@authup/access 1.0.0-beta.49 → 1.0.0-beta.51

package/dist/permission/helpers/equal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"equal.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/equal.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAc9G"}
+{"version":3,"file":"equal.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/equal.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,wBAAgB,8BAA8B,CAC1C,CAAC,EAAE;IAAE,UAAU,EAAE,cAAc,CAAA;CAAE,EACjC,CAAC,EAAE;IAAE,UAAU,EAAE,cAAc,CAAA;CAAE,GAClC,OAAO,CAcT"}

package/dist/permission/helpers/grant.d.ts

@@ -0,0 +1,9 @@
+import type { PermissionGrant } from '../types';
+/**
+ * Whether the actor's `parent` grant covers the target's `child` grant: it reaches at least as
+ * far (ordered none < own < ownOrNull < any) AND its policy provably covers the child's
+ * (see `policyDominates`). Used per grant by `isSuperset` over the aggregated disjunction —
+ * every child grant must be dominated by SOME parent grant.
+ */
+export declare function grantDominates(parent: PermissionGrant, child: PermissionGrant): boolean;
+//# sourceMappingURL=grant.d.ts.map

package/dist/permission/helpers/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/grant.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AA2GhD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAMvF"}

package/dist/permission/helpers/index.d.ts

@@ -1,4 +1,5 @@
+export * from './aggregate';
 export * from './equal';
+export * from './grant';
 export * from './key';
-export * from './merge';
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC"}

package/dist/permission/index.d.ts

@@ -2,5 +2,6 @@ export * from './error';
 export * from './helpers';
 export * from './provider';
 export * from './evaluator';
+export * from './realm-scope';
 export * from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC"}

package/dist/permission/provider/memory.d.ts

@@ -1,9 +1,9 @@
-import type { PermissionPolicyBinding } from '../types';
+import type { PermissionPolicyBinding, PermissionPolicyBindingAggregated } from '../types';
 import type { IPermissionProvider, PermissionGetOptions } from './types';
 export declare class PermissionMemoryProvider implements IPermissionProvider {
-    protected items: Record<string, PermissionPolicyBinding>;
+    protected items: Record<string, PermissionPolicyBindingAggregated>;
     constructor(items?: PermissionPolicyBinding[]);
-    findOne(options: PermissionGetOptions): Promise<PermissionPolicyBinding | null>;
+    findOne(options: PermissionGetOptions): Promise<PermissionPolicyBindingAggregated | null>;
     setMany(input: PermissionPolicyBinding[]): void;
 }
 //# sourceMappingURL=memory.d.ts.map

package/dist/permission/provider/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/permission/provider/memory.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEzE,qBAAa,wBAAyB,YAAW,mBAAmB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAM;gBAEnD,KAAK,GAAE,uBAAuB,EAAO;IAI3C,OAAO,CACT,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAe1C,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE;CAQ3C"}
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/permission/provider/memory.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEzE,qBAAa,wBAAyB,YAAW,mBAAmB;IAChE,SAAS,CAAC,KAAK,EAAG,MAAM,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAM;gBAE7D,KAAK,GAAE,uBAAuB,EAAO;IAI3C,OAAO,CACT,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAepD,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE;CAQ3C"}

package/dist/permission/provider/types.d.ts

@@ -1,10 +1,10 @@
-import type { PermissionPolicyBinding } from '../types';
+import type { PermissionPolicyBindingAggregated } from '../types';
 export type PermissionGetOptions = {
     name: string;
     clientId?: string | null;
     realmId?: string | null;
 };
 export interface IPermissionProvider {
-    findOne(criteria: PermissionGetOptions): Promise<PermissionPolicyBinding | null>;
+    findOne(criteria: PermissionGetOptions): Promise<PermissionPolicyBindingAggregated | null>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/permission/provider/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,MAAM,oBAAoB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CACrF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/provider/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,UAAU,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAChC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;CAC/F"}

package/dist/permission/realm-scope/constants.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Actor-relative realm reach of a permission grant.
+ *
+ * Total order (least -> most permissive): none < own < ownOrNull < any.
+ * A missing/unknown column coerces to `own` (fail-closed); `none` is only ever an
+ * explicit value (the grant reaches no realm at all).
+ */
+export declare enum RealmScope {
+    /** No reach — the grant matches no resource realm. */
+    NONE = "none",
+    /** Own realm only — resource realm must equal the actor's realm. */
+    OWN = "own",
+    /** Own realm or null/global resources (realm_id === null). */
+    OWN_OR_NULL = "ownOrNull",
+    /** Any realm, including null/global. */
+    ANY = "any"
+}
+/** Numeric restrictiveness order — internal to the fold/compare helpers. */
+export declare const REALM_SCOPE_ORDER: Record<`${RealmScope}`, number>;
+//# sourceMappingURL=constants.d.ts.map

package/dist/permission/realm-scope/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/constants.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,oBAAY,UAAU;IAClB,sDAAsD;IACtD,IAAI,SAAS;IACb,oEAAoE;IACpE,GAAG,QAAQ;IACX,8DAA8D;IAC9D,WAAW,cAAc;IACzB,wCAAwC;IACxC,GAAG,QAAQ;CACd;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,EAAE,MAAM,CAK7D,CAAC"}

package/dist/permission/realm-scope/helpers.d.ts

@@ -0,0 +1,23 @@
+import { RealmScope } from './constants';
+/**
+ * Coerce an arbitrary value to a RealmScope, defaulting to `own` for missing /
+ * null / unknown input (fail-closed). `none` is honoured only when explicit.
+ */
+export declare function normalizeRealmScope(value?: `${RealmScope}` | null): `${RealmScope}`;
+/**
+ * Numeric comparison of two realm scopes by restrictiveness.
+ * Negative when `a` is more restrictive than `b`, positive when less.
+ */
+export declare function compareRealmScope(a?: `${RealmScope}` | null, b?: `${RealmScope}` | null): number;
+/** Fold scopes to the MOST permissive (ordered max). Empty folds to `own`. */
+export declare function maxRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
+/** Fold scopes to the MORE restrictive (ordered min) — used to CAP a grant. Empty folds to `own`. */
+export declare function minRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
+/**
+ * Whether `scope` reaches the resource. The resource realm may be presented as a single
+ * id, `null` (global), or an array of realm ids — the array form (a resource that spans
+ * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
+ * so any app/entity can express its realm via one or many keys under the canonical contract.
+ */
+export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/permission/realm-scope/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,GAAG,UAAU,EAAE,CAMnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAC1B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAC3B,MAAM,CAER;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAYhG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAWhG;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EACzC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACrD,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAyBT"}

package/dist/permission/realm-scope/index.d.ts

@@ -0,0 +1,3 @@
+export * from './constants';
+export * from './helpers';
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/realm-scope/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/dist/permission/types.d.ts

@@ -1,13 +1,50 @@
 import type { BasePolicy } from '../policy';
 import type { DecisionStrategy } from '@authup/kit';
+import type { RealmScope } from './realm-scope';
 export type BasePermission = {
     name: string;
     client_id?: string | null;
     realm_id?: string | null;
     decision_strategy?: `${DecisionStrategy}` | null;
 };
+/**
+ * A raw permission grant: one permission with its policies and realm reach, as loaded from a
+ * role/identity junction. `aggregatePermissionPolicyBindings` groups these per permission into
+ * a `PermissionPolicyBindingAggregated` (the lossless disjunction of grants).
+ */
 export type PermissionPolicyBinding = {
     permission: BasePermission;
     policies?: BasePolicy[];
+    /**
+     * Relative realm reach of this grant (none/own/ownOrNull/any). Absent coerces to the
+     * most restrictive `own` (fail-closed). NOT part of the binding identity key
+     * (see isPermissionPolicyBindingEqual).
+     */
+    realm_scope?: `${RealmScope}`;
+};
+/**
+ * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
+ * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realm_scope) ∧ policy`
+ * across the grants of a permission.
+ */
+export type PermissionGrant = {
+    /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
+    realm_scope: `${RealmScope}`;
+    /**
+     * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
+     * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
+     * when the grant carries no restriction.
+     */
+    policy?: BasePolicy;
+};
+/**
+ * A permission together with the actor's disjunction of grants for it. Output of
+ * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
+ * `PermissionPolicyBinding` (no top-level realm_scope/policies; the access decision is the
+ * OR over `grants`).
+ */
+export type PermissionPolicyBindingAggregated = {
+    permission: BasePermission;
+    grants: PermissionGrant[];
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAA;CACnD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CAC3B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAA;CACnD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,6FAA6F;IAC7F,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,cAAc,CAAC;IAC3B,MAAM,EAAE,eAAe,EAAE,CAAC;CAC7B,CAAC"}

package/dist/policy/built-in/constants.d.ts

@@ -37,8 +37,6 @@ export declare const SystemPolicyName: {
     readonly IDENTITY: "system.identity";
     readonly PERMISSION_BINDING: "system.permission-binding";
     readonly REALM_MATCH: "system.realm-match";
-    readonly REALM_BOUND: "system.realm-bound";
-    readonly REALM_OR_GLOBAL: "system.realm-or-global";
     readonly CLIENT_NAMES_SELF_MANAGE: "system.client-names-self-manage";
     readonly ROBOT_NAMES_SELF_MANAGE: "system.robot-names-self-manage";
     readonly USER_NAMES_SELF_MANAGE: "system.user-names-self-manage";

package/dist/policy/built-in/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB;;OAEG;IACH,SAAS,cAAc;IACvB;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,eAAe,mBAAmB;IAClC;;OAEG;IACH,UAAU,eAAe;IACzB;;OAEG;IACH,WAAW,eAAe;IAE1B;;OAEG;IACH,QAAQ,aAAa;IAErB;;OAEG;IACH,kBAAkB,sBAAsB;CAI3C;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;CAUnB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB;;OAEG;IACH,SAAS,cAAc;IACvB;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,eAAe,mBAAmB;IAClC;;OAEG;IACH,UAAU,eAAe;IACzB;;OAEG;IACH,WAAW,eAAe;IAE1B;;OAEG;IACH,QAAQ,aAAa;IAErB;;OAEG;IACH,kBAAkB,sBAAsB;CAI3C;AAED,eAAO,MAAM,gBAAgB;;;;;;;;CAQnB,CAAC"}

package/dist/policy/built-in/realm-match/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAA0B,YAAW,gBAAgB;IAC9D,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC;IAEhD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAQpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA6I5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/evaluator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAA0B,YAAW,gBAAgB;IAC9D,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC;IAEhD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAQpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2J5G"}

package/dist/policy/built-in/realm-match/types.d.ts

@@ -1,4 +1,5 @@
 import type { DecisionStrategy } from '@authup/kit';
+import type { RealmScope } from '../../../permission/realm-scope';
 import type { BasePolicy } from '../../types';
 export interface RealmMatchPolicy extends BasePolicy {
     /**
@@ -20,9 +21,11 @@ export interface RealmMatchPolicy extends BasePolicy {
      */
     attribute_null_match_all?: boolean;
     /**
-     * Specifies whether the master realm of an identity should match all realm-id/name attributes, including null.
-     * If true, the master realm can access any resource regardless of its realm value.
+     * Coarse, actor-relative realm reach (none/own/ownOrNull/any). When set, the evaluator
+     * runs in SCOPE MODE: it matches the resource realm read from the REALM_MATCH data key
+     * against the identity realm via `realmScopeMatches`, and ignores `attribute_name` /
+     * `attribute_null_match_all`. With no REALM_MATCH key present it neutral-passes.
      */
-    identity_master_match_all?: boolean;
+    scope?: `${RealmScope}`;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/built-in/realm-match/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE1C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEnC;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACtC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE1C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEnC;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,CAAA;CAC1B"}

package/dist/policy/built-in/realm-match/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,qBAAa,yBAA0B,SAAQ,SAAS,CAAC,gBAAgB,CAAC;IAC7D,UAAU;CA+DtB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,qBAAa,yBAA0B,SAAQ,SAAS,CAAC,gBAAgB,CAAC;IAC7D,UAAU;CA+DtB"}

package/dist/policy/index.d.ts

@@ -7,4 +7,5 @@ export * from './built-in';
 export * from './types';
 export * from './constants.ts';
 export * from './data.ts';
+export * from './input.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AAExB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AAExB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/policy/input.d.ts

@@ -0,0 +1,26 @@
+import type { BuiltInPolicyType } from './built-in/constants';
+import type { IdentityPolicyData } from './built-in/identity/types';
+import { PolicyData } from './data';
+/**
+ * Typed seed for a permission evaluation's {@link PolicyData} bag.
+ *
+ * The well-known context keys are value-typed, so construction is discoverable and a
+ * wrong-typed value is a compile error. The trailing index signature keeps the bag **open** —
+ * a third-party evaluator may supply its own key without any change to this published type
+ * (the `access` evaluator set is deliberately extensible).
+ */
+export interface PolicyInput {
+    [BuiltInPolicyType.IDENTITY]?: IdentityPolicyData;
+    [BuiltInPolicyType.ATTRIBUTES]?: Record<string, any>;
+    [BuiltInPolicyType.REALM_MATCH]?: string | string[] | null;
+    [key: string]: any;
+}
+/**
+ * Build a {@link PolicyData} bag from a typed {@link PolicyInput} seed. Well-known keys
+ * (identity / attributes / realmMatch) are type-checked; unknown keys are accepted as-is.
+ *
+ * Prefer this over `new PolicyData({ ... })` at construction sites so the key vocabulary and
+ * per-key value types live in one place.
+ */
+export declare function definePolicyData(input?: PolicyInput): PolicyData;
+//# sourceMappingURL=input.d.ts.map

package/dist/policy/input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/policy/input.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IACxB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAClD,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3D,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,WAAgB,GAAG,UAAU,CAEpE"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.49",
+    "version": "1.0.0-beta.51",
     "description": "A library for evaluating permissions and policies.",
     "license": "Apache-2.0",
     "exports": {
@@ -24,7 +24,7 @@
         "test:coverage": "cross-env NODE_ENV=test vitest run --coverage"
     },
     "engines": {
-        "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0"
+        "node": "^22.13.0 || ^23.5.0 || >=24.0.0"
     },
     "keywords": [
         "auth",
@@ -53,22 +53,18 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
+        "@authup/errors": "^1.0.0-beta.51",
+        "@authup/kit": "^1.0.0-beta.51",
         "@ucast/mongo2js": "^2.0.0",
-        "pathtrace": "^2.2.0",
+        "@validup/zod": "^0.3.3",
+        "smob": "^1.6.1",
         "validup": "^0.5.1",
-        "zod": "^4.4.3",
-        "@validup/zod": "^0.3.3"
+        "zod": "^4.4.3"
     },
     "devDependencies": {
-        "@authup/errors": "^1.0.0-beta.49",
-        "@authup/kit": "^1.0.0-beta.49",
         "unplugin-swc": "^1.5.9",
         "vitest": "^4.0.14"
     },
-    "peerDependencies": {
-        "@authup/errors": "^1.0.0-beta.49",
-        "@authup/kit": "^1.0.0-beta.49"
-    },
     "publishConfig": {
         "access": "public"
     }

package/dist/permission/helpers/merge.d.ts

@@ -1,3 +0,0 @@
-import type { PermissionPolicyBinding } from '../types';
-export declare function mergePermissionPolicyBindings(input: PermissionPolicyBinding[]): PermissionPolicyBinding[];
-//# sourceMappingURL=merge.d.ts.map

package/dist/permission/helpers/merge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../src/permission/helpers/merge.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAQxD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,uBAAuB,EAAE,GAAI,uBAAuB,EAAE,CAiE1G"}