@authup/access 1.0.0-beta.65 → 1.0.0-beta.67

package/dist/permission/authorization/check-schema.d.ts

@@ -0,0 +1,23 @@
+import { Container } from 'validup';
+import type { AuthorizationCheckEvaluatorInput, AuthorizationCheckPermissions } from './types';
+/**
+ * The whole input `createAuthorizationCheckEvaluator` takes: the answer
+ * `POST /authorization/check` served and the identity it belongs to. Same
+ * validup-over-zod shape as the catalog's input, so a consumer can override
+ * one member's rules instead of restating the answer.
+ */
+export declare class AuthorizationCheckEvaluatorInputValidator extends Container<AuthorizationCheckEvaluatorInput> {
+    initialize(): void;
+}
+export type AuthorizationCheckEvaluatorInputParsed = {
+    permissions: AuthorizationCheckPermissions;
+    identity: AuthorizationCheckEvaluatorInput['identity'];
+};
+/**
+ * Validate the check evaluator's input, plus the one rule a per-key validator
+ * cannot express: a permission namespace appears at most once. Two entries for
+ * one name would make the answer depend on which the consumer looked up first,
+ * and the server emits one entry per name by construction.
+ */
+export declare function parseAuthorizationCheckEvaluatorInput(input: AuthorizationCheckEvaluatorInput): Promise<AuthorizationCheckEvaluatorInputParsed>;
+//# sourceMappingURL=check-schema.d.ts.map

package/dist/permission/authorization/check-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-schema.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/check-schema.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAElD,OAAO,KAAK,EAAE,gCAAgC,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AAE/F;;;;;GAKG;AACH,qBAAa,yCAA0C,SAAQ,SAAS,CAAC,gCAAgC,CAAC;IAC7F,UAAU;CAMtB;AAID,MAAM,MAAM,sCAAsC,GAAG;IACjD,WAAW,EAAE,6BAA6B,CAAC;IAC3C,QAAQ,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,qCAAqC,CACvD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,sCAAsC,CAAC,CA0BlD"}

package/dist/permission/authorization/check.d.ts

@@ -0,0 +1,7 @@
+import type { AuthorizationCatalogStaleError } from './error';
+/**
+ * Marker-only: the error carries no code of its own, and it never crosses a
+ * wire boundary, so there is no shape to fall back to.
+ */
+export declare function isAuthorizationCatalogStaleError(input: unknown): input is AuthorizationCatalogStaleError;
+//# sourceMappingURL=check.d.ts.map

package/dist/permission/authorization/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/check.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,SAAS,CAAC;AAG9D;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAI,KAAK,IAAI,8BAA8B,CAEzG"}

package/dist/permission/authorization/constants.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The node a policy tree travels as when the server withholds it, because the
+ * caller's realm reach does not cover the row it was read from.
+ *
+ * It is deliberately a type no consumer can project: `projectAuthorizationPolicy`
+ * refuses it, which is already the state a definition referencing it denies
+ * through and a grant naming it is dropped through, so withholding a body needs
+ * no rule of its own on the consumer side. That is a contract between the two
+ * halves rather than a server detail, which is why it is declared HERE, next to
+ * the projection that has to keep refusing it, and pinned by this package's own
+ * test.
+ */
+export declare const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
+//# sourceMappingURL=constants.d.ts.map

package/dist/permission/authorization/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kCAAkC,aAAa,CAAC"}

package/dist/permission/authorization/error.d.ts

@@ -0,0 +1,18 @@
+import { AuthupError } from '@authup/errors';
+export declare const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE: unique symbol;
+/**
+ * A grant references a definition or a policy the supplied catalog does not
+ * carry: the caller's cached catalog predates the definition or the junction
+ * row and must be refetched. A definition the catalog carries with
+ * `policies: null`, and one whose tree this copy cannot project, are not
+ * stale but unevaluable, and a grant of either is dropped.
+ *
+ * Recognize it with `isAuthorizationCatalogStaleError`, never `instanceof`:
+ * this package is a plain caret dependency of several workspaces, so a
+ * consumer tree may resolve two copies of it and turn the one recoverable
+ * state into an unrecoverable one.
+ */
+export declare class AuthorizationCatalogStaleError extends AuthupError {
+    constructor(message: string);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/permission/authorization/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/error.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAE7D,eAAO,MAAM,0CAA0C,eAA8D,CAAC;AAEtH;;;;;;;;;;;GAWG;AACH,qBAAa,8BAA+B,SAAQ,WAAW;gBAC/C,OAAO,EAAE,MAAM;CAM9B"}

package/dist/permission/authorization/index.d.ts

@@ -0,0 +1,9 @@
+export * from './check';
+export * from './check-schema';
+export * from './constants';
+export * from './error';
+export * from './module';
+export * from './policy';
+export * from './schema';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/permission/authorization/module.d.ts

@@ -0,0 +1,77 @@
+import type { IPermissionEvaluator } from '../evaluator';
+import type { AuthorizationCheckEvaluatorInput, AuthorizationEvaluatorInput, AuthorizationEvaluatorOptions } from './types';
+/**
+ * Build a resource-server (or console) evaluator from the catalog
+ * `GET /authorization` serves, the identity's grants as the introspection
+ * endpoints report them, and the identity itself. Rejects legacy, incomplete
+ * and unsupported input. A grant referencing a definition or a policy the
+ * catalog lacks throws `AuthorizationCatalogStaleError`, the signal to
+ * refetch the catalog: the grants come from a fresh introspection while the
+ * catalog may predate the definition or the junction row. A definition the
+ * server could not project travels with `policies: null` instead of being
+ * left out, so a grant of it is dropped rather than reported stale: the
+ * definition layer cannot be evaluated here, a refetch changes nothing, and
+ * the permission denies until the policy is fixed.
+ *
+ * A tree THIS copy cannot project is the same condition read from the other
+ * side, and it is per tree: a policy type the validator registry lacks (a
+ * type newer than this package, or a custom one the caller did not register)
+ * or a configuration its validator refuses denies the definitions that reference
+ * it, exactly as `policies: null` does, and drops a grant that names it,
+ * exactly as a binding check does. One such tree never takes the evaluator
+ * down for the permissions that do not use it. A malformed catalog still
+ * throws: a duplicate permission namespace is not a data condition.
+ *
+ * Both the identity and the grants are optional. Without an identity no grant
+ * is bound and any IDENTITY key the caller supplied is REMOVED, so the
+ * binding evaluator answers with missing data exactly as the server does for
+ * an anonymous request, only a definition whose policies need no identity can
+ * pass, and a caller can never inject an identity the document did not prove.
+ * Grants without the identity they belong to are refused.
+ *
+ * The REALM_MATCH data key follows the server's own three-way rule: a
+ * resource that carries a realm passes it (null for a global row, which
+ * `own` denies), a resource with no realm dimension passes nothing and reach
+ * neutral-passes. `preEvaluate` / `preEvaluateOneOf` are the pre-gate and
+ * enforce reach only when that key is present. `compile` returns the
+ * allow/deny/conditional/post contract; a `post` collection query must be
+ * rejected or evaluated over every candidate before paging. The supplied
+ * identity is authoritative; `options.decisionStrategy` is forwarded and the
+ * policy include, exclude and pending options are refused.
+ *
+ * The policy type set is open (#3635): `options.validators` decides which
+ * trees project and `options.evaluators` how they evaluate, the built-in
+ * registries by default. A custom type needs both, the validator the server
+ * projected it with and the evaluator the server decides it with; given only
+ * the first it projects and then denies. The binding evaluator is always this
+ * function's own, since it is what binds the introspected grants.
+ */
+export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput, options?: AuthorizationEvaluatorOptions): Promise<IPermissionEvaluator>;
+/**
+ * An `IPermissionEvaluator` over the answer `POST /authorization/check`
+ * served: the caller's own verdicts, paired with the realms they hold in.
+ *
+ * It is what a PUBLIC client gets where the catalog is out of reach. A public
+ * client holds no secret, so it can obtain no `client_credentials` token and
+ * has no credential of its own for the catalog's gate to be satisfied by;
+ * publishing every policy predicate to it instead would be the wrong trade.
+ * The verdicts are computed by the server from the same grants and the same
+ * evaluators a request runs, so this is authoritative where the name-only
+ * fallback it replaces is merely coarse.
+ *
+ * Two properties follow from the answer being a pre-gate:
+ *
+ * It is an UPPER BOUND, so `evaluate` and `evaluateOneOf` answer exactly what
+ * the pre-gate pair answers. A check that depends on a resource row belongs to
+ * whoever holds the row, and the server decides it there; answering such a
+ * check here would mean inventing a verdict. That is the same bound the
+ * name-only fallback already had, so nothing that gates on it loosens.
+ *
+ * And a resource realm is matched against what the REQUEST asked about: a
+ * `realmMatch` naming a realm the request never carried is in no entry's list
+ * and therefore denies. That is fail-closed by construction rather than by a
+ * rule, and it is why a caller must ask about the realms its UI will ask
+ * about.
+ */
+export declare function createAuthorizationCheckEvaluator(input: AuthorizationCheckEvaluatorInput): Promise<IPermissionEvaluator>;
+//# sourceMappingURL=module.d.ts.map

package/dist/permission/authorization/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EAIvB,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACR,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,EAEhC,MAAM,SAAS,CAAC;AA0CjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,2BAA2B,EAClC,OAAO,GAAE,6BAAkC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAgMhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iCAAiC,CACnD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}

package/dist/permission/authorization/policy.d.ts

@@ -0,0 +1,31 @@
+import type { PolicyValidators } from '../../policy';
+import type { AuthorizationPolicy } from './types';
+/**
+ * The one definition of what a policy looks like on the wire, used by the server
+ * to build a document and by the consumer to validate one. A node is the OUTPUT
+ * of its type's validator (validup strips every unmounted key, so entity columns
+ * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
+ * and, for a composite, its projected children.
+ *
+ * The type set is the `validators` registry, `PolicyDefaultValidators` unless
+ * the caller hands another (#3635): a type the registry lacks is refused, so
+ * the server and a consumer that register the same custom type let it travel,
+ * and one that does not denies it. The withheld node is refused whatever the
+ * registry says, since projecting it would evaluate a tree the caller was not
+ * allowed to see.
+ *
+ * Every refusal is a `ValidupError`, the node's head and the type's own
+ * validator alike, and a child's issues are rebased onto the position it sits
+ * at, so one message names the node in the tree that is wrong.
+ */
+export declare function projectAuthorizationPolicy(input: unknown, validators?: PolicyValidators): Promise<AuthorizationPolicy>;
+/**
+ * Whether a projected tree evaluates the permission binding at any depth. A
+ * grant policy carrying one would re-enter its own permission's grants, so
+ * `createAuthorizationEvaluator` drops the grant that names it and evaluates
+ * the permission from the rest. Its one caller is that consumer: the tree is
+ * legal in a definition, where the binding check is what reach is enforced
+ * by, so the producer carries it and only the grant side is refused.
+ */
+export declare function containsBindingCheck(policy: AuthorizationPolicy): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/permission/authorization/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAqBnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,0BAA0B,CAC5C,KAAK,EAAE,OAAO,EACd,UAAU,GAAE,gBAA0C,GACtD,OAAO,CAAC,mBAAmB,CAAC,CA+C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAI,OAAO,CAM1E"}

package/dist/permission/authorization/schema.d.ts

@@ -0,0 +1,107 @@
+import { DecisionStrategy } from '@authup/kit';
+import { Container } from 'validup';
+import { z } from 'zod';
+import { RealmScope } from '../realm-scope';
+import type { AuthorizationCatalog, AuthorizationEvaluatorInput, AuthorizationGrant } from './types';
+/**
+ * A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
+ * that type's own configuration, and `projectAuthorizationPolicy` is what
+ * validates it, by running the type's own validator. Mounting a node in a
+ * validup container would strip every key the container does not mount, and
+ * the whole configuration would go with it.
+ */
+export declare const authorizationPolicySchema: z.ZodObject<{
+    type: z.ZodString;
+}, z.core.$loose>;
+/**
+ * One permission definition. `policies` carries the ids of its
+ * definition-layer trees, or `null` when the server could not project one.
+ */
+export declare const authorizationDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    realm_id: z.ZodNullable<z.ZodString>;
+    client_id: z.ZodNullable<z.ZodString>;
+    decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+    policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCatalogSchema: z.ZodObject<{
+    policies: z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodString;
+    }, z.core.$loose>>;
+    permissions: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        realm_id: z.ZodNullable<z.ZodString>;
+        client_id: z.ZodNullable<z.ZodString>;
+        decision_strategy: z.ZodNullable<z.ZodEnum<typeof DecisionStrategy>>;
+        policies: z.ZodNullable<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * One grant of the identity, as the introspection endpoints report it.
+ * Whether a grant's policy ids are declared is checked against the catalog
+ * the consumer holds, since the two travel separately.
+ */
+export declare const authorizationGrantSchema: z.ZodObject<{
+    name: z.ZodString;
+    realm_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    client_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    realm_scope: z.ZodOptional<z.ZodNullable<z.ZodEnum<typeof RealmScope>>>;
+    policies: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$strip>;
+export declare const authorizationIdentitySchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<{
+        user: "user";
+        client: "client";
+    }>;
+    realmId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    realmName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    clientId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * The whole input `createAuthorizationEvaluator` takes: the catalog
+ * `GET /authorization` serves, the grants an introspection reports and the
+ * identity it names. A validup container over zod mounts, the shape every
+ * validator in this package uses, so a consumer can reuse or override one
+ * member's rules instead of restating the document.
+ */
+export declare class AuthorizationEvaluatorInputValidator extends Container<AuthorizationEvaluatorInput> {
+    initialize(): void;
+}
+export type AuthorizationEvaluatorInputParsed = {
+    catalog: AuthorizationCatalog;
+    grants: AuthorizationGrant[];
+    identity: AuthorizationEvaluatorInput['identity'];
+};
+/**
+ * Validate the evaluator's input, plus the two rules per-key validators
+ * cannot express.
+ *
+ * Every id a definition names must be a key of `policies`: a dangling id
+ * resolves to `undefined`, which reads as "this layer carries no policy", so
+ * a catalog that merely omitted a tree would grant unrestricted access rather
+ * than fail. The lookup is own-property only, so an id such as `constructor`
+ * cannot be answered by a member of `Object.prototype`.
+ *
+ * And the identity and its grants travel together: grants without an identity
+ * belong to nobody, while an identity without a grant list is the shape an
+ * INACTIVE introspection produces (`permissions` is absent unless the
+ * credential is active), which read as "holds nothing" would authorize every
+ * definition that carries no binding check. An identity holding no grant says
+ * so with an empty array.
+ */
+export declare function parseAuthorizationEvaluatorInput(input: AuthorizationEvaluatorInput): Promise<AuthorizationEvaluatorInputParsed>;
+/**
+ * One verdict: the permission namespace and the requested realms it holds in.
+ * A realm value is a realm key the caller itself supplied, or `null` for the
+ * global rows, so nothing here is resolved or looked up.
+ */
+export declare const authorizationCheckPermissionSchema: z.ZodObject<{
+    name: z.ZodString;
+    realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizationCheckPermissionsSchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/permission/authorization/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/schema.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EACR,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACrB,MAAM,SAAS,CAAC;AAKjB;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;iBAA6C,CAAC;AAEpF;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;iBAMxC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAGrC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAMtC,CAAC;AAEH;;;;;;GAMG;AACH,qBAAa,oCAAqC,SAAQ,SAAS,CAAC,2BAA2B,CAAC;IACnF,UAAU;CAOtB;AAID,MAAM,MAAM,iCAAiC,GAAG;IAC5C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gCAAgC,CAClD,KAAK,EAAE,2BAA2B,GAClC,OAAO,CAAC,iCAAiC,CAAC,CAqD7C;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;;kBAA8C,CAAC"}

package/dist/permission/authorization/types.d.ts

@@ -0,0 +1,136 @@
+import type { DecisionStrategy } from '@authup/kit';
+import type { IdentityPolicyData, PolicyEvaluators, PolicyValidators } from '../../policy';
+import type { RealmScope } from '../realm-scope';
+/**
+ * One policy tree node as it travels: the type's configuration keys (the output
+ * of that type's validator), `invert`, and for a composite its children inline.
+ */
+export type AuthorizationPolicy = {
+    type: string;
+    invert?: boolean | null;
+    children?: AuthorizationPolicy[];
+    [key: string]: unknown;
+};
+export type AuthorizationDefinition = {
+    name: string;
+    realm_id: string | null;
+    client_id: string | null;
+    decision_strategy: `${DecisionStrategy}` | null;
+    /**
+     * The definition layer: the ids of the policy trees bound to the permission
+     * definition (`auth_permission_policies`). Empty means unrestricted at this
+     * layer. `null` means the server could not project one of those trees onto
+     * the wire (a policy type the catalog does not carry, or a configuration
+     * its validator refuses): the definition exists, a consumer cannot evaluate
+     * it and denies it, dropping every grant of it, until the policy is fixed.
+     */
+    policies: string[] | null;
+};
+/**
+ * Identity-free and cacheable: every permission definition with its policy trees.
+ */
+export type AuthorizationCatalog = {
+    /**
+     * Every policy tree a definition or a grant can name, keyed by the tree's
+     * own id and present exactly once however many of them reference it.
+     */
+    policies: Record<string, AuthorizationPolicy>;
+    permissions: AuthorizationDefinition[];
+};
+/**
+ * One raw grant of an identity as the introspection endpoints report it: the
+ * permission namespace it names, its realm reach and the junction policy ids.
+ * Structurally the extended `OAuth2TokenPermission` of `@authup/specs` (this
+ * package does not depend on specs).
+ */
+export type AuthorizationGrant = {
+    name: string;
+    realm_id?: string | null;
+    client_id?: string | null;
+    /**
+     * Absent or null coerces to `own`, fail-closed.
+     */
+    realm_scope?: `${RealmScope}` | null;
+    /**
+     * Absent or null means no junction policy.
+     */
+    policies?: string[] | null;
+};
+export type AuthorizationEvaluatorInput = {
+    /**
+     * An `AuthorizationCatalog`, validated by the schema.
+     */
+    catalog: unknown;
+    /**
+     * `AuthorizationGrant[]`, validated by the schema. Defaults to none, and
+     * may only be supplied together with the identity holding them.
+     */
+    grants?: unknown;
+    /**
+     * The identity the grants belong to. Omitted for an anonymous caller:
+     * no identity data is injected and no grant is bound, so only a
+     * definition whose policies need no identity can pass.
+     */
+    identity?: IdentityPolicyData;
+};
+export type AuthorizationEvaluatorOptions = {
+    /**
+     * The policy types a catalog tree may carry. Defaults to
+     * `PolicyDefaultValidators`; spread it to add a custom type.
+     */
+    validators?: PolicyValidators;
+    /**
+     * How the projected trees evaluate. Defaults to
+     * `PolicyDefaultEvaluators`; spread it to add a custom type. The
+     * permission-binding evaluator is always replaced by the one binding the
+     * introspected grants.
+     */
+    evaluators?: PolicyEvaluators;
+};
+/**
+ * Which resource realms a batch check evaluates against.
+ *
+ * A string is SYMBOLIC and resolved server-side against the caller's own
+ * identity: `own` is the realm the identity belongs to, `ownOrNull` is that
+ * realm plus `null`, the global rows every realm shares. An array is taken
+ * VERBATIM: the server resolves no realm key, so it discloses no realm's
+ * existence and the caller matches the answer against its own input with no
+ * resolution step of its own.
+ *
+ * String versus array is what discriminates the two forms, so `own` stays
+ * unambiguous even though it is a legal realm name.
+ */
+export type AuthorizationCheckRealms = `${RealmScope.OWN}` | `${RealmScope.OWN_OR_NULL}` | Array<string | null>;
+/**
+ * One permission the identity may attempt, and the requested realms it may
+ * attempt it in. Never empty: a permission reaching no requested realm is
+ * absent from the answer entirely, so absent means denied.
+ */
+export type AuthorizationCheckPermission = {
+    name: string;
+    realms: Array<string | null>;
+};
+/**
+ * The answer `POST /authorization/check` serves: the caller's own verdicts,
+ * paired with the realms they hold in.
+ *
+ * It is an upper bound on what may be ATTEMPTED rather than an entitlement,
+ * the same posture the catalog and `GET /schemas` take: it is a pre-gate, so a
+ * grant whose junction policy needs a resource row passes here and is still
+ * decided per row on the server, which stays the enforcement point.
+ */
+export type AuthorizationCheckPermissions = AuthorizationCheckPermission[];
+export type AuthorizationCheckEvaluatorInput = {
+    /**
+     * An `AuthorizationCheckPermissions`, validated by the schema.
+     */
+    permissions: unknown;
+    /**
+     * The identity the verdicts belong to, used to resolve a `realmMatch` of
+     * `own` shape: a resource realm equal to this identity's realm id or name
+     * is the identity's own realm. Omitted for an anonymous caller, which
+     * holds no verdict at all.
+     */
+    identity?: IdentityPolicyData;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/permission/authorization/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,WAAW,EAAE,uBAAuB,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,wBAAwB,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAC1D,GAAG,UAAU,CAAC,WAAW,EAAE,GAC3B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,4BAA4B,EAAE,CAAC;AAE3E,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC"}

package/dist/permission/evaluator/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAqH1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAe7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAYxE;;;;;;;;;OASG;IACG,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;CAyElF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAsH1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAe7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAYxE;;;;;;;;;OASG;IACG,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;CA0ElF"}

package/dist/permission/evaluator/types.d.ts

@@ -1,6 +1,6 @@
 import type { ICondition } from '@rapiq/core';
 import type { DecisionStrategy } from '@authup/kit';
-import type { IPolicyEngine, PolicyData } from '../../policy';
+import type { IPolicyEngine, PolicyData, PolicyTransitionSink } from '../../policy';
 import type { IPermissionProvider } from '../provider';
 export interface IPermissionEvaluator {
     evaluate(ctx: PermissionEvaluationContext): Promise<void>;
@@ -29,6 +29,13 @@ export type PermissionEvaluationOptions = {
      *   (`preEvaluate()`): only a tree that settles false with the current bag denies.
      */
     pendingPolicies?: 'deny' | 'permit';
+    /**
+     * Receives the instants at which a clock-dependent policy (`date`, `time`)
+     * in an evaluated tree could change its verdict, so a caller caching the
+     * outcome knows when it expires. Handed to every policy evaluation this call
+     * runs; a policy-free grant evaluates nothing and reports nothing.
+     */
+    transitions?: PolicyTransitionSink;
 };
 export type PermissionEvaluationContext = {
     name: string | string[];
@@ -51,6 +58,14 @@ export type PermissionCompileContext = {
      * compiled condition ranges over.
      */
     data?: PolicyData;
+    /**
+     * Row column the realm reach is lowered onto, when the rows this compilation
+     * ranges over carry their realm under another name — a junction's owner-realm
+     * key (`roleRealmId`, `clientRealmId`, …). Default `realmId`. Affects the
+     * `conditional` condition only; the per-row `post` fallback still reads the
+     * realm from the `realmMatch` data key its caller supplies.
+     */
+    realmAttributeName?: string;
 };
 /**
  * Outcome of compiling a permission's policy trees against the knowns bag

package/dist/permission/evaluator/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/permission/index.d.ts

@@ -4,4 +4,5 @@ export * from './provider';
 export * from './evaluator';
 export * from './realm-scope';
 export * from './types';
+export * from './authorization';
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC"}

package/dist/permission/realm-scope/helpers.d.ts

@@ -19,5 +19,5 @@ export declare function minRealmScope(values: Array<`${RealmScope}` | null | und
  * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
  * so any app/entity can express its realm via one or many keys under the canonical contract.
  */
-export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | Array<string | null> | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/permission/realm-scope/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,GAAG,UAAU,EAAE,CAMnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAC1B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAC3B,MAAM,CAER;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAYhG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAWhG;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EACzC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACrD,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAyBT"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,GAAG,UAAU,EAAE,CAMnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAC1B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAC3B,MAAM,CAER;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAYhG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAWhG;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EACzC,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,EACjE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAyBT"}

package/dist/policy/built-in/date/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/date/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkBlD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAoC5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/date/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA0ClD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA4C5G"}

package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts

@@ -0,0 +1,21 @@
+import type { PermissionPolicyBinding, PermissionPolicyBindingAggregated } from '../../../permission/types';
+import type { IPolicyEvaluator, PolicyEvaluationContext, PolicyEvaluationResult } from '../../evaluation';
+import type { IdentityPolicyData } from '../identity';
+import { IdentityPolicyEvaluator } from '../identity';
+import { RealmMatchPolicyEvaluator } from '../realm-match';
+import { PermissionBindingPolicyValidator } from './validator';
+type IdentityPermissionProvider = {
+    getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
+};
+export declare class IdentityPermissionBindingPolicyEvaluator implements IPolicyEvaluator {
+    protected validator: PermissionBindingPolicyValidator;
+    protected identityEvaluator: IdentityPolicyEvaluator;
+    protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
+    protected identityPermissionProvider: IdentityPermissionProvider;
+    constructor(identityPermissionProvider: IdentityPermissionProvider);
+    requires(): string[];
+    accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
+    evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
+}
+export {};
+//# sourceMappingURL=identity-evaluator.d.ts.map

package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/identity-evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,KAAK,0BAA0B,GAAG;IAC9B,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC5E,CAAC;AAmBF,qBAAa,wCAAyC,YAAW,gBAAgB;IAC7E,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;gBAErD,0BAA0B,EAAE,0BAA0B;IAOlE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA6N5G"}

package/dist/policy/built-in/permission-binding/index.d.ts

@@ -1,3 +1,4 @@
+export * from './identity-evaluator';
 export * from './module';
 export * from './types';
 export * from './validator';

package/dist/policy/built-in/permission-binding/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/index.ts"],"names":[],"mappings":"AAOA,cAAc,sBAAsB,CAAC;AACrC,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC"}

package/dist/policy/built-in/permission-binding/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/validator.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,qBAAa,gCAAiC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC3E,UAAU;CAGtB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,qBAAa,gCAAiC,SAAQ,SAAS,CAAC,uBAAuB,CAAC;IAC3E,UAAU;CAWtB"}

package/dist/policy/built-in/time/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA6ClD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAwE5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkGlD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAgF5G"}