@authup/access 1.0.0-beta.65 → 1.0.0-beta.67

package/dist/policy/constants.d.ts

@@ -1,4 +1,5 @@
 import { AttributeNamesPolicyEvaluator, AttributesPolicyEvaluator, CompositePolicyEvaluator, DatePolicyEvaluator, IdentityPolicyEvaluator, PermissionBindingPolicyEvaluator, RealmMatchPolicyEvaluator, TimePolicyEvaluator } from './built-in';
+import type { PolicyValidators } from './types.ts';
 export declare const PolicyDefaultEvaluators: {
     readonly composite: CompositePolicyEvaluator;
     readonly attributes: AttributesPolicyEvaluator<Record<string, any>>;
@@ -9,4 +10,14 @@ export declare const PolicyDefaultEvaluators: {
     readonly realmMatch: RealmMatchPolicyEvaluator;
     readonly time: TimePolicyEvaluator;
 };
+/**
+ * The configuration validator of every built-in policy type, keyed like
+ * `PolicyDefaultEvaluators`. It is what `projectAuthorizationPolicy` runs a
+ * node through, so a type absent here cannot travel in the authorization
+ * catalog. The registry is open like the evaluator one (#3635): spread it and
+ * add a custom type's validator to let that type travel. It is frozen, since
+ * a write into it would make the type projectable for every caller in the
+ * process.
+ */
+export declare const PolicyDefaultValidators: Readonly<PolicyValidators>;
 //# sourceMappingURL=constants.d.ts.map

package/dist/policy/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/policy/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,6BAA6B,EAC7B,yBAAyB,EAEzB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACtB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,uBAAuB;;;;;;;;;CAS1B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/policy/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,6BAA6B,EAE7B,yBAAyB,EAGzB,wBAAwB,EAExB,mBAAmB,EAEnB,uBAAuB,EAEvB,gCAAgC,EAEhC,yBAAyB,EAEzB,mBAAmB,EAEtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAO,MAAM,uBAAuB;;;;;;;;;CAS1B,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAG,QAAQ,CAAC,gBAAgB,CAS9D,CAAC"}

package/dist/policy/data.d.ts

@@ -2,6 +2,7 @@ export interface IPolicyData {
     set(key: string, value: unknown): void;
     has(key: string): boolean;
     get<T = unknown>(key: string): T;
+    delete(key: string): void;
     isValidated(key: string): boolean;
     setValidated(key: string): void;
     clone(): IPolicyData;
@@ -13,6 +14,7 @@ export declare class PolicyData implements IPolicyData {
     set<T = unknown>(key: string, value: T): void;
     get<T = unknown>(key: string): T;
     has(key: string): boolean;
+    delete(key: string): void;
     setValidated(key: string): void;
     isValidated(key: string): boolean;
     clone(): PolicyData;

package/dist/policy/data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/policy/data.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAI,IAAI,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,CAAC,CAAC;IAElC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI,CAAC;IAEjC,KAAK,IAAK,WAAW,CAAA;CACxB;AAED,qBAAa,UAAW,YAAW,WAAW;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEpC,SAAS,CAAC,SAAS,EAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAG9B,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAC9B,SAAS,GAAE,GAAG,CAAC,MAAM,CAAa;IAMtC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAI,IAAI;IAK9C,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,CAAC;IAQjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IAIhC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAI,OAAO;IAIlC,KAAK;CAGR"}
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/policy/data.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAI,IAAI,CAAC;IACxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI,CAAC;IAE3B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI,CAAC;IAEjC,KAAK,IAAK,WAAW,CAAA;CACxB;AAED,qBAAa,UAAW,YAAW,WAAW;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEpC,SAAS,CAAC,SAAS,EAAG,GAAG,CAAC,MAAM,CAAC,CAAC;gBAG9B,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAC9B,SAAS,GAAE,GAAG,CAAC,MAAM,CAAa;IAMtC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAI,IAAI;IAK9C,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAI,CAAC;IAQjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IAK1B,YAAY,CAAC,GAAG,EAAE,MAAM,GAAI,IAAI;IAIhC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAI,OAAO;IAIlC,KAAK;CAGR"}

package/dist/policy/evaluation/context/define.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAS1B"}
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAW1B"}

package/dist/policy/evaluation/context/index.d.ts

@@ -1,3 +1,4 @@
 export * from './define.ts';
+export * from './transition.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/evaluation/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/policy/evaluation/context/transition.d.ts

@@ -0,0 +1,13 @@
+import type { PolicyTransitionSink } from './types.ts';
+export type PolicyTransitionCollector = PolicyTransitionSink & {
+    /**
+     * The earliest reported instant, or undefined when nothing reported one.
+     */
+    readonly next: Date | undefined;
+};
+/**
+ * A sink keeping the earliest reported instant, which is the moment an answer
+ * built from every evaluation it was handed to stops being current.
+ */
+export declare function createPolicyTransitionCollector(): PolicyTransitionCollector;
+//# sourceMappingURL=transition.d.ts.map

package/dist/policy/evaluation/context/transition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transition.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/transition.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG;IAC3D;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CAClC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,+BAA+B,IAAK,yBAAyB,CAa5E"}

package/dist/policy/evaluation/context/types.d.ts

@@ -1,5 +1,17 @@
 import type { PolicyData } from '../../data.ts';
 import type { IPolicyEvaluator } from '../types.ts';
+/**
+ * Receives the instants at which a clock-dependent verdict could change.
+ *
+ * A `date` or `time` policy that fell back to the real clock (no `date` / `time`
+ * key in the bag) reports the next strictly-future instant its own verdict could
+ * flip, from inside the evaluation walk that already runs. A caller that caches
+ * an answer derived from such a walk learns when to stop trusting it. Reports may
+ * be early (conservative) but never late, and `invert` does not move them.
+ */
+export type PolicyTransitionSink = {
+    report(at: Date): void;
+};
 export type PolicyEvaluationContext = {
     readonly evaluators: Record<string, IPolicyEvaluator>;
     readonly path: (string | number)[];
@@ -13,6 +25,21 @@ export type PolicyEvaluationContext = {
      * query-build callers opt in.
      */
     readonly withConditions: boolean;
+    /**
+     * Row column the realm reach is LOWERED onto, for a caller whose rows carry the
+     * realm under another name (a junction's `roleRealmId` / `clientRealmId` / …).
+     * Default `realmId`. It reaches `RealmMatchPolicyEvaluator` scope mode as
+     * `attributeName`, which that mode reads only while lowering — settled
+     * evaluation takes the resource realm from the `realmMatch` data key and never
+     * consults a column name, so this can never change an evaluate() outcome.
+     */
+    readonly realmAttributeName?: string;
+    /**
+     * Optional receiver of clock transitions (see {@link PolicyTransitionSink}).
+     * Nested evaluations inherit it, since every walk propagates the context by
+     * spread.
+     */
+    readonly transitions?: PolicyTransitionSink;
 };
 export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/evaluation/context/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACnC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,MAAM,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,CAAA;CACzB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAC9C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/policy/types.d.ts

@@ -1,3 +1,8 @@
+import type { Container } from 'validup';
+/**
+ * A policy type's configuration validator, keyed by the type it validates.
+ */
+export type PolicyValidators = Record<string, Container<Record<string, any>>>;
 export type BasePolicy<T extends string = string> = {
     /**
      * Type describing the policy.

package/dist/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAChD;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC;IAET;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,CACtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACnD,CAAC,SAAS,MAAM,GAAG,MAAM,IACzB,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAChD;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC;IAET;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,CACtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACnD,CAAC,SAAS,MAAM,GAAG,MAAM,IACzB,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.65",
+    "version": "1.0.0-beta.67",
     "description": "A library for evaluating permissions and policies.",
     "license": "Apache-2.0",
     "exports": {
@@ -54,19 +54,19 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/errors": "^1.0.0-beta.65",
-        "@authup/kit": "^1.0.0-beta.65",
+        "@authup/errors": "^1.0.0-beta.67",
+        "@authup/kit": "^1.0.0-beta.67",
         "@ebec/core": "^1.3.2",
-        "@rapiq/adapter-memory": "^2.2.0",
-        "@rapiq/core": "^2.2.0",
-        "@rapiq/parser-mongo": "^2.2.0",
+        "@rapiq/adapter-memory": "^2.4.0",
+        "@rapiq/core": "^2.4.0",
+        "@rapiq/parser-mongo": "^2.4.0",
         "@validup/zod": "^2.0.1",
         "smob": "^1.6.1",
         "validup": "^2.0.1",
-        "zod": "^4.5.4"
+        "zod": "^4.6.5"
     },
     "devDependencies": {
-        "unplugin-swc": "^1.5.11",
+        "unplugin-swc": "^1.6.0",
         "vitest": "^4.0.14"
     },
     "publishConfig": {