@authup/access 1.0.0-beta.33 → 1.0.0-beta.35

package/dist/index.mjs

@@ -1,1176 +1,1007 @@
-import { AuthupError, ErrorCode } from '@authup/errors';
-import { buildPermissionBindingKey, mergePermissionBindings } from '@authup/core-kit';
-export { buildPermissionBindingKey, isPermissionBindingEqual, mergePermissionBindings } from '@authup/core-kit';
-import { defineIssueItem, defineIssueGroup, Container } from 'validup';
-import { isObject, flattenObject, DecisionStrategy, hasOwnProperty } from '@authup/kit';
-export { DecisionStrategy } from '@authup/kit';
-import { createValidator } from '@validup/adapter-zod';
-import { z } from 'zod';
-import { guard } from '@ucast/mongo2js';
-
-class PermissionError extends AuthupError {
-    constructor(options = {}){
-        super({
-            ...options,
-            message: options.message || 'A permission error occurred.',
-            statusCode: options.statusCode || 403
-        });
-    }
-    addIssue(data) {
-        this.issues.push(data);
-    }
-    addIssues(data) {
-        this.issues.push(...data);
-    }
-    static notFound(name) {
-        return new PermissionError({
-            message: `The permission ${name} was not found.`,
-            code: ErrorCode.PERMISSION_NOT_FOUND
-        });
-    }
-    static denied(name) {
-        return new PermissionError({
-            message: `The permission ${name} has not been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static deniedAll(names) {
-        return new PermissionError({
-            message: `None of the permissions ${names.join(', ')} has been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static evaluationFailed(name) {
-        if (Array.isArray(name)) {
-            return new PermissionError({
-                message: `The evaluation of permissions ${name.join(', ')} failed`,
-                code: ErrorCode.PERMISSION_EVALUATION_FAILED
-            });
-        }
-        return new PermissionError({
-            message: `The evaluation of permission ${name} failed`,
-            code: ErrorCode.PERMISSION_EVALUATION_FAILED
-        });
-    }
-}
-
-class PermissionMemoryProvider {
-    items = {};
-    constructor(items = []){
-        this.setMany(items);
-    }
-    async findOne(options) {
-        const entry = this.items[buildPermissionBindingKey({
-            name: options.name,
-            client_id: options.clientId,
-            realm_id: options.realmId
-        })];
-        if (entry) {
-            return entry;
-        }
-        return null;
-    }
-    setMany(input) {
-        this.items = mergePermissionBindings(input).reduce((prev, current)=>{
-            prev[buildPermissionBindingKey(current.permission)] = current;
-            return prev;
-        }, {});
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function maybeInvertPolicyOutcome(outcome, invert) {
-    if (typeof invert === 'undefined') {
-        return outcome;
-    }
-    if (typeof invert === 'function') {
-        return invert(outcome);
-    }
-    if (!invert) {
-        return outcome;
-    }
-    return !outcome;
-}
-
-class PolicyError extends AuthupError {
-    constructor(message, code){
-        super({
-            message,
-            code
-        });
-    }
-    addIssue(data) {
-        this.issues.push(data);
-    }
-    addIssues(data) {
-        this.issues.push(...data);
-    }
-    static evaluatorNotFound(type) {
-        return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
-    }
-    static evaluatorNotProcessable() {
-        return new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
-    }
-    static evaluatorContextInvalid() {
-        return new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
-    }
-}
-
+import { AuthupError, ErrorCode } from "@authup/errors";
+import { DecisionStrategy, DecisionStrategy as DecisionStrategy$1, flattenObject, hasOwnProperty, isObject } from "@authup/kit";
+import { Container, defineIssueGroup, defineIssueItem } from "validup";
+import { createValidator } from "@validup/adapter-zod";
+import { z } from "zod";
+import { guard } from "@ucast/mongo2js";
+//#region src/permission/error/module.ts
+var PermissionError = class PermissionError extends AuthupError {
+	constructor(options = {}) {
+		super({
+			...options,
+			message: options.message || "A permission error occurred.",
+			statusCode: options.statusCode || 403
+		});
+	}
+	addIssue(data) {
+		this.issues.push(data);
+	}
+	addIssues(data) {
+		this.issues.push(...data);
+	}
+	static notFound(name) {
+		return new PermissionError({
+			message: `The permission ${name} was not found.`,
+			code: ErrorCode.PERMISSION_NOT_FOUND
+		});
+	}
+	static denied(name) {
+		return new PermissionError({
+			message: `The permission ${name} has not been granted.`,
+			code: ErrorCode.PERMISSION_DENIED
+		});
+	}
+	static deniedAll(names) {
+		return new PermissionError({
+			message: `None of the permissions ${names.join(", ")} has been granted.`,
+			code: ErrorCode.PERMISSION_DENIED
+		});
+	}
+	static evaluationFailed(name) {
+		if (Array.isArray(name)) return new PermissionError({
+			message: `The evaluation of permissions ${name.join(", ")} failed`,
+			code: ErrorCode.PERMISSION_EVALUATION_FAILED
+		});
+		return new PermissionError({
+			message: `The evaluation of permission ${name} failed`,
+			code: ErrorCode.PERMISSION_EVALUATION_FAILED
+		});
+	}
+};
+//#endregion
+//#region src/permission/helpers/equal.ts
+function isPermissionPolicyBindingEqual(a, b) {
+	if (a.permission.name !== b.permission.name) return false;
+	if ((a.permission.realm_id ?? null) !== (b.permission.realm_id ?? null)) return false;
+	if ((a.permission.client_id ?? null) !== (b.permission.client_id ?? null)) return false;
+	return true;
+}
+//#endregion
+//#region src/permission/helpers/key.ts
+function formatKeySegment(value) {
+	return value || "*";
+}
+function buildPermissionKey(input) {
+	return `${formatKeySegment(input.realm_id)}/${formatKeySegment(input.client_id)}/${input.name}`;
+}
+//#endregion
+//#region src/permission/helpers/merge.ts
+function mergePermissionPolicyBindings(input) {
+	const grouped = input.reduce((previous, current) => {
+		const key = buildPermissionKey(current.permission);
+		if (!previous[key]) previous[key] = [];
+		previous[key].push(current);
+		return previous;
+	}, {});
+	const output = [];
+	const keys = Object.keys(grouped);
+	for (const key of keys) {
+		const group = grouped[key];
+		const first = group[0];
+		if (group.length === 1) {
+			output.push(first);
+			continue;
+		}
+		const children = [];
+		for (const element of group) {
+			if (!element.policies || element.policies.length === 0) continue;
+			const policy = {
+				type: "composite",
+				decision_strategy: element.permission.decision_strategy || DecisionStrategy$1.UNANIMOUS,
+				children: element.policies
+			};
+			children.push(policy);
+		}
+		let mergedPolicies;
+		if (children.length > 0 && children.length === group.length) mergedPolicies = [{
+			type: "composite",
+			decision_strategy: DecisionStrategy$1.AFFIRMATIVE,
+			children
+		}];
+		output.push({
+			permission: {
+				...first.permission,
+				decision_strategy: DecisionStrategy$1.AFFIRMATIVE
+			},
+			policies: mergedPolicies
+		});
+	}
+	return output;
+}
+//#endregion
+//#region src/permission/provider/memory.ts
+var PermissionMemoryProvider = class {
+	items = {};
+	constructor(items = []) {
+		this.setMany(items);
+	}
+	async findOne(options) {
+		const key = buildPermissionKey({
+			name: options.name,
+			client_id: options.clientId,
+			realm_id: options.realmId
+		});
+		const entry = this.items[key];
+		if (entry) return entry;
+		return null;
+	}
+	setMany(input) {
+		this.items = mergePermissionPolicyBindings(input).reduce((prev, current) => {
+			const key = buildPermissionKey(current.permission);
+			prev[key] = current;
+			return prev;
+		}, {});
+	}
+};
+//#endregion
+//#region src/policy/helpers/invert.ts
+function maybeInvertPolicyOutcome(outcome, invert) {
+	if (typeof invert === "undefined") return outcome;
+	if (typeof invert === "function") return invert(outcome);
+	if (!invert) return outcome;
+	return !outcome;
+}
+//#endregion
+//#region src/policy/error/module.ts
+var PolicyError = class PolicyError extends AuthupError {
+	constructor(message, code) {
+		super({
+			message,
+			code
+		});
+	}
+	addIssue(data) {
+		this.issues.push(data);
+	}
+	addIssues(data) {
+		this.issues.push(...data);
+	}
+	static evaluatorNotFound(type) {
+		return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
+	}
+	static evaluatorNotProcessable() {
+		return new PolicyError("The evaluator can not process the policy.", ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
+	}
+	static evaluatorContextInvalid() {
+		return new PolicyError("The evaluator context is not valid.", ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
+	}
+};
+//#endregion
+//#region src/policy/engine/module.ts
 /**
- * The policy engine is a component that interprets defined policies and makes decisions
- * on whether to allow or deny a particular access.
- */ class PolicyEngine {
-    evaluators;
-    constructor(evaluators = {}){
-        this.evaluators = evaluators;
-    }
-    registerEvaluator(type, evaluator) {
-        this.evaluators[type] = evaluator;
-    }
-    registerEvaluators(evaluators) {
-        const keys = Object.keys(evaluators);
-        for (const key of keys){
-            this.registerEvaluator(key, evaluators[key]);
-        }
-    }
-    /**
-     * @param policy
-     * @param ctx
-     */ async evaluate(policy, ctx) {
-        if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.includes(policy.type)) {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        if (ctx.include && ctx.include.length > 0 && !ctx.include.includes(policy.type)) {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        const issues = [];
-        const evaluator = this.evaluators[policy.type];
-        if (!evaluator) {
-            // todo: add issue here instead + return false ?
-            issues.push(defineIssueItem({
-                path: [
-                    policy.type
-                ],
-                message: `The policy ${policy.type} can not be handled by any evaluator.`,
-                code: ErrorCode.POLICY_EVALUATOR_NOT_FOUND
-            }));
-            return {
-                success: maybeInvertPolicyOutcome(false, policy.invert),
-                issues
-            };
-        }
-        try {
-            return await evaluator.evaluate(policy, {
-                ...ctx,
-                evaluators: {
-                    ...this.evaluators,
-                    ...ctx.evaluators || {}
-                }
-            });
-        } catch  {
-            issues.push(defineIssueItem({
-                path: [
-                    policy.type
-                ],
-                message: `The ${policy.type} evaluator can not process the policy specification.`,
-                code: ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE
-            }));
-            return {
-                success: maybeInvertPolicyOutcome(false, policy.invert),
-                issues
-            };
-        }
-    }
-    async evaluateOrFail(policy, ctx) {
-        const issues = [];
-        try {
-            const outcome = await this.evaluate(policy, ctx);
-            if (outcome.success) {
-                return;
-            }
-            if (outcome.issues) {
-                issues.push(...outcome.issues);
-            }
-        } catch (e) {
-            if (e instanceof PolicyError) {
-                throw e;
-            }
-        }
-        const error = new PolicyError(`The policy ${policy.type} evaluation failed.`);
-        error.addIssues(issues);
-        throw error;
-    }
-}
-
-/*
- * Copyright (c) 2026.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ class PolicyData {
-    data;
-    validated;
-    constructor(data = {}, validated = new Set()){
-        this.data = data;
-        this.validated = validated;
-    }
-    set(key, value) {
-        this.data[key] = value;
-        this.validated.delete(key);
-    }
-    get(key) {
-        if (key in this.data) {
-            return this.data[key];
-        }
-        throw new Error(`Policy data item ${key} does not exist.`);
-    }
-    has(key) {
-        return key in this.data;
-    }
-    setValidated(key) {
-        this.validated.add(key);
-    }
-    isValidated(key) {
-        return this.validated.has(key);
-    }
-    clone() {
-        return new PolicyData({
-            ...this.data
-        }, new Set(this.validated));
-    }
-}
-
+* The policy engine is a component that interprets defined policies and makes decisions
+* on whether to allow or deny a particular access.
+*/
+var PolicyEngine = class {
+	evaluators;
+	constructor(evaluators = {}) {
+		this.evaluators = evaluators;
+	}
+	registerEvaluator(type, evaluator) {
+		this.evaluators[type] = evaluator;
+	}
+	registerEvaluators(evaluators) {
+		const keys = Object.keys(evaluators);
+		for (const key of keys) this.registerEvaluator(key, evaluators[key]);
+	}
+	/**
+	* @param policy
+	* @param ctx
+	*/
+	async evaluate(policy, ctx) {
+		if (!policy.type) return {
+			success: maybeInvertPolicyOutcome(false, policy.invert),
+			issues: [defineIssueItem({
+				path: [],
+				message: "The policy can not be handled by any evaluator.",
+				code: ErrorCode.POLICY_EVALUATOR_NOT_FOUND
+			})]
+		};
+		if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.includes(policy.type)) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		if (ctx.include && ctx.include.length > 0 && !ctx.include.includes(policy.type)) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		const issues = [];
+		const evaluator = this.evaluators[policy.type];
+		if (!evaluator) {
+			issues.push(defineIssueItem({
+				path: [policy.type],
+				message: `The policy ${policy.type} can not be handled by any evaluator.`,
+				code: ErrorCode.POLICY_EVALUATOR_NOT_FOUND
+			}));
+			return {
+				success: maybeInvertPolicyOutcome(false, policy.invert),
+				issues
+			};
+		}
+		try {
+			return await evaluator.evaluate(policy, {
+				...ctx,
+				evaluators: {
+					...this.evaluators,
+					...ctx.evaluators || {}
+				}
+			});
+		} catch {
+			issues.push(defineIssueItem({
+				path: [policy.type],
+				message: `The ${policy.type} evaluator can not process the policy specification.`,
+				code: ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE
+			}));
+			return {
+				success: maybeInvertPolicyOutcome(false, policy.invert),
+				issues
+			};
+		}
+	}
+	async evaluateOrFail(policy, ctx) {
+		const issues = [];
+		try {
+			const outcome = await this.evaluate(policy, ctx);
+			if (outcome.success) return;
+			if (outcome.issues) issues.push(...outcome.issues);
+		} catch (e) {
+			if (e instanceof PolicyError) throw e;
+		}
+		const error = new PolicyError(`The policy ${policy.type} evaluation failed.`);
+		error.addIssues(issues);
+		throw error;
+	}
+};
+//#endregion
+//#region src/policy/data.ts
+var PolicyData = class PolicyData {
+	data;
+	validated;
+	constructor(data = {}, validated = /* @__PURE__ */ new Set()) {
+		this.data = data;
+		this.validated = validated;
+	}
+	set(key, value) {
+		this.data[key] = value;
+		this.validated.delete(key);
+	}
+	get(key) {
+		if (key in this.data) return this.data[key];
+		throw new Error(`Policy data item ${key} does not exist.`);
+	}
+	has(key) {
+		return key in this.data;
+	}
+	setValidated(key) {
+		this.validated.add(key);
+	}
+	isValidated(key) {
+		return this.validated.has(key);
+	}
+	clone() {
+		return new PolicyData({ ...this.data }, new Set(this.validated));
+	}
+};
+//#endregion
+//#region src/policy/evaluation/context/define.ts
 function definePolicyEvaluationContext(input = {}) {
-    return {
-        evaluators: input.evaluators || {},
-        path: input.path || [],
-        data: input.data || new PolicyData(),
-        include: input.include || [],
-        exclude: input.exclude || []
-    };
-}
-
-/*
- * Copyright (c) 2026-2026.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var PolicyIssueSeverity = /*#__PURE__*/ function(PolicyIssueSeverity) {
-    PolicyIssueSeverity["WARNING"] = "warning";
-    PolicyIssueSeverity["ERROR"] = "error";
-    return PolicyIssueSeverity;
+	return {
+		evaluators: input.evaluators || {},
+		path: input.path || [],
+		data: input.data || new PolicyData(),
+		include: input.include || [],
+		exclude: input.exclude || []
+	};
+}
+//#endregion
+//#region src/policy/issue/constants.ts
+let PolicyIssueSeverity = /* @__PURE__ */ function(PolicyIssueSeverity) {
+	PolicyIssueSeverity["WARNING"] = "warning";
+	PolicyIssueSeverity["ERROR"] = "error";
+	return PolicyIssueSeverity;
 }({});
-var PolicyIssueCode = /*#__PURE__*/ function(PolicyIssueCode) {
-    // Data/Input
-    PolicyIssueCode["DATA_MISSING"] = "DATA_MISSING";
-    PolicyIssueCode["DATA_INVALID"] = "DATA_INVALID";
-    // Policy Spec / Config
-    PolicyIssueCode["INVALID"] = "INVALID";
-    PolicyIssueCode["TYPE_UNKNOWN"] = "TYPE_UNKNOWN";
-    PolicyIssueCode["FIELD_MISSING"] = "FIELD_MISSING";
-    PolicyIssueCode["FIELD_INVALID"] = "FIELD_INVALID";
-    // Composite / Tree evaluation
-    PolicyIssueCode["CHILD_INVALID"] = "CHILD_INVALID";
-    PolicyIssueCode["CHILD_EVALUATION_FAILED"] = "CHILD_EVALUATION_FAILED";
-    // Engine / Evaluator registry
-    PolicyIssueCode["EVALUATION_DENIED"] = "EVALUATION_DENIED";
-    PolicyIssueCode["EVALUATOR_NOT_FOUND"] = "EVALUATOR_NOT_FOUND";
-    PolicyIssueCode["EVALUATOR_ERROR"] = "EVALUATOR_ERROR";
-    // Execution control
-    PolicyIssueCode["SKIPPED_EXCLUDED"] = "SKIPPED_EXCLUDED";
-    PolicyIssueCode["SKIPPED_NOT_INCLUDED"] = "SKIPPED_NOT_INCLUDED";
-    // Internal / unexpected
-    PolicyIssueCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
-    return PolicyIssueCode;
+let PolicyIssueCode = /* @__PURE__ */ function(PolicyIssueCode) {
+	PolicyIssueCode["DATA_MISSING"] = "DATA_MISSING";
+	PolicyIssueCode["DATA_INVALID"] = "DATA_INVALID";
+	PolicyIssueCode["INVALID"] = "INVALID";
+	PolicyIssueCode["TYPE_UNKNOWN"] = "TYPE_UNKNOWN";
+	PolicyIssueCode["FIELD_MISSING"] = "FIELD_MISSING";
+	PolicyIssueCode["FIELD_INVALID"] = "FIELD_INVALID";
+	PolicyIssueCode["CHILD_INVALID"] = "CHILD_INVALID";
+	PolicyIssueCode["CHILD_EVALUATION_FAILED"] = "CHILD_EVALUATION_FAILED";
+	PolicyIssueCode["EVALUATION_DENIED"] = "EVALUATION_DENIED";
+	PolicyIssueCode["EVALUATOR_NOT_FOUND"] = "EVALUATOR_NOT_FOUND";
+	PolicyIssueCode["EVALUATOR_ERROR"] = "EVALUATOR_ERROR";
+	PolicyIssueCode["SKIPPED_EXCLUDED"] = "SKIPPED_EXCLUDED";
+	PolicyIssueCode["SKIPPED_NOT_INCLUDED"] = "SKIPPED_NOT_INCLUDED";
+	PolicyIssueCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+	return PolicyIssueCode;
 }({});
-
+//#endregion
+//#region src/policy/issue/define.ts
 function definePolicyIssueItem(input) {
-    return defineIssueItem(input);
+	return defineIssueItem(input);
 }
 function definePolicyIssueGroup(input) {
-    return defineIssueGroup(input);
-}
-
-class AttributeNamesPolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('names', createValidator(z.array(z.string().min(3).max(128))));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function defineAttributesPolicy(data) {
-    return data;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var BuiltInPolicyType = /*#__PURE__*/ function(BuiltInPolicyType) {
-    /**
-     * Bundles different policies.
-     */ BuiltInPolicyType["COMPOSITE"] = "composite";
-    /**
-     * Date Based Access Control (DBAC)
-     */ BuiltInPolicyType["DATE"] = "date";
-    /**
-     * Time Based Access Control (TBAC)
-     */ BuiltInPolicyType["TIME"] = "time";
-    /**
-     * Attribute Name Based Access Control (ANBAC)
-     */ BuiltInPolicyType["ATTRIBUTE_NAMES"] = "attributeNames";
-    /**
-     * Attribute Based Access Control (ABAC)
-     */ BuiltInPolicyType["ATTRIBUTES"] = "attributes";
-    /**
-     * Realm of Identity is for attribute realm.
-     */ BuiltInPolicyType["REALM_MATCH"] = "realmMatch";
-    /**
-     * Restriction based on identity (type, id, ...)
-     */ BuiltInPolicyType["IDENTITY"] = "identity";
-    /**
-     * Restriction based on a binding between identity <-> permission
-     */ BuiltInPolicyType["PERMISSION_BINDING"] = "permissionBinding";
-    return BuiltInPolicyType;
+	return defineIssueGroup(input);
+}
+//#endregion
+//#region src/policy/built-in/attribute-names/validator.ts
+var AttributeNamesPolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("names", createValidator(z.array(z.string().min(3).max(128))));
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/attributes/define.ts
+function defineAttributesPolicy(data) {
+	return data;
+}
+//#endregion
+//#region src/policy/built-in/constants.ts
+let BuiltInPolicyType = /* @__PURE__ */ function(BuiltInPolicyType) {
+	/**
+	* Bundles different policies.
+	*/
+	BuiltInPolicyType["COMPOSITE"] = "composite";
+	/**
+	* Date Based Access Control (DBAC)
+	*/
+	BuiltInPolicyType["DATE"] = "date";
+	/**
+	* Time Based Access Control (TBAC)
+	*/
+	BuiltInPolicyType["TIME"] = "time";
+	/**
+	* Attribute Name Based Access Control (ANBAC)
+	*/
+	BuiltInPolicyType["ATTRIBUTE_NAMES"] = "attributeNames";
+	/**
+	* Attribute Based Access Control (ABAC)
+	*/
+	BuiltInPolicyType["ATTRIBUTES"] = "attributes";
+	/**
+	* Realm of Identity is for attribute realm.
+	*/
+	BuiltInPolicyType["REALM_MATCH"] = "realmMatch";
+	/**
+	* Restriction based on identity (type, id, ...)
+	*/
+	BuiltInPolicyType["IDENTITY"] = "identity";
+	/**
+	* Restriction based on a binding between identity <-> permission
+	*/
+	BuiltInPolicyType["PERMISSION_BINDING"] = "permissionBinding";
+	return BuiltInPolicyType;
 }({});
 const SystemPolicyName = {
-    DEFAULT: 'system.default',
-    IDENTITY: 'system.identity',
-    PERMISSION_BINDING: 'system.permission-binding',
-    REALM_MATCH: 'system.realm-match',
-    REALM_BOUND: 'system.realm-bound',
-    REALM_OR_GLOBAL: 'system.realm-or-global'
+	DEFAULT: "system.default",
+	IDENTITY: "system.identity",
+	PERMISSION_BINDING: "system.permission-binding",
+	REALM_MATCH: "system.realm-match",
+	REALM_BOUND: "system.realm-bound",
+	REALM_OR_GLOBAL: "system.realm-or-global"
 };
-
-class AttributesPolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('query', createValidator(z.looseObject({})));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class AttributesPolicyEvaluator {
-    validator;
-    constructor(){
-        this.validator = new AttributesPolicyValidator();
-    }
-    async accessData(ctx) {
-        if (!ctx.data.has(BuiltInPolicyType.ATTRIBUTES)) {
-            return null;
-        }
-        if (ctx.data.isValidated(BuiltInPolicyType.ATTRIBUTES)) {
-            return ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
-        }
-        // todo: run validator on attributes (isObject ...)
-        const data = ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
-        ctx.data.set(BuiltInPolicyType.ATTRIBUTES, data);
-        ctx.data.setValidated(BuiltInPolicyType.ATTRIBUTES);
-        return data;
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        const data = await this.accessData(ctx);
-        if (!data) {
-            return {
-                success: false,
-                issues: [
-                    definePolicyIssueItem({
-                        code: PolicyIssueCode.DATA_MISSING,
-                        message: 'The data property attributes is missing',
-                        path: ctx.path
-                    })
-                ]
-            };
-        }
-        this.fixQuery(policy.query);
-        const testIt = guard(policy.query);
-        return {
-            success: maybeInvertPolicyOutcome(testIt(data), policy.invert)
-        };
-    }
-    fixQuery(query) {
-        if (Array.isArray(query)) {
-            for (const element of query){
-                this.fixQuery(element);
-            }
-            return;
-        }
-        if (isObject(query)) {
-            const keys = Object.keys(query);
-            for (const key of keys){
-                const value = query[key];
-                if (isObject(value) || Array.isArray(value)) {
-                    this.fixQuery(value);
-                    continue;
-                }
-                if (key === '$regex' && typeof value === 'string') {
-                    const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
-                    if (fragments) {
-                        query[key] = new RegExp(fragments[1], fragments[2]);
-                    }
-                }
-            }
-        }
-    }
-}
-
-class AttributeNamesPolicyEvaluator {
-    validator;
-    attributesEvaluator;
-    constructor(){
-        this.validator = new AttributeNamesPolicyValidator();
-        this.attributesEvaluator = new AttributesPolicyEvaluator();
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        const data = await this.attributesEvaluator.accessData(ctx);
-        if (!data) {
-            return {
-                success: false,
-                issues: [
-                    definePolicyIssueItem({
-                        code: PolicyIssueCode.DATA_MISSING,
-                        message: 'The data property attributes is missing',
-                        path: ctx.path
-                    })
-                ]
-            };
-        }
-        const attributes = flattenObject(data);
-        const keys = Object.keys(attributes);
-        const issues = [];
-        for (const key of keys){
-            const index = policy.names.indexOf(key);
-            if (index === -1) {
-                issues.push(definePolicyIssueItem({
-                    code: PolicyIssueCode.EVALUATION_DENIED,
-                    message: `The attribute ${key} is not included`,
-                    path: [
-                        ...ctx.path,
-                        key
-                    ]
-                }));
-            }
-        }
-        return {
-            success: maybeInvertPolicyOutcome(issues.length === 0, policy.invert),
-            issues
-        };
-    }
-}
-
-class CompositePolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('decision_strategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-        this.mount('children', createValidator(z.array(z.looseObject({
-            type: z.string().min(3)
-        }))));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class CompositePolicyEvaluator {
-    validator;
-    constructor(){
-        this.validator = new CompositePolicyValidator();
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        let count = 0;
-        const decision_strategy = policy.decision_strategy ?? DecisionStrategy.UNANIMOUS;
-        const engine = new PolicyEngine(ctx.evaluators);
-        const issues = [];
-        for(let i = 0; i < policy.children.length; i++){
-            const childPolicy = policy.children[i];
-            const path = [
-                ...ctx.path || [],
-                childPolicy.type
-            ];
-            const outcome = await engine.evaluate(childPolicy, {
-                ...ctx,
-                path
-            });
-            if (outcome.success) {
-                if (decision_strategy === DecisionStrategy.AFFIRMATIVE) {
-                    return {
-                        success: maybeInvertPolicyOutcome(true, policy.invert),
-                        issues: []
-                    };
-                }
-                count++;
-            } else {
-                if (outcome.issues) {
-                    issues.push(defineIssueGroup({
-                        message: `The evaluation of child policy ${childPolicy.type} failed`,
-                        issues: outcome.issues || [],
-                        path
-                    }));
-                }
-                if (decision_strategy === DecisionStrategy.UNANIMOUS) {
-                    return {
-                        success: maybeInvertPolicyOutcome(false, policy.invert),
-                        issues: [
-                            defineIssueGroup({
-                                message: `The evaluation of composite policy failed (${DecisionStrategy.UNANIMOUS})`,
-                                issues,
-                                path: ctx.path
-                            })
-                        ]
-                    };
-                }
-                count--;
-            }
-        }
-        if (count > 0) {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        return {
-            success: maybeInvertPolicyOutcome(false, policy.invert),
-            issues: [
-                defineIssueGroup({
-                    message: `The evaluation of composite policy failed (${DecisionStrategy.CONSENSUS})`,
-                    issues: issues || [],
-                    path: ctx.path
-                })
-            ]
-        };
-    }
-}
-
+//#endregion
+//#region src/policy/built-in/attributes/validator.ts
+var AttributesPolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("query", createValidator(z.looseObject({})));
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/attributes/evaluator.ts
+var AttributesPolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new AttributesPolicyValidator();
+	}
+	async accessData(ctx) {
+		if (!ctx.data.has(BuiltInPolicyType.ATTRIBUTES)) return null;
+		if (ctx.data.isValidated(BuiltInPolicyType.ATTRIBUTES)) return ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
+		const data = ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
+		ctx.data.set(BuiltInPolicyType.ATTRIBUTES, data);
+		ctx.data.setValidated(BuiltInPolicyType.ATTRIBUTES);
+		return data;
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const data = await this.accessData(ctx);
+		if (!data) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.DATA_MISSING,
+				message: "The data property attributes is missing",
+				path: ctx.path
+			})]
+		};
+		this.fixQuery(policy.query);
+		return { success: maybeInvertPolicyOutcome(guard(policy.query)(data), policy.invert) };
+	}
+	fixQuery(query) {
+		if (Array.isArray(query)) {
+			for (const element of query) this.fixQuery(element);
+			return;
+		}
+		if (isObject(query)) {
+			const keys = Object.keys(query);
+			for (const key of keys) {
+				const value = query[key];
+				if (isObject(value) || Array.isArray(value)) {
+					this.fixQuery(value);
+					continue;
+				}
+				if (key === "$regex" && typeof value === "string") {
+					const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
+					if (fragments && fragments[1] !== void 0) query[key] = new RegExp(fragments[1], fragments[2] || "");
+				}
+			}
+		}
+	}
+};
+//#endregion
+//#region src/policy/built-in/attribute-names/evaluator.ts
+var AttributeNamesPolicyEvaluator = class {
+	validator;
+	attributesEvaluator;
+	constructor() {
+		this.validator = new AttributeNamesPolicyValidator();
+		this.attributesEvaluator = new AttributesPolicyEvaluator();
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const data = await this.attributesEvaluator.accessData(ctx);
+		if (!data) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.DATA_MISSING,
+				message: "The data property attributes is missing",
+				path: ctx.path
+			})]
+		};
+		const attributes = flattenObject(data);
+		const keys = Object.keys(attributes);
+		const issues = [];
+		for (const key of keys) if (policy.names.indexOf(key) === -1) issues.push(definePolicyIssueItem({
+			code: PolicyIssueCode.EVALUATION_DENIED,
+			message: `The attribute ${key} is not included`,
+			path: [...ctx.path, key]
+		}));
+		return {
+			success: maybeInvertPolicyOutcome(issues.length === 0, policy.invert),
+			issues
+		};
+	}
+};
+//#endregion
+//#region src/policy/built-in/composite/validator.ts
+var CompositePolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("decision_strategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(3) }))));
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/composite/evaluator.ts
+var CompositePolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new CompositePolicyValidator();
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		let count = 0;
+		const decision_strategy = policy.decision_strategy ?? DecisionStrategy.UNANIMOUS;
+		const engine = new PolicyEngine(ctx.evaluators);
+		const issues = [];
+		for (const childPolicy of policy.children) {
+			const path = [...ctx.path || [], ...childPolicy.type ? [childPolicy.type] : []];
+			const outcome = await engine.evaluate(childPolicy, {
+				...ctx,
+				path
+			});
+			if (outcome.success) {
+				if (decision_strategy === DecisionStrategy.AFFIRMATIVE) return {
+					success: maybeInvertPolicyOutcome(true, policy.invert),
+					issues: []
+				};
+				count++;
+			} else {
+				if (outcome.issues) issues.push(defineIssueGroup({
+					message: `The evaluation of child policy ${childPolicy.type} failed`,
+					issues: outcome.issues || [],
+					path
+				}));
+				if (decision_strategy === DecisionStrategy.UNANIMOUS) return {
+					success: maybeInvertPolicyOutcome(false, policy.invert),
+					issues: [defineIssueGroup({
+						message: `The evaluation of composite policy failed (${DecisionStrategy.UNANIMOUS})`,
+						issues,
+						path: ctx.path
+					})]
+				};
+				count--;
+			}
+		}
+		if (count > 0) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		return {
+			success: maybeInvertPolicyOutcome(false, policy.invert),
+			issues: [defineIssueGroup({
+				message: `The evaluation of composite policy failed (${DecisionStrategy.CONSENSUS})`,
+				issues: issues || [],
+				path: ctx.path
+			})]
+		};
+	}
+};
+//#endregion
+//#region src/policy/built-in/composite/helper.ts
 function isCompositePolicy(input) {
-    return input.type === BuiltInPolicyType.COMPOSITE;
-}
-
-class DatePolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('start', createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('end', createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
-    }
-}
-
+	return input.type === BuiltInPolicyType.COMPOSITE;
+}
+//#endregion
+//#region src/policy/built-in/date/validator.ts
+var DatePolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("start", createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+		this.mount("end", createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+		this.mount("invert", createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/date/evaluator.ts
 function normalizeDate$1(input) {
-    return new Date(input.getFullYear(), input.getMonth(), input.getDate());
+	return new Date(input.getFullYear(), input.getMonth(), input.getDate());
 }
 function toDate$1(input) {
-    if (typeof input === 'string') {
-        return new Date(input);
-    }
-    if (typeof input === 'number') {
-        return new Date(input);
-    }
-    return input;
-}
-class DatePolicyEvaluator {
-    validator;
-    constructor(){
-        this.validator = new DatePolicyValidator();
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        let now;
-        if (ctx.data.has(BuiltInPolicyType.DATE)) {
-            if (ctx.data.isValidated(BuiltInPolicyType.DATE)) {
-                now = ctx.data.get(BuiltInPolicyType.DATE);
-            } else {
-                // todo: run validator on attributes (isObject ...)
-                now = normalizeDate$1(toDate$1(ctx.data.get(BuiltInPolicyType.DATE)));
-                ctx.data.set(BuiltInPolicyType.DATE, now);
-                ctx.data.setValidated(BuiltInPolicyType.DATE);
-            }
-        } else {
-            now = normalizeDate$1(new Date());
-        }
-        if (policy.start) {
-            const start = normalizeDate$1(toDate$1(policy.start));
-            if (now < start) {
-                return {
-                    success: maybeInvertPolicyOutcome(false, policy.invert)
-                };
-            }
-        }
-        if (policy.end) {
-            const end = normalizeDate$1(toDate$1(policy.end));
-            if (now > end) {
-                return {
-                    success: maybeInvertPolicyOutcome(false, policy.invert)
-                };
-            }
-        }
-        return {
-            success: maybeInvertPolicyOutcome(true, policy.invert)
-        };
-    }
-}
-
-class PolicyIdentityDataValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('type', createValidator(z.string().min(3).max(128)));
-        this.mount('id', createValidator(z.uuid()));
-        this.mount('clientId', createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('realmId', createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('realmName', createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class IdentityPolicyValidator extends Container {
-    initialize() {
-        this.mount('types', createValidator(z.array(z.string()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class IdentityPolicyEvaluator {
-    validator;
-    dataValidator;
-    constructor(){
-        this.validator = new IdentityPolicyValidator();
-        this.dataValidator = new PolicyIdentityDataValidator();
-    }
-    async accessData(ctx) {
-        if (!ctx.data.has('identity')) {
-            return null;
-        }
-        if (ctx.data.isValidated('identity')) {
-            return ctx.data.get('identity');
-        }
-        const data = await this.dataValidator.run(ctx.data.get('identity'));
-        ctx.data.set('identity', data);
-        ctx.data.setValidated('identity');
-        return data;
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        const data = await this.accessData(ctx);
-        if (!data) {
-            return {
-                success: false,
-                issues: [
-                    definePolicyIssueItem({
-                        code: PolicyIssueCode.DATA_MISSING,
-                        message: 'The data property identity is missing',
-                        path: ctx.path
-                    })
-                ]
-            };
-        }
-        if (!policy.types || policy.types.length === 0) {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        const typeAllowed = policy.types.includes(data.type);
-        if (typeAllowed) {
-            return {
-                success: maybeInvertPolicyOutcome(typeAllowed, policy.invert)
-            };
-        }
-        return {
-            success: maybeInvertPolicyOutcome(typeAllowed, policy.invert),
-            issues: [
-                definePolicyIssueItem({
-                    code: PolicyIssueCode.EVALUATION_DENIED,
-                    message: `The type ${data.type} is not covered by the policy configuration`,
-                    path: ctx.path
-                })
-            ]
-        };
-    }
-}
-
-class PermissionBindingPolicyValidator extends Container {
-    initialize() {}
-}
-
-class PermissionBindingPolicyEvaluator {
-    validator;
-    constructor(){
-        this.validator = new PermissionBindingPolicyValidator();
-    }
-    async evaluate(value) {
-        const policy = await this.validator.run(value);
-        // todo: this must be changed when the permission-checker not only checks owned permissions.
-        return {
-            success: maybeInvertPolicyOutcome(true, policy.invert)
-        };
-    }
-}
-
-class RealmMatchPolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('decision_strategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-        this.mount('attribute_name', createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
-        this.mount('attribute_name_strict', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-        this.mount('attribute_null_match_all', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-        this.mount('identity_master_match_all', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class RealmMatchPolicyEvaluator {
-    validator;
-    identityEvaluator;
-    attributesEvaluator;
-    constructor(){
-        this.validator = new RealmMatchPolicyValidator();
-        this.identityEvaluator = new IdentityPolicyEvaluator();
-        this.attributesEvaluator = new AttributesPolicyEvaluator();
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        const identity = await this.identityEvaluator.accessData(ctx);
-        if (!identity) {
-            return {
-                success: false,
-                issues: [
-                    definePolicyIssueItem({
-                        code: PolicyIssueCode.DATA_MISSING,
-                        message: 'The data property identity is missing',
-                        path: ctx.path
-                    })
-                ]
-            };
-        }
-        const attributes = await this.attributesEvaluator.accessData(ctx);
-        if (!attributes) {
-            return {
-                success: false,
-                issues: [
-                    definePolicyIssueItem({
-                        code: PolicyIssueCode.DATA_MISSING,
-                        message: 'The data property attributes is missing',
-                        path: ctx.path
-                    })
-                ]
-            };
-        }
-        const identityMasterMatchAll = policy.identity_master_match_all ?? true;
-        if (identityMasterMatchAll && identity.realmName && identity.realmName === 'master') {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        let keys;
-        if (policy.attribute_name) {
-            if (Array.isArray(policy.attribute_name)) {
-                keys = policy.attribute_name;
-            } else {
-                keys = [
-                    policy.attribute_name
-                ];
-            }
-        } else {
-            keys = [
-                'realm_id',
-                'realm_name',
-                'realmId',
-                'realmName'
-            ];
-            policy.decision_strategy = DecisionStrategy.CONSENSUS;
-        }
-        const attribute_name_strict = policy.attribute_name_strict ?? true;
-        if (!attribute_name_strict) {
-            const resourceKeys = Object.keys(attributes);
-            const keysToAdd = [];
-            for (const resourceKey of resourceKeys){
-                let contains = false;
-                for (const key of keys){
-                    if (resourceKey !== key && resourceKey.includes(key)) {
-                        contains = true;
-                        break;
-                    }
-                }
-                if (contains) {
-                    keysToAdd.push(resourceKey);
-                }
-            }
-            if (keysToAdd.length > 0) {
-                keys.push(...keysToAdd);
-            }
-        }
-        let count = 0;
-        let evaluated = false;
-        for (const key of keys){
-            if (!hasOwnProperty(attributes, key)) {
-                continue;
-            }
-            evaluated = true;
-            let outcome = false;
-            const attributeValue = attributes[key];
-            if (attributeValue === null && policy.attribute_null_match_all) {
-                outcome = true;
-            } else if (attributeValue === identity.realmId || attributeValue === identity.realmName) {
-                outcome = true;
-            }
-            if (outcome) {
-                if (policy.decision_strategy === DecisionStrategy.AFFIRMATIVE) {
-                    return {
-                        success: maybeInvertPolicyOutcome(true, policy.invert)
-                    };
-                }
-                count++;
-            } else {
-                if (policy.decision_strategy === DecisionStrategy.UNANIMOUS) {
-                    return {
-                        success: maybeInvertPolicyOutcome(false, policy.invert)
-                    };
-                }
-                count--;
-            }
-        }
-        if (!evaluated) {
-            return {
-                success: maybeInvertPolicyOutcome(true, policy.invert)
-            };
-        }
-        return {
-            success: maybeInvertPolicyOutcome(count > 0, policy.invert)
-        };
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var TimePolicyInterval = /*#__PURE__*/ function(TimePolicyInterval) {
-    TimePolicyInterval["DAILY"] = "daily";
-    TimePolicyInterval["WEEKLY"] = "weekly";
-    TimePolicyInterval["MONTHLY"] = "monthly";
-    TimePolicyInterval["YEARLY"] = "yearly";
-    return TimePolicyInterval;
+	if (typeof input === "string") return new Date(input);
+	if (typeof input === "number") return new Date(input);
+	return input;
+}
+var DatePolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new DatePolicyValidator();
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		let now;
+		if (ctx.data.has(BuiltInPolicyType.DATE)) if (ctx.data.isValidated(BuiltInPolicyType.DATE)) now = ctx.data.get(BuiltInPolicyType.DATE);
+		else {
+			now = normalizeDate$1(toDate$1(ctx.data.get(BuiltInPolicyType.DATE)));
+			ctx.data.set(BuiltInPolicyType.DATE, now);
+			ctx.data.setValidated(BuiltInPolicyType.DATE);
+		}
+		else now = normalizeDate$1(/* @__PURE__ */ new Date());
+		if (policy.start) {
+			const start = normalizeDate$1(toDate$1(policy.start));
+			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		}
+		if (policy.end) {
+			const end = normalizeDate$1(toDate$1(policy.end));
+			if (now > end) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		}
+		return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+	}
+};
+//#endregion
+//#region src/policy/built-in/identity/data/validator.ts
+var PolicyIdentityDataValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("type", createValidator(z.string().min(3).max(128)));
+		this.mount("id", createValidator(z.uuid()));
+		this.mount("clientId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
+		this.mount("realmId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
+		this.mount("realmName", createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/identity/validator.ts
+var IdentityPolicyValidator = class extends Container {
+	initialize() {
+		this.mount("types", createValidator(z.array(z.string()).or(z.null()).or(z.undefined()).optional()));
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/identity/evaluator.ts
+var IdentityPolicyEvaluator = class {
+	validator;
+	dataValidator;
+	constructor() {
+		this.validator = new IdentityPolicyValidator();
+		this.dataValidator = new PolicyIdentityDataValidator();
+	}
+	async accessData(ctx) {
+		if (!ctx.data.has("identity")) return null;
+		if (ctx.data.isValidated("identity")) return ctx.data.get("identity");
+		const data = await this.dataValidator.run(ctx.data.get("identity"));
+		ctx.data.set("identity", data);
+		ctx.data.setValidated("identity");
+		return data;
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const data = await this.accessData(ctx);
+		if (!data) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.DATA_MISSING,
+				message: "The data property identity is missing",
+				path: ctx.path
+			})]
+		};
+		if (!policy.types || policy.types.length === 0) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		const typeAllowed = policy.types.includes(data.type);
+		if (typeAllowed) return { success: maybeInvertPolicyOutcome(typeAllowed, policy.invert) };
+		return {
+			success: maybeInvertPolicyOutcome(typeAllowed, policy.invert),
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.EVALUATION_DENIED,
+				message: `The type ${data.type} is not covered by the policy configuration`,
+				path: ctx.path
+			})]
+		};
+	}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/validator.ts
+var PermissionBindingPolicyValidator = class extends Container {
+	initialize() {}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/module.ts
+var PermissionBindingPolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new PermissionBindingPolicyValidator();
+	}
+	async evaluate(value) {
+		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
+	}
+};
+//#endregion
+//#region src/policy/built-in/realm-match/validator.ts
+var RealmMatchPolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("decision_strategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+		this.mount("attribute_name", createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
+		this.mount("attribute_name_strict", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+		this.mount("attribute_null_match_all", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+		this.mount("identity_master_match_all", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/realm-match/evaluator.ts
+var RealmMatchPolicyEvaluator = class {
+	validator;
+	identityEvaluator;
+	attributesEvaluator;
+	constructor() {
+		this.validator = new RealmMatchPolicyValidator();
+		this.identityEvaluator = new IdentityPolicyEvaluator();
+		this.attributesEvaluator = new AttributesPolicyEvaluator();
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const identity = await this.identityEvaluator.accessData(ctx);
+		if (!identity) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.DATA_MISSING,
+				message: "The data property identity is missing",
+				path: ctx.path
+			})]
+		};
+		const attributes = await this.attributesEvaluator.accessData(ctx);
+		if (!attributes) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: PolicyIssueCode.DATA_MISSING,
+				message: "The data property attributes is missing",
+				path: ctx.path
+			})]
+		};
+		if ((policy.identity_master_match_all ?? true) && identity.realmName && identity.realmName === "master") return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		let keys;
+		if (policy.attribute_name) if (Array.isArray(policy.attribute_name)) keys = policy.attribute_name;
+		else keys = [policy.attribute_name];
+		else {
+			keys = [
+				"realm_id",
+				"realm_name",
+				"realmId",
+				"realmName"
+			];
+			policy.decision_strategy = DecisionStrategy.CONSENSUS;
+		}
+		if (!(policy.attribute_name_strict ?? true)) {
+			const resourceKeys = Object.keys(attributes);
+			const keysToAdd = [];
+			for (const resourceKey of resourceKeys) {
+				let contains = false;
+				for (const key of keys) if (resourceKey !== key && resourceKey.includes(key)) {
+					contains = true;
+					break;
+				}
+				if (contains) keysToAdd.push(resourceKey);
+			}
+			if (keysToAdd.length > 0) keys.push(...keysToAdd);
+		}
+		let count = 0;
+		let evaluated = false;
+		for (const key of keys) {
+			if (!hasOwnProperty(attributes, key)) continue;
+			evaluated = true;
+			let outcome = false;
+			const attributeValue = attributes[key];
+			if (attributeValue === null && policy.attribute_null_match_all) outcome = true;
+			else if (attributeValue === identity.realmId || attributeValue === identity.realmName) outcome = true;
+			if (outcome) {
+				if (policy.decision_strategy === DecisionStrategy.AFFIRMATIVE) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				count++;
+			} else {
+				if (policy.decision_strategy === DecisionStrategy.UNANIMOUS) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+				count--;
+			}
+		}
+		if (!evaluated) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		return { success: maybeInvertPolicyOutcome(count > 0, policy.invert) };
+	}
+};
+//#endregion
+//#region src/policy/built-in/time/constants.ts
+let TimePolicyInterval = /* @__PURE__ */ function(TimePolicyInterval) {
+	TimePolicyInterval["DAILY"] = "daily";
+	TimePolicyInterval["WEEKLY"] = "weekly";
+	TimePolicyInterval["MONTHLY"] = "monthly";
+	TimePolicyInterval["YEARLY"] = "yearly";
+	return TimePolicyInterval;
 }({});
-
+//#endregion
+//#region src/policy/built-in/time/helpers.ts
 function isIntervalForDayOfWeek(interval) {
-    return interval === TimePolicyInterval.WEEKLY || interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+	return interval === TimePolicyInterval.WEEKLY || interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
 }
 function isIntervalForDayOfMonth(interval) {
-    return interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+	return interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
 }
 function isIntervalForDayOfYear(interval) {
-    return interval === TimePolicyInterval.YEARLY;
-}
-
-class TimePolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('day_of_week', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
-        this.mount('day_of_month', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
-        this.mount('day_of_year', createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
-        this.mount('start', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('end', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('interval', createValidator(z.enum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
-        this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
-    }
-}
-
+	return interval === TimePolicyInterval.YEARLY;
+}
+//#endregion
+//#region src/policy/built-in/time/validator.ts
+var TimePolicyValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("day_of_week", createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
+		this.mount("day_of_month", createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
+		this.mount("day_of_year", createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
+		this.mount("start", createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+		this.mount("end", createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+		this.mount("interval", createValidator(z.enum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
+		this.mount("invert", createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/time/evaluator.ts
 const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$/;
 function normalizeDate(input, dateRef) {
-    const date = dateRef ? new Date(dateRef) : new Date();
-    date.setHours(input.getHours(), input.getMinutes());
-    return date;
+	const date = dateRef ? new Date(dateRef) : /* @__PURE__ */ new Date();
+	date.setHours(input.getHours(), input.getMinutes());
+	return date;
 }
 function toDate(input, dateRef) {
-    if (typeof input === 'string') {
-        if (timeRegex.test(input)) {
-            const [startHours, startMinutes] = input.split(':').map(Number);
-            const date = dateRef ? new Date(dateRef) : new Date();
-            date.setHours(startHours, startMinutes);
-            return date;
-        }
-        return new Date(input);
-    }
-    if (typeof input === 'number') {
-        return new Date(input);
-    }
-    return input;
-}
-class TimePolicyEvaluator {
-    validator;
-    constructor(){
-        this.validator = new TimePolicyValidator();
-    }
-    async evaluate(value, ctx) {
-        // todo: catch errors + transform to issue(s)
-        const policy = await this.validator.run(value);
-        let now;
-        if (ctx.data.has(BuiltInPolicyType.TIME)) {
-            if (ctx.data.isValidated(BuiltInPolicyType.TIME)) {
-                now = ctx.data.get(BuiltInPolicyType.TIME);
-            } else {
-                // todo: run validator on attributes (isObject ...)
-                now = toDate(ctx.data.get(BuiltInPolicyType.TIME));
-                ctx.data.set(BuiltInPolicyType.TIME, now);
-                ctx.data.setValidated(BuiltInPolicyType.TIME);
-            }
-        } else {
-            now = new Date();
-        }
-        if (policy.start) {
-            const start = normalizeDate(toDate(policy.start, now), now);
-            if (now < start) {
-                return {
-                    success: maybeInvertPolicyOutcome(false, policy.invert)
-                };
-            }
-        }
-        if (policy.end) {
-            const end = normalizeDate(toDate(policy.end, now), now);
-            if (now > end) {
-                return {
-                    success: maybeInvertPolicyOutcome(false, policy.invert)
-                };
-            }
-        }
-        if (policy.interval) {
-            if (isIntervalForDayOfWeek(policy.interval) && policy.day_of_week) {
-                if (now.getDay() !== policy.day_of_week) {
-                    return {
-                        success: maybeInvertPolicyOutcome(false, policy.invert)
-                    };
-                }
-            }
-            if (isIntervalForDayOfMonth(policy.interval) && policy.day_of_month) {
-                if (now.getDate() !== policy.day_of_month) {
-                    return {
-                        success: maybeInvertPolicyOutcome(false, policy.invert)
-                    };
-                }
-            }
-            if (isIntervalForDayOfYear(policy.interval) && policy.day_of_year) {
-                const start = new Date(now.getFullYear(), 0, 0);
-                const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
-                const oneDay = 1000 * 60 * 60 * 24;
-                const dayOfYear = Math.floor(diff / oneDay);
-                if (dayOfYear !== policy.day_of_year) {
-                    return {
-                        success: maybeInvertPolicyOutcome(false, policy.invert)
-                    };
-                }
-            }
-        }
-        return {
-            success: maybeInvertPolicyOutcome(true, policy.invert)
-        };
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function definePolicyWithType(type, data) {
-    return {
-        ...data,
-        type
-    };
-}
-
+	if (typeof input === "string") {
+		if (timeRegex.test(input)) {
+			const parts = input.split(":");
+			const startHours = Number(parts[0]);
+			const startMinutes = Number(parts[1]);
+			const startSeconds = parts[2] !== void 0 ? Number(parts[2]) : 0;
+			if (Number.isFinite(startHours) && Number.isFinite(startMinutes) && Number.isFinite(startSeconds)) {
+				const date = dateRef ? new Date(dateRef) : /* @__PURE__ */ new Date();
+				date.setHours(startHours, startMinutes, startSeconds, 0);
+				return date;
+			}
+		}
+		return new Date(input);
+	}
+	if (typeof input === "number") return new Date(input);
+	return input;
+}
+var TimePolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new TimePolicyValidator();
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		let now;
+		if (ctx.data.has(BuiltInPolicyType.TIME)) if (ctx.data.isValidated(BuiltInPolicyType.TIME)) now = ctx.data.get(BuiltInPolicyType.TIME);
+		else {
+			now = toDate(ctx.data.get(BuiltInPolicyType.TIME));
+			ctx.data.set(BuiltInPolicyType.TIME, now);
+			ctx.data.setValidated(BuiltInPolicyType.TIME);
+		}
+		else now = /* @__PURE__ */ new Date();
+		if (policy.start) {
+			const start = normalizeDate(toDate(policy.start, now), now);
+			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		}
+		if (policy.end) {
+			const end = normalizeDate(toDate(policy.end, now), now);
+			if (now > end) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		}
+		if (policy.interval) {
+			if (isIntervalForDayOfWeek(policy.interval) && policy.day_of_week) {
+				if (now.getDay() !== policy.day_of_week) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+			}
+			if (isIntervalForDayOfMonth(policy.interval) && policy.day_of_month) {
+				if (now.getDate() !== policy.day_of_month) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+			}
+			if (isIntervalForDayOfYear(policy.interval) && policy.day_of_year) {
+				const start = new Date(now.getFullYear(), 0, 0);
+				const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1e3;
+				if (Math.floor(diff / (1e3 * 60 * 60 * 24)) !== policy.day_of_year) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+			}
+		}
+		return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+	}
+};
+//#endregion
+//#region src/policy/built-in/define.ts
+function definePolicyWithType(type, data) {
+	return {
+		...data,
+		type
+	};
+}
+//#endregion
+//#region src/policy/constants.ts
 const PolicyDefaultEvaluators = {
-    [BuiltInPolicyType.COMPOSITE]: new CompositePolicyEvaluator(),
-    [BuiltInPolicyType.ATTRIBUTES]: new AttributesPolicyEvaluator(),
-    [BuiltInPolicyType.ATTRIBUTE_NAMES]: new AttributeNamesPolicyEvaluator(),
-    [BuiltInPolicyType.DATE]: new DatePolicyEvaluator(),
-    [BuiltInPolicyType.IDENTITY]: new IdentityPolicyEvaluator(),
-    [BuiltInPolicyType.PERMISSION_BINDING]: new PermissionBindingPolicyEvaluator(),
-    [BuiltInPolicyType.REALM_MATCH]: new RealmMatchPolicyEvaluator(),
-    [BuiltInPolicyType.TIME]: new TimePolicyEvaluator()
+	[BuiltInPolicyType.COMPOSITE]: new CompositePolicyEvaluator(),
+	[BuiltInPolicyType.ATTRIBUTES]: new AttributesPolicyEvaluator(),
+	[BuiltInPolicyType.ATTRIBUTE_NAMES]: new AttributeNamesPolicyEvaluator(),
+	[BuiltInPolicyType.DATE]: new DatePolicyEvaluator(),
+	[BuiltInPolicyType.IDENTITY]: new IdentityPolicyEvaluator(),
+	[BuiltInPolicyType.PERMISSION_BINDING]: new PermissionBindingPolicyEvaluator(),
+	[BuiltInPolicyType.REALM_MATCH]: new RealmMatchPolicyEvaluator(),
+	[BuiltInPolicyType.TIME]: new TimePolicyEvaluator()
 };
+//#endregion
+//#region src/permission/evaluator/module.ts
+var PermissionEvaluator = class {
+	provider;
+	policyEngine;
+	clientId;
+	realmId;
+	constructor(options) {
+		this.provider = options.provider;
+		this.clientId = options.clientId || null;
+		this.realmId = options.realmId || null;
+		if (options.policyEngine) this.policyEngine = options.policyEngine;
+		else this.policyEngine = new PolicyEngine(PolicyDefaultEvaluators);
+	}
+	async findOne(input, overrides = {}) {
+		return this.provider.findOne({
+			name: input,
+			clientId: overrides.clientId ?? this.clientId,
+			realmId: overrides.realmId ?? this.realmId
+		});
+	}
+	async evaluate(ctx) {
+		if (!Array.isArray(ctx.name)) {
+			await this.evaluate({
+				...ctx,
+				name: [ctx.name]
+			});
+			return;
+		}
+		const { options = {} } = ctx;
+		const decisionStrategy = options.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+		const issues = [];
+		let count = 0;
+		const dataBase = ctx.input || new PolicyData();
+		for (const name of ctx.name) {
+			const binding = await this.findOne(name, {
+				realmId: ctx.realmId,
+				clientId: ctx.clientId
+			});
+			if (!binding) {
+				issues.push(defineIssueItem({
+					code: ErrorCode.PERMISSION_NOT_FOUND,
+					message: `The ${name} permission could not be resolved`,
+					path: [name]
+				}));
+				if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+					const error = PermissionError.evaluationFailed(ctx.name);
+					error.addIssues(issues);
+					throw error;
+				}
+				continue;
+			}
+			const policies = binding.policies ?? [];
+			if (policies.length === 0) {
+				if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) return;
+				count++;
+				continue;
+			}
+			const data = dataBase.clone();
+			data.set(BuiltInPolicyType.PERMISSION_BINDING, binding);
+			const policyDecisionStrategy = binding.permission.decision_strategy ?? DecisionStrategy.UNANIMOUS;
+			const compositePolicy = {
+				type: BuiltInPolicyType.COMPOSITE,
+				decision_strategy: policyDecisionStrategy,
+				children: policies
+			};
+			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
+				include: options.policiesIncluded,
+				exclude: options.policiesExcluded,
+				data
+			}));
+			if (evaluationResult.success) {
+				if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) return;
+				count++;
+			} else {
+				issues.push(definePolicyIssueGroup({
+					code: ErrorCode.PERMISSION_EVALUATION_FAILED,
+					issues: evaluationResult.issues || [],
+					message: `The ${binding.permission.name} permissions policy evaluation failed`,
+					path: [binding.permission.name]
+				}));
+				if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+					const error = PermissionError.evaluationFailed(binding.permission.name);
+					error.addIssues(issues);
+					throw error;
+				}
+				count--;
+			}
+		}
+		if (count > 0) return;
+		if (issues.length === 0) throw PermissionError.deniedAll(ctx.name);
+		else {
+			const error = PermissionError.evaluationFailed(ctx.name);
+			error.addIssues(issues);
+			throw error;
+		}
+	}
+	async evaluateOneOf(ctx) {
+		return this.evaluate({
+			...ctx,
+			options: {
+				...ctx.options || {},
+				decisionStrategy: DecisionStrategy.AFFIRMATIVE
+			}
+		});
+	}
+	async preEvaluate(ctx) {
+		return this.evaluate({
+			...ctx,
+			options: {
+				...ctx.options || {},
+				policiesExcluded: [
+					BuiltInPolicyType.ATTRIBUTES,
+					BuiltInPolicyType.ATTRIBUTE_NAMES,
+					BuiltInPolicyType.REALM_MATCH
+				]
+			}
+		});
+	}
+	async preEvaluateOneOf(ctx) {
+		return this.preEvaluate({
+			...ctx,
+			options: {
+				...ctx.options || {},
+				decisionStrategy: DecisionStrategy.AFFIRMATIVE
+			}
+		});
+	}
+};
+//#endregion
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionKey, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionPolicyBindingEqual, maybeInvertPolicyOutcome, mergePermissionPolicyBindings };
 
-class PermissionEvaluator {
-    provider;
-    policyEngine;
-    clientId;
-    realmId;
-    // ----------------------------------------------
-    constructor(options = {}){
-        if (options.provider) {
-            this.provider = options.provider;
-        } else {
-            this.provider = new PermissionMemoryProvider();
-        }
-        if (typeof options.clientId !== 'undefined') {
-            this.clientId = options.clientId;
-        }
-        if (typeof options.realmId !== 'undefined') {
-            this.realmId = options.realmId;
-        }
-        if (options.policyEngine) {
-            this.policyEngine = options.policyEngine;
-        } else {
-            this.policyEngine = new PolicyEngine(PolicyDefaultEvaluators);
-        }
-    }
-    // ----------------------------------------------
-    async findOne(input, overrides) {
-        const options = {
-            name: input
-        };
-        if (typeof overrides?.clientId !== 'undefined') {
-            options.clientId = overrides.clientId;
-        } else if (typeof this.clientId !== 'undefined') {
-            options.clientId = this.clientId;
-        }
-        if (typeof overrides?.realmId !== 'undefined') {
-            options.realmId = overrides.realmId;
-        } else if (typeof this.realmId !== 'undefined') {
-            options.realmId = this.realmId;
-        }
-        return this.provider.findOne(options);
-    }
-    // ----------------------------------------------
-    async evaluate(ctx) {
-        if (!Array.isArray(ctx.name)) {
-            await this.evaluate({
-                ...ctx,
-                name: [
-                    ctx.name
-                ]
-            });
-            return;
-        }
-        const { options = {} } = ctx;
-        const decisionStrategy = options.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        const issues = [];
-        let count = 0;
-        const dataBase = ctx.input || new PolicyData();
-        for(let i = 0; i < ctx.name.length; i++){
-            const binding = await this.findOne(ctx.name[i], {
-                realmId: ctx.realmId,
-                clientId: ctx.clientId
-            });
-            if (!binding) {
-                issues.push(defineIssueItem({
-                    code: ErrorCode.PERMISSION_NOT_FOUND,
-                    message: `The ${ctx.name[i]} permission could not be resolved`,
-                    path: [
-                        ctx.name[i]
-                    ]
-                }));
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    const error = PermissionError.evaluationFailed(ctx.name);
-                    error.addIssues(issues);
-                    throw error;
-                }
-                continue;
-            }
-            const policies = binding.policies ?? [];
-            if (policies.length === 0) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return;
-                }
-                count++;
-                continue;
-            }
-            const data = dataBase.clone();
-            data.set(BuiltInPolicyType.PERMISSION_BINDING, binding);
-            const policyDecisionStrategy = binding.permission.decision_strategy ?? DecisionStrategy.UNANIMOUS;
-            const compositePolicy = {
-                type: BuiltInPolicyType.COMPOSITE,
-                decision_strategy: policyDecisionStrategy,
-                children: policies
-            };
-            const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
-                include: options.policiesIncluded,
-                exclude: options.policiesExcluded,
-                data
-            }));
-            if (evaluationResult.success) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return;
-                }
-                count++;
-            } else {
-                issues.push(definePolicyIssueGroup({
-                    code: ErrorCode.PERMISSION_EVALUATION_FAILED,
-                    issues: evaluationResult.issues || [],
-                    message: `The ${binding.permission.name} permissions policy evaluation failed`,
-                    path: [
-                        binding.permission.name
-                    ]
-                }));
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    const error = PermissionError.evaluationFailed(binding.permission.name);
-                    error.addIssues(issues);
-                    throw error;
-                }
-                count--;
-            }
-        }
-        if (count > 0) {
-            return;
-        }
-        if (issues.length === 0) {
-            throw PermissionError.deniedAll(ctx.name);
-        } else {
-            const error = PermissionError.evaluationFailed(ctx.name);
-            error.addIssues(issues);
-            throw error;
-        }
-    }
-    async evaluateOneOf(ctx) {
-        return this.evaluate({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE
-            }
-        });
-    }
-    // ----------------------------------------------
-    async preEvaluate(ctx) {
-        return this.evaluate({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                policiesExcluded: [
-                    BuiltInPolicyType.ATTRIBUTES,
-                    BuiltInPolicyType.ATTRIBUTE_NAMES,
-                    BuiltInPolicyType.REALM_MATCH
-                ]
-            }
-        });
-    }
-    async preEvaluateOneOf(ctx) {
-        return this.preEvaluate({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE
-            }
-        });
-    }
-}
-
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, maybeInvertPolicyOutcome };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map