@authup/access 1.0.0-beta.65 → 1.0.0-beta.67

package/dist/index.mjs

@@ -1,10 +1,10 @@
-import { AuthupError, ErrorCode, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
+import { AuthupError, ErrorCode, InternalError, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
 import { DecisionStrategy, flattenObject, hasOwnProperty, isObject } from "@authup/kit";
 import { isEqual } from "smob";
 import { and, eq, inArray, nin, not, or } from "@rapiq/core";
-import { defineIssueGroup, defineIssueItem } from "@ebec/core";
-import { createValidator } from "@validup/zod";
-import { Container } from "validup";
+import { defineIssueGroup, defineIssueItem, prefixIssuePath } from "@ebec/core";
+import { buildIssuesForZodError, createValidator } from "@validup/zod";
+import { Container, ValidupError, isValidupError } from "validup";
 import { z } from "zod";
 import { compileFilters } from "@rapiq/adapter-memory";
 import { MongoFiltersParser } from "@rapiq/parser-mongo";
@@ -515,6 +515,10 @@ var PolicyData = class PolicyData {
 	has(key) {
 		return key in this.data;
 	}
+	delete(key) {
+		delete this.data[key];
+		this.validated.delete(key);
+	}
 	setValidated(key) {
 		this.validated.add(key);
 	}
@@ -534,7 +538,26 @@ function definePolicyEvaluationContext(input = {}) {
 		data: input.data || new PolicyData(),
 		include: input.include || [],
 		exclude: input.exclude || [],
-		withConditions: input.withConditions ?? false
+		withConditions: input.withConditions ?? false,
+		realmAttributeName: input.realmAttributeName,
+		transitions: input.transitions
+	};
+}
+//#endregion
+//#region src/policy/evaluation/context/transition.ts
+/**
+* A sink keeping the earliest reported instant, which is the moment an answer
+* built from every evaluation it was handed to stops being current.
+*/
+function createPolicyTransitionCollector() {
+	let next;
+	return {
+		report(at) {
+			if (!next || at.getTime() < next.getTime()) next = at;
+		},
+		get next() {
+			return next;
+		}
 	};
 }
 //#endregion
@@ -757,7 +780,7 @@ var CompositePolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
 		this.mount("decisionStrategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(3) }))));
+		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(1) }))));
 		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
 	}
 };
@@ -895,6 +918,22 @@ function toDate$1(input) {
 	if (typeof input === "number") return new Date(input);
 	return input;
 }
+/**
+* The next instant at which a date policy's verdict could change, seen from the
+* (day-normalized) `now`: the start day while it is still ahead, else the
+* midnight after the end day while that day has not passed. Nothing once the
+* end day is behind, since the verdict is final from then on.
+*/
+function nextDateTransition(policy, now) {
+	if (policy.start) {
+		const start = normalizeDate$1(toDate$1(policy.start));
+		if (now < start) return start;
+	}
+	if (policy.end) {
+		const end = normalizeDate$1(toDate$1(policy.end));
+		if (now <= end) return new Date(end.getFullYear(), end.getMonth(), end.getDate() + 1);
+	}
+}
 var DatePolicyEvaluator = class {
 	validator;
 	constructor() {
@@ -910,7 +949,13 @@ var DatePolicyEvaluator = class {
 				ctx.data.set("date", now);
 				ctx.data.setValidated("date");
 			}
-		} else now = normalizeDate$1(/* @__PURE__ */ new Date());
+		} else {
+			now = normalizeDate$1(/* @__PURE__ */ new Date());
+			if (ctx.transitions) {
+				const next = nextDateTransition(policy, now);
+				if (next) ctx.transitions.report(next);
+			}
+		}
 		if (policy.start) {
 			const start = normalizeDate$1(toDate$1(policy.start));
 			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
@@ -987,25 +1032,6 @@ var IdentityPolicyEvaluator = class {
 	}
 };
 //#endregion
-//#region src/policy/built-in/permission-binding/validator.ts
-var PermissionBindingPolicyValidator = class extends Container {
-	initialize() {}
-};
-//#endregion
-//#region src/policy/built-in/permission-binding/module.ts
-var PermissionBindingPolicyEvaluator = class {
-	validator;
-	constructor() {
-		this.validator = new PermissionBindingPolicyValidator();
-	}
-	requires() {
-		return ["permissionBinding"];
-	}
-	async evaluate(value) {
-		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
-	}
-};
-//#endregion
 //#region src/policy/built-in/realm-match/validator.ts
 var RealmMatchPolicyValidator = class extends Container {
 	initialize() {
@@ -1062,7 +1088,7 @@ var RealmMatchPolicyEvaluator = class {
 			else {
 				const terms = [];
 				if (realmId !== null && scope !== "none") terms.push(eq(field, realmId));
-				if (scope === "ownOrNull") terms.push(eq(field, null));
+				if (scope === "ownOrNull" && (realmId !== null || identity.realmName != null)) terms.push(eq(field, null));
 				if (terms.length === 0) condition = inArray(field, []);
 				else if (terms.length === 1) condition = terms[0];
 				else condition = or(...terms);
@@ -1161,6 +1187,159 @@ var RealmMatchPolicyEvaluator = class {
 	}
 };
 //#endregion
+//#region src/policy/built-in/permission-binding/validator.ts
+var PermissionBindingPolicyValidator = class extends Container {
+	initialize() {
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/identity-evaluator.ts
+function containsPermissionBinding(policy) {
+	if (policy.type === "permissionBinding") return true;
+	if (policy.type !== "composite") return false;
+	const children = policy.children;
+	return Array.isArray(children) && children.some((child) => !!child && typeof child === "object" && containsPermissionBinding(child));
+}
+var IdentityPermissionBindingPolicyEvaluator = class {
+	validator;
+	identityEvaluator;
+	realmMatchEvaluator;
+	identityPermissionProvider;
+	constructor(identityPermissionProvider) {
+		this.validator = new PermissionBindingPolicyValidator();
+		this.identityEvaluator = new IdentityPolicyEvaluator();
+		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
+		this.identityPermissionProvider = identityPermissionProvider;
+	}
+	requires() {
+		return ["permissionBinding"];
+	}
+	async accessData(ctx) {
+		if (!ctx.data.has("permissionBinding")) return null;
+		if (ctx.data.isValidated("permissionBinding")) return ctx.data.get("permissionBinding");
+		const data = ctx.data.get("permissionBinding");
+		ctx.data.set("permissionBinding", data);
+		ctx.data.setValidated("permissionBinding");
+		return data;
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const identity = await this.identityEvaluator.accessData(ctx);
+		if (!identity) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: "DATA_MISSING",
+				message: "The data property identity is missing",
+				path: ctx.path
+			})]
+		};
+		const binding = await this.accessData(ctx);
+		if (!binding) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: "DATA_MISSING",
+				message: "The data property permission is missing",
+				path: ctx.path
+			})]
+		};
+		const identityBindings = await this.identityPermissionProvider.getFor(identity).then((bindings) => bindings.filter((item) => {
+			if (item.permission.name !== binding.permission.name) return false;
+			return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
+		}));
+		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
+		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const issues = [];
+		const pendingIssues = [];
+		const conditions = [];
+		let pending = false;
+		let lowerable = true;
+		for (const grant of aggr.grants) {
+			let reachCondition = null;
+			const realmOutcome = await this.realmMatchEvaluator.evaluate({
+				scope: grant.realmScope,
+				attributeName: ctx.realmAttributeName
+			}, ctx);
+			if (realmOutcome.pending) {
+				const scope = normalizeRealmScope(grant.realmScope);
+				if (scope === "none") continue;
+				if (scope !== "any") {
+					if (!realmOutcome.condition) {
+						pending = true;
+						lowerable = false;
+						continue;
+					}
+					reachCondition = realmOutcome.condition;
+				}
+			} else if (!realmOutcome.success) continue;
+			if (!grant.policy) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			if (containsPermissionBinding(grant.policy)) {
+				issues.push(definePolicyIssueItem({
+					code: "INVALID",
+					message: "A grant policy must not evaluate the permission binding.",
+					path: ctx.path
+				}));
+				continue;
+			}
+			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
+				...ctx,
+				path: [...ctx.path || []]
+			});
+			if (outcome.success) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			if (outcome.pending) {
+				pending = true;
+				if (ctx.withConditions && outcome.condition && !ctx.realmAttributeName) conditions.push(reachCondition ? and(reachCondition, outcome.condition) : outcome.condition);
+				else lowerable = false;
+				if (outcome.issues) pendingIssues.push(...outcome.issues);
+				continue;
+			}
+			if (outcome.issues) issues.push(...outcome.issues);
+		}
+		if (pending) {
+			const result = {
+				success: false,
+				pending: true,
+				issues: pendingIssues
+			};
+			if (lowerable && ctx.withConditions && conditions.length > 0) {
+				const condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+				result.condition = policy.invert ? not(condition) : condition;
+			}
+			return result;
+		}
+		const success = maybeInvertPolicyOutcome(false, policy.invert);
+		return {
+			success,
+			issues: success ? [] : issues
+		};
+	}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/module.ts
+var PermissionBindingPolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new PermissionBindingPolicyValidator();
+	}
+	requires() {
+		return ["permissionBinding"];
+	}
+	async evaluate(value) {
+		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
+	}
+};
+//#endregion
 //#region src/policy/built-in/time/constants.ts
 let TimePolicyInterval = /* @__PURE__ */ function(TimePolicyInterval) {
 	TimePolicyInterval["DAILY"] = "daily";
@@ -1220,6 +1399,30 @@ function toDate(input, dateRef) {
 	if (typeof input === "number") return new Date(input);
 	return input;
 }
+/**
+* The next instant at which a time policy's verdict could change, seen from
+* `now`: today's start while it is ahead, the minute after today's end while
+* that is ahead, and the next local midnight, where the daily window moves on
+* and the day-of-week/month/year checks roll over. The earliest of those; a
+* policy with no constraint never changes.
+*
+* `normalizeDate` keeps the seconds and milliseconds of the instant it is
+* evaluated at and drops the policy's own, so the comparisons below are made
+* at minute precision: `now < start` stops holding at HH:MM:00.000 of the
+* start, and `now > end` starts holding at the following minute. Reading the
+* candidates off `normalizeDate` instead would report the seconds of this
+* evaluation, up to a minute after the verdict already flipped.
+*/
+function nextTimeTransition(policy, now) {
+	const candidates = [];
+	const atMinute = (input) => new Date(now.getFullYear(), now.getMonth(), now.getDate(), input.getHours(), input.getMinutes());
+	if (policy.start) candidates.push(atMinute(toDate(policy.start, now)));
+	if (policy.end) candidates.push(new Date(atMinute(toDate(policy.end, now)).getTime() + 6e4));
+	if (policy.start || policy.end || policy.interval) candidates.push(new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1));
+	let next;
+	for (const candidate of candidates) if (candidate.getTime() > now.getTime() && (!next || candidate.getTime() < next.getTime())) next = candidate;
+	return next;
+}
 var TimePolicyEvaluator = class {
 	validator;
 	constructor() {
@@ -1235,7 +1438,13 @@ var TimePolicyEvaluator = class {
 				ctx.data.set("time", now);
 				ctx.data.setValidated("time");
 			}
-		} else now = /* @__PURE__ */ new Date();
+		} else {
+			now = /* @__PURE__ */ new Date();
+			if (ctx.transitions) {
+				const next = nextTimeTransition(policy, now);
+				if (next) ctx.transitions.report(next);
+			}
+		}
 		if (policy.start) {
 			const start = normalizeDate(toDate(policy.start, now), now);
 			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
@@ -1280,6 +1489,25 @@ const PolicyDefaultEvaluators = {
 	["realmMatch"]: new RealmMatchPolicyEvaluator(),
 	["time"]: new TimePolicyEvaluator()
 };
+/**
+* The configuration validator of every built-in policy type, keyed like
+* `PolicyDefaultEvaluators`. It is what `projectAuthorizationPolicy` runs a
+* node through, so a type absent here cannot travel in the authorization
+* catalog. The registry is open like the evaluator one (#3635): spread it and
+* add a custom type's validator to let that type travel. It is frozen, since
+* a write into it would make the type projectable for every caller in the
+* process.
+*/
+const PolicyDefaultValidators = Object.freeze({
+	["composite"]: new CompositePolicyValidator(),
+	["attributes"]: new AttributesPolicyValidator(),
+	["attributeNames"]: new AttributeNamesPolicyValidator(),
+	["date"]: new DatePolicyValidator(),
+	["identity"]: new IdentityPolicyValidator(),
+	["permissionBinding"]: new PermissionBindingPolicyValidator(),
+	["realmMatch"]: new RealmMatchPolicyValidator(),
+	["time"]: new TimePolicyValidator()
+});
 //#endregion
 //#region src/policy/input.ts
 /**
@@ -1356,6 +1584,7 @@ var PermissionEvaluator = class {
 			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
 				include: options.policiesIncluded,
 				exclude: options.policiesExcluded,
+				transitions: options.transitions,
 				data
 			}));
 			if (evaluationResult.success || options.pendingPolicies === "permit" && !!evaluationResult.pending) {
@@ -1435,7 +1664,8 @@ var PermissionEvaluator = class {
 			};
 			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
 				data,
-				withConditions: true
+				withConditions: true,
+				realmAttributeName: ctx.realmAttributeName
 			}));
 			if (evaluationResult.success) return { verdict: "allow" };
 			if (evaluationResult.pending) {
@@ -1459,6 +1689,584 @@ var PermissionEvaluator = class {
 	}
 };
 //#endregion
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };
+//#region src/permission/authorization/error.ts
+const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE = Symbol.for("@authup/access/AuthorizationCatalogStaleError");
+/**
+* A grant references a definition or a policy the supplied catalog does not
+* carry: the caller's cached catalog predates the definition or the junction
+* row and must be refetched. A definition the catalog carries with
+* `policies: null`, and one whose tree this copy cannot project, are not
+* stale but unevaluable, and a grant of either is dropped.
+*
+* Recognize it with `isAuthorizationCatalogStaleError`, never `instanceof`:
+* this package is a plain caret dependency of several workspaces, so a
+* consumer tree may resolve two copies of it and turn the one recoverable
+* state into an unrecoverable one.
+*/
+var AuthorizationCatalogStaleError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		this.name = "AuthorizationCatalogStaleError";
+		markInstanceof(this, AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE);
+	}
+};
+//#endregion
+//#region src/permission/authorization/check.ts
+/**
+* Marker-only: the error carries no code of its own, and it never crosses a
+* wire boundary, so there is no shape to fall back to.
+*/
+function isAuthorizationCatalogStaleError(input) {
+	return matchesInstanceof(input, AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE);
+}
+//#endregion
+//#region src/permission/authorization/schema.ts
+const id = z.string().min(1);
+const namespaceId = id.nullable();
+/**
+* A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
+* that type's own configuration, and `projectAuthorizationPolicy` is what
+* validates it, by running the type's own validator. Mounting a node in a
+* validup container would strip every key the container does not mount, and
+* the whole configuration would go with it.
+*/
+const authorizationPolicySchema = z.looseObject({ type: z.string().min(1) });
+/**
+* One permission definition. `policies` carries the ids of its
+* definition-layer trees, or `null` when the server could not project one.
+*/
+const authorizationDefinitionSchema = z.object({
+	name: z.string().min(1),
+	realm_id: namespaceId,
+	client_id: namespaceId,
+	decision_strategy: z.enum(DecisionStrategy).nullable(),
+	policies: z.array(id).nullable()
+});
+const authorizationCatalogSchema = z.object({
+	policies: z.record(id, authorizationPolicySchema),
+	permissions: z.array(authorizationDefinitionSchema)
+});
+/**
+* One grant of the identity, as the introspection endpoints report it.
+* Whether a grant's policy ids are declared is checked against the catalog
+* the consumer holds, since the two travel separately.
+*/
+const authorizationGrantSchema = z.object({
+	name: z.string().min(1),
+	realm_id: namespaceId.optional(),
+	client_id: namespaceId.optional(),
+	realm_scope: z.enum(RealmScope).nullish(),
+	policies: z.array(id).nullish()
+});
+const authorizationIdentitySchema = z.object({
+	id: z.string().min(1),
+	type: z.enum(["user", "client"]),
+	realmId: z.string().nullish(),
+	realmName: z.string().nullish(),
+	clientId: z.string().nullish()
+});
+/**
+* The whole input `createAuthorizationEvaluator` takes: the catalog
+* `GET /authorization` serves, the grants an introspection reports and the
+* identity it names. A validup container over zod mounts, the shape every
+* validator in this package uses, so a consumer can reuse or override one
+* member's rules instead of restating the document.
+*/
+var AuthorizationEvaluatorInputValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("catalog", createValidator(authorizationCatalogSchema));
+		this.mount("grants", createValidator(z.array(authorizationGrantSchema).optional()));
+		this.mount("identity", createValidator(authorizationIdentitySchema.optional()));
+	}
+};
+const validator = new AuthorizationEvaluatorInputValidator();
+/**
+* Validate the evaluator's input, plus the two rules per-key validators
+* cannot express.
+*
+* Every id a definition names must be a key of `policies`: a dangling id
+* resolves to `undefined`, which reads as "this layer carries no policy", so
+* a catalog that merely omitted a tree would grant unrestricted access rather
+* than fail. The lookup is own-property only, so an id such as `constructor`
+* cannot be answered by a member of `Object.prototype`.
+*
+* And the identity and its grants travel together: grants without an identity
+* belong to nobody, while an identity without a grant list is the shape an
+* INACTIVE introspection produces (`permissions` is absent unless the
+* credential is active), which read as "holds nothing" would authorize every
+* definition that carries no binding check. An identity holding no grant says
+* so with an empty array.
+*/
+async function parseAuthorizationEvaluatorInput(input) {
+	const identityGiven = typeof input.identity !== "undefined";
+	const grantsGiven = typeof input.grants !== "undefined";
+	if (!identityGiven && grantsGiven) throw new ValidupError([defineIssueItem({
+		message: "Grants require the identity they belong to.",
+		path: ["identity"]
+	})]);
+	if (identityGiven && !grantsGiven) throw new ValidupError([defineIssueItem({
+		message: "An identity requires its grant list; pass an empty array for an identity holding none.",
+		path: ["grants"]
+	})]);
+	const { catalog, grants, identity } = await validator.run(structuredClone(input));
+	for (const [i, definition] of catalog.permissions.entries()) for (const [j, policyId] of (definition.policies ?? []).entries()) {
+		if (Object.hasOwn(catalog.policies, policyId)) continue;
+		throw new ValidupError([defineIssueItem({
+			message: `The policy ${policyId} is not declared by the catalog.`,
+			path: [
+				"catalog",
+				"permissions",
+				i,
+				"policies",
+				j
+			]
+		})]);
+	}
+	return {
+		catalog,
+		grants: grants ?? [],
+		identity
+	};
+}
+/**
+* One verdict: the permission namespace and the requested realms it holds in.
+* A realm value is a realm key the caller itself supplied, or `null` for the
+* global rows, so nothing here is resolved or looked up.
+*/
+const authorizationCheckPermissionSchema = z.object({
+	name: z.string().min(1),
+	realms: z.array(z.string().min(1).nullable()).min(1)
+});
+const authorizationCheckPermissionsSchema = z.array(authorizationCheckPermissionSchema);
+//#endregion
+//#region src/permission/authorization/check-schema.ts
+/**
+* The whole input `createAuthorizationCheckEvaluator` takes: the answer
+* `POST /authorization/check` served and the identity it belongs to. Same
+* validup-over-zod shape as the catalog's input, so a consumer can override
+* one member's rules instead of restating the answer.
+*/
+var AuthorizationCheckEvaluatorInputValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("permissions", createValidator(authorizationCheckPermissionsSchema));
+		this.mount("identity", createValidator(authorizationIdentitySchema.optional()));
+	}
+};
+const checkValidator = new AuthorizationCheckEvaluatorInputValidator();
+/**
+* Validate the check evaluator's input, plus the one rule a per-key validator
+* cannot express: a permission namespace appears at most once. Two entries for
+* one name would make the answer depend on which the consumer looked up first,
+* and the server emits one entry per name by construction.
+*/
+async function parseAuthorizationCheckEvaluatorInput(input) {
+	const { permissions, identity } = await checkValidator.run(structuredClone(input));
+	const seen = /* @__PURE__ */ new Set();
+	for (const [i, permission] of permissions.entries()) {
+		if (seen.has(permission.name)) throw new ValidupError([defineIssueItem({
+			message: `The permission ${permission.name} is answered more than once.`,
+			path: [
+				"permissions",
+				i,
+				"name"
+			]
+		})]);
+		seen.add(permission.name);
+	}
+	return {
+		permissions,
+		identity
+	};
+}
+//#endregion
+//#region src/permission/authorization/constants.ts
+/**
+* The node a policy tree travels as when the server withholds it, because the
+* caller's realm reach does not cover the row it was read from.
+*
+* It is deliberately a type no consumer can project: `projectAuthorizationPolicy`
+* refuses it, which is already the state a definition referencing it denies
+* through and a grant naming it is dropped through, so withholding a body needs
+* no rule of its own on the consumer side. That is a contract between the two
+* halves rather than a server detail, which is why it is declared HERE, next to
+* the projection that has to keep refusing it, and pinned by this package's own
+* test.
+*/
+const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
+//#endregion
+//#region src/permission/authorization/policy.ts
+/**
+* The two keys a node carries whatever its type is. Deliberately NOT the whole
+* node: every other key is that type's own configuration, which the type's own
+* validator reads, and a container strips every key it does not mount.
+*/
+var AuthorizationPolicyHeadValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("type", createValidator(z.string().min(1)));
+		this.mount("children", createValidator(z.array(z.unknown()).optional()));
+	}
+};
+/**
+* The one definition of what a policy looks like on the wire, used by the server
+* to build a document and by the consumer to validate one. A node is the OUTPUT
+* of its type's validator (validup strips every unmounted key, so entity columns
+* such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
+* and, for a composite, its projected children.
+*
+* The type set is the `validators` registry, `PolicyDefaultValidators` unless
+* the caller hands another (#3635): a type the registry lacks is refused, so
+* the server and a consumer that register the same custom type let it travel,
+* and one that does not denies it. The withheld node is refused whatever the
+* registry says, since projecting it would evaluate a tree the caller was not
+* allowed to see.
+*
+* Every refusal is a `ValidupError`, the node's head and the type's own
+* validator alike, and a child's issues are rebased onto the position it sits
+* at, so one message names the node in the tree that is wrong.
+*/
+async function projectAuthorizationPolicy(input, validators = PolicyDefaultValidators) {
+	const headValidator = new AuthorizationPolicyHeadValidator();
+	const project = async (value) => {
+		const head = await headValidator.run(value);
+		const validator = head.type !== "withheld" && Object.hasOwn(validators, head.type) ? validators[head.type] : void 0;
+		if (!validator) throw new ValidupError([defineIssueItem({
+			message: `The policy type ${head.type} is not supported.`,
+			path: ["type"]
+		})]);
+		const output = {
+			...await validator.run(value),
+			type: head.type
+		};
+		for (const key of Object.keys(output)) if (typeof output[key] === "undefined") delete output[key];
+		if (head.type === "composite") output.children = await Promise.all((head.children ?? []).map((child, index) => projectChild(child, index)));
+		else delete output.children;
+		return output;
+	};
+	const projectChild = async (child, index) => {
+		try {
+			return await project(child);
+		} catch (e) {
+			if (isValidupError(e)) throw new ValidupError(e.issues.map((issue) => prefixIssuePath(issue, ["children", index])));
+			throw e;
+		}
+	};
+	return project(input);
+}
+/**
+* Whether a projected tree evaluates the permission binding at any depth. A
+* grant policy carrying one would re-enter its own permission's grants, so
+* `createAuthorizationEvaluator` drops the grant that names it and evaluates
+* the permission from the rest. Its one caller is that consumer: the tree is
+* legal in a definition, where the binding check is what reach is enforced
+* by, so the producer carries it and only the grant side is refused.
+*/
+function containsBindingCheck(policy) {
+	if (policy.type === "permissionBinding") return true;
+	return (policy.children ?? []).some((child) => containsBindingCheck(child));
+}
+//#endregion
+//#region src/permission/authorization/module.ts
+/**
+* Every value `realmScopeMatches` decides, and nothing it would have to guess
+* at (#3636): a realm key, `null` for a global row, or a list of either for a
+* row spanning several realms. An empty key and an empty list are legal and
+* DENY there (no identity's realm is the empty string, and the empty set is
+* fail-closed), so refusing them here would make the consumer the one side
+* that errors where the server answers. `undefined` stays refused: the server
+* coerces it to `null`, which reads as a global row, and a caller passing an
+* absent column should hear about it rather than reach the global rows.
+*/
+const realmMatchSchema = z.union([
+	z.string(),
+	z.array(z.string().nullable()),
+	z.null()
+]);
+/**
+* Every refusal of the DOCUMENT is a `ValidupError` carrying the path of the
+* member at fault, the shape `parseAuthorizationEvaluatorInput` raises and the
+* one a consumer can render. A bare `Error` carries neither a code nor a path,
+* so nothing downstream can normalize it.
+*/
+function refuseDocument(message, path) {
+	throw new ValidupError([defineIssueItem({
+		message,
+		path
+	})]);
+}
+function refuseDocumentWithIssues(issues) {
+	throw new ValidupError(issues);
+}
+function toPolicy(tree) {
+	const { invert, children, ...policy } = tree;
+	return {
+		...policy,
+		...typeof invert === "boolean" ? { invert } : {},
+		...children ? { children: children.map((child) => toPolicy(child)) } : {}
+	};
+}
+/**
+* Build a resource-server (or console) evaluator from the catalog
+* `GET /authorization` serves, the identity's grants as the introspection
+* endpoints report them, and the identity itself. Rejects legacy, incomplete
+* and unsupported input. A grant referencing a definition or a policy the
+* catalog lacks throws `AuthorizationCatalogStaleError`, the signal to
+* refetch the catalog: the grants come from a fresh introspection while the
+* catalog may predate the definition or the junction row. A definition the
+* server could not project travels with `policies: null` instead of being
+* left out, so a grant of it is dropped rather than reported stale: the
+* definition layer cannot be evaluated here, a refetch changes nothing, and
+* the permission denies until the policy is fixed.
+*
+* A tree THIS copy cannot project is the same condition read from the other
+* side, and it is per tree: a policy type the validator registry lacks (a
+* type newer than this package, or a custom one the caller did not register)
+* or a configuration its validator refuses denies the definitions that reference
+* it, exactly as `policies: null` does, and drops a grant that names it,
+* exactly as a binding check does. One such tree never takes the evaluator
+* down for the permissions that do not use it. A malformed catalog still
+* throws: a duplicate permission namespace is not a data condition.
+*
+* Both the identity and the grants are optional. Without an identity no grant
+* is bound and any IDENTITY key the caller supplied is REMOVED, so the
+* binding evaluator answers with missing data exactly as the server does for
+* an anonymous request, only a definition whose policies need no identity can
+* pass, and a caller can never inject an identity the document did not prove.
+* Grants without the identity they belong to are refused.
+*
+* The REALM_MATCH data key follows the server's own three-way rule: a
+* resource that carries a realm passes it (null for a global row, which
+* `own` denies), a resource with no realm dimension passes nothing and reach
+* neutral-passes. `preEvaluate` / `preEvaluateOneOf` are the pre-gate and
+* enforce reach only when that key is present. `compile` returns the
+* allow/deny/conditional/post contract; a `post` collection query must be
+* rejected or evaluated over every candidate before paging. The supplied
+* identity is authoritative; `options.decisionStrategy` is forwarded and the
+* policy include, exclude and pending options are refused.
+*
+* The policy type set is open (#3635): `options.validators` decides which
+* trees project and `options.evaluators` how they evaluate, the built-in
+* registries by default. A custom type needs both, the validator the server
+* projected it with and the evaluator the server decides it with; given only
+* the first it projects and then denies. The binding evaluator is always this
+* function's own, since it is what binds the introspected grants.
+*/
+async function createAuthorizationEvaluator(input, options = {}) {
+	const { catalog, grants, identity } = await parseAuthorizationEvaluatorInput(input);
+	const trees = /* @__PURE__ */ new Map();
+	const unevaluable = /* @__PURE__ */ new Set();
+	for (const [id, raw] of Object.entries(catalog.policies)) try {
+		trees.set(id, await projectAuthorizationPolicy(raw, options.validators));
+	} catch {
+		unevaluable.add(id);
+	}
+	const definitions = [];
+	const permissions = /* @__PURE__ */ new Map();
+	for (const [index, entry] of catalog.permissions.entries()) {
+		const permission = {
+			name: entry.name,
+			realmId: entry.realm_id,
+			clientId: entry.client_id,
+			decisionStrategy: entry.decision_strategy ?? void 0
+		};
+		const key = buildPermissionKey(permission);
+		if (permissions.has(key)) refuseDocument(`The catalog defines the permission ${key} more than once.`, [
+			"catalog",
+			"permissions",
+			index
+		]);
+		if (entry.policies === null || entry.policies.some((id) => unevaluable.has(id))) {
+			permissions.set(key, null);
+			continue;
+		}
+		permissions.set(key, permission);
+		const policies = [];
+		for (const [i, id] of entry.policies.entries()) {
+			const tree = trees.get(id);
+			if (!tree) refuseDocument(`The catalog does not declare the policy ${id}.`, [
+				"catalog",
+				"permissions",
+				index,
+				"policies",
+				i
+			]);
+			policies.push(toPolicy(tree));
+		}
+		definitions.push({
+			permission,
+			policies: policies.length > 0 ? policies : void 0
+		});
+	}
+	const bindings = [];
+	for (const grant of grants) {
+		const key = buildPermissionKey({
+			name: grant.name,
+			realmId: grant.realm_id ?? null,
+			clientId: grant.client_id ?? null
+		});
+		const permission = permissions.get(key);
+		if (typeof permission === "undefined") throw new AuthorizationCatalogStaleError(`The catalog does not define the permission ${key}.`);
+		if (permission === null) continue;
+		const policies = [];
+		let evaluable = true;
+		for (const id of grant.policies ?? []) {
+			if (unevaluable.has(id)) {
+				evaluable = false;
+				break;
+			}
+			const tree = trees.get(id);
+			if (!tree) throw new AuthorizationCatalogStaleError(`The catalog does not declare the policy ${id}.`);
+			if (containsBindingCheck(tree)) {
+				evaluable = false;
+				break;
+			}
+			policies.push(toPolicy(tree));
+		}
+		if (!evaluable) continue;
+		bindings.push({
+			permission,
+			realmScope: normalizeRealmScope(grant.realm_scope),
+			policies: policies.length > 0 ? policies : void 0
+		});
+	}
+	const engine = new PolicyEngine(options.evaluators ?? PolicyDefaultEvaluators);
+	engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator({ getFor: async () => bindings }));
+	const evaluator = new PermissionEvaluator({
+		provider: new PermissionMemoryProvider(definitions),
+		policyEngine: engine
+	});
+	const withIdentity = (input) => {
+		const data = input?.clone() ?? new PolicyData();
+		if (!identity) {
+			data.delete("identity");
+			return data;
+		}
+		data.set("identity", {
+			id: identity.id,
+			type: identity.type,
+			realmId: identity.realmId ?? void 0,
+			realmName: identity.realmName ?? void 0,
+			clientId: identity.clientId ?? null
+		});
+		return data;
+	};
+	const forGate = (ctx) => {
+		if (ctx.options?.policiesIncluded || ctx.options?.policiesExcluded || ctx.options?.pendingPolicies) throw new InternalError("The authorization evaluator does not accept policy bypass options.");
+		return {
+			name: ctx.name,
+			realmId: ctx.realmId,
+			clientId: ctx.clientId,
+			data: withIdentity(ctx.data),
+			...ctx.options?.decisionStrategy ? { options: { decisionStrategy: ctx.options.decisionStrategy } } : {}
+		};
+	};
+	const forResource = (ctx) => {
+		const next = forGate(ctx);
+		if (next.data.has("realmMatch")) {
+			const value = next.data.get("realmMatch");
+			const outcome = realmMatchSchema.safeParse(value);
+			if (!outcome.success) refuseDocumentWithIssues(buildIssuesForZodError(outcome.error, value).map((issue) => prefixIssuePath(issue, ["data", "realmMatch"])));
+		}
+		return next;
+	};
+	return {
+		async evaluate(ctx) {
+			return evaluator.evaluate(forResource(ctx));
+		},
+		async evaluateOneOf(ctx) {
+			return evaluator.evaluateOneOf(forResource(ctx));
+		},
+		async preEvaluate(ctx) {
+			return evaluator.preEvaluate(forGate(ctx));
+		},
+		async preEvaluateOneOf(ctx) {
+			return evaluator.preEvaluateOneOf(forGate(ctx));
+		},
+		async compile(ctx) {
+			if (ctx.data?.has("realmMatch") || ctx.data?.has("attributes")) throw new InternalError("Compile authorization without resource realm or row attributes.");
+			return evaluator.compile({
+				name: ctx.name,
+				realmId: ctx.realmId,
+				clientId: ctx.clientId,
+				data: withIdentity(ctx.data),
+				realmAttributeName: ctx.realmAttributeName
+			});
+		}
+	};
+}
+/**
+* An `IPermissionEvaluator` over the answer `POST /authorization/check`
+* served: the caller's own verdicts, paired with the realms they hold in.
+*
+* It is what a PUBLIC client gets where the catalog is out of reach. A public
+* client holds no secret, so it can obtain no `client_credentials` token and
+* has no credential of its own for the catalog's gate to be satisfied by;
+* publishing every policy predicate to it instead would be the wrong trade.
+* The verdicts are computed by the server from the same grants and the same
+* evaluators a request runs, so this is authoritative where the name-only
+* fallback it replaces is merely coarse.
+*
+* Two properties follow from the answer being a pre-gate:
+*
+* It is an UPPER BOUND, so `evaluate` and `evaluateOneOf` answer exactly what
+* the pre-gate pair answers. A check that depends on a resource row belongs to
+* whoever holds the row, and the server decides it there; answering such a
+* check here would mean inventing a verdict. That is the same bound the
+* name-only fallback already had, so nothing that gates on it loosens.
+*
+* And a resource realm is matched against what the REQUEST asked about: a
+* `realmMatch` naming a realm the request never carried is in no entry's list
+* and therefore denies. That is fail-closed by construction rather than by a
+* rule, and it is why a caller must ask about the realms its UI will ask
+* about.
+*/
+async function createAuthorizationCheckEvaluator(input) {
+	const { permissions, identity } = await parseAuthorizationCheckEvaluatorInput(input);
+	const verdicts = /* @__PURE__ */ new Map();
+	for (const permission of permissions) verdicts.set(permission.name, new Set(permission.realms));
+	const ownKeys = /* @__PURE__ */ new Set();
+	if (identity?.realmId) ownKeys.add(identity.realmId);
+	if (identity?.realmName) ownKeys.add(identity.realmName);
+	const matchesRealm = (realms, value) => {
+		if (realms.has(value)) return true;
+		if (value === null || !ownKeys.has(value)) return false;
+		for (const key of ownKeys) if (realms.has(key)) return true;
+		return false;
+	};
+	const holds = (name, data) => {
+		const realms = verdicts.get(name);
+		if (!realms) return false;
+		if (!data || !data.has("realmMatch")) return true;
+		const value = data.get("realmMatch");
+		if (Array.isArray(value)) {
+			if (value.length === 0) return false;
+			return value.every((entry) => matchesRealm(realms, entry ?? null));
+		}
+		return matchesRealm(realms, value ?? null);
+	};
+	const names = (ctx) => Array.isArray(ctx.name) ? ctx.name : [ctx.name];
+	const assertEvery = async (ctx) => {
+		for (const name of names(ctx)) if (!holds(name, ctx.data)) throw PermissionError.evaluationFailed(ctx.name);
+	};
+	const assertSome = async (ctx) => {
+		const list = names(ctx);
+		for (const name of list) if (holds(name, ctx.data)) return;
+		throw PermissionError.evaluationFailed(ctx.name);
+	};
+	return {
+		evaluate: assertEvery,
+		evaluateOneOf: assertSome,
+		preEvaluate: assertEvery,
+		preEvaluateOneOf: assertSome,
+		async compile(ctx) {
+			if ((Array.isArray(ctx.name) ? ctx.name : [ctx.name]).some((name) => holds(name, ctx.data))) return { verdict: "post" };
+			return { verdict: "deny" };
+		}
+	};
+}
+//#endregion
+export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
 
 //# sourceMappingURL=index.mjs.map