@authup/access 1.0.0-beta.66 → 1.0.0-beta.68

package/dist/permission/authorization/module.d.ts

@@ -1,5 +1,5 @@
 import type { IPermissionEvaluator } from '../evaluator';
-import type { AuthorizationCheckEvaluatorInput, AuthorizationEvaluatorInput } from './types';
+import type { AuthorizationCheckEvaluatorInput, AuthorizationEvaluatorInput, AuthorizationEvaluatorOptions } from './types';
 /**
  * Build a resource-server (or console) evaluator from the catalog
  * `GET /authorization` serves, the identity's grants as the introspection
@@ -14,9 +14,9 @@ import type { AuthorizationCheckEvaluatorInput, AuthorizationEvaluatorInput } fr
  * the permission denies until the policy is fixed.
  *
  * A tree THIS copy cannot project is the same condition read from the other
- * side, and it is per tree: a policy type newer than this package (the
- * built-in type enum is closed while the column is a free string) or a
- * configuration its validator refuses denies the definitions that reference
+ * side, and it is per tree: a policy type the validator registry lacks (a
+ * type newer than this package, or a custom one the caller did not register)
+ * or a configuration its validator refuses denies the definitions that reference
  * it, exactly as `policies: null` does, and drops a grant that names it,
  * exactly as a binding check does. One such tree never takes the evaluator
  * down for the permissions that do not use it. A malformed catalog still
@@ -38,8 +38,15 @@ import type { AuthorizationCheckEvaluatorInput, AuthorizationEvaluatorInput } fr
  * rejected or evaluated over every candidate before paging. The supplied
  * identity is authoritative; `options.decisionStrategy` is forwarded and the
  * policy include, exclude and pending options are refused.
+ *
+ * The policy type set is open (#3635): `options.validators` decides which
+ * trees project and `options.evaluators` how they evaluate, the built-in
+ * registries by default. A custom type needs both, the validator the server
+ * projected it with and the evaluator the server decides it with; given only
+ * the first it projects and then denies. The binding evaluator is always this
+ * function's own, since it is what binds the introspected grants.
  */
-export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput): Promise<IPermissionEvaluator>;
+export declare function createAuthorizationEvaluator(input: AuthorizationEvaluatorInput, options?: AuthorizationEvaluatorOptions): Promise<IPermissionEvaluator>;
 /**
  * An `IPermissionEvaluator` over the answer `POST /authorization/check`
  * served: the caller's own verdicts, paired with the realms they hold in.

package/dist/permission/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EAIvB,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACR,gCAAgC,EAChC,2BAA2B,EAE9B,MAAM,SAAS,CAAC;AAgCjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,2BAA2B,GAAI,OAAO,CAAC,oBAAoB,CAAC,CAgMrH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iCAAiC,CACnD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EAIvB,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACR,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,EAEhC,MAAM,SAAS,CAAC;AA0CjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,2BAA2B,EAClC,OAAO,GAAE,6BAAkC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAgMhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iCAAiC,CACnD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}

package/dist/permission/authorization/policy.d.ts

@@ -1,3 +1,4 @@
+import type { PolicyValidators } from '../../policy';
 import type { AuthorizationPolicy } from './types';
 /**
  * The one definition of what a policy looks like on the wire, used by the server
@@ -6,11 +7,18 @@ import type { AuthorizationPolicy } from './types';
  * such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
  * and, for a composite, its projected children.
  *
+ * The type set is the `validators` registry, `PolicyDefaultValidators` unless
+ * the caller hands another (#3635): a type the registry lacks is refused, so
+ * the server and a consumer that register the same custom type let it travel,
+ * and one that does not denies it. The withheld node is refused whatever the
+ * registry says, since projecting it would evaluate a tree the caller was not
+ * allowed to see.
+ *
  * Every refusal is a `ValidupError`, the node's head and the type's own
  * validator alike, and a child's issues are rebased onto the position it sits
  * at, so one message names the node in the tree that is wrong.
  */
-export declare function projectAuthorizationPolicy(input: unknown): Promise<AuthorizationPolicy>;
+export declare function projectAuthorizationPolicy(input: unknown, validators?: PolicyValidators): Promise<AuthorizationPolicy>;
 /**
  * Whether a projected tree evaluates the permission binding at any depth. A
  * grant policy carrying one would re-enter its own permission's grants, so

package/dist/permission/authorization/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/policy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAkCnD;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAI,OAAO,CAAC,mBAAmB,CAAC,CAuC9F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAI,OAAO,CAM1E"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAqBnD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,0BAA0B,CAC5C,KAAK,EAAE,OAAO,EACd,UAAU,GAAE,gBAA0C,GACtD,OAAO,CAAC,mBAAmB,CAAC,CA+C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAI,OAAO,CAM1E"}

package/dist/permission/authorization/types.d.ts

@@ -1,5 +1,5 @@
 import type { DecisionStrategy } from '@authup/kit';
-import type { IdentityPolicyData } from '../../policy';
+import type { IdentityPolicyData, PolicyEvaluators, PolicyValidators } from '../../policy';
 import type { RealmScope } from '../realm-scope';
 /**
  * One policy tree node as it travels: the type's configuration keys (the output
@@ -73,6 +73,20 @@ export type AuthorizationEvaluatorInput = {
      */
     identity?: IdentityPolicyData;
 };
+export type AuthorizationEvaluatorOptions = {
+    /**
+     * The policy types a catalog tree may carry. Defaults to
+     * `PolicyDefaultValidators`; spread it to add a custom type.
+     */
+    validators?: PolicyValidators;
+    /**
+     * How the projected trees evaluate. Defaults to
+     * `PolicyDefaultEvaluators`; spread it to add a custom type. The
+     * permission-binding evaluator is always replaced by the one binding the
+     * introspected grants.
+     */
+    evaluators?: PolicyEvaluators;
+};
 /**
  * Which resource realms a batch check evaluates against.
  *

package/dist/permission/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,WAAW,EAAE,uBAAuB,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,wBAAwB,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAC1D,GAAG,UAAU,CAAC,WAAW,EAAE,GAC3B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,4BAA4B,EAAE,CAAC;AAE3E,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,WAAW,EAAE,uBAAuB,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,wBAAwB,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,GAC1D,GAAG,UAAU,CAAC,WAAW,EAAE,GAC3B,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,4BAA4B,EAAE,CAAC;AAE3E,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC"}

package/dist/permission/evaluator/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAqH1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAe7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAYxE;;;;;;;;;OASG;IACG,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;CA0ElF"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/module.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA+B,aAAa,EAAE,MAAM,cAAc,CAAC;AAU/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EACR,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC7B,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAoB,YAAW,oBAAoB;IAC5D,SAAS,CAAC,QAAQ,EAAG,mBAAmB,CAAC;IAEzC,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;gBAItB,OAAO,EAAE,0BAA0B;cAe/B,OAAO,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KACtB,GACN,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAU/C,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAsH1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAY/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAe7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAI,OAAO,CAAC,IAAI,CAAC;IAYxE;;;;;;;;;OASG;IACG,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAI,OAAO,CAAC,uBAAuB,CAAC;CA0ElF"}

package/dist/permission/evaluator/types.d.ts

@@ -1,6 +1,6 @@
 import type { ICondition } from '@rapiq/core';
 import type { DecisionStrategy } from '@authup/kit';
-import type { IPolicyEngine, PolicyData } from '../../policy';
+import type { IPolicyEngine, PolicyData, PolicyTransitionSink } from '../../policy';
 import type { IPermissionProvider } from '../provider';
 export interface IPermissionEvaluator {
     evaluate(ctx: PermissionEvaluationContext): Promise<void>;
@@ -29,6 +29,13 @@ export type PermissionEvaluationOptions = {
      *   (`preEvaluate()`): only a tree that settles false with the current bag denies.
      */
     pendingPolicies?: 'deny' | 'permit';
+    /**
+     * Receives the instants at which a clock-dependent policy (`date`, `time`)
+     * in an evaluated tree could change its verdict, so a caller caching the
+     * outcome knows when it expires. Handed to every policy evaluation this call
+     * runs; a policy-free grant evaluates nothing and reports nothing.
+     */
+    transitions?: PolicyTransitionSink;
 };
 export type PermissionEvaluationContext = {
     name: string | string[];

package/dist/permission/evaluator/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/evaluator/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,aAAa,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,0BAA0B,GAAG;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,gBAAgB,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,2BAA2B,CAAA;CACxC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACnC;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,GACjD;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/permission/realm-scope/helpers.d.ts

@@ -19,5 +19,5 @@ export declare function minRealmScope(values: Array<`${RealmScope}` | null | und
  * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
  * so any app/entity can express its realm via one or many keys under the canonical contract.
  */
-export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | string[] | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
+export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | Array<string | null> | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/permission/realm-scope/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,GAAG,UAAU,EAAE,CAMnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAC1B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAC3B,MAAM,CAER;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAYhG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAWhG;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EACzC,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACrD,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAyBT"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/permission/realm-scope/helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,GAAG,UAAU,EAAE,CAMnF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAC1B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAC3B,MAAM,CAER;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAYhG;AAED,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,EAAE,CAWhG;AAwBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,GAAG,SAAS,EACzC,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,EACjE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAyBT"}

package/dist/policy/built-in/date/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/date/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkBlD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAoC5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/date/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA0ClD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA4C5G"}

package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/identity-evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,KAAK,0BAA0B,GAAG;IAC9B,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC5E,CAAC;AAEF,qBAAa,wCAAyC,YAAW,gBAAgB;IAC7E,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;gBAErD,0BAA0B,EAAE,0BAA0B;IAOlE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+M5G"}
+{"version":3,"file":"identity-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/identity-evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,KAAK,0BAA0B,GAAG;IAC9B,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC5E,CAAC;AAmBF,qBAAa,wCAAyC,YAAW,gBAAgB;IAC7E,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;gBAErD,0BAA0B,EAAE,0BAA0B;IAOlE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA6N5G"}

package/dist/policy/built-in/time/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAI1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA6ClD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAwE5G"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/time/evaluator.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1G,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkGlD,qBAAa,mBAAoB,YAAW,gBAAgB;IACxD,SAAS,CAAC,SAAS,EAAG,mBAAmB,CAAC;;IAMpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAgF5G"}

package/dist/policy/constants.d.ts

@@ -1,4 +1,5 @@
 import { AttributeNamesPolicyEvaluator, AttributesPolicyEvaluator, CompositePolicyEvaluator, DatePolicyEvaluator, IdentityPolicyEvaluator, PermissionBindingPolicyEvaluator, RealmMatchPolicyEvaluator, TimePolicyEvaluator } from './built-in';
+import type { PolicyValidators } from './types.ts';
 export declare const PolicyDefaultEvaluators: {
     readonly composite: CompositePolicyEvaluator;
     readonly attributes: AttributesPolicyEvaluator<Record<string, any>>;
@@ -9,4 +10,14 @@ export declare const PolicyDefaultEvaluators: {
     readonly realmMatch: RealmMatchPolicyEvaluator;
     readonly time: TimePolicyEvaluator;
 };
+/**
+ * The configuration validator of every built-in policy type, keyed like
+ * `PolicyDefaultEvaluators`. It is what `projectAuthorizationPolicy` runs a
+ * node through, so a type absent here cannot travel in the authorization
+ * catalog. The registry is open like the evaluator one (#3635): spread it and
+ * add a custom type's validator to let that type travel. It is frozen, since
+ * a write into it would make the type projectable for every caller in the
+ * process.
+ */
+export declare const PolicyDefaultValidators: Readonly<PolicyValidators>;
 //# sourceMappingURL=constants.d.ts.map

package/dist/policy/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/policy/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,6BAA6B,EAC7B,yBAAyB,EAEzB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACtB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,uBAAuB;;;;;;;;;CAS1B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/policy/constants.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,6BAA6B,EAE7B,yBAAyB,EAGzB,wBAAwB,EAExB,mBAAmB,EAEnB,uBAAuB,EAEvB,gCAAgC,EAEhC,yBAAyB,EAEzB,mBAAmB,EAEtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAO,MAAM,uBAAuB;;;;;;;;;CAS1B,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAG,QAAQ,CAAC,gBAAgB,CAS9D,CAAC"}

package/dist/policy/evaluation/context/define.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAU1B"}
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/define.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAGxF,wBAAgB,6BAA6B,CACzC,KAAK,GAAE,4BAAiC,GACxC,uBAAuB,CAW1B"}

package/dist/policy/evaluation/context/index.d.ts

@@ -1,3 +1,4 @@
 export * from './define.ts';
+export * from './transition.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/evaluation/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC"}

package/dist/policy/evaluation/context/transition.d.ts

@@ -0,0 +1,13 @@
+import type { PolicyTransitionSink } from './types.ts';
+export type PolicyTransitionCollector = PolicyTransitionSink & {
+    /**
+     * The earliest reported instant, or undefined when nothing reported one.
+     */
+    readonly next: Date | undefined;
+};
+/**
+ * A sink keeping the earliest reported instant, which is the moment an answer
+ * built from every evaluation it was handed to stops being current.
+ */
+export declare function createPolicyTransitionCollector(): PolicyTransitionCollector;
+//# sourceMappingURL=transition.d.ts.map

package/dist/policy/evaluation/context/transition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transition.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/transition.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,yBAAyB,GAAG,oBAAoB,GAAG;IAC3D;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CAClC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,+BAA+B,IAAK,yBAAyB,CAa5E"}

package/dist/policy/evaluation/context/types.d.ts

@@ -1,5 +1,17 @@
 import type { PolicyData } from '../../data.ts';
 import type { IPolicyEvaluator } from '../types.ts';
+/**
+ * Receives the instants at which a clock-dependent verdict could change.
+ *
+ * A `date` or `time` policy that fell back to the real clock (no `date` / `time`
+ * key in the bag) reports the next strictly-future instant its own verdict could
+ * flip, from inside the evaluation walk that already runs. A caller that caches
+ * an answer derived from such a walk learns when to stop trusting it. Reports may
+ * be early (conservative) but never late, and `invert` does not move them.
+ */
+export type PolicyTransitionSink = {
+    report(at: Date): void;
+};
 export type PolicyEvaluationContext = {
     readonly evaluators: Record<string, IPolicyEvaluator>;
     readonly path: (string | number)[];
@@ -22,6 +34,12 @@ export type PolicyEvaluationContext = {
      * consults a column name, so this can never change an evaluate() outcome.
      */
     readonly realmAttributeName?: string;
+    /**
+     * Optional receiver of clock transitions (see {@link PolicyTransitionSink}).
+     * Nested evaluations inherit it, since every walk propagates the context by
+     * spread.
+     */
+    readonly transitions?: PolicyTransitionSink;
 };
 export type PolicyEvaluationContextInput = Partial<PolicyEvaluationContext>;
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/evaluation/context/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CACvC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/evaluation/context/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAC/B,MAAM,CAAC,EAAE,EAAE,IAAI,GAAG,IAAI,CAAA;CACzB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACtD,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAC9C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC"}

package/dist/policy/types.d.ts

@@ -1,3 +1,8 @@
+import type { Container } from 'validup';
+/**
+ * A policy type's configuration validator, keyed by the type it validates.
+ */
+export type PolicyValidators = Record<string, Container<Record<string, any>>>;
 export type BasePolicy<T extends string = string> = {
     /**
      * Type describing the policy.

package/dist/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAChD;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC;IAET;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,CACtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACnD,CAAC,SAAS,MAAM,GAAG,MAAM,IACzB,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI;IAChD;;OAEG;IACH,IAAI,CAAC,EAAE,CAAC,CAAC;IAET;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,CACtB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACnD,CAAC,SAAS,MAAM,GAAG,MAAM,IACzB,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.66",
+    "version": "1.0.0-beta.68",
     "description": "A library for evaluating permissions and policies.",
     "license": "Apache-2.0",
     "exports": {
@@ -54,12 +54,12 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/errors": "^1.0.0-beta.66",
-        "@authup/kit": "^1.0.0-beta.66",
+        "@authup/errors": "^1.0.0-beta.68",
+        "@authup/kit": "^1.0.0-beta.68",
         "@ebec/core": "^1.3.2",
-        "@rapiq/adapter-memory": "^2.2.0",
-        "@rapiq/core": "^2.2.0",
-        "@rapiq/parser-mongo": "^2.2.0",
+        "@rapiq/adapter-memory": "^2.4.0",
+        "@rapiq/core": "^2.4.0",
+        "@rapiq/parser-mongo": "^2.4.0",
         "@validup/zod": "^2.0.1",
         "smob": "^1.6.1",
         "validup": "^2.0.1",