@authup/access 1.0.0-beta.53 → 1.0.0-beta.55

package/dist/index.mjs

@@ -1,10 +1,12 @@
 import { AuthupError, ErrorCode, hasInstanceof, isAuthupError, markInstanceof } from "@authup/errors";
 import { DecisionStrategy, flattenObject, hasOwnProperty, isObject } from "@authup/kit";
 import { isEqual } from "smob";
+import { and, eq, inArray, nin, not, or } from "@rapiq/core";
 import { Container, defineIssueGroup, defineIssueItem } from "validup";
 import { createValidator } from "@validup/zod";
 import { z } from "zod";
-import { guard } from "@ucast/mongo2js";
+import { compileFilters } from "@rapiq/memory";
+import { MongoFiltersParser } from "@rapiq/parser-mongo";
 //#region src/permission/error/module.ts
 const PERMISSION_ERROR_INSTANCE = Symbol.for("@authup/access/PermissionError");
 var PermissionError = class PermissionError extends AuthupError {
@@ -72,7 +74,7 @@ let RealmScope = /* @__PURE__ */ function(RealmScope) {
 	RealmScope["NONE"] = "none";
 	/** Own realm only — resource realm must equal the actor's realm. */
 	RealmScope["OWN"] = "own";
-	/** Own realm or null/global resources (realm_id === null). */
+	/** Own realm or null/global resources (realmId === null). */
 	RealmScope["OWN_OR_NULL"] = "ownOrNull";
 	/** Any realm, including null/global. */
 	RealmScope["ANY"] = "any";
@@ -162,7 +164,7 @@ function formatKeySegment(value) {
 	return value || "*";
 }
 function buildPermissionKey(input) {
-	return `${formatKeySegment(input.realm_id)}/${formatKeySegment(input.client_id)}/${input.name}`;
+	return `${formatKeySegment(input.realmId)}/${formatKeySegment(input.clientId)}/${input.name}`;
 }
 //#endregion
 //#region src/permission/helpers/aggregate.ts
@@ -170,24 +172,24 @@ function buildPermissionKey(input) {
 * One disjunction term per raw binding: the grant's realm reach (fail-closed `own` default)
 * paired with its policy — the raw single policy (its `id` preserved for junction propagation),
 * a composite over multiple policies (Layer-1 permission policies, combined under the
-* permission's decision_strategy), or `undefined` when the grant is unrestricted.
+* permission's decisionStrategy), or `undefined` when the grant is unrestricted.
 */
 function buildGrant(binding) {
 	let policy;
 	if (binding.policies && binding.policies.length === 1) policy = binding.policies[0];
 	else if (binding.policies && binding.policies.length > 1) policy = {
 		type: "composite",
-		decision_strategy: binding.permission.decision_strategy || DecisionStrategy.UNANIMOUS,
+		decisionStrategy: binding.permission.decisionStrategy || DecisionStrategy.UNANIMOUS,
 		children: binding.policies
 	};
 	return {
-		realm_scope: normalizeRealmScope(binding.realm_scope),
+		realmScope: normalizeRealmScope(binding.realmScope),
 		policy
 	};
 }
 /**
 * Group raw permission-policy bindings by permission key into the actor's disjunction of
-* `(realm_scope, policy)` grants per permission — with NO lossy collapse. Every consumer
+* `(realmScope, policy)` grants per permission — with NO lossy collapse. Every consumer
 * (the binding evaluator, isSuperset, junction propagation, the memory provider) evaluates the
 * grant disjunction directly, so each grant's realm reach stays paired with the policy that
 * gates it.
@@ -213,8 +215,8 @@ function aggregatePermissionPolicyBindings(input) {
 //#region src/permission/helpers/equal.ts
 function isPermissionPolicyBindingEqual(a, b) {
 	if (a.permission.name !== b.permission.name) return false;
-	if ((a.permission.realm_id ?? null) !== (b.permission.realm_id ?? null)) return false;
-	if ((a.permission.client_id ?? null) !== (b.permission.client_id ?? null)) return false;
+	if ((a.permission.realmId ?? null) !== (b.permission.realmId ?? null)) return false;
+	if ((a.permission.clientId ?? null) !== (b.permission.clientId ?? null)) return false;
 	return true;
 }
 //#endregion
@@ -223,9 +225,9 @@ function isPermissionPolicyBindingEqual(a, b) {
 * Policy fields that do NOT affect evaluation — persisted identity, audit and label columns plus
 * the loaded `parent` / `realm` relation objects. They are stripped before the structural compare
 * in isPolicyEquivalent so two DISTINCT rows with identical configuration still match. Verified
-* against every built-in evaluator, which read only `type`, `invert`, `decision_strategy`,
+* against every built-in evaluator, which read only `type`, `invert`, `decisionStrategy`,
 * `children` and the type-specific config (query / names / types / start / end / interval /
-* day_of_* / attribute_name* / scope). `parent` is additionally a circular back-reference and
+* dayOf* / attributeName* / scope). `parent` is additionally a circular back-reference and
 * `realm` a nested object with its own id, so leaving either in would break the deep compare.
 *
 * SECURITY INVARIANT: every key here MUST stay non-evaluation-affecting. Adding an
@@ -234,16 +236,16 @@ function isPermissionPolicyBindingEqual(a, b) {
 */
 const NON_SEMANTIC_POLICY_KEYS = /* @__PURE__ */ new Set([
 	"id",
-	"built_in",
+	"builtIn",
 	"name",
-	"display_name",
+	"displayName",
 	"description",
-	"parent_id",
+	"parentId",
 	"parent",
-	"realm_id",
+	"realmId",
 	"realm",
-	"created_at",
-	"updated_at"
+	"createdAt",
+	"updatedAt"
 ]);
 /**
 * Project a policy node onto its evaluation-relevant configuration: drop the non-semantic keys
@@ -305,7 +307,7 @@ function policyDominates(parent, child) {
 * every child grant must be dominated by SOME parent grant.
 */
 function grantDominates(parent, child) {
-	if (compareRealmScope(parent.realm_scope, child.realm_scope) < 0) return false;
+	if (compareRealmScope(parent.realmScope, child.realmScope) < 0) return false;
 	return policyDominates(parent.policy, child.policy);
 }
 //#endregion
@@ -318,8 +320,8 @@ var PermissionMemoryProvider = class {
 	async findOne(options) {
 		const key = buildPermissionKey({
 			name: options.name,
-			client_id: options.clientId,
-			realm_id: options.realmId
+			clientId: options.clientId,
+			realmId: options.realmId
 		});
 		const entry = this.items[key];
 		if (entry) return entry;
@@ -334,6 +336,38 @@ var PermissionMemoryProvider = class {
 	}
 };
 //#endregion
+//#region src/policy/issue/constants.ts
+let PolicyIssueSeverity = /* @__PURE__ */ function(PolicyIssueSeverity) {
+	PolicyIssueSeverity["WARNING"] = "warning";
+	PolicyIssueSeverity["ERROR"] = "error";
+	return PolicyIssueSeverity;
+}({});
+let PolicyIssueCode = /* @__PURE__ */ function(PolicyIssueCode) {
+	PolicyIssueCode["DATA_MISSING"] = "DATA_MISSING";
+	PolicyIssueCode["DATA_INVALID"] = "DATA_INVALID";
+	PolicyIssueCode["INVALID"] = "INVALID";
+	PolicyIssueCode["TYPE_UNKNOWN"] = "TYPE_UNKNOWN";
+	PolicyIssueCode["FIELD_MISSING"] = "FIELD_MISSING";
+	PolicyIssueCode["FIELD_INVALID"] = "FIELD_INVALID";
+	PolicyIssueCode["CHILD_INVALID"] = "CHILD_INVALID";
+	PolicyIssueCode["CHILD_EVALUATION_FAILED"] = "CHILD_EVALUATION_FAILED";
+	PolicyIssueCode["EVALUATION_DENIED"] = "EVALUATION_DENIED";
+	PolicyIssueCode["EVALUATOR_NOT_FOUND"] = "EVALUATOR_NOT_FOUND";
+	PolicyIssueCode["EVALUATOR_ERROR"] = "EVALUATOR_ERROR";
+	PolicyIssueCode["SKIPPED_EXCLUDED"] = "SKIPPED_EXCLUDED";
+	PolicyIssueCode["SKIPPED_NOT_INCLUDED"] = "SKIPPED_NOT_INCLUDED";
+	PolicyIssueCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+	return PolicyIssueCode;
+}({});
+//#endregion
+//#region src/policy/issue/define.ts
+function definePolicyIssueItem(input) {
+	return defineIssueItem(input);
+}
+function definePolicyIssueGroup(input) {
+	return defineIssueGroup(input);
+}
+//#endregion
 //#region src/policy/error/module.ts
 const POLICY_ERROR_INSTANCE = Symbol.for("@authup/access/PolicyError");
 var PolicyError = class PolicyError extends AuthupError {
@@ -418,6 +452,25 @@ var PolicyEngine = class {
 			};
 		}
 		try {
+			if (evaluator.requires) {
+				const missing = evaluator.requires(policy).filter((key) => !ctx.data || !ctx.data.has(key));
+				if (missing.length > 0) {
+					const result = {
+						success: false,
+						pending: true,
+						issues: [definePolicyIssueItem({
+							code: "DATA_MISSING",
+							message: `The data propert${missing.length > 1 ? "ies" : "y"} ${missing.join(", ")} ${missing.length > 1 ? "are" : "is"} missing`,
+							path: ctx.path
+						})]
+					};
+					if (ctx.withConditions && evaluator.toCondition) try {
+						const condition = await evaluator.toCondition(policy, ctx);
+						if (condition) result.condition = condition;
+					} catch {}
+					return result;
+				}
+			}
 			return await evaluator.evaluate(policy, {
 				...ctx,
 				evaluators: {
@@ -494,42 +547,11 @@ function definePolicyEvaluationContext(input = {}) {
 		path: input.path || [],
 		data: input.data || new PolicyData(),
 		include: input.include || [],
-		exclude: input.exclude || []
+		exclude: input.exclude || [],
+		withConditions: input.withConditions ?? false
 	};
 }
 //#endregion
-//#region src/policy/issue/constants.ts
-let PolicyIssueSeverity = /* @__PURE__ */ function(PolicyIssueSeverity) {
-	PolicyIssueSeverity["WARNING"] = "warning";
-	PolicyIssueSeverity["ERROR"] = "error";
-	return PolicyIssueSeverity;
-}({});
-let PolicyIssueCode = /* @__PURE__ */ function(PolicyIssueCode) {
-	PolicyIssueCode["DATA_MISSING"] = "DATA_MISSING";
-	PolicyIssueCode["DATA_INVALID"] = "DATA_INVALID";
-	PolicyIssueCode["INVALID"] = "INVALID";
-	PolicyIssueCode["TYPE_UNKNOWN"] = "TYPE_UNKNOWN";
-	PolicyIssueCode["FIELD_MISSING"] = "FIELD_MISSING";
-	PolicyIssueCode["FIELD_INVALID"] = "FIELD_INVALID";
-	PolicyIssueCode["CHILD_INVALID"] = "CHILD_INVALID";
-	PolicyIssueCode["CHILD_EVALUATION_FAILED"] = "CHILD_EVALUATION_FAILED";
-	PolicyIssueCode["EVALUATION_DENIED"] = "EVALUATION_DENIED";
-	PolicyIssueCode["EVALUATOR_NOT_FOUND"] = "EVALUATOR_NOT_FOUND";
-	PolicyIssueCode["EVALUATOR_ERROR"] = "EVALUATOR_ERROR";
-	PolicyIssueCode["SKIPPED_EXCLUDED"] = "SKIPPED_EXCLUDED";
-	PolicyIssueCode["SKIPPED_NOT_INCLUDED"] = "SKIPPED_NOT_INCLUDED";
-	PolicyIssueCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
-	return PolicyIssueCode;
-}({});
-//#endregion
-//#region src/policy/issue/define.ts
-function definePolicyIssueItem(input) {
-	return defineIssueItem(input);
-}
-function definePolicyIssueGroup(input) {
-	return defineIssueGroup(input);
-}
-//#endregion
 //#region src/policy/helpers/invert.ts
 function maybeInvertPolicyOutcome(outcome, invert) {
 	if (typeof invert === "undefined") return outcome;
@@ -594,7 +616,6 @@ const SystemPolicyName = {
 	PERMISSION_BINDING: "system.permission-binding",
 	REALM_MATCH: "system.realm-match",
 	CLIENT_NAMES_SELF_MANAGE: "system.client-names-self-manage",
-	ROBOT_NAMES_SELF_MANAGE: "system.robot-names-self-manage",
 	USER_NAMES_SELF_MANAGE: "system.user-names-self-manage"
 };
 //#endregion
@@ -610,8 +631,25 @@ var AttributesPolicyValidator = class extends Container {
 //#region src/policy/built-in/attributes/evaluator.ts
 var AttributesPolicyEvaluator = class {
 	validator;
+	parser;
 	constructor() {
 		this.validator = new AttributesPolicyValidator();
+		this.parser = new MongoFiltersParser();
+	}
+	requires() {
+		return ["attributes"];
+	}
+	async toCondition(value) {
+		let policy;
+		let condition;
+		try {
+			policy = await this.validator.run(value);
+			this.fixQuery(policy.query);
+			condition = this.parser.parse(policy.query);
+		} catch {
+			return null;
+		}
+		return policy.invert ? not(condition) : condition;
 	}
 	async accessData(ctx) {
 		if (!ctx.data.has("attributes")) return null;
@@ -633,7 +671,20 @@ var AttributesPolicyEvaluator = class {
 			})]
 		};
 		this.fixQuery(policy.query);
-		return { success: maybeInvertPolicyOutcome(guard(policy.query)(data), policy.invert) };
+		let testIt;
+		try {
+			testIt = compileFilters(this.parser.parse(policy.query), { caseSensitive: true });
+		} catch (e) {
+			return {
+				success: false,
+				issues: [definePolicyIssueItem({
+					code: "FIELD_INVALID",
+					message: e instanceof Error ? e.message : "The query could not be parsed.",
+					path: ctx.path
+				})]
+			};
+		}
+		return { success: maybeInvertPolicyOutcome(testIt(data), policy.invert) };
 	}
 	fixQuery(query) {
 		if (Array.isArray(query)) {
@@ -665,6 +716,9 @@ var AttributeNamesPolicyEvaluator = class {
 		this.validator = new AttributeNamesPolicyValidator();
 		this.attributesEvaluator = new AttributesPolicyEvaluator();
 	}
+	requires() {
+		return ["attributes"];
+	}
 	async evaluate(value, ctx) {
 		const policy = await this.validator.run(value);
 		const data = await this.attributesEvaluator.accessData(ctx);
@@ -698,7 +752,7 @@ var AttributeNamesPolicyEvaluator = class {
 var CompositePolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("decision_strategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+		this.mount("decisionStrategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
 		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(3) }))));
 		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
 	}
@@ -712,18 +766,41 @@ var CompositePolicyEvaluator = class {
 	}
 	async evaluate(value, ctx) {
 		const policy = await this.validator.run(value);
+		if (policy.children.length === 0) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: "INVALID",
+				message: "A composite policy must define at least one child policy.",
+				path: ctx.path
+			})]
+		};
 		let count = 0;
-		const decision_strategy = policy.decision_strategy ?? DecisionStrategy.UNANIMOUS;
+		let pending = 0;
+		const decisionStrategy = policy.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
 		const engine = new PolicyEngine(ctx.evaluators);
 		const issues = [];
+		const pendingIssues = [];
+		const pendingConditions = [];
+		let pendingWithoutCondition = 0;
 		for (const childPolicy of policy.children) {
 			const path = [...ctx.path || [], ...childPolicy.type ? [childPolicy.type] : []];
 			const outcome = await engine.evaluate(childPolicy, {
 				...ctx,
 				path
 			});
+			if (outcome.pending) {
+				pending++;
+				if (outcome.condition) pendingConditions.push(outcome.condition);
+				else pendingWithoutCondition++;
+				if (outcome.issues && outcome.issues.length > 0) pendingIssues.push(defineIssueGroup({
+					message: `The evaluation of child policy ${childPolicy.type} is pending`,
+					issues: outcome.issues,
+					path
+				}));
+				continue;
+			}
 			if (outcome.success) {
-				if (decision_strategy === DecisionStrategy.AFFIRMATIVE) return {
+				if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) return {
 					success: maybeInvertPolicyOutcome(true, policy.invert),
 					issues: []
 				};
@@ -734,7 +811,7 @@ var CompositePolicyEvaluator = class {
 					issues: outcome.issues || [],
 					path
 				}));
-				if (decision_strategy === DecisionStrategy.UNANIMOUS) {
+				if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
 					const success = maybeInvertPolicyOutcome(false, policy.invert);
 					return {
 						success,
@@ -748,12 +825,41 @@ var CompositePolicyEvaluator = class {
 				count--;
 			}
 		}
-		if (count > 0) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+		let settled;
+		switch (decisionStrategy) {
+			case DecisionStrategy.AFFIRMATIVE:
+				settled = pending > 0 ? null : false;
+				break;
+			case DecisionStrategy.UNANIMOUS:
+				settled = pending > 0 ? null : count > 0;
+				break;
+			default: if (count - pending > 0) settled = true;
+			else if (count + pending <= 0) settled = false;
+			else settled = null;
+		}
+		if (settled === null) {
+			let condition = null;
+			if (ctx.withConditions && pendingWithoutCondition === 0 && pendingConditions.length > 0 && decisionStrategy !== DecisionStrategy.CONSENSUS) {
+				if (pendingConditions.length === 1) {
+					const [first] = pendingConditions;
+					condition = first ?? null;
+				} else if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) condition = or(...pendingConditions);
+				else condition = and(...pendingConditions);
+				if (condition && policy.invert) condition = not(condition);
+			}
+			return {
+				success: false,
+				pending: true,
+				...condition ? { condition } : {},
+				issues: pendingIssues
+			};
+		}
+		if (settled) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
 		const success = maybeInvertPolicyOutcome(false, policy.invert);
 		return {
 			success,
 			issues: success ? [] : [defineIssueGroup({
-				message: `The evaluation of composite policy failed (${DecisionStrategy.CONSENSUS})`,
+				message: `The evaluation of composite policy failed (${decisionStrategy})`,
 				issues: issues || [],
 				path: ctx.path
 			})]
@@ -840,6 +946,9 @@ var IdentityPolicyEvaluator = class {
 		this.validator = new IdentityPolicyValidator();
 		this.dataValidator = new PolicyIdentityDataValidator();
 	}
+	requires() {
+		return ["identity"];
+	}
 	async accessData(ctx) {
 		if (!ctx.data.has("identity")) return null;
 		if (ctx.data.isValidated("identity")) return ctx.data.get("identity");
@@ -884,6 +993,9 @@ var PermissionBindingPolicyEvaluator = class {
 	constructor() {
 		this.validator = new PermissionBindingPolicyValidator();
 	}
+	requires() {
+		return ["permissionBinding"];
+	}
 	async evaluate(value) {
 		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
 	}
@@ -893,10 +1005,10 @@ var PermissionBindingPolicyEvaluator = class {
 var RealmMatchPolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("decision_strategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-		this.mount("attribute_name", createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
-		this.mount("attribute_name_strict", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-		this.mount("attribute_null_match_all", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+		this.mount("decisionStrategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+		this.mount("attributeName", createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
+		this.mount("attributeNameStrict", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+		this.mount("attributeNullMatchAll", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
 		this.mount("scope", createValidator(z.enum(RealmScope).or(z.null()).or(z.undefined()).optional()));
 		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
 	}
@@ -912,6 +1024,56 @@ var RealmMatchPolicyEvaluator = class {
 		this.identityEvaluator = new IdentityPolicyEvaluator();
 		this.attributesEvaluator = new AttributesPolicyEvaluator();
 	}
+	requires(value) {
+		if (value.scope) return ["identity"];
+		return ["identity", "attributes"];
+	}
+	/**
+	* Condition form over the row's realm column, with the actor realm baked in
+	* (mirrors `realmScopeMatches` / the attribute-mode match). Exactness holds for
+	* row-shaped data where the referenced field exists (DB rows) — the object-bag
+	* "key absent → neutral-pass" case has no SQL counterpart. Lowerable configs:
+	* scope mode (field = single-string `attributeName`, default `realmId` — scope-mode
+	* EVALUATION ignores `attributeName`, lowering reuses it as the column override),
+	* and strict attribute mode with a single explicit `attributeName`. Everything
+	* else (multi-key / default-key CONSENSUS, non-strict key expansion) is
+	* row-shape-dependent and stays a post-check.
+	*/
+	async toCondition(value, ctx) {
+		let policy;
+		try {
+			policy = await this.validator.run(value);
+		} catch {
+			return null;
+		}
+		const identity = await this.identityEvaluator.accessData(ctx);
+		if (!identity) return null;
+		const realmId = identity.realmId ?? null;
+		if (policy.scope) {
+			const scope = normalizeRealmScope(policy.scope);
+			const field = typeof policy.attributeName === "string" ? policy.attributeName : "realmId";
+			let condition;
+			if (scope === "any") condition = nin(field, []);
+			else {
+				const terms = [];
+				if (scope !== "none" && realmId !== null) terms.push(eq(field, realmId));
+				if (scope === "ownOrNull") terms.push(eq(field, null));
+				if (terms.length === 0) condition = inArray(field, []);
+				else if (terms.length === 1) condition = terms[0];
+				else condition = or(...terms);
+			}
+			return policy.invert ? not(condition) : condition;
+		}
+		if (typeof policy.attributeName !== "string" || (policy.attributeNameStrict ?? true) === false) return null;
+		const key = policy.attributeName;
+		const terms = [];
+		if (policy.attributeNullMatchAll) terms.push(eq(key, null));
+		if (identity.realmId !== void 0) terms.push(eq(key, identity.realmId));
+		if (identity.realmName !== void 0) terms.push(eq(key, identity.realmName));
+		if (terms.length === 0) return policy.invert ? nin(key, []) : inArray(key, []);
+		const condition = terms.length === 1 ? terms[0] : or(...terms);
+		return policy.invert ? not(condition) : condition;
+	}
 	async evaluate(value, ctx) {
 		const policy = await this.validator.run(value);
 		const identity = await this.identityEvaluator.accessData(ctx);
@@ -924,7 +1086,17 @@ var RealmMatchPolicyEvaluator = class {
 			})]
 		};
 		if (policy.scope) {
-			if (!ctx.data || !ctx.data.has("realmMatch")) return { success: true };
+			if (!ctx.data || !ctx.data.has("realmMatch")) {
+				if (ctx.withConditions) {
+					const condition = await this.toCondition(value, ctx);
+					return {
+						success: false,
+						pending: true,
+						...condition ? { condition } : {}
+					};
+				}
+				return { success: true };
+			}
 			const resourceRealm = ctx.data.get("realmMatch");
 			return { success: maybeInvertPolicyOutcome(realmScopeMatches(policy.scope, resourceRealm ?? null, identity.realmId, identity.realmName), policy.invert) };
 		}
@@ -938,8 +1110,8 @@ var RealmMatchPolicyEvaluator = class {
 			})]
 		};
 		let keys;
-		if (policy.attribute_name) if (Array.isArray(policy.attribute_name)) keys = policy.attribute_name;
-		else keys = [policy.attribute_name];
+		if (policy.attributeName) if (Array.isArray(policy.attributeName)) keys = policy.attributeName;
+		else keys = [policy.attributeName];
 		else {
 			keys = [
 				"realm_id",
@@ -947,9 +1119,9 @@ var RealmMatchPolicyEvaluator = class {
 				"realmId",
 				"realmName"
 			];
-			policy.decision_strategy = DecisionStrategy.CONSENSUS;
+			policy.decisionStrategy = DecisionStrategy.CONSENSUS;
 		}
-		if (!(policy.attribute_name_strict ?? true)) {
+		if (!(policy.attributeNameStrict ?? true)) {
 			const resourceKeys = Object.keys(attributes);
 			const keysToAdd = [];
 			for (const resourceKey of resourceKeys) {
@@ -969,13 +1141,13 @@ var RealmMatchPolicyEvaluator = class {
 			evaluated = true;
 			let outcome = false;
 			const attributeValue = attributes[key];
-			if (attributeValue === null && policy.attribute_null_match_all) outcome = true;
+			if (attributeValue === null && policy.attributeNullMatchAll) outcome = true;
 			else if (attributeValue === identity.realmId || attributeValue === identity.realmName) outcome = true;
 			if (outcome) {
-				if (policy.decision_strategy === DecisionStrategy.AFFIRMATIVE) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				if (policy.decisionStrategy === DecisionStrategy.AFFIRMATIVE) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
 				count++;
 			} else {
-				if (policy.decision_strategy === DecisionStrategy.UNANIMOUS) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+				if (policy.decisionStrategy === DecisionStrategy.UNANIMOUS) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 				count--;
 			}
 		}
@@ -1008,9 +1180,9 @@ function isIntervalForDayOfYear(interval) {
 var TimePolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("day_of_week", createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
-		this.mount("day_of_month", createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
-		this.mount("day_of_year", createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
+		this.mount("dayOfWeek", createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
+		this.mount("dayOfMonth", createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
+		this.mount("dayOfYear", createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
 		this.mount("start", createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
 		this.mount("end", createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
 		this.mount("interval", createValidator(z.enum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
@@ -1067,16 +1239,16 @@ var TimePolicyEvaluator = class {
 			if (now > end) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 		}
 		if (policy.interval) {
-			if (isIntervalForDayOfWeek(policy.interval) && policy.day_of_week) {
-				if (now.getDay() !== policy.day_of_week) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+			if (isIntervalForDayOfWeek(policy.interval) && policy.dayOfWeek) {
+				if (now.getDay() !== policy.dayOfWeek) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 			}
-			if (isIntervalForDayOfMonth(policy.interval) && policy.day_of_month) {
-				if (now.getDate() !== policy.day_of_month) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+			if (isIntervalForDayOfMonth(policy.interval) && policy.dayOfMonth) {
+				if (now.getDate() !== policy.dayOfMonth) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 			}
-			if (isIntervalForDayOfYear(policy.interval) && policy.day_of_year) {
+			if (isIntervalForDayOfYear(policy.interval) && policy.dayOfYear) {
 				const start = new Date(now.getFullYear(), 0, 0);
 				const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1e3;
-				if (Math.floor(diff / (1e3 * 60 * 60 * 24)) !== policy.day_of_year) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+				if (Math.floor(diff / (1e3 * 60 * 60 * 24)) !== policy.dayOfYear) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
 			}
 		}
 		return { success: maybeInvertPolicyOutcome(true, policy.invert) };
@@ -1176,7 +1348,7 @@ var PermissionEvaluator = class {
 			data.set("permissionBinding", binding);
 			const compositePolicy = {
 				type: "composite",
-				decision_strategy: DecisionStrategy.AFFIRMATIVE,
+				decisionStrategy: DecisionStrategy.AFFIRMATIVE,
 				children: grantPolicies
 			};
 			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
@@ -1184,7 +1356,7 @@ var PermissionEvaluator = class {
 				exclude: options.policiesExcluded,
 				data
 			}));
-			if (evaluationResult.success) {
+			if (evaluationResult.success || options.pendingPolicies === "permit" && !!evaluationResult.pending) {
 				if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) return;
 				count++;
 			} else {
@@ -1224,11 +1396,7 @@ var PermissionEvaluator = class {
 			...ctx,
 			options: {
 				...ctx.options || {},
-				policiesExcluded: [
-					"attributes",
-					"attributeNames",
-					"realmMatch"
-				]
+				pendingPolicies: "permit"
 			}
 		});
 	}
@@ -1241,6 +1409,58 @@ var PermissionEvaluator = class {
 			}
 		});
 	}
+	/**
+	* Compile the permission's policy trees against the knowns bag into a
+	* {@link PermissionCompileResult} — the query-build counterpart of
+	* {@link evaluate} (issue #3286 phase 3). Runs the SAME evaluation walk with
+	* `withConditions` enabled: policies that settle with the knowns settle here,
+	* pending subtrees contribute their exact condition form. Multiple names are
+	* a disjunction (any-of), so a single non-expressible name degrades the whole
+	* compilation to `post` — pushing only some disjuncts would wrongly exclude
+	* rows another name would admit.
+	*/
+	async compile(ctx) {
+		const names = Array.isArray(ctx.name) ? ctx.name : [ctx.name];
+		const dataBase = ctx.data || new PolicyData();
+		const conditions = [];
+		let post = false;
+		for (const name of names) {
+			const binding = await this.findOne(name, {
+				realmId: ctx.realmId,
+				clientId: ctx.clientId
+			});
+			if (!binding) continue;
+			const grantPolicies = binding.grants.map((grant) => grant.policy).filter((grantPolicy) => !!grantPolicy);
+			if (grantPolicies.length < binding.grants.length) return { verdict: "allow" };
+			const data = dataBase.clone();
+			data.set("permissionBinding", binding);
+			const compositePolicy = {
+				type: "composite",
+				decisionStrategy: DecisionStrategy.AFFIRMATIVE,
+				children: grantPolicies
+			};
+			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
+				data,
+				withConditions: true
+			}));
+			if (evaluationResult.success) return { verdict: "allow" };
+			if (evaluationResult.pending) if (evaluationResult.condition) conditions.push(evaluationResult.condition);
+			else post = true;
+		}
+		if (post) return { verdict: "post" };
+		if (conditions.length === 0) return { verdict: "deny" };
+		if (conditions.length === 1) {
+			const [condition] = conditions;
+			return {
+				verdict: "conditional",
+				condition
+			};
+		}
+		return {
+			verdict: "conditional",
+			condition: or(...conditions)
+		};
+	}
 };
 //#endregion
 export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };