@authup/access 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/permission/evaluator/module.d.ts

@@ -1,7 +1,7 @@
 import type { IPolicyEngine } from '../../policy';
 import type { IPermissionProvider } from '../provider';
 import type { PermissionPolicyBindingAggregated } from '../types.ts';
-import type { IPermissionEvaluator, PermissionEvaluationContext, PermissionEvaluatorOptions } from './types.ts';
+import type { IPermissionEvaluator, PermissionCompileContext, PermissionCompileResult, PermissionEvaluationContext, PermissionEvaluatorOptions } from './types.ts';
 export declare class PermissionEvaluator implements IPermissionEvaluator {
     protected provider: IPermissionProvider;
     protected policyEngine: IPolicyEngine;
@@ -16,5 +16,16 @@ export declare class PermissionEvaluator implements IPermissionEvaluator {
     evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+    /**
+     * Compile the permission's policy trees against the knowns bag into a
+     * {@link PermissionCompileResult} — the query-build counterpart of
+     * {@link evaluate} (issue #3286 phase 3). Runs the SAME evaluation walk with
+     * `withConditions` enabled: policies that settle with the knowns settle here,
+     * pending subtrees contribute their exact condition form. Multiple names are
+     * a disjunction (any-of), so a single non-expressible name degrades the whole
+     * compilation to `post` — pushing only some disjuncts would wrongly exclude
+     * rows another name would admit.
+     */
+    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/permission/evaluator/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAEhH,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAmH1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAc7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;CAS3E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IA2H1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAe7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAYxE;;;;;;;;;OASG;IACG,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAyElF"}

package/dist/permission/evaluator/types.d.ts

@@ -1,3 +1,4 @@
+import type { ICondition } from '@rapiq/core';
 import type { DecisionStrategy } from '@authup/kit';
 import type { IPolicyEngine, PolicyData } from '../../policy';
 import type { IPermissionProvider } from '../provider';
@@ -6,6 +7,7 @@ export interface IPermissionEvaluator {
     evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
     preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
+    compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 export type PermissionEvaluatorOptions = {
     provider: IPermissionProvider;
@@ -17,6 +19,16 @@ export type PermissionEvaluationOptions = {
     decisionStrategy?: `${DecisionStrategy}`;
     policiesIncluded?: string[];
     policiesExcluded?: string[];
+    /**
+     * How a grant whose policy evaluation is PENDING (a required data key is absent —
+     * see `PolicyEvaluationResult.pending`) is treated:
+     *
+     * - `deny` (default): pending counts as failure — full `evaluate()` semantics,
+     *   matching the historical missing-data deny.
+     * - `permit`: pending counts as pass — the data-availability-derived pre-gate
+     *   (`preEvaluate()`): only a tree that settles false with the current bag denies.
+     */
+    pendingPolicies?: 'deny' | 'permit';
 };
 export type PermissionEvaluationContext = {
     name: string | string[];
@@ -25,4 +37,40 @@ export type PermissionEvaluationContext = {
     data?: PolicyData;
     options?: PermissionEvaluationOptions;
 };
+export type PermissionCompileContext = {
+    /**
+     * Permission name(s). Several names compile as a disjunction — the row is
+     * readable when ANY of them passes (`evaluateOneOf` semantics).
+     */
+    name: string | string[];
+    realmId?: string | null;
+    clientId?: string | null;
+    /**
+     * The knowns bag (typically the actor identity). Row-dependent keys
+     * (`attributes`, `realmMatch`) are deliberately absent — they are what the
+     * compiled condition ranges over.
+     */
+    data?: PolicyData;
+};
+/**
+ * Outcome of compiling a permission's policy trees against the knowns bag
+ * (issue #3286 phase 3) — the query-build counterpart of `evaluate()`:
+ *
+ * - `allow` — settled true for every row; no restriction needed.
+ * - `deny` — settled false for every row; no row can pass.
+ * - `conditional` — the EXACT residual as a rapiq condition over row attributes:
+ *   push it into the row query (WHERE) and skip per-row post-evaluation.
+ * - `post` — some pending policy is not expressible as a condition; fall back to
+ *   loading rows and evaluating per row (always sound).
+ */
+export type PermissionCompileResult = {
+    verdict: 'allow';
+} | {
+    verdict: 'deny';
+} | {
+    verdict: 'conditional';
+    condition: ICondition;
+} | {
+    verdict: 'post';
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/permission/evaluator/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/permission/helpers/aggregate.d.ts

@@ -1,7 +1,7 @@
 import type { PermissionPolicyBinding, PermissionPolicyBindingAggregated } from '../types';
 /**
  * Group raw permission-policy bindings by permission key into the actor's disjunction of
- * `(realm_scope, policy)` grants per permission — with NO lossy collapse. Every consumer
+ * `(realmScope, policy)` grants per permission — with NO lossy collapse. Every consumer
  * (the binding evaluator, isSuperset, junction propagation, the memory provider) evaluates the
  * grant disjunction directly, so each grant's realm reach stays paired with the policy that
  * gates it.

package/dist/permission/realm-scope/constants.d.ts

@@ -10,7 +10,7 @@ export declare enum RealmScope {
     NONE = "none",
     /** Own realm only — resource realm must equal the actor's realm. */
     OWN = "own",
-    /** Own realm or null/global resources (realm_id === null). */
+    /** Own realm or null/global resources (realmId === null). */
     OWN_OR_NULL = "ownOrNull",
     /** Any realm, including null/global. */
     ANY = "any"

package/dist/permission/realm-scope/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/constants.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,oBAAY,UAAU;IAClB,sDAAsD;IACtD,IAAI,SAAS;IACb,oEAAoE;IACpE,GAAG,QAAQ;IACX,8DAA8D;IAC9D,WAAW,cAAc;IACzB,wCAAwC;IACxC,GAAG,QAAQ;CACd;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,EAAE,MAAM,CAK7D,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/constants.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,oBAAY,UAAU;IAClB,sDAAsD;IACtD,IAAI,SAAS;IACb,oEAAoE;IACpE,GAAG,QAAQ;IACX,6DAA6D;IAC7D,WAAW,cAAc;IACzB,wCAAwC;IACxC,GAAG,QAAQ;CACd;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,GAAG,UAAU,EAAE,EAAE,MAAM,CAK7D,CAAC"}

package/dist/permission/types.d.ts

@@ -3,9 +3,9 @@ import type { DecisionStrategy } from '@authup/kit';
 import type { RealmScope } from './realm-scope';
 export type BasePermission = {
     name: string;
-    client_id?: string | null;
-    realm_id?: string | null;
-    decision_strategy?: `${DecisionStrategy}` | null;
+    clientId?: string | null;
+    realmId?: string | null;
+    decisionStrategy?: `${DecisionStrategy}` | null;
 };
 /**
  * A raw permission grant: one permission with its policies and realm reach, as loaded from a
@@ -20,16 +20,16 @@ export type PermissionPolicyBinding = {
      * most restrictive `own` (fail-closed). NOT part of the binding identity key
      * (see isPermissionPolicyBindingEqual).
      */
-    realm_scope?: `${RealmScope}`;
+    realmScope?: `${RealmScope}`;
 };
 /**
  * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
- * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realm_scope) ∧ policy`
+ * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
  * across the grants of a permission.
  */
 export type PermissionGrant = {
     /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
-    realm_scope: `${RealmScope}`;
+    realmScope: `${RealmScope}`;
     /**
      * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
      * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
@@ -40,7 +40,7 @@ export type PermissionGrant = {
 /**
  * A permission together with the actor's disjunction of grants for it. Output of
  * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
- * `PermissionPolicyBinding` (no top-level realm_scope/policies; the access decision is the
+ * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
  * OR over `grants`).
  */
 export type PermissionPolicyBindingAggregated = {

package/dist/permission/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAA;CACnD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,6FAA6F;IAC7F,WAAW,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,cAAc,CAAC;IAC3B,MAAM,EAAE,eAAe,EAAE,CAAC;CAC7B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permission/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,MAAM,cAAc,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAA;CAClD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC1B,6FAA6F;IAC7F,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC5C,UAAU,EAAE,cAAc,CAAC;IAC3B,MAAM,EAAE,eAAe,EAAE,CAAC;CAC7B,CAAC"}

package/dist/policy/built-in/attribute-names/evaluator.d.ts

@@ -5,6 +5,7 @@ export declare class AttributeNamesPolicyEvaluator implements IPolicyEvaluator {
     protected validator: AttributeNamesPolicyValidator;
     protected attributesEvaluator: AttributesPolicyEvaluator;
     constructor();
+    requires(): string[];
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/policy/built-in/attribute-names/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attribute-names/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,qBAAa,6BAA8B,YAAW,gBAAgB;IAClE,SAAS,CAAC,SAAS,EAAG,6BAA6B,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAOpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAuD5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attribute-names/evaluator.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAG1D,qBAAa,6BAA8B,YAAW,gBAAgB;IAClE,SAAS,CAAC,SAAS,EAAG,6BAA6B,CAAC;IAEpD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAO1D,QAAQ,IAAK,MAAM,EAAE;IAIf,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAuD5G"}

package/dist/policy/built-in/attributes/evaluator.d.ts

@@ -1,8 +1,13 @@
+import type { ICondition } from '@rapiq/core';
+import { MongoFiltersParser } from '@rapiq/parser-mongo';
 import type { IPolicyEvaluator, PolicyEvaluationContext, PolicyEvaluationResult } from '../../evaluation';
 import { AttributesPolicyValidator } from './validator';
 export declare class AttributesPolicyEvaluator<T extends Record<string, any> = Record<string, any>> implements IPolicyEvaluator {
     protected validator: AttributesPolicyValidator<T>;
+    protected parser: MongoFiltersParser;
     constructor();
+    requires(): string[];
+    toCondition(value: Record<string, any>): Promise<ICondition | null>;
     accessData(ctx: PolicyEvaluationContext): Promise<T | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
     protected fixQuery(query: unknown | unknown[]): void;

package/dist/policy/built-in/attributes/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attributes/evaluator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAAyB,CAClC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CACrD,YAAW,gBAAgB;IACzB,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;;IAM7C,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAyBzG,SAAS,CAAC,QAAQ,CACd,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE;CAgCjC"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attributes/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAAyB,CAClC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CACrD,YAAW,gBAAgB;IACzB,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAEnD,SAAS,CAAC,MAAM,EAAG,kBAAkB,CAAC;;IAOtC,QAAQ,IAAK,MAAM,EAAE;IAIf,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiBpE,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAkB5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6CzG,SAAS,CAAC,QAAQ,CACd,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE;CAgCjC"}

package/dist/policy/built-in/attributes/types.d.ts

@@ -1,6 +1,6 @@
-import type { MongoQuery } from '@ucast/mongo2js';
+import type { MongoFiltersParserInput } from '@rapiq/parser-mongo';
 import type { BasePolicy } from '../../types';
-export type AttributesPolicyQuery<T> = MongoQuery<T>;
+export type AttributesPolicyQuery<T extends Record<string, any> = Record<string, any>> = MongoFiltersParserInput<T>;
 export interface AttributesPolicy<T extends Record<string, any> = Record<string, any>> extends BasePolicy {
     query: AttributesPolicyQuery<T>;
 }

package/dist/policy/built-in/attributes/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attributes/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAErD,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CACrD,SAAQ,UAAU;IAChB,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/attributes/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IACnD,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAE/B,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CACrD,SAAQ,UAAU;IAChB,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAA;CAClC"}

package/dist/policy/built-in/composite/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/composite/evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,qBAAa,wBAAyB,YAAW,gBAAgB;IAC7D,SAAS,CAAC,SAAS,EAAG,wBAAwB,CAAC;;IAMzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA8E5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/composite/evaluator.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,qBAAa,wBAAyB,YAAW,gBAAgB;IAC7D,SAAS,CAAC,SAAS,EAAG,wBAAwB,CAAC;;IAMzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAgM5G"}

package/dist/policy/built-in/composite/types.d.ts

@@ -4,7 +4,7 @@ export interface CompositePolicy extends BasePolicy {
     /**
      * How to decide if a policy evaluates to true.
      */
-    decision_strategy?: `${DecisionStrategy}`;
+    decisionStrategy?: `${DecisionStrategy}`;
     /**
      * Child policies.
      */

package/dist/policy/built-in/composite/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/composite/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,eAAgB,SAAQ,UAAU;IAC/C;;OAEG;IACH,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAC1C;;OAEG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/composite/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,eAAgB,SAAQ,UAAU;IAC/C;;OAEG;IACH,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC;;OAEG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;CAC1B"}

package/dist/policy/built-in/constants.d.ts

@@ -38,7 +38,6 @@ export declare const SystemPolicyName: {
     readonly PERMISSION_BINDING: "system.permission-binding";
     readonly REALM_MATCH: "system.realm-match";
     readonly CLIENT_NAMES_SELF_MANAGE: "system.client-names-self-manage";
-    readonly ROBOT_NAMES_SELF_MANAGE: "system.robot-names-self-manage";
     readonly USER_NAMES_SELF_MANAGE: "system.user-names-self-manage";
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/policy/built-in/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB;;OAEG;IACH,SAAS,cAAc;IACvB;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,eAAe,mBAAmB;IAClC;;OAEG;IACH,UAAU,eAAe;IACzB;;OAEG;IACH,WAAW,eAAe;IAE1B;;OAEG;IACH,QAAQ,aAAa;IAErB;;OAEG;IACH,kBAAkB,sBAAsB;CAI3C;AAED,eAAO,MAAM,gBAAgB;;;;;;;;CAQnB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/constants.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IACzB;;OAEG;IACH,SAAS,cAAc;IACvB;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,IAAI,SAAS;IACb;;OAEG;IACH,eAAe,mBAAmB;IAClC;;OAEG;IACH,UAAU,eAAe;IACzB;;OAEG;IACH,WAAW,eAAe;IAE1B;;OAEG;IACH,QAAQ,aAAa;IAErB;;OAEG;IACH,kBAAkB,sBAAsB;CAI3C;AAED,eAAO,MAAM,gBAAgB;;;;;;;CAOnB,CAAC"}

package/dist/policy/built-in/identity/evaluator.d.ts

@@ -6,6 +6,7 @@ export declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
     protected validator: IdentityPolicyValidator;
     protected dataValidator: PolicyIdentityDataValidator;
     constructor();
+    requires(): string[];
     accessData(ctx: PolicyEvaluationContext): Promise<IdentityPolicyData | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }

package/dist/policy/built-in/identity/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/identity/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,qBAAa,uBAAwB,YAAW,gBAAgB;IAC5D,SAAS,CAAC,SAAS,EAAG,uBAAuB,CAAC;IAE9C,SAAS,CAAC,aAAa,EAAG,2BAA2B,CAAC;;IAOhD,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAiB7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA0C5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/identity/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,qBAAa,uBAAwB,YAAW,gBAAgB;IAC5D,SAAS,CAAC,SAAS,EAAG,uBAAuB,CAAC;IAE9C,SAAS,CAAC,aAAa,EAAG,2BAA2B,CAAC;;IAOtD,QAAQ,IAAK,MAAM,EAAE;IAIf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAiB7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA0C5G"}

package/dist/policy/built-in/identity/types.d.ts

@@ -7,7 +7,7 @@ export interface IdentityPolicy extends BasePolicy {
 }
 export type IdentityPolicyData = {
     /**
-     * user, client, robot
+     * user, client
      */
     type: string;
     /**

package/dist/policy/built-in/permission-binding/module.d.ts

@@ -3,6 +3,7 @@ import { PermissionBindingPolicyValidator } from './validator';
 export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
     protected validator: PermissionBindingPolicyValidator;
     constructor();
+    requires(): string[];
     evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
 }
 //# sourceMappingURL=module.d.ts.map

package/dist/policy/built-in/permission-binding/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAEjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;;IAMhD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAM9E"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAGjF,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,qBAAa,gCAAiC,YAAW,gBAAgB;IACrE,SAAS,CAAC,SAAS,EAAE,gCAAgC,CAAC;;IAMtD,QAAQ,IAAK,MAAM,EAAE;IAMf,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAM9E"}

package/dist/policy/built-in/realm-match/evaluator.d.ts

@@ -1,3 +1,4 @@
+import type { ICondition } from '@rapiq/core';
 import type { IPolicyEvaluator, PolicyEvaluationContext, PolicyEvaluationResult } from '../../evaluation';
 import { AttributesPolicyEvaluator } from '../attributes';
 import { IdentityPolicyEvaluator } from '../identity';
@@ -7,6 +8,19 @@ export declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
     protected identityEvaluator: IdentityPolicyEvaluator;
     protected attributesEvaluator: AttributesPolicyEvaluator;
     constructor();
+    requires(value: Record<string, any>): string[];
+    /**
+     * Condition form over the row's realm column, with the actor realm baked in
+     * (mirrors `realmScopeMatches` / the attribute-mode match). Exactness holds for
+     * row-shaped data where the referenced field exists (DB rows) — the object-bag
+     * "key absent → neutral-pass" case has no SQL counterpart. Lowerable configs:
+     * scope mode (field = single-string `attributeName`, default `realmId` — scope-mode
+     * EVALUATION ignores `attributeName`, lowering reuses it as the column override),
+     * and strict attribute mode with a single explicit `attributeName`. Everything
+     * else (multi-key / default-key CONSENSUS, non-strict key expansion) is
+     * row-shape-dependent and stays a post-check.
+     */
+    toCondition(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<ICondition | null>;
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/policy/built-in/realm-match/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/evaluator.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAA0B,YAAW,gBAAgB;IAC9D,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC;IAEhD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAQpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA2J5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAU9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qBAAa,yBAA0B,YAAW,gBAAgB;IAC9D,SAAS,CAAC,SAAS,EAAG,yBAAyB,CAAC;IAEhD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAQ1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAI,MAAM,EAAE;IAW/C;;;;;;;;;;OAUG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAuFlG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAuK5G"}

package/dist/policy/built-in/realm-match/types.d.ts

@@ -5,26 +5,26 @@ export interface RealmMatchPolicy extends BasePolicy {
     /**
      * Determines how realm-id/name matches are handled.
      */
-    decision_strategy?: `${DecisionStrategy}`;
+    decisionStrategy?: `${DecisionStrategy}`;
     /**
      * Specifies the name(s) of the realm-id/name attribute(s) used for matching.
      * Can be a single attribute name or an array of attribute names.
      */
-    attribute_name?: string | string[];
+    attributeName?: string | string[];
     /**
      * Only match if the attribute is strict equal to the name.
      */
-    attribute_name_strict?: boolean;
+    attributeNameStrict?: boolean;
     /**
      * Determines if resources with null realm-id/name value should match all identity realms.
      * If true, any identity realm can access resources with null realm-id/name values.
      */
-    attribute_null_match_all?: boolean;
+    attributeNullMatchAll?: boolean;
     /**
      * Coarse, actor-relative realm reach (none/own/ownOrNull/any). When set, the evaluator
      * runs in SCOPE MODE: it matches the resource realm read from the REALM_MATCH data key
-     * against the identity realm via `realmScopeMatches`, and ignores `attribute_name` /
-     * `attribute_null_match_all`. With no REALM_MATCH key present it neutral-passes.
+     * against the identity realm via `realmScopeMatches`, and ignores `attributeName` /
+     * `attributeNullMatchAll`. With no REALM_MATCH key present it neutral-passes.
      */
     scope?: `${RealmScope}`;
 }

package/dist/policy/built-in/realm-match/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAChD;;OAEG;IACH,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE1C;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEnC;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/realm-match/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAChD;;OAEG;IACH,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAEzC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAElC;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,CAAA;CAC1B"}

package/dist/policy/built-in/time/types.d.ts

@@ -16,14 +16,14 @@ export interface TimePolicy extends BasePolicy {
     /**
      *  0 (Sunday) - 6 (Saturday)
      */
-    day_of_week?: number;
+    dayOfWeek?: number;
     /**
      * 1 - 31
      */
-    day_of_month?: number;
+    dayOfMonth?: number;
     /**
      * 1 - 365
      */
-    day_of_year?: number;
+    dayOfYear?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/built-in/time/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC1C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAE/B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC1C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAE/B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/policy/built-in/types.d.ts

@@ -5,6 +5,7 @@ import type { DatePolicy } from './date';
 import type { CompositePolicy } from './composite';
 import type { IdentityPolicy } from './identity';
 import type { PermissionBindingPolicy } from './permission-binding';
+import type { RealmMatchPolicy } from './realm-match';
 import type { TimePolicy } from './time';
 type BuiltInPolicyTypeMapRaw<T extends Record<string, any> = Record<string, any>> = {
     [BuiltInPolicyType.ATTRIBUTES]: AttributesPolicy<T>;
@@ -14,6 +15,7 @@ type BuiltInPolicyTypeMapRaw<T extends Record<string, any> = Record<string, any>
     [BuiltInPolicyType.TIME]: TimePolicy;
     [BuiltInPolicyType.IDENTITY]: IdentityPolicy;
     [BuiltInPolicyType.PERMISSION_BINDING]: PermissionBindingPolicy;
+    [BuiltInPolicyType.REALM_MATCH]: RealmMatchPolicy;
 };
 export type BuiltInPolicyTypeMap<T extends Record<string, any> = Record<string, any>> = {
     [K in keyof BuiltInPolicyTypeMapRaw<T> as `${K}`]: BuiltInPolicyTypeMapRaw<T>[K];

package/dist/policy/built-in/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;IAChF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAC1D,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IACrC,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC/C,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IACrC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC7C,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAA;CAClE,CAAC;AAEF,MAAM,MAAM,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KACnF,CAAC,IAAI,MAAM,uBAAuB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnF,CAAC;AAEF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KAC9E,CAAC,IAAI,MAAM,oBAAoB,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/D,IAAI,EAAE,CAAC,CAAA;KACV;CACJ,CAAC,MAAM,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/built-in/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;IAChF,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAC1D,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IACrC,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IAC/C,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IACrC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC7C,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAChE,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CACpD,CAAC;AAEF,MAAM,MAAM,oBAAoB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KACnF,CAAC,IAAI,MAAM,uBAAuB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnF,CAAC;AAEF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KAC9E,CAAC,IAAI,MAAM,oBAAoB,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/D,IAAI,EAAE,CAAC,CAAA;KACV;CACJ,CAAC,MAAM,oBAAoB,CAAC,CAAC"}

package/dist/policy/engine/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/policy/engine/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiB9C;;;GAGG;AACH,qBAAa,YAAa,YAAW,aAAa;IAC9C,SAAS,CAAC,UAAU,EAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAE5C,UAAU,GAAE,gBAAqB;IAItC,iBAAiB,CACpB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,gBAAgB,GAC3B,IAAI;IAID,kBAAkB,CAAC,UAAU,EAAE,gBAAgB;IAOtD;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,sBAAsB,CAAC;IA2E5F,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,IAAI,CAAC;CAgCzF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/policy/engine/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiB9C;;;GAGG;AACH,qBAAa,YAAa,YAAW,aAAa;IAC9C,SAAS,CAAC,UAAU,EAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;gBAE5C,UAAU,GAAE,gBAAqB;IAItC,iBAAiB,CACpB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,gBAAgB,GAC3B,IAAI;IAID,kBAAkB,CAAC,UAAU,EAAE,gBAAgB;IAOtD;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,sBAAsB,CAAC;IAoH5F,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,IAAI,CAAC;CAgCzF"}

package/dist/policy/evaluation/context/define.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAQ1B"}
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAS1B"}

package/dist/policy/evaluation/context/types.d.ts

@@ -6,6 +6,13 @@ export type PolicyEvaluationContext = {
     readonly exclude: string[];
     readonly include: string[];
     readonly data: PolicyData;
+    /**
+     * Attach the condition form (`PolicyEvaluationResult.condition`) to pending
+     * subtrees via `IPolicyEvaluator.toCondition`. Off by default — evaluation-only
+     * callers (evaluate / preEvaluate hot paths) must not pay the lowering cost;
+     * query-build callers opt in.
+     */
+    readonly withConditions: boolean;
 };
 export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/evaluation/context/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAC5B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACnC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/policy/evaluation/types.d.ts

@@ -1,11 +1,53 @@
+import type { ICondition } from '@rapiq/core';
 import type { Issue } from 'validup';
 import type { PolicyEvaluationContext } from './context';
 export type PolicyEvaluators = Record<string, IPolicyEvaluator>;
 export type PolicyEvaluationResult = {
     success: boolean;
+    /**
+     * The policy could not be settled yet — a data key it requires is absent from the
+     * evaluation bag (see {@link IPolicyEvaluator.requires}). Pending always rides on
+     * `success: false` (fail-closed: a consumer that ignores the flag behaves like a
+     * deny); only pre-gate style consumers treat pending as a pass.
+     *
+     * Unknown stays unknown: `invert` is never applied to a pending result.
+     */
+    pending?: boolean;
+    /**
+     * EXACT condition form of the pending subtree (see
+     * {@link IPolicyEvaluator.toCondition}): a row satisfies the condition iff the
+     * pending subtree settles true on that row's attributes, given the current bag.
+     * Attached only on pending results, only when the evaluation context requested it
+     * (`withConditions`), and only when the ENTIRE pending subtree is expressible —
+     * a partially expressible tree carries no condition (fail-safe: the consumer
+     * falls back to a per-row post-check).
+     */
+    condition?: ICondition;
     issues?: Issue[];
 };
 export interface IPolicyEvaluator {
+    /**
+     * PolicyData keys this policy needs before it can settle (e.g. `identity`,
+     * `attributes`). When any returned key is absent from the evaluation bag, the
+     * engine returns a pending result instead of invoking {@link evaluate}.
+     *
+     * Receives the raw (unvalidated) policy configuration, since data needs may be
+     * config-dependent (e.g. realm-match scope vs. attribute mode). Omit the method
+     * (or return an empty array) for policies evaluable with ambient data only.
+     */
+    requires?(value: Record<string, any>): string[];
+    /**
+     * Express the policy as a condition over row attributes (rapiq `ICondition`)
+     * instead of waiting for the row — the WHERE-pushdown capability. The result is
+     * a partial evaluation against the knowns in `context.data` (e.g. the actor's
+     * realm is baked into a realm-match condition), and must be EXACT: for every
+     * row, `condition(row)` === "this policy settles true with attributes = row".
+     *
+     * Return `null` when this configuration is not expressible (the policy then
+     * stays a per-row post-check — always sound). Omit the method for policies that
+     * never lower (identity, date/time, attributeNames).
+     */
+    toCondition?(value: Record<string, any>, context: PolicyEvaluationContext): Promise<ICondition | null>;
     /**
      * Execute the policy with specific data and a given context.
      */

package/dist/policy/evaluation/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/evaluation/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;CACnB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3G"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/policy/evaluation/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;CACnB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;IAEhD;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAEvG;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3G"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.52",
+    "version": "1.0.0-beta.54",
     "description": "A library for evaluating permissions and policies.",
     "license": "Apache-2.0",
     "exports": {
@@ -53,9 +53,11 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/errors": "^1.0.0-beta.52",
-        "@authup/kit": "^1.0.0-beta.52",
-        "@ucast/mongo2js": "^2.0.0",
+        "@authup/errors": "^1.0.0-beta.54",
+        "@authup/kit": "^1.0.0-beta.54",
+        "@rapiq/core": "^2.0.0-beta.7",
+        "@rapiq/memory": "^2.0.0-beta.7",
+        "@rapiq/parser-mongo": "^2.0.0-beta.7",
         "@validup/zod": "^0.3.3",
         "smob": "^1.6.1",
         "validup": "^0.5.1",