOSITE,
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE,
-                children: permissions.map((el)=>el.policy).filter((el)=>typeof el !== 'undefined')
-            };
-            if (permission.policy) {
-                policy.children.push(permission.policy);
-            }
-            if (policy.children.length > 0) {
-                permission.policy = policy;
-            }
-        }
-        output.push(permission);
-    }
-    return output;
-}
-
-class PermissionMemoryRepository {
-    items = {};
-    constructor(items = []){
-        this.setMany(items);
-    }
-    async findOne(options) {
-        const entry = this.items[buildPermissionItemKey(options)];
-        if (entry) {
-            return entry;
-        }
-        return null;
-    }
-    setMany(input) {
-        this.items = mergePermissionItems(input).reduce((prev, current)=>{
-            prev[buildPermissionItemKey(current)] = current;
-            return prev;
-        }, {});
-    }
-}
-
-class PermissionChecker {
+class PermissionEvaluator {
     provider;
     policyEngine;
     clientId;
@@ -1072,12 +1017,12 @@ class PermissionChecker {
         if (options.repository) {
             this.provider = options.repository;
         } else {
-            this.provider = new PermissionMemoryRepository();
+            this.provider = new PermissionMemoryProvider();
         }
-        if (options.clientId) {
+        if (typeof options.clientId !== 'undefined') {
             this.clientId = options.clientId;
         }
-        if (options.realmId) {
+        if (typeof options.realmId !== 'undefined') {
             this.realmId = options.realmId;
         }
         if (options.policyEngine) {
@@ -1087,32 +1032,26 @@ class PermissionChecker {
         }
     }
     // ----------------------------------------------
-    /**
-     * Get a permission.
-     *
-     * @param input
-     */ async findOne(input) {
+    async findOne(input, overrides) {
         const options = {
             name: input
         };
-        if (this.clientId) {
+        if (typeof overrides?.clientId !== 'undefined') {
+            options.clientId = overrides.clientId;
+        } else if (typeof this.clientId !== 'undefined') {
             options.clientId = this.clientId;
         }
-        if (this.realmId) {
+        if (typeof overrides?.realmId !== 'undefined') {
+            options.realmId = overrides.realmId;
+        } else if (typeof this.realmId !== 'undefined') {
             options.realmId = this.realmId;
         }
         return this.provider.findOne(options);
     }
     // ----------------------------------------------
-    /**
-     * Verify if one or more possible owned permissions satisfy their conditions.
-     *
-     * @throws PermissionError
-     *
-     * @param ctx
-     */ async check(ctx) {
+    async evaluate(ctx) {
         if (!Array.isArray(ctx.name)) {
-            await this.check({
+            await this.evaluate({
                 ...ctx,
                 name: [
                     ctx.name
@@ -1126,8 +1065,11 @@ class PermissionChecker {
         let count = 0;
         const dataBase = ctx.input || new PolicyData();
         for(let i = 0; i < ctx.name.length; i++){
-            const entity = await this.findOne(ctx.name[i]);
-            if (!entity) {
+            const binding = await this.findOne(ctx.name[i], {
+                realmId: ctx.realmId,
+                clientId: ctx.clientId
+            });
+            if (!binding) {
                 issues.push(defineIssueItem({
                     code: ErrorCode.PERMISSION_NOT_FOUND,
                     message: `The ${ctx.name[i]} permission could not be resolved`,
@@ -1142,7 +1084,8 @@ class PermissionChecker {
                 }
                 continue;
             }
-            if (!entity.policy) {
+            const policies = binding.policies ?? [];
+            if (policies.length === 0) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
                     return;
                 }
@@ -1150,8 +1093,14 @@ class PermissionChecker {
                 continue;
             }
             const data = dataBase.clone();
-            data.set(BuiltInPolicyType.PERMISSION_BINDING, entity);
-            const evaluationResult = await this.policyEngine.evaluate(entity.policy, definePolicyEvaluationContext({
+            data.set(BuiltInPolicyType.PERMISSION_BINDING, binding);
+            const policyDecisionStrategy = binding.permission.decision_strategy ?? DecisionStrategy.UNANIMOUS;
+            const compositePolicy = {
+                type: BuiltInPolicyType.COMPOSITE,
+                decision_strategy: policyDecisionStrategy,
+                children: policies
+            };
+            const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
                 include: options.policiesIncluded,
                 exclude: options.policiesExcluded,
                 data
@@ -1165,13 +1114,13 @@ class PermissionChecker {
                 issues.push(definePolicyIssueGroup({
                     code: ErrorCode.PERMISSION_EVALUATION_FAILED,
                     issues: evaluationResult.issues || [],
-                    message: `The ${entity.name} permissions policy evaluation failed`,
+                    message: `The ${binding.permission.name} permissions policy evaluation failed`,
                     path: [
-                        entity.name
+                        binding.permission.name
                     ]
                 }));
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    const error = PermissionError.evaluationFailed(entity.name);
+                    const error = PermissionError.evaluationFailed(binding.permission.name);
                     error.addIssues(issues);
                     throw error;
                 }
@@ -1189,14 +1138,8 @@ class PermissionChecker {
             throw error;
         }
     }
-    /**
-     * Verify if one of the permissions evaluates to true.
-     *
-     * @throws PermissionError
-     *
-     * @param ctx
-     */ async checkOneOf(ctx) {
-        return this.check({
+    async evaluateOneOf(ctx) {
+        return this.evaluate({
             ...ctx,
             options: {
                 ...ctx.options || {},
@@ -1205,8 +1148,8 @@ class PermissionChecker {
         });
     }
     // ----------------------------------------------
-    async preCheck(ctx) {
-        return this.check({
+    async preEvaluate(ctx) {
+        return this.evaluate({
             ...ctx,
             options: {
                 ...ctx.options || {},
@@ -1218,8 +1161,8 @@ class PermissionChecker {
             }
         });
     }
-    async preCheckOneOf(ctx) {
-        return this.preCheck({
+    async preEvaluateOneOf(ctx) {
+        return this.preEvaluate({
             ...ctx,
             options: {
                 ...ctx.options || {},
@@ -1229,5 +1172,5 @@ class PermissionChecker {
     }
 }
 
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryRepository, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionItemKey, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, maybeInvertPolicyOutcome };
 //# sourceMappingURL=index.mjs.map