@authup/access 1.0.0-beta.64 → 1.0.0-beta.66

package/dist/index.d.mts

@@ -3,30 +3,33 @@ import { DecisionStrategy } from "@authup/kit";
 import { ICondition } from "@rapiq/core";
 import { Issue, IssueGroup, IssueItem } from "@ebec/core";
 import { Container } from "validup";
+import { z } from "zod";
 import { MongoFiltersParser, MongoFiltersParserInput } from "@rapiq/parser-mongo";
 //#region src/policy/data.d.ts
-interface IPolicyData {
+export interface IPolicyData {
   set(key: string, value: unknown): void;
   has(key: string): boolean;
   get<T = unknown>(key: string): T;
+  delete(key: string): void;
   isValidated(key: string): boolean;
   setValidated(key: string): void;
   clone(): IPolicyData;
 }
-declare class PolicyData implements IPolicyData {
+export declare class PolicyData implements IPolicyData {
   protected data: Record<string, any>;
   protected validated: Set<string>;
   constructor(data?: Record<string, any>, validated?: Set<string>);
   set<T = unknown>(key: string, value: T): void;
   get<T = unknown>(key: string): T;
   has(key: string): boolean;
+  delete(key: string): void;
   setValidated(key: string): void;
   isValidated(key: string): boolean;
   clone(): PolicyData;
 }
 //#endregion
 //#region src/policy/evaluation/context/types.d.ts
-type PolicyEvaluationContext = {
+export type PolicyEvaluationContext = {
   readonly evaluators: Record<string, IPolicyEvaluator>;
   readonly path: (string | number)[];
   readonly exclude: string[];
@@ -39,15 +42,24 @@ type PolicyEvaluationContext = {
    * query-build callers opt in.
    */
   readonly withConditions: boolean;
+  /**
+   * Row column the realm reach is LOWERED onto, for a caller whose rows carry the
+   * realm under another name (a junction's `roleRealmId` / `clientRealmId` / …).
+   * Default `realmId`. It reaches `RealmMatchPolicyEvaluator` scope mode as
+   * `attributeName`, which that mode reads only while lowering — settled
+   * evaluation takes the resource realm from the `realmMatch` data key and never
+   * consults a column name, so this can never change an evaluate() outcome.
+   */
+  readonly realmAttributeName?: string;
 };
-type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
+export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //#endregion
 //#region src/policy/evaluation/context/define.d.ts
-declare function definePolicyEvaluationContext(input?: PolicyEvaluationContextInput): PolicyEvaluationContext;
+export declare function definePolicyEvaluationContext(input?: PolicyEvaluationContextInput): PolicyEvaluationContext;
 //#endregion
 //#region src/policy/evaluation/types.d.ts
-type PolicyEvaluators = Record<string, IPolicyEvaluator>;
-type PolicyEvaluationResult = {
+export type PolicyEvaluators = Record<string, IPolicyEvaluator>;
+export type PolicyEvaluationResult = {
   success: boolean;
   /**
    * The policy could not be settled yet — a data key it requires is absent from the
@@ -70,7 +82,7 @@ type PolicyEvaluationResult = {
   condition?: ICondition;
   issues?: Issue[];
 };
-interface IPolicyEvaluator {
+export interface IPolicyEvaluator {
   /**
    * PolicyData keys this policy needs before it can settle (e.g. `identity`,
    * `attributes`). When any returned key is absent from the evaluation bag, the
@@ -100,7 +112,7 @@ interface IPolicyEvaluator {
 }
 //#endregion
 //#region src/policy/types.d.ts
-type BasePolicy<T extends string = string> = {
+export type BasePolicy<T extends string = string> = {
   /**
    * Type describing the policy.
    */
@@ -110,10 +122,10 @@ type BasePolicy<T extends string = string> = {
    */
   invert?: boolean;
 };
-type PolicyWithType<R extends Record<string, any> = Record<string, any>, T extends string = string> = R & BasePolicy<T>;
+export type PolicyWithType<R extends Record<string, any> = Record<string, any>, T extends string = string> = R & BasePolicy<T>;
 //#endregion
 //#region src/policy/engine/types.d.ts
-interface IPolicyEngine {
+export interface IPolicyEngine {
   evaluate(policy: BasePolicy, options: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
   evaluateOrFail(policy: BasePolicy, options: PolicyEvaluationContext): Promise<void>;
 }
@@ -123,7 +135,7 @@ interface IPolicyEngine {
  * The policy engine is a component that interprets defined policies and makes decisions
  * on whether to allow or deny a particular access.
  */
-declare class PolicyEngine implements IPolicyEngine {
+export declare class PolicyEngine implements IPolicyEngine {
   protected evaluators: Record<string, IPolicyEvaluator>;
   constructor(evaluators?: PolicyEvaluators);
   registerEvaluator(type: string, evaluator: IPolicyEvaluator): void;
@@ -137,11 +149,11 @@ declare class PolicyEngine implements IPolicyEngine {
 }
 //#endregion
 //#region src/policy/issue/constants.d.ts
-declare enum PolicyIssueSeverity {
+export declare enum PolicyIssueSeverity {
   WARNING = "warning",
   ERROR = "error"
 }
-declare enum PolicyIssueCode {
+export declare enum PolicyIssueCode {
   DATA_MISSING = "DATA_MISSING",
   DATA_INVALID = "DATA_INVALID",
   INVALID = "INVALID",
@@ -159,17 +171,17 @@ declare enum PolicyIssueCode {
 }
 //#endregion
 //#region src/policy/issue/types.d.ts
-type PolicyIssueItem = IssueItem;
-type PolicyIssueGroup = IssueGroup;
-type PolicyIssue = PolicyIssueItem | PolicyIssueGroup;
+export type PolicyIssueItem = IssueItem;
+export type PolicyIssueGroup = IssueGroup;
+export type PolicyIssue = PolicyIssueItem | PolicyIssueGroup;
 //#endregion
 //#region src/policy/issue/define.d.ts
-declare function definePolicyIssueItem(input: Omit<PolicyIssueItem, 'type'>): PolicyIssueItem;
-declare function definePolicyIssueGroup(input: Omit<PolicyIssueGroup, 'type'>): PolicyIssueGroup;
+export declare function definePolicyIssueItem(input: Omit<PolicyIssueItem, 'type'>): PolicyIssueItem;
+export declare function definePolicyIssueGroup(input: Omit<PolicyIssueGroup, 'type'>): PolicyIssueGroup;
 //#endregion
 //#region src/policy/error/module.d.ts
-declare const POLICY_ERROR_INSTANCE: unique symbol;
-declare class PolicyError extends AuthupError {
+export declare const POLICY_ERROR_INSTANCE: unique symbol;
+export declare class PolicyError extends AuthupError {
   constructor(message?: string, code?: string | null, issues?: PolicyIssue[]);
   static evaluatorNotFound(type: string): PolicyError;
   static evaluatorNotProcessable(): PolicyError;
@@ -177,38 +189,38 @@ declare class PolicyError extends AuthupError {
 }
 //#endregion
 //#region src/policy/error/check.d.ts
-declare function isPolicyError(input: unknown): input is PolicyError;
+export declare function isPolicyError(input: unknown): input is PolicyError;
 //#endregion
 //#region src/policy/helpers/invert.d.ts
 type InvertFn = (input: boolean) => boolean;
-declare function maybeInvertPolicyOutcome(outcome: boolean, invert?: boolean | InvertFn): boolean;
+export declare function maybeInvertPolicyOutcome(outcome: boolean, invert?: boolean | InvertFn): boolean;
 //#endregion
 //#region src/policy/built-in/attribute-names/types.d.ts
-interface AttributeNamesPolicy extends BasePolicy {
+export interface AttributeNamesPolicy extends BasePolicy {
   names: string[];
 }
 //#endregion
 //#region src/policy/built-in/attribute-names/validator.d.ts
-declare class AttributeNamesPolicyValidator extends Container<AttributeNamesPolicy> {
+export declare class AttributeNamesPolicyValidator extends Container<AttributeNamesPolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/attributes/types.d.ts
-type AttributesPolicyQuery<T extends Record<string, any> = Record<string, any>> = MongoFiltersParserInput<T>;
-interface AttributesPolicy<T extends Record<string, any> = Record<string, any>> extends BasePolicy {
+export type AttributesPolicyQuery<T extends Record<string, any> = Record<string, any>> = MongoFiltersParserInput<T>;
+export interface AttributesPolicy<T extends Record<string, any> = Record<string, any>> extends BasePolicy {
   query: AttributesPolicyQuery<T>;
 }
 //#endregion
 //#region src/policy/built-in/attributes/define.d.ts
-declare function defineAttributesPolicy<T extends Record<string, any> = Record<string, any>>(data: AttributesPolicy<T>): AttributesPolicy<T>;
+export declare function defineAttributesPolicy<T extends Record<string, any> = Record<string, any>>(data: AttributesPolicy<T>): AttributesPolicy<T>;
 //#endregion
 //#region src/policy/built-in/attributes/validator.d.ts
-declare class AttributesPolicyValidator<T extends Record<string, any> = Record<string, any>> extends Container<AttributesPolicy<T>> {
+export declare class AttributesPolicyValidator<T extends Record<string, any> = Record<string, any>> extends Container<AttributesPolicy<T>> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/attributes/evaluator.d.ts
-declare class AttributesPolicyEvaluator<T extends Record<string, any> = Record<string, any>> implements IPolicyEvaluator {
+export declare class AttributesPolicyEvaluator<T extends Record<string, any> = Record<string, any>> implements IPolicyEvaluator {
   protected validator: AttributesPolicyValidator<T>;
   protected parser: MongoFiltersParser;
   constructor();
@@ -220,7 +232,7 @@ declare class AttributesPolicyEvaluator<T extends Record<string, any> = Record<s
 }
 //#endregion
 //#region src/policy/built-in/attribute-names/evaluator.d.ts
-declare class AttributeNamesPolicyEvaluator implements IPolicyEvaluator {
+export declare class AttributeNamesPolicyEvaluator implements IPolicyEvaluator {
   protected validator: AttributeNamesPolicyValidator;
   protected attributesEvaluator: AttributesPolicyEvaluator;
   constructor();
@@ -228,7 +240,7 @@ declare class AttributeNamesPolicyEvaluator implements IPolicyEvaluator {
 }
 //#endregion
 //#region src/policy/built-in/composite/types.d.ts
-interface CompositePolicy extends BasePolicy {
+export interface CompositePolicy extends BasePolicy {
   /**
    * How to decide if a policy evaluates to true.
    */
@@ -240,46 +252,46 @@ interface CompositePolicy extends BasePolicy {
 }
 //#endregion
 //#region src/policy/built-in/composite/validator.d.ts
-declare class CompositePolicyValidator extends Container<CompositePolicy> {
+export declare class CompositePolicyValidator extends Container<CompositePolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/composite/evaluator.d.ts
-declare class CompositePolicyEvaluator implements IPolicyEvaluator {
+export declare class CompositePolicyEvaluator implements IPolicyEvaluator {
   protected validator: CompositePolicyValidator;
   constructor();
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
 //#region src/policy/built-in/composite/helper.d.ts
-declare function isCompositePolicy(input: PolicyWithType): input is PolicyWithType<CompositePolicy>;
+export declare function isCompositePolicy(input: PolicyWithType): input is PolicyWithType<CompositePolicy>;
 //#endregion
 //#region src/policy/built-in/date/types.d.ts
-interface DatePolicy extends BasePolicy {
+export interface DatePolicy extends BasePolicy {
   start?: string | Date | number;
   end?: string | Date | number;
 }
 //#endregion
 //#region src/policy/built-in/date/validator.d.ts
-declare class DatePolicyValidator extends Container<DatePolicy> {
+export declare class DatePolicyValidator extends Container<DatePolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/date/evaluator.d.ts
-declare class DatePolicyEvaluator implements IPolicyEvaluator {
+export declare class DatePolicyEvaluator implements IPolicyEvaluator {
   protected validator: DatePolicyValidator;
   constructor();
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
 //#region src/policy/built-in/identity/types.d.ts
-interface IdentityPolicy extends BasePolicy {
+export interface IdentityPolicy extends BasePolicy {
   /**
    * Set of allowed identity types.
    */
   types?: string[];
 }
-type IdentityPolicyData = {
+export type IdentityPolicyData = {
   /**
    * user, client
    */
@@ -308,12 +320,12 @@ declare class PolicyIdentityDataValidator extends Container<IdentityPolicyData>
 }
 //#endregion
 //#region src/policy/built-in/identity/validator.d.ts
-declare class IdentityPolicyValidator extends Container<IdentityPolicy> {
+export declare class IdentityPolicyValidator extends Container<IdentityPolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/identity/evaluator.d.ts
-declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
+export declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
   protected validator: IdentityPolicyValidator;
   protected dataValidator: PolicyIdentityDataValidator;
   constructor();
@@ -322,22 +334,6 @@ declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
-//#region src/policy/built-in/permission-binding/types.d.ts
-interface PermissionBindingPolicy extends BasePolicy {}
-//#endregion
-//#region src/policy/built-in/permission-binding/validator.d.ts
-declare class PermissionBindingPolicyValidator extends Container<PermissionBindingPolicy> {
-  initialize(): void;
-}
-//#endregion
-//#region src/policy/built-in/permission-binding/module.d.ts
-declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
-  protected validator: PermissionBindingPolicyValidator;
-  constructor();
-  requires(): string[];
-  evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
-}
-//#endregion
 //#region src/permission/realm-scope/constants.d.ts
 /**
  * Actor-relative realm reach of a permission grant.
@@ -346,7 +342,7 @@ declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
  * A missing/unknown column coerces to `own` (fail-closed); `none` is only ever an
  * explicit value (the grant reaches no realm at all).
  */
-declare enum RealmScope {
+export declare enum RealmScope {
   /** No reach — the grant matches no resource realm. */
   NONE = "none",
   /** Own realm only — resource realm must equal the actor's realm. */
@@ -357,33 +353,81 @@ declare enum RealmScope {
   ANY = "any"
 }
 /** Numeric restrictiveness order — internal to the fold/compare helpers. */
-declare const REALM_SCOPE_ORDER: Record<`${RealmScope}`, number>;
+export declare const REALM_SCOPE_ORDER: Record<`${RealmScope}`, number>;
 //#endregion
 //#region src/permission/realm-scope/helpers.d.ts
 /**
  * Coerce an arbitrary value to a RealmScope, defaulting to `own` for missing /
  * null / unknown input (fail-closed). `none` is honoured only when explicit.
  */
-declare function normalizeRealmScope(value?: `${RealmScope}` | null): `${RealmScope}`;
+export declare function normalizeRealmScope(value?: `${RealmScope}` | null): `${RealmScope}`;
 /**
  * Numeric comparison of two realm scopes by restrictiveness.
  * Negative when `a` is more restrictive than `b`, positive when less.
  */
-declare function compareRealmScope(a?: `${RealmScope}` | null, b?: `${RealmScope}` | null): number;
+export declare function compareRealmScope(a?: `${RealmScope}` | null, b?: `${RealmScope}` | null): number;
 /** Fold scopes to the MOST permissive (ordered max). Empty folds to `own`. */
-declare function maxRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
+export declare function maxRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
 /** Fold scopes to the MORE restrictive (ordered min) — used to CAP a grant. Empty folds to `own`. */
-declare function minRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
+export declare function minRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
 /**
  * Whether `scope` reaches the resource. The resource realm may be presented as a single
  * id, `null` (global), or an array of realm ids — the array form (a resource that spans
  * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
  * so any app/entity can express its realm via one or many keys under the canonical contract.
  */
-declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+//#endregion
+//#region src/permission/types.d.ts
+export type BasePermission = {
+  name: string;
+  clientId?: string | null;
+  realmId?: string | null;
+  decisionStrategy?: `${DecisionStrategy}` | null;
+};
+/**
+ * A raw permission grant: one permission with its policies and realm reach, as loaded from a
+ * role/identity junction. `aggregatePermissionPolicyBindings` groups these per permission into
+ * a `PermissionPolicyBindingAggregated` (the lossless disjunction of grants).
+ */
+export type PermissionPolicyBinding = {
+  permission: BasePermission;
+  policies?: BasePolicy[];
+  /**
+   * Relative realm reach of this grant (none/own/ownOrNull/any). Absent coerces to the
+   * most restrictive `own` (fail-closed). NOT part of the binding identity key
+   * (see isPermissionPolicyBindingEqual).
+   */
+  realmScope?: `${RealmScope}`;
+};
+/**
+ * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
+ * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
+ * across the grants of a permission.
+ */
+export type PermissionGrant = {
+  /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
+  realmScope: `${RealmScope}`;
+  /**
+   * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
+   * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
+   * when the grant carries no restriction.
+   */
+  policy?: BasePolicy;
+};
+/**
+ * A permission together with the actor's disjunction of grants for it. Output of
+ * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
+ * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
+ * OR over `grants`).
+ */
+export type PermissionPolicyBindingAggregated = {
+  permission: BasePermission;
+  grants: PermissionGrant[];
+};
 //#endregion
 //#region src/policy/built-in/realm-match/types.d.ts
-interface RealmMatchPolicy extends BasePolicy {
+export interface RealmMatchPolicy extends BasePolicy {
   /**
    * Determines how realm-id/name matches are handled.
    */
@@ -412,12 +456,12 @@ interface RealmMatchPolicy extends BasePolicy {
 }
 //#endregion
 //#region src/policy/built-in/realm-match/validator.d.ts
-declare class RealmMatchPolicyValidator extends Container<RealmMatchPolicy> {
+export declare class RealmMatchPolicyValidator extends Container<RealmMatchPolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/realm-match/evaluator.d.ts
-declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
+export declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
   protected validator: RealmMatchPolicyValidator;
   protected identityEvaluator: IdentityPolicyEvaluator;
   protected attributesEvaluator: AttributesPolicyEvaluator;
@@ -438,8 +482,39 @@ declare class RealmMatchPolicyEvaluator implements IPolicyEvaluator {
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
+//#region src/policy/built-in/permission-binding/types.d.ts
+export interface PermissionBindingPolicy extends BasePolicy {}
+//#endregion
+//#region src/policy/built-in/permission-binding/validator.d.ts
+export declare class PermissionBindingPolicyValidator extends Container<PermissionBindingPolicy> {
+  initialize(): void;
+}
+//#endregion
+//#region src/policy/built-in/permission-binding/identity-evaluator.d.ts
+type IdentityPermissionProvider = {
+  getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+};
+export declare class IdentityPermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+  protected validator: PermissionBindingPolicyValidator;
+  protected identityEvaluator: IdentityPolicyEvaluator;
+  protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
+  protected identityPermissionProvider: IdentityPermissionProvider;
+  constructor(identityPermissionProvider: IdentityPermissionProvider);
+  requires(): string[];
+  accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
+  evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
+}
+//#endregion
+//#region src/policy/built-in/permission-binding/module.d.ts
+export declare class PermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+  protected validator: PermissionBindingPolicyValidator;
+  constructor();
+  requires(): string[];
+  evaluate(value: Record<string, any>): Promise<PolicyEvaluationResult>;
+}
+//#endregion
 //#region src/policy/built-in/time/constants.d.ts
-declare enum TimePolicyInterval {
+export declare enum TimePolicyInterval {
   DAILY = "daily",
   WEEKLY = "weekly",
   MONTHLY = "monthly",
@@ -447,7 +522,7 @@ declare enum TimePolicyInterval {
 }
 //#endregion
 //#region src/policy/built-in/time/types.d.ts
-interface TimePolicy extends BasePolicy {
+export interface TimePolicy extends BasePolicy {
   /**
    * Format: HH:MM
    */
@@ -475,24 +550,24 @@ interface TimePolicy extends BasePolicy {
 }
 //#endregion
 //#region src/policy/built-in/time/validator.d.ts
-declare class TimePolicyValidator extends Container<TimePolicy> {
+export declare class TimePolicyValidator extends Container<TimePolicy> {
   initialize(): void;
 }
 //#endregion
 //#region src/policy/built-in/time/evaluator.d.ts
-declare class TimePolicyEvaluator implements IPolicyEvaluator {
+export declare class TimePolicyEvaluator implements IPolicyEvaluator {
   protected validator: TimePolicyValidator;
   constructor();
   evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
 //#endregion
 //#region src/policy/built-in/time/helpers.d.ts
-declare function isIntervalForDayOfWeek(interval: string): interval is TimePolicyInterval.WEEKLY | TimePolicyInterval.MONTHLY | TimePolicyInterval.YEARLY;
-declare function isIntervalForDayOfMonth(interval: string): interval is TimePolicyInterval.MONTHLY | TimePolicyInterval.YEARLY;
-declare function isIntervalForDayOfYear(interval: string): interval is TimePolicyInterval.YEARLY;
+export declare function isIntervalForDayOfWeek(interval: string): interval is TimePolicyInterval.WEEKLY | TimePolicyInterval.MONTHLY | TimePolicyInterval.YEARLY;
+export declare function isIntervalForDayOfMonth(interval: string): interval is TimePolicyInterval.MONTHLY | TimePolicyInterval.YEARLY;
+export declare function isIntervalForDayOfYear(interval: string): interval is TimePolicyInterval.YEARLY;
 //#endregion
 //#region src/policy/built-in/constants.d.ts
-declare enum BuiltInPolicyType {
+export declare enum BuiltInPolicyType {
   /**
    * Bundles different policies.
    */
@@ -526,7 +601,7 @@ declare enum BuiltInPolicyType {
    */
   PERMISSION_BINDING = "permissionBinding"
 }
-declare const SystemPolicyName: {
+export declare const SystemPolicyName: {
   readonly DEFAULT: "system.default";
   readonly IDENTITY: "system.identity";
   readonly PERMISSION_BINDING: "system.permission-binding";
@@ -546,16 +621,16 @@ type BuiltInPolicyTypeMapRaw<T extends Record<string, any> = Record<string, any>
   [BuiltInPolicyType.PERMISSION_BINDING]: PermissionBindingPolicy;
   [BuiltInPolicyType.REALM_MATCH]: RealmMatchPolicy;
 };
-type BuiltInPolicyTypeMap<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMapRaw<T> as `${K}`]: BuiltInPolicyTypeMapRaw<T>[K]; };
-type BuiltInPolicies<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMap<T>]: BuiltInPolicyTypeMap<T>[K] & {
+export type BuiltInPolicyTypeMap<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMapRaw<T> as `${K}`]: BuiltInPolicyTypeMapRaw<T>[K]; };
+export type BuiltInPolicies<T extends Record<string, any> = Record<string, any>> = { [K in keyof BuiltInPolicyTypeMap<T>]: BuiltInPolicyTypeMap<T>[K] & {
   type: K;
 }; }[keyof BuiltInPolicyTypeMap];
 //#endregion
 //#region src/policy/built-in/define.d.ts
-declare function definePolicyWithType<K extends keyof BuiltInPolicyTypeMap, D extends BuiltInPolicyTypeMap<any>[K]>(type: K, data: D): PolicyWithType<D, K>;
+export declare function definePolicyWithType<K extends keyof BuiltInPolicyTypeMap, D extends BuiltInPolicyTypeMap<any>[K]>(type: K, data: D): PolicyWithType<D, K>;
 //#endregion
 //#region src/policy/constants.d.ts
-declare const PolicyDefaultEvaluators: {
+export declare const PolicyDefaultEvaluators: {
   readonly composite: CompositePolicyEvaluator;
   readonly attributes: AttributesPolicyEvaluator<Record<string, any>>;
   readonly attributeNames: AttributeNamesPolicyEvaluator;
@@ -575,7 +650,7 @@ declare const PolicyDefaultEvaluators: {
  * a third-party evaluator may supply its own key without any change to this published type
  * (the `access` evaluator set is deliberately extensible).
  */
-interface PolicyInput {
+export interface PolicyInput {
   [BuiltInPolicyType.IDENTITY]?: IdentityPolicyData;
   [BuiltInPolicyType.ATTRIBUTES]?: Record<string, any>;
   [BuiltInPolicyType.REALM_MATCH]?: string | string[] | null;
@@ -588,11 +663,11 @@ interface PolicyInput {
  * Prefer this over `new PolicyData({ ... })` at construction sites so the key vocabulary and
  * per-key value types live in one place.
  */
-declare function definePolicyData(input?: PolicyInput): PolicyData;
+export declare function definePolicyData(input?: PolicyInput): PolicyData;
 //#endregion
 //#region src/permission/error/module.d.ts
-declare const PERMISSION_ERROR_INSTANCE: unique symbol;
-declare class PermissionError extends AuthupError {
+export declare const PERMISSION_ERROR_INSTANCE: unique symbol;
+export declare class PermissionError extends AuthupError {
   constructor(options?: AuthupErrorOptions);
   static notFound(name: string): PermissionError;
   static denied(name: string): PermissionError;
@@ -601,55 +676,7 @@ declare class PermissionError extends AuthupError {
 }
 //#endregion
 //#region src/permission/error/check.d.ts
-declare function isPermissionError(input: unknown): input is PermissionError;
-//#endregion
-//#region src/permission/types.d.ts
-type BasePermission = {
-  name: string;
-  clientId?: string | null;
-  realmId?: string | null;
-  decisionStrategy?: `${DecisionStrategy}` | null;
-};
-/**
- * A raw permission grant: one permission with its policies and realm reach, as loaded from a
- * role/identity junction. `aggregatePermissionPolicyBindings` groups these per permission into
- * a `PermissionPolicyBindingAggregated` (the lossless disjunction of grants).
- */
-type PermissionPolicyBinding = {
-  permission: BasePermission;
-  policies?: BasePolicy[];
-  /**
-   * Relative realm reach of this grant (none/own/ownOrNull/any). Absent coerces to the
-   * most restrictive `own` (fail-closed). NOT part of the binding identity key
-   * (see isPermissionPolicyBindingEqual).
-   */
-  realmScope?: `${RealmScope}`;
-};
-/**
- * One disjunction term of an aggregated binding: a single grant's realm reach paired with its
- * own (single) policy. A disjunction-aware consumer ORs `realmScopeMatches(realmScope) ∧ policy`
- * across the grants of a permission.
- */
-type PermissionGrant = {
-  /** Relative realm reach (none/own/ownOrNull/any), normalized — fail-closed default `own`. */
-  realmScope: `${RealmScope}`;
-  /**
-   * The grant's policy: the raw junction policy (its `id` preserved, for propagation) for a
-   * single-policy grant, a composite for a multi-policy (Layer-1) binding, or `undefined`
-   * when the grant carries no restriction.
-   */
-  policy?: BasePolicy;
-};
-/**
- * A permission together with the actor's disjunction of grants for it. Output of
- * `aggregatePermissionPolicyBindings` — the honest, lossless replacement for the collapsed
- * `PermissionPolicyBinding` (no top-level realmScope/policies; the access decision is the
- * OR over `grants`).
- */
-type PermissionPolicyBindingAggregated = {
-  permission: BasePermission;
-  grants: PermissionGrant[];
-};
+export declare function isPermissionError(input: unknown): input is PermissionError;
 //#endregion
 //#region src/permission/helpers/aggregate.d.ts
 /**
@@ -659,10 +686,10 @@ type PermissionPolicyBindingAggregated = {
  * grant disjunction directly, so each grant's realm reach stays paired with the policy that
  * gates it.
  */
-declare function aggregatePermissionPolicyBindings(input: PermissionPolicyBinding[]): PermissionPolicyBindingAggregated[];
+export declare function aggregatePermissionPolicyBindings(input: PermissionPolicyBinding[]): PermissionPolicyBindingAggregated[];
 //#endregion
 //#region src/permission/helpers/equal.d.ts
-declare function isPermissionPolicyBindingEqual(a: {
+export declare function isPermissionPolicyBindingEqual(a: {
   permission: BasePermission;
 }, b: {
   permission: BasePermission;
@@ -675,23 +702,23 @@ declare function isPermissionPolicyBindingEqual(a: {
  * (see `policyDominates`). Used per grant by `isSuperset` over the aggregated disjunction —
  * every child grant must be dominated by SOME parent grant.
  */
-declare function grantDominates(parent: PermissionGrant, child: PermissionGrant): boolean;
+export declare function grantDominates(parent: PermissionGrant, child: PermissionGrant): boolean;
 //#endregion
 //#region src/permission/helpers/key.d.ts
-declare function buildPermissionKey(input: BasePermission): string;
+export declare function buildPermissionKey(input: BasePermission): string;
 //#endregion
 //#region src/permission/provider/types.d.ts
-type PermissionGetOptions = {
+export type PermissionGetOptions = {
   name: string;
   clientId?: string | null;
   realmId?: string | null;
 };
-interface IPermissionProvider {
+export interface IPermissionProvider {
   findOne(criteria: PermissionGetOptions): Promise<PermissionPolicyBindingAggregated | null>;
 }
 //#endregion
 //#region src/permission/provider/memory.d.ts
-declare class PermissionMemoryProvider implements IPermissionProvider {
+export declare class PermissionMemoryProvider implements IPermissionProvider {
   protected items: Record<string, PermissionPolicyBindingAggregated>;
   constructor(items?: PermissionPolicyBinding[]);
   findOne(options: PermissionGetOptions): Promise<PermissionPolicyBindingAggregated | null>;
@@ -699,20 +726,20 @@ declare class PermissionMemoryProvider implements IPermissionProvider {
 }
 //#endregion
 //#region src/permission/evaluator/types.d.ts
-interface IPermissionEvaluator {
+export interface IPermissionEvaluator {
   evaluate(ctx: PermissionEvaluationContext): Promise<void>;
   evaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluate(ctx: PermissionEvaluationContext): Promise<void>;
   preEvaluateOneOf(ctx: PermissionEvaluationContext): Promise<void>;
   compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
-type PermissionEvaluatorOptions = {
+export type PermissionEvaluatorOptions = {
   provider: IPermissionProvider;
   policyEngine?: IPolicyEngine;
   realmId?: string | null;
   clientId?: string | null;
 };
-type PermissionEvaluationOptions = {
+export type PermissionEvaluationOptions = {
   decisionStrategy?: `${DecisionStrategy}`;
   policiesIncluded?: string[];
   policiesExcluded?: string[];
@@ -727,14 +754,14 @@ type PermissionEvaluationOptions = {
    */
   pendingPolicies?: 'deny' | 'permit';
 };
-type PermissionEvaluationContext = {
+export type PermissionEvaluationContext = {
   name: string | string[];
   realmId?: string | null;
   clientId?: string | null;
   data?: PolicyData;
   options?: PermissionEvaluationOptions;
 };
-type PermissionCompileContext = {
+export type PermissionCompileContext = {
   /**
    * Permission name(s). Several names compile as a disjunction — the row is
    * readable when ANY of them passes (`evaluateOneOf` semantics).
@@ -748,6 +775,14 @@ type PermissionCompileContext = {
    * compiled condition ranges over.
    */
   data?: PolicyData;
+  /**
+   * Row column the realm reach is lowered onto, when the rows this compilation
+   * ranges over carry their realm under another name — a junction's owner-realm
+   * key (`roleRealmId`, `clientRealmId`, …). Default `realmId`. Affects the
+   * `conditional` condition only; the per-row `post` fallback still reads the
+   * realm from the `realmMatch` data key its caller supplies.
+   */
+  realmAttributeName?: string;
 };
 /**
  * Outcome of compiling a permission's policy trees against the knowns bag
@@ -760,7 +795,7 @@ type PermissionCompileContext = {
  * - `post` — some pending policy is not expressible as a condition; fall back to
  *   loading rows and evaluating per row (always sound).
  */
-type PermissionCompileResult = {
+export type PermissionCompileResult = {
   verdict: 'allow';
 } | {
   verdict: 'deny';
@@ -772,7 +807,7 @@ type PermissionCompileResult = {
 };
 //#endregion
 //#region src/permission/evaluator/module.d.ts
-declare class PermissionEvaluator implements IPermissionEvaluator {
+export declare class PermissionEvaluator implements IPermissionEvaluator {
   protected provider: IPermissionProvider;
   protected policyEngine: IPolicyEngine;
   protected clientId?: string | null;
@@ -799,5 +834,381 @@ declare class PermissionEvaluator implements IPermissionEvaluator {
   compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 //#endregion
-export { AttributeNamesPolicy, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicy, AttributesPolicyEvaluator, AttributesPolicyQuery, AttributesPolicyValidator, BasePermission, BasePolicy, BuiltInPolicies, BuiltInPolicyType, BuiltInPolicyTypeMap, CompositePolicy, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicy, DatePolicyEvaluator, DatePolicyValidator, IPermissionEvaluator, IPermissionProvider, IPolicyData, IPolicyEngine, IPolicyEvaluator, IdentityPolicy, IdentityPolicyData, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicy, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionCompileContext, PermissionCompileResult, PermissionError, PermissionEvaluationContext, PermissionEvaluationOptions, PermissionEvaluator, PermissionEvaluatorOptions, PermissionGetOptions, PermissionGrant, PermissionMemoryProvider, PermissionPolicyBinding, PermissionPolicyBindingAggregated, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyEvaluationContext, PolicyEvaluationContextInput, PolicyEvaluationResult, PolicyEvaluators, PolicyInput, PolicyIssue, PolicyIssueCode, PolicyIssueGroup, PolicyIssueItem, PolicyIssueSeverity, PolicyWithType, REALM_SCOPE_ORDER, RealmMatchPolicy, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicy, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };
+//#region src/permission/authorization/error.d.ts
+export declare const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE: unique symbol;
+/**
+ * A grant references a definition or a policy the supplied catalog does not
+ * carry: the caller's cached catalog predates the definition or the junction
+ * row and must be refetched. A definition the catalog carries with
+ * `policies: null`, and one whose tree this copy cannot project, are not
+ * stale but unevaluable, and a grant of either is dropped.
+ *
+ * Recognize it with `isAuthorizationCatalogStaleError`, never `instanceof`:
+ * this package is a plain caret dependency of several workspaces, so a
+ * consumer tree may resolve two copies of it and turn the one recoverable
+ * state into an unrecoverable one.
+ */
+export declare class AuthorizationCatalogStaleError extends AuthupError {
+  constructor(message: string);
+}
+//#endregion
+//#region src/permission/authorization/check.d.ts
+/**
+ * Marker-only: the error carries no code of its own, and it never crosses a
+ * wire boundary, so there is no shape to fall back to.
+ */
+export declare function isAuthorizationCatalogStaleError(input: unknown): input is AuthorizationCatalogStaleError;
+//#endregion
+//#region src/permission/authorization/types.d.ts
+/**
+ * One policy tree node as it travels: the type's configuration keys (the output
+ * of that type's validator), `invert`, and for a composite its children inline.
+ */
+export type AuthorizationPolicy = {
+  type: string;
+  invert?: boolean | null;
+  children?: AuthorizationPolicy[];
+  [key: string]: unknown;
+};
+export type AuthorizationDefinition = {
+  name: string;
+  realm_id: string | null;
+  client_id: string | null;
+  decision_strategy: `${DecisionStrategy}` | null;
+  /**
+   * The definition layer: the ids of the policy trees bound to the permission
+   * definition (`auth_permission_policies`). Empty means unrestricted at this
+   * layer. `null` means the server could not project one of those trees onto
+   * the wire (a policy type the catalog does not carry, or a configuration
+   * its validator refuses): the definition exists, a consumer cannot evaluate
+   * it and denies it, dropping every grant of it, until the policy is fixed.
+   */
+  policies: string[] | null;
+};
+/**
+ * Identity-free and cacheable: every permission definition with its policy trees.
+ */
+export type AuthorizationCatalog = {
+  /**
+   * Every policy tree a definition or a grant can name, keyed by the tree's
+   * own id and present exactly once however many of them reference it.
+   */
+  policies: Record<string, AuthorizationPolicy>;
+  permissions: AuthorizationDefinition[];
+};
+/**
+ * One raw grant of an identity as the introspection endpoints report it: the
+ * permission namespace it names, its realm reach and the junction policy ids.
+ * Structurally the extended `OAuth2TokenPermission` of `@authup/specs` (this
+ * package does not depend on specs).
+ */
+export type AuthorizationGrant = {
+  name: string;
+  realm_id?: string | null;
+  client_id?: string | null;
+  /**
+   * Absent or null coerces to `own`, fail-closed.
+   */
+  realm_scope?: `${RealmScope}` | null;
+  /**
+   * Absent or null means no junction policy.
+   */
+  policies?: string[] | null;
+};
+export type AuthorizationEvaluatorInput = {
+  /**
+   * An `AuthorizationCatalog`, validated by the schema.
+   */
+  catalog: unknown;
+  /**
+   * `AuthorizationGrant[]`, validated by the schema. Defaults to none, and
+   * may only be supplied together with the identity holding them.
+   */
+  grants?: unknown;
+  /**
+   * The identity the grants belong to. Omitted for an anonymous caller:
+   * no identity data is injected and no grant is bound, so only a
+   * definition whose policies need no identity can pass.
+   */
+  identity?: IdentityPolicyData;
+};
+/**
+ * Which resource realms a batch check evaluates against.
+ *
+ * A string is SYMBOLIC and resolved server-side against the caller's own
+ * identity: `own` is the realm the identity belongs to, `ownOrNull` is that
+ * realm plus `null`, the global rows every realm shares. An array is taken
+ * VERBATIM: the server resolves no realm key, so it discloses no realm's
+ * existence and the caller matches the answer against its own input with no
+ * resolution step of its own.
+ *
+ * String versus array is what discriminates the two forms, so `own` stays
+ * unambiguous even though it is a legal realm name.
+ */
+export type AuthorizationCheckRealms = `${RealmScope.OWN}` | `${RealmScope.OWN_OR_NULL}` | Array<string | null>;
+/**
+ * One permission the identity may attempt, and the requested realms it may
+ * attempt it in. Never empty: a permission reaching no requested realm is
+ * absent from the answer entirely, so absent means denied.
+ */
+export type AuthorizationCheckPermission = {
+  name: string;
+  realms: Array<string | null>;
+};
+/**
+ * The answer `POST /authorization/check` serves: the caller's own verdicts,
+ * paired with the realms they hold in.
+ *
+ * It is an upper bound on what may be ATTEMPTED rather than an entitlement,
+ * the same posture the catalog and `GET /schemas` take: it is a pre-gate, so a
+ * grant whose junction policy needs a resource row passes here and is still
+ * decided per row on the server, which stays the enforcement point.
+ */
+export type AuthorizationCheckPermissions = AuthorizationCheckPermission[];
+export type AuthorizationCheckEvaluatorInput = {
+  /**
+   * An `AuthorizationCheckPermissions`, validated by the schema.
+   */
+  permissions: unknown;
+  /**
+   * The identity the verdicts belong to, used to resolve a `realmMatch` of
+   * `own` shape: a resource realm equal to this identity's realm id or name
+   * is the identity's own realm. Omitted for an anonymous caller, which
+   * holds no verdict at all.
+   */
+  identity?: IdentityPolicyData;
+};
+//#endregion
+//#region src/permission/authorization/check-schema.d.ts
+/**
+ * The whole input `createAuthorizationCheckEvaluator` takes: the answer
+ * `POST /authorization/check` served and the identity it belongs to. Same
+ * validup-over-zod shape as the catalog's input, so a consumer can override
+ * one member's rules instead of restating the answer.
+ */
+export declare class AuthorizationCheckEvaluatorInputValidator extends Container<AuthorizationCheckEvaluatorInput> {
+  initialize(): void;
+}
+export type AuthorizationCheckEvaluatorInputParsed = {
+  permissions: AuthorizationCheckPermissions;
+  identity: AuthorizationCheckEvaluatorInput['identity'];
+};
+/**
+ * Validate the check evaluator's input, plus the one rule a per-key validator
+ * cannot express: a permission namespace appears at most once. Two entries for
+ * one name would make the answer depend on which the consumer looked up first,
+ * and the server emits one entry per name by construction.
+ */
+export declare function parseAuthorizationCheckEvaluatorInput(input: AuthorizationCheckEvaluatorInput): Promise<AuthorizationCheckEvaluatorInputParsed>;
+//#endregion
+//#region src/permission/authorization/constants.d.ts
+/**
+ * The node a policy tree travels as when the server withholds it, because the
+ * caller's realm reach does not cover the row it was read from.
+ *
+ * It is deliberately a type no consumer can project: `projectAuthorizationPolicy`
+ * refuses it, which is already the state a definition referencing it denies
+ * through and a grant naming it is dropped through, so withholding a body needs
+ * no rule of its own on the consumer side. That is a contract between the two
+ * halves rather than a server detail, which is why it is declared HERE, next to
+ * the projection that has to keep refusing it, and pinned by this package's own
+ * test.
+ */
+export declare const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
+//#endregion
+//#region src/permission/authorization/module.d.ts
+/**
+ * Build a resource-server (or console) evaluator from the catalog
+ * `GET /authorization` serves, the identity's grants as the introspection
+ * endpoints report them, and the identity itself. Rejects legacy, incomplete
+ * and unsupported input. A grant referencing a definition or a policy the
+ * catalog lacks throws `AuthorizationCatalogStaleError`, the signal to
+ * refetch the catalog: the grants come from a fresh introspection while the
+ * catalog may predate the definition or the junction row. A definition the
+ * server could not project travels with `policies: null` instead of being
+ * left out, so a grant of it is dropped rather than reported stale: the
+ * definition layer cannot be evaluated here, a refetch changes nothing, and
+ * the permission denies until the policy is fixed.
+ *
+ * A tree THIS copy cannot project is the same condition read from the other
+ * side, and it is per tree: a policy type newer than this package (the
+ * built-in type enum is closed while the column is a free string) or a
+ * configuration its validator refuses denies the definitions that reference
+ * it, exactly as `policies: null` does, and drops a grant that names it,
+ * exactly as a binding check does. One such tree never takes the evaluator
+ * down for the permissions that do not use it. A malformed catalog still
+ * throws: a duplicate permission namespace is not a data condition.
+ *
+ * Both the identity and the grants are optional. Without an identity no grant
+ * is bound and any IDENTITY key the caller supplied is REMOVED, so the
+ * binding evaluator answers with missing data exactly as the server does for
+ * an anonymous request, only a definition whose policies need no identity can
+ * pass, and a caller can never inject an identity the document did not prove.
+ * Grants without the identity they belong to are refused.
+ *
+ * The REALM_MATCH data key follows the server's own three-way rule: a
+ * resource that carries a realm passes it (null for a global row, which
+ * `own` denies), a resource with no realm dimension passes nothing and reach
+ * neutral-passes. `preEvaluate` / `preEvaluateOneOf` are the pre-gate and
+ * enforce reach only when that key is present. `compile` returns the
+ * allow/deny/conditional/post contract; a `post` collection query must be
+ * rejected or evaluated over every candidate before paging. The supplied
+ * identity is authoritative; `options.decisionStrategy` is forwarded and the
+ * policy include, exclude and pending options are refused.
+ */
+export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput): Promise<IPermissionEvaluator>;
+/**
+ * An `IPermissionEvaluator` over the answer `POST /authorization/check`
+ * served: the caller's own verdicts, paired with the realms they hold in.
+ *
+ * It is what a PUBLIC client gets where the catalog is out of reach. A public
+ * client holds no secret, so it can obtain no `client_credentials` token and
+ * has no credential of its own for the catalog's gate to be satisfied by;
+ * publishing every policy predicate to it instead would be the wrong trade.
+ * The verdicts are computed by the server from the same grants and the same
+ * evaluators a request runs, so this is authoritative where the name-only
+ * fallback it replaces is merely coarse.
+ *
+ * Two properties follow from the answer being a pre-gate:
+ *
+ * It is an UPPER BOUND, so `evaluate` and `evaluateOneOf` answer exactly what
+ * the pre-gate pair answers. A check that depends on a resource row belongs to
+ * whoever holds the row, and the server decides it there; answering such a
+ * check here would mean inventing a verdict. That is the same bound the
+ * name-only fallback already had, so nothing that gates on it loosens.
+ *
+ * And a resource realm is matched against what the REQUEST asked about: a
+ * `realmMatch` naming a realm the request never carried is in no entry's list
+ * and therefore denies. That is fail-closed by construction rather than by a
+ * rule, and it is why a caller must ask about the realms its UI will ask
+ * about.
+ */
+export declare function createAuthorizationCheckEvaluator(input: AuthorizationCheckEvaluatorInput): Promise<IPermissionEvaluator>;
+//#endregion
+//#region src/permission/authorization/policy.d.ts
+/**
+ * The one definition of what a policy looks like on the wire, used by the server
+ * to build a document and by the consumer to validate one. A node is the OUTPUT
+ * of its type's validator (validup strips every unmounted key, so entity columns
+ * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
+ * and, for a composite, its projected children.
+ *
+ * Every refusal is a `ValidupError`, the node's head and the type's own
+ * validator alike, and a child's issues are rebased onto the position it sits
+ * at, so one message names the node in the tree that is wrong.
+ */
+export declare function projectAuthorizationPolicy(input: unknown): Promise<AuthorizationPolicy>;
+/**
+ * Whether a projected tree evaluates the permission binding at any depth. A
+ * grant policy carrying one would re-enter its own permission's grants, so
+ * `createAuthorizationEvaluator` drops the grant that names it and evaluates
+ * the permission from the rest. Its one caller is that consumer: the tree is
+ * legal in a definition, where the binding check is what reach is enforced
+ * by, so the producer carries it and only the grant side is refused.
+ */
+export declare function containsBindingCheck(policy: AuthorizationPolicy): boolean;
+//#endregion
+//#region src/permission/authorization/schema.d.ts
+/**
+ * A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
+ * that type's own configuration, and `projectAuthorizationPolicy` is what
+ * validates it, by running the type's own validator. Mounting a node in a
+ * validup container would strip every key the container does not mount, and
+ * the whole configuration would go with it.
+ */
+export declare const authorizationPolicySchema: z.ZodObject<{
+  type: z.ZodString;
+}, z.core.$loose>;
+/**
+ * One permission definition. `policies` carries the ids of its
+ * definition-layer trees, or `null` when the server could not project one.
+ */
+export declare const authorizationDefinitionSchema: z.ZodObject<{
+  name: z.ZodString;
+  realm_id: z.ZodNullable<z.ZodString>;
+  client_id: z.ZodNullable<z.ZodString>;
+  decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+  policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCatalogSchema: z.ZodObject<{
+  policies: z.ZodRecord<z.ZodString, z.ZodObject<{
+    type: z.ZodString;
+  }, z.core.$loose>>;
+  permissions: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    realm_id: z.ZodNullable<z.ZodString>;
+    client_id: z.ZodNullable<z.ZodString>;
+    decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+    policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * One grant of the identity, as the introspection endpoints report it.
+ * Whether a grant's policy ids are declared is checked against the catalog
+ * the consumer holds, since the two travel separately.
+ */
+export declare const authorizationGrantSchema: z.ZodObject<{
+  name: z.ZodString;
+  realm_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  client_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  realm_scope: z.ZodOptional<z.ZodNullable<z.ZodEnum<typeof RealmScope>>>;
+  policies: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export declare const authorizationIdentitySchema: z.ZodObject<{
+  id: z.ZodString;
+  type: z.ZodEnum<{
+    user: "user";
+    client: "client";
+  }>;
+  realmId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  realmName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * The whole input `createAuthorizationEvaluator` takes: the catalog
+ * `GET /authorization` serves, the grants an introspection reports and the
+ * identity it names. A validup container over zod mounts, the shape every
+ * validator in this package uses, so a consumer can reuse or override one
+ * member's rules instead of restating the document.
+ */
+export declare class AuthorizationEvaluatorInputValidator extends Container<AuthorizationEvaluatorInput> {
+  initialize(): void;
+}
+export type AuthorizationEvaluatorInputParsed = {
+  catalog: AuthorizationCatalog;
+  grants: AuthorizationGrant[];
+  identity: AuthorizationEvaluatorInput['identity'];
+};
+/**
+ * Validate the evaluator's input, plus the two rules per-key validators
+ * cannot express.
+ *
+ * Every id a definition names must be a key of `policies`: a dangling id
+ * resolves to `undefined`, which reads as "this layer carries no policy", so
+ * a catalog that merely omitted a tree would grant unrestricted access rather
+ * than fail. The lookup is own-property only, so an id such as `constructor`
+ * cannot be answered by a member of `Object.prototype`.
+ *
+ * And the identity and its grants travel together: grants without an identity
+ * belong to nobody, while an identity without a grant list is the shape an
+ * INACTIVE introspection produces (`permissions` is absent unless the
+ * credential is active), which read as "holds nothing" would authorize every
+ * definition that carries no binding check. An identity holding no grant says
+ * so with an empty array.
+ */
+export declare function parseAuthorizationEvaluatorInput(input: AuthorizationEvaluatorInput): Promise<AuthorizationEvaluatorInputParsed>;
+/**
+ * One verdict: the permission namespace and the requested realms it holds in.
+ * A realm value is a realm key the caller itself supplied, or `null` for the
+ * global rows, so nothing here is resolved or looked up.
+ */
+export declare const authorizationCheckPermissionSchema: z.ZodObject<{
+  name: z.ZodString;
+  realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCheckPermissionsSchema: z.ZodArray<z.ZodObject<{
+  name: z.ZodString;
+  realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+//#endregion
 //# sourceMappingURL=index.d.mts.map