@authup/access 1.0.0-beta.66 → 1.0.0-beta.67

package/dist/index.d.mts

@@ -29,6 +29,18 @@ export declare class PolicyData implements IPolicyData {
 }
 //#endregion
 //#region src/policy/evaluation/context/types.d.ts
+/**
+ * Receives the instants at which a clock-dependent verdict could change.
+ *
+ * A `date` or `time` policy that fell back to the real clock (no `date` / `time`
+ * key in the bag) reports the next strictly-future instant its own verdict could
+ * flip, from inside the evaluation walk that already runs. A caller that caches
+ * an answer derived from such a walk learns when to stop trusting it. Reports may
+ * be early (conservative) but never late, and `invert` does not move them.
+ */
+export type PolicyTransitionSink = {
+  report(at: Date): void;
+};
 export type PolicyEvaluationContext = {
   readonly evaluators: Record<string, IPolicyEvaluator>;
   readonly path: (string | number)[];
@@ -51,12 +63,31 @@ export type PolicyEvaluationContext = {
    * consults a column name, so this can never change an evaluate() outcome.
    */
   readonly realmAttributeName?: string;
+  /**
+   * Optional receiver of clock transitions (see {@link PolicyTransitionSink}).
+   * Nested evaluations inherit it, since every walk propagates the context by
+   * spread.
+   */
+  readonly transitions?: PolicyTransitionSink;
 };
 export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //#endregion
 //#region src/policy/evaluation/context/define.d.ts
 export declare function definePolicyEvaluationContext(input?: PolicyEvaluationContextInput): PolicyEvaluationContext;
 //#endregion
+//#region src/policy/evaluation/context/transition.d.ts
+export type PolicyTransitionCollector = PolicyTransitionSink & {
+  /**
+   * The earliest reported instant, or undefined when nothing reported one.
+   */
+  readonly next: Date | undefined;
+};
+/**
+ * A sink keeping the earliest reported instant, which is the moment an answer
+ * built from every evaluation it was handed to stops being current.
+ */
+export declare function createPolicyTransitionCollector(): PolicyTransitionCollector;
+//#endregion
 //#region src/policy/evaluation/types.d.ts
 export type PolicyEvaluators = Record<string, IPolicyEvaluator>;
 export type PolicyEvaluationResult = {
@@ -112,6 +143,10 @@ export interface IPolicyEvaluator {
 }
 //#endregion
 //#region src/policy/types.d.ts
+/**
+ * A policy type's configuration validator, keyed by the type it validates.
+ */
+export type PolicyValidators = Record<string, Container<Record<string, any>>>;
 export type BasePolicy<T extends string = string> = {
   /**
    * Type describing the policy.
@@ -376,7 +411,7 @@ export declare function minRealmScope(values: Array<`${RealmScope}` | null | und
  * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
  * so any app/entity can express its realm via one or many keys under the canonical contract.
  */
-export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | Array<string | null> | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
 //#endregion
 //#region src/permission/types.d.ts
 export type BasePermission = {
@@ -640,6 +675,16 @@ export declare const PolicyDefaultEvaluators: {
   readonly realmMatch: RealmMatchPolicyEvaluator;
   readonly time: TimePolicyEvaluator;
 };
+/**
+ * The configuration validator of every built-in policy type, keyed like
+ * `PolicyDefaultEvaluators`. It is what `projectAuthorizationPolicy` runs a
+ * node through, so a type absent here cannot travel in the authorization
+ * catalog. The registry is open like the evaluator one (#3635): spread it and
+ * add a custom type's validator to let that type travel. It is frozen, since
+ * a write into it would make the type projectable for every caller in the
+ * process.
+ */
+export declare const PolicyDefaultValidators: Readonly<PolicyValidators>;
 //#endregion
 //#region src/policy/input.d.ts
 /**
@@ -753,6 +798,13 @@ export type PermissionEvaluationOptions = {
    *   (`preEvaluate()`): only a tree that settles false with the current bag denies.
    */
   pendingPolicies?: 'deny' | 'permit';
+  /**
+   * Receives the instants at which a clock-dependent policy (`date`, `time`)
+   * in an evaluated tree could change its verdict, so a caller caching the
+   * outcome knows when it expires. Handed to every policy evaluation this call
+   * runs; a policy-free grant evaluates nothing and reports nothing.
+   */
+  transitions?: PolicyTransitionSink;
 };
 export type PermissionEvaluationContext = {
   name: string | string[];
@@ -932,6 +984,20 @@ export type AuthorizationEvaluatorInput = {
    */
   identity?: IdentityPolicyData;
 };
+export type AuthorizationEvaluatorOptions = {
+  /**
+   * The policy types a catalog tree may carry. Defaults to
+   * `PolicyDefaultValidators`; spread it to add a custom type.
+   */
+  validators?: PolicyValidators;
+  /**
+   * How the projected trees evaluate. Defaults to
+   * `PolicyDefaultEvaluators`; spread it to add a custom type. The
+   * permission-binding evaluator is always replaced by the one binding the
+   * introspected grants.
+   */
+  evaluators?: PolicyEvaluators;
+};
 /**
  * Which resource realms a batch check evaluates against.
  *
@@ -1031,9 +1097,9 @@ export declare const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
  * the permission denies until the policy is fixed.
  *
  * A tree THIS copy cannot project is the same condition read from the other
- * side, and it is per tree: a policy type newer than this package (the
- * built-in type enum is closed while the column is a free string) or a
- * configuration its validator refuses denies the definitions that reference
+ * side, and it is per tree: a policy type the validator registry lacks (a
+ * type newer than this package, or a custom one the caller did not register)
+ * or a configuration its validator refuses denies the definitions that reference
  * it, exactly as `policies: null` does, and drops a grant that names it,
  * exactly as a binding check does. One such tree never takes the evaluator
  * down for the permissions that do not use it. A malformed catalog still
@@ -1055,8 +1121,15 @@ export declare const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
  * rejected or evaluated over every candidate before paging. The supplied
  * identity is authoritative; `options.decisionStrategy` is forwarded and the
  * policy include, exclude and pending options are refused.
+ *
+ * The policy type set is open (#3635): `options.validators` decides which
+ * trees project and `options.evaluators` how they evaluate, the built-in
+ * registries by default. A custom type needs both, the validator the server
+ * projected it with and the evaluator the server decides it with; given only
+ * the first it projects and then denies. The binding evaluator is always this
+ * function's own, since it is what binds the introspected grants.
  */
-export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput): Promise<IPermissionEvaluator>;
+export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput, options?: AuthorizationEvaluatorOptions): Promise<IPermissionEvaluator>;
 /**
  * An `IPermissionEvaluator` over the answer `POST /authorization/check`
  * served: the caller's own verdicts, paired with the realms they hold in.
@@ -1093,11 +1166,18 @@ export declare function createAuthorizationCheckEvaluator(input: AuthorizationCh
  * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
  * and, for a composite, its projected children.
  *
+ * The type set is the `validators` registry, `PolicyDefaultValidators` unless
+ * the caller hands another (#3635): a type the registry lacks is refused, so
+ * the server and a consumer that register the same custom type let it travel,
+ * and one that does not denies it. The withheld node is refused whatever the
+ * registry says, since projecting it would evaluate a tree the caller was not
+ * allowed to see.
+ *
  * Every refusal is a `ValidupError`, the node's head and the type's own
  * validator alike, and a child's issues are rebased onto the position it sits
  * at, so one message names the node in the tree that is wrong.
  */
-export declare function projectAuthorizationPolicy(input: unknown): Promise<AuthorizationPolicy>;
+export declare function projectAuthorizationPolicy(input: unknown, validators?: PolicyValidators): Promise<AuthorizationPolicy>;
 /**
  * Whether a projected tree evaluates the permission binding at any depth. A
  * grant policy carrying one would re-enter its own permission's grants, so

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;YCrDG;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;YAGD,+BAA+B,QAAQ;;;wBCvBnC,8BACZ,QAAO,+BACP;;;YCDQ,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;YC1DxE,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCZF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCeA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1BrE,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;qBCFA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBChC1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,uDACA,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBC/CK,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;KCUR;EACD,OAAO,UAAU,qBAAqB,QAAQ;;qBAGrC,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;YAEtB,4BAA4B;EAE1B,YAAA,4BAA4B;EAOxC;EAQM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBCxDzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBC0CA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCtDtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCGT;;;;;;;;;;;;;;;;;;;;iBCAI;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;YAGQ;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBC3DO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAqH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;qBCzO9C;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;;;;;;;;;;;;;;YAgBH,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCtHF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC4FS,6BAA6B,OAAO,8BAA+B,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4N3E,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;wBC1QU,2BAA2B,iBAAkB,QAAQ;;;;;;;;;wBAiD3D,qBAAqB,QAAQ;;;;;;;;;;qBCvFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/context/transition.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;;;;;;;;;;YC5CG;EACR,OAAO,IAAI;;YAGH;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;;;;;WAMA,cAAc;;YAGf,+BAA+B,QAAQ;;;wBC1CnC,8BACZ,QAAO,+BACP;;;YCHQ,4BAA4B;;;;WAI3B,MAAM;;;;;;wBAOH,mCAAoC;;;YCTxC,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;;;;YCrDxE,mBAAmB,eAAe,UAAU;YAE5C,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCnBF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCwCA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCnDrE,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;cCvBS,oCAAoC,UAAU;EAC9C;;;;qBCFA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBChC1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,0BAA0B,yCAC1B,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBC/CK,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;KCWR;EACD,OAAO,UAAU,qBAAqB,QAAQ;;qBAoBrC,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;YAEtB,4BAA4B;EAE1B,YAAA,4BAA4B;EAOxC;EAQM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBC1EzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBCgGA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBC5GtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCYT;;;;;;;;;;;;;;;;;;;qBAoBA,yBAA0B,SAAS;;;;;;;;;;;iBC7B/B;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;;;;;;EAOA,cAAc;;YAGN;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBClEO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAsH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;qBC1O9C;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;YAGH;;;;;EAKR,aAAa;;;;;;;EAOb,aAAa;;;;;;;;;;;;;;;YAgBL,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCrIF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC8GS,6BAClB,OAAO,6BACP,UAAS,gCACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA4NU,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;;;;;;;wBC7SU,2BAClB,gBACA,aAAY,mBACZ,QAAQ;;;;;;;;;wBAyDI,qBAAqB,QAAQ;;;;;;;;;;qBCpFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}

package/dist/index.mjs

@@ -539,7 +539,25 @@ function definePolicyEvaluationContext(input = {}) {
 		include: input.include || [],
 		exclude: input.exclude || [],
 		withConditions: input.withConditions ?? false,
-		realmAttributeName: input.realmAttributeName
+		realmAttributeName: input.realmAttributeName,
+		transitions: input.transitions
+	};
+}
+//#endregion
+//#region src/policy/evaluation/context/transition.ts
+/**
+* A sink keeping the earliest reported instant, which is the moment an answer
+* built from every evaluation it was handed to stops being current.
+*/
+function createPolicyTransitionCollector() {
+	let next;
+	return {
+		report(at) {
+			if (!next || at.getTime() < next.getTime()) next = at;
+		},
+		get next() {
+			return next;
+		}
 	};
 }
 //#endregion
@@ -762,7 +780,7 @@ var CompositePolicyValidator = class extends Container {
 	initialize() {
 		super.initialize();
 		this.mount("decisionStrategy", createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(3) }))));
+		this.mount("children", createValidator(z.array(z.looseObject({ type: z.string().min(1) }))));
 		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
 	}
 };
@@ -900,6 +918,22 @@ function toDate$1(input) {
 	if (typeof input === "number") return new Date(input);
 	return input;
 }
+/**
+* The next instant at which a date policy's verdict could change, seen from the
+* (day-normalized) `now`: the start day while it is still ahead, else the
+* midnight after the end day while that day has not passed. Nothing once the
+* end day is behind, since the verdict is final from then on.
+*/
+function nextDateTransition(policy, now) {
+	if (policy.start) {
+		const start = normalizeDate$1(toDate$1(policy.start));
+		if (now < start) return start;
+	}
+	if (policy.end) {
+		const end = normalizeDate$1(toDate$1(policy.end));
+		if (now <= end) return new Date(end.getFullYear(), end.getMonth(), end.getDate() + 1);
+	}
+}
 var DatePolicyEvaluator = class {
 	validator;
 	constructor() {
@@ -915,7 +949,13 @@ var DatePolicyEvaluator = class {
 				ctx.data.set("date", now);
 				ctx.data.setValidated("date");
 			}
-		} else now = normalizeDate$1(/* @__PURE__ */ new Date());
+		} else {
+			now = normalizeDate$1(/* @__PURE__ */ new Date());
+			if (ctx.transitions) {
+				const next = nextDateTransition(policy, now);
+				if (next) ctx.transitions.report(next);
+			}
+		}
 		if (policy.start) {
 			const start = normalizeDate$1(toDate$1(policy.start));
 			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
@@ -1155,6 +1195,12 @@ var PermissionBindingPolicyValidator = class extends Container {
 };
 //#endregion
 //#region src/policy/built-in/permission-binding/identity-evaluator.ts
+function containsPermissionBinding(policy) {
+	if (policy.type === "permissionBinding") return true;
+	if (policy.type !== "composite") return false;
+	const children = policy.children;
+	return Array.isArray(children) && children.some((child) => !!child && typeof child === "object" && containsPermissionBinding(child));
+}
 var IdentityPermissionBindingPolicyEvaluator = class {
 	validator;
 	identityEvaluator;
@@ -1233,6 +1279,14 @@ var IdentityPermissionBindingPolicyEvaluator = class {
 				pending = true;
 				continue;
 			}
+			if (containsPermissionBinding(grant.policy)) {
+				issues.push(definePolicyIssueItem({
+					code: "INVALID",
+					message: "A grant policy must not evaluate the permission binding.",
+					path: ctx.path
+				}));
+				continue;
+			}
 			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
 				...ctx,
 				path: [...ctx.path || []]
@@ -1345,6 +1399,30 @@ function toDate(input, dateRef) {
 	if (typeof input === "number") return new Date(input);
 	return input;
 }
+/**
+* The next instant at which a time policy's verdict could change, seen from
+* `now`: today's start while it is ahead, the minute after today's end while
+* that is ahead, and the next local midnight, where the daily window moves on
+* and the day-of-week/month/year checks roll over. The earliest of those; a
+* policy with no constraint never changes.
+*
+* `normalizeDate` keeps the seconds and milliseconds of the instant it is
+* evaluated at and drops the policy's own, so the comparisons below are made
+* at minute precision: `now < start` stops holding at HH:MM:00.000 of the
+* start, and `now > end` starts holding at the following minute. Reading the
+* candidates off `normalizeDate` instead would report the seconds of this
+* evaluation, up to a minute after the verdict already flipped.
+*/
+function nextTimeTransition(policy, now) {
+	const candidates = [];
+	const atMinute = (input) => new Date(now.getFullYear(), now.getMonth(), now.getDate(), input.getHours(), input.getMinutes());
+	if (policy.start) candidates.push(atMinute(toDate(policy.start, now)));
+	if (policy.end) candidates.push(new Date(atMinute(toDate(policy.end, now)).getTime() + 6e4));
+	if (policy.start || policy.end || policy.interval) candidates.push(new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1));
+	let next;
+	for (const candidate of candidates) if (candidate.getTime() > now.getTime() && (!next || candidate.getTime() < next.getTime())) next = candidate;
+	return next;
+}
 var TimePolicyEvaluator = class {
 	validator;
 	constructor() {
@@ -1360,7 +1438,13 @@ var TimePolicyEvaluator = class {
 				ctx.data.set("time", now);
 				ctx.data.setValidated("time");
 			}
-		} else now = /* @__PURE__ */ new Date();
+		} else {
+			now = /* @__PURE__ */ new Date();
+			if (ctx.transitions) {
+				const next = nextTimeTransition(policy, now);
+				if (next) ctx.transitions.report(next);
+			}
+		}
 		if (policy.start) {
 			const start = normalizeDate(toDate(policy.start, now), now);
 			if (now < start) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
@@ -1405,6 +1489,25 @@ const PolicyDefaultEvaluators = {
 	["realmMatch"]: new RealmMatchPolicyEvaluator(),
 	["time"]: new TimePolicyEvaluator()
 };
+/**
+* The configuration validator of every built-in policy type, keyed like
+* `PolicyDefaultEvaluators`. It is what `projectAuthorizationPolicy` runs a
+* node through, so a type absent here cannot travel in the authorization
+* catalog. The registry is open like the evaluator one (#3635): spread it and
+* add a custom type's validator to let that type travel. It is frozen, since
+* a write into it would make the type projectable for every caller in the
+* process.
+*/
+const PolicyDefaultValidators = Object.freeze({
+	["composite"]: new CompositePolicyValidator(),
+	["attributes"]: new AttributesPolicyValidator(),
+	["attributeNames"]: new AttributeNamesPolicyValidator(),
+	["date"]: new DatePolicyValidator(),
+	["identity"]: new IdentityPolicyValidator(),
+	["permissionBinding"]: new PermissionBindingPolicyValidator(),
+	["realmMatch"]: new RealmMatchPolicyValidator(),
+	["time"]: new TimePolicyValidator()
+});
 //#endregion
 //#region src/policy/input.ts
 /**
@@ -1481,6 +1584,7 @@ var PermissionEvaluator = class {
 			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
 				include: options.policiesIncluded,
 				exclude: options.policiesExcluded,
+				transitions: options.transitions,
 				data
 			}));
 			if (evaluationResult.success || options.pendingPolicies === "permit" && !!evaluationResult.pending) {
@@ -1801,22 +1905,10 @@ const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
 var AuthorizationPolicyHeadValidator = class extends Container {
 	initialize() {
 		super.initialize();
-		this.mount("type", createValidator(z.enum(BuiltInPolicyType)));
+		this.mount("type", createValidator(z.string().min(1)));
 		this.mount("children", createValidator(z.array(z.unknown()).optional()));
 	}
 };
-function createValidators() {
-	return {
-		["attributes"]: new AttributesPolicyValidator(),
-		["attributeNames"]: new AttributeNamesPolicyValidator(),
-		["composite"]: new CompositePolicyValidator(),
-		["date"]: new DatePolicyValidator(),
-		["time"]: new TimePolicyValidator(),
-		["identity"]: new IdentityPolicyValidator(),
-		["permissionBinding"]: new PermissionBindingPolicyValidator(),
-		["realmMatch"]: new RealmMatchPolicyValidator()
-	};
-}
 /**
 * The one definition of what a policy looks like on the wire, used by the server
 * to build a document and by the consumer to validate one. A node is the OUTPUT
@@ -1824,17 +1916,28 @@ function createValidators() {
 * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
 * and, for a composite, its projected children.
 *
+* The type set is the `validators` registry, `PolicyDefaultValidators` unless
+* the caller hands another (#3635): a type the registry lacks is refused, so
+* the server and a consumer that register the same custom type let it travel,
+* and one that does not denies it. The withheld node is refused whatever the
+* registry says, since projecting it would evaluate a tree the caller was not
+* allowed to see.
+*
 * Every refusal is a `ValidupError`, the node's head and the type's own
 * validator alike, and a child's issues are rebased onto the position it sits
 * at, so one message names the node in the tree that is wrong.
 */
-async function projectAuthorizationPolicy(input) {
+async function projectAuthorizationPolicy(input, validators = PolicyDefaultValidators) {
 	const headValidator = new AuthorizationPolicyHeadValidator();
-	const validators = createValidators();
 	const project = async (value) => {
 		const head = await headValidator.run(value);
+		const validator = head.type !== "withheld" && Object.hasOwn(validators, head.type) ? validators[head.type] : void 0;
+		if (!validator) throw new ValidupError([defineIssueItem({
+			message: `The policy type ${head.type} is not supported.`,
+			path: ["type"]
+		})]);
 		const output = {
-			...await validators[head.type].run(value),
+			...await validator.run(value),
 			type: head.type
 		};
 		for (const key of Object.keys(output)) if (typeof output[key] === "undefined") delete output[key];
@@ -1866,9 +1969,19 @@ function containsBindingCheck(policy) {
 }
 //#endregion
 //#region src/permission/authorization/module.ts
+/**
+* Every value `realmScopeMatches` decides, and nothing it would have to guess
+* at (#3636): a realm key, `null` for a global row, or a list of either for a
+* row spanning several realms. An empty key and an empty list are legal and
+* DENY there (no identity's realm is the empty string, and the empty set is
+* fail-closed), so refusing them here would make the consumer the one side
+* that errors where the server answers. `undefined` stays refused: the server
+* coerces it to `null`, which reads as a global row, and a caller passing an
+* absent column should hear about it rather than reach the global rows.
+*/
 const realmMatchSchema = z.union([
-	z.string().min(1),
-	z.array(z.string().min(1)).min(1),
+	z.string(),
+	z.array(z.string().nullable()),
 	z.null()
 ]);
 /**
@@ -1908,9 +2021,9 @@ function toPolicy(tree) {
 * the permission denies until the policy is fixed.
 *
 * A tree THIS copy cannot project is the same condition read from the other
-* side, and it is per tree: a policy type newer than this package (the
-* built-in type enum is closed while the column is a free string) or a
-* configuration its validator refuses denies the definitions that reference
+* side, and it is per tree: a policy type the validator registry lacks (a
+* type newer than this package, or a custom one the caller did not register)
+* or a configuration its validator refuses denies the definitions that reference
 * it, exactly as `policies: null` does, and drops a grant that names it,
 * exactly as a binding check does. One such tree never takes the evaluator
 * down for the permissions that do not use it. A malformed catalog still
@@ -1932,13 +2045,20 @@ function toPolicy(tree) {
 * rejected or evaluated over every candidate before paging. The supplied
 * identity is authoritative; `options.decisionStrategy` is forwarded and the
 * policy include, exclude and pending options are refused.
+*
+* The policy type set is open (#3635): `options.validators` decides which
+* trees project and `options.evaluators` how they evaluate, the built-in
+* registries by default. A custom type needs both, the validator the server
+* projected it with and the evaluator the server decides it with; given only
+* the first it projects and then denies. The binding evaluator is always this
+* function's own, since it is what binds the introspected grants.
 */
-async function createAuthorizationEvaluator(input) {
+async function createAuthorizationEvaluator(input, options = {}) {
 	const { catalog, grants, identity } = await parseAuthorizationEvaluatorInput(input);
 	const trees = /* @__PURE__ */ new Map();
 	const unevaluable = /* @__PURE__ */ new Set();
 	for (const [id, raw] of Object.entries(catalog.policies)) try {
-		trees.set(id, await projectAuthorizationPolicy(raw));
+		trees.set(id, await projectAuthorizationPolicy(raw, options.validators));
 	} catch {
 		unevaluable.add(id);
 	}
@@ -2011,7 +2131,7 @@ async function createAuthorizationEvaluator(input) {
 			policies: policies.length > 0 ? policies : void 0
 		});
 	}
-	const engine = new PolicyEngine(PolicyDefaultEvaluators);
+	const engine = new PolicyEngine(options.evaluators ?? PolicyDefaultEvaluators);
 	engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator({ getFor: async () => bindings }));
 	const evaluator = new PermissionEvaluator({
 		provider: new PermissionMemoryProvider(definitions),
@@ -2147,6 +2267,6 @@ async function createAuthorizationCheckEvaluator(input) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
+export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
 
 //# sourceMappingURL=index.mjs.map