@authup/access 1.0.0-beta.69 → 1.0.0-beta.70

package/README.md

@@ -0,0 +1,230 @@
+<p align="center">
+    <img src="https://raw.githubusercontent.com/authup/authup/master/.github/assets/logo.svg" alt="Authup logo" width="96" height="96" />
+</p>
+
+<h1 align="center">@authup/access</h1>
+
+<p align="center">
+    <b>Evaluate Authup permissions and policies in your own process, with the same engine the server uses.</b><br>
+    Your API decides "may this token update this row?" locally, instead of asking Authup on every request.
+</p>
+
+<p align="center">
+    <a href="https://www.npmjs.com/package/@authup/access"><img src="https://img.shields.io/npm/v/@authup/access" alt="npm version" /></a>
+    <a href="https://github.com/authup/authup/actions/workflows/main.yml"><img src="https://github.com/authup/authup/actions/workflows/main.yml/badge.svg" alt="CI" /></a>
+    <a href="./LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue" alt="License: Apache-2.0" /></a>
+</p>
+
+<p align="center">
+    <a href="#installation"><b>Installation</b></a> · <a href="#usage">Usage</a> · <a href="#api">API</a> · <a href="https://authup.org">Documentation</a>
+</p>
+
+---
+
+## Why @authup/access?
+
+In Authup a grant is more than a permission name. Each grant carries a realm reach (`own`, `ownOrNull`, `any`) and optional policies (attributes, identity, time, date, realm match, composites), and a permission can carry policies of its own. Re-implementing that model in every API that receives an Authup token is how the API and the server end up disagreeing. This package is the model itself: the server-core service evaluates every management API request with it, and so can you.
+
+| Concern | Without it | With it |
+|---|---|---|
+| **Permission checks** | `if (token.permissions.includes('user_update'))`, which ignores realm reach and policies | `evaluateRecord(evaluator, { name: 'user_update', realm })` answers the way the server would |
+| **Realm reach** | Hand-written tenant comparisons per route | `own`, `ownOrNull` and `any` are evaluated per grant against the record's realm |
+| **Policies** | A second, partial implementation of attribute, time and identity rules | The built-in policy evaluators, plus your own types through `PolicyEngine` |
+| **Stale data** | Silent denials after a permission is added on the server | `AuthorizationCatalogStaleError` says the copy is old, so you refetch |
+| **List queries** | Fetch everything, then filter in memory | `compile()` lowers a decision to a rapiq condition you can push into the query |
+
+## Installation
+
+```shell
+npm install @authup/access
+```
+
+ESM only. Node.js `^22.13.0 || ^23.5.0 || >=24.0.0`. No peer dependencies; the policy engine runs in a browser as well.
+
+## Usage
+
+### Evaluate permissions you define
+
+```typescript
+import {
+    BuiltInPolicyType,
+    PermissionEvaluator,
+    PermissionMemoryProvider,
+    defineAttributesPolicy,
+    definePolicyData,
+} from '@authup/access';
+
+const evaluator = new PermissionEvaluator({
+    provider: new PermissionMemoryProvider([
+        { permission: { name: 'report_read' } },
+        {
+            permission: { name: 'report_update' },
+            policies: [defineAttributesPolicy({ type: BuiltInPolicyType.ATTRIBUTES, query: { ownerId: 'u1' } })],
+        },
+    ]),
+});
+
+await evaluator.evaluate({ name: 'report_read' });
+
+await evaluator.evaluate({
+    name: 'report_update',
+    data: definePolicyData({ [BuiltInPolicyType.ATTRIBUTES]: { ownerId: 'u1' } }),
+});
+
+await evaluator.preEvaluate({ name: 'report_update' }); // passes: the row is not known yet
+```
+
+- `evaluate` resolves or throws a `PermissionError` (`isPermissionError`). With several names it needs all of them; `evaluateOneOf` needs one.
+- `preEvaluate` is the gate before the data exists: a policy whose data key is missing counts as passed, and only a policy that already fails denies. `evaluate` with the same missing key denies.
+- A permission the provider does not know denies.
+- An `attributes` policy's `query` is a MongoDB-style filter (`{ ownerId: 'u1' }`, `{ age: { $gte: 18 } }`) matched against the `attributes` data key.
+
+### Decide from Authup's catalog
+
+A resource server reads the identity-free catalog once (`GET /authorization`, with its own client credentials and `permission_read`), and takes the grants and the identity from the introspection of the token it received (`POST /token/introspect`: `permissions`, `sub`, `sub_kind`, `realm_id`, `realm_name`):
+
+```typescript
+import {
+    createAuthorizationEvaluator,
+    evaluateRecord,
+    isAuthorizationCatalogStaleError,
+    reachesRecord,
+} from '@authup/access';
+
+declare const catalog: unknown;
+declare const grants: unknown;
+declare function refetchCatalog(): Promise<unknown>;
+
+const identity = {
+    type: 'user',
+    id: '7c9e6679-7425-40de-944b-e07fc1f099d6',
+    realmId: '4c8e0f9e-6c0a-4b1e-9d31-2a6f0b1c7e11',
+};
+
+let evaluator;
+try {
+    evaluator = await createAuthorizationEvaluator({ catalog, grants, identity });
+} catch (error) {
+    if (!isAuthorizationCatalogStaleError(error)) {
+        throw error;
+    }
+
+    evaluator = await createAuthorizationEvaluator({ catalog: await refetchCatalog(), grants, identity });
+}
+
+await evaluateRecord(evaluator, {
+    name: 'user_update',
+    realm: '4c8e0f9e-6c0a-4b1e-9d31-2a6f0b1c7e11',
+    data: { attributes: { name: 'alice' } },
+});
+
+const canDelete = await reachesRecord(evaluator, { name: 'user_delete', realm: null });
+```
+
+- `catalog` and `grants` are validated, so you can pass the parsed response bodies as they are. A malformed document throws.
+- A grant naming a permission or a policy the catalog lacks throws `AuthorizationCatalogStaleError`: your catalog is older than the grant. Refetch and build again.
+- A definition the server could not project arrives with `policies: null`, and a policy tree your copy cannot project (an unknown type, a configuration its validator refuses) denies the permissions that use it. Neither throws, and other permissions are unaffected.
+- Without an `identity` only definitions whose policies need no identity can pass. Grants without an identity are refused.
+- Custom policy types need both halves: `createAuthorizationEvaluator(input, { validators, evaluators })`, each replacing the built-in registry (spread `PolicyDefaultValidators` / `PolicyDefaultEvaluators` to extend it).
+
+### Check one record
+
+`evaluateRecord`, `evaluateRecordOneOf`, `reachesRecord`, `reachesRecordOneOf` and `evaluateRecordUpdate` take the record's realm explicitly:
+
+| `realm` | Means |
+|---|---|
+| `'<realm id>'` | A row of that realm |
+| `null` | A global row |
+| `['<id>', null]` | A row spanning several realms; every one must be reached |
+| `undefined` | Throws: a missing realm is a bug, never "global" |
+
+- `data` is a `PolicyData` or a plain record and must not carry `realmMatch` itself; the helper sets it from `realm`. It is cloned, never written to.
+- `reachesRecord*` returns `false` for a `PermissionError` and rethrows anything else.
+- `evaluateRecordUpdate(evaluator, { name, current, next })` evaluates the stored row and the updated row, so an update can neither move a row into reach nor out of it.
+- `hasUnboundedReach(evaluator, name)` is true when `compile` answers `allow`: an `any` grant with no narrowing policy.
+
+### Use the batch check answer
+
+A public client (a browser app) holds no secret, so it cannot read the catalog. It asks `POST /authorization/check` for its own verdicts instead and gates its UI with them:
+
+```typescript
+import { createAuthorizationCheckEvaluator, reachesRecord } from '@authup/access';
+
+declare const permissions: unknown; // the response body
+
+const evaluator = await createAuthorizationCheckEvaluator({
+    permissions,
+    identity: {
+        type: 'user',
+        id: '7c9e6679-7425-40de-944b-e07fc1f099d6',
+        realmId: '4c8e0f9e-6c0a-4b1e-9d31-2a6f0b1c7e11',
+        realmName: 'acme',
+    },
+});
+
+const canEdit = await reachesRecord(evaluator, { name: 'user_update', realm: 'acme' });
+```
+
+The answer lists each permission with the realms it holds in; a missing entry is a denial. A record realm matches its own entry, or the identity's own realm by id or by name. A realm the request did not ask about denies. The result is an upper bound: the server still decides each row.
+
+## Realm reach
+
+| `realmScope` | Reaches |
+|---|---|
+| `none` | Nothing |
+| `own` (default) | Rows of the identity's own realm |
+| `ownOrNull` | Own realm and global rows (`realm: null`) |
+| `any` | Every realm and global rows |
+
+A grant without a `realmScope` is `own`. An identity without a realm reaches nothing below `any`.
+
+## Policy types
+
+| `BuiltInPolicyType` | Value | Decides on |
+|---|---|---|
+| `ATTRIBUTES` | `attributes` | A MongoDB-style `query` over the `attributes` data |
+| `ATTRIBUTE_NAMES` | `attributeNames` | Which field `names` the data may carry (with `invert`, a denylist) |
+| `IDENTITY` | `identity` | The identity's `types` (`user`, `client`) |
+| `REALM_MATCH` | `realmMatch` | The record realm against the identity's realm |
+| `DATE` | `date` | A `start` / `end` date window |
+| `TIME` | `time` | A `start` / `end` time of day (`HH:MM`), optionally limited by `interval` with `dayOfWeek`, `dayOfMonth` or `dayOfYear` |
+| `COMPOSITE` | `composite` | Its `children`, combined `unanimous`, `affirmative` or `consensus` |
+| `PERMISSION_BINDING` | `permissionBinding` | Whether the identity holds a grant that reaches the record |
+
+Every policy accepts `invert`. Policy data is a `PolicyData` bag keyed by the type names (`attributes`, `identity`, `realmMatch`, ...); `definePolicyData` builds one with the well-known keys type-checked.
+
+## API
+
+| Export | Kind | Purpose |
+|---|---|---|
+| `PermissionEvaluator`, `IPermissionEvaluator` | class, interface | `evaluate`, `evaluateOneOf`, `preEvaluate`, `preEvaluateOneOf`, `compile` |
+| `PermissionMemoryProvider`, `IPermissionProvider` | class, interface | Where an evaluator looks permission definitions up |
+| `evaluateRecord`, `evaluateRecordOneOf`, `reachesRecord`, `reachesRecordOneOf`, `evaluateRecordUpdate`, `hasUnboundedReach` | function | Single-record checks with an explicit realm |
+| `createAuthorizationEvaluator` | function | An evaluator over the catalog, the introspected grants and the identity |
+| `createAuthorizationCheckEvaluator` | function | An evaluator over the batch check answer |
+| `AuthorizationCatalogStaleError`, `isAuthorizationCatalogStaleError` | class, function | The refetch signal |
+| `projectAuthorizationPolicy`, `AUTHORIZATION_POLICY_WITHHELD_TYPE` | function, const | The wire projection of a policy tree, and the node type the server sends in place of a tree the caller may not read |
+| `AuthorizationCatalog`, `AuthorizationGrant`, `AuthorizationCheckPermissions`, `authorizationCatalogSchema`, ... | type, schema | Wire types and their zod schemas |
+| `PolicyEngine`, `IPolicyEngine`, `IPolicyEvaluator` | class, interface | Evaluate a policy tree; `registerEvaluator(type, evaluator)` adds a type |
+| `PolicyDefaultEvaluators`, `PolicyDefaultValidators` | const | The built-in registries |
+| `BuiltInPolicyType`, `SystemPolicyName` | enum, const | Policy type names; the names of the provisioned system policies (`system.default`, ...) |
+| `<Type>Policy`, `<Type>PolicyEvaluator`, `<Type>PolicyValidator` | type, class | One trio per built-in policy type |
+| `IdentityPermissionBindingPolicyEvaluator` | class | Decides `permissionBinding` from the grants carried on the identity data |
+| `PolicyData`, `definePolicyData`, `PolicyInput`, `IdentityPolicyData` | class, function, type | The evaluation data bag |
+| `RealmScope`, `realmScopeMatches`, `normalizeRealmScope`, `compareRealmScope`, `minRealmScope`, `maxRealmScope` | enum, function | Realm reach |
+| `aggregatePermissionPolicyBindings`, `grantDominates`, `buildPermissionKey` | function | Grant aggregation and comparison |
+| `PermissionError`, `PolicyError`, `isPermissionError`, `isPolicyError` | class, function | Errors (both extend `AuthupError` from `@authup/errors`) |
+| `createPolicyTransitionCollector`, `PolicyTransitionSink` | function, type | Collect the instant at which a `date` or `time` verdict could change |
+
+## Notes
+
+- **Realm reach is enforced by the `permissionBinding` policy.** A `PermissionEvaluator` over `PermissionMemoryProvider` ignores a binding's `realmScope`, and its default `permissionBinding` evaluator always passes. `createAuthorizationEvaluator` wires `IdentityPermissionBindingPolicyEvaluator`, and Authup binds `system.default` (which contains a `permissionBinding` policy) to every permission it creates, so that is where reach is checked. Build from the catalog when reach matters.
+- **Identity data uses UUIDs.** The identity data validator checks `id`, `clientId` and `realmId` as UUIDs; any other value makes every `identity` policy fail.
+- **`compile` can answer `post`.** That means the decision cannot be expressed as a query condition; evaluate every candidate row before you page, or the page and its total are wrong.
+- **Each `PolicyEngine` owns its evaluator map.** The constructor copies the map, so `registerEvaluator` on one engine never reaches another.
+
+## License
+
+Made with 💚
+
+Published under the [Apache 2.0 License](./LICENSE).

package/dist/index.d.mts

@@ -895,6 +895,81 @@ export declare class PermissionEvaluator implements IPermissionEvaluator {
   compile(ctx: PermissionCompileContext): Promise<PermissionCompileResult>;
 }
 //#endregion
+//#region src/permission/record/types.d.ts
+/**
+ * The realm of the record a check is evaluated against: a realm id, `null`
+ * for a global row, or a list of either when every listed realm must be
+ * reached.
+ */
+export type RecordRealm = string | null | (string | null)[];
+/** One record a single-record check is evaluated against. */
+export type RecordTarget = {
+  /**
+   * The RECORD's realm (`null` = global row), or the target realm on
+   * create. This is what each grant's `realm_scope` is matched against.
+   * It is distinct from `PermissionEvaluationContext.realmId`, which is the
+   * realm the PERMISSION is bound to. Required: `undefined` throws, so a
+   * caller cannot drop the realm by omission and neutral-pass every grant's
+   * `realm_scope`.
+   */
+  realm: RecordRealm;
+  /**
+   * The policy data the record is evaluated with: the row under
+   * `attributes` (for attribute policies on the grant; never synthesized,
+   * so without it an attribute policy stays pending), an identity, a custom
+   * key. Never mutated; must not carry `realmMatch`, which is set from
+   * `realm`.
+   */
+  data?: PolicyData | PolicyInput;
+};
+export type RecordEvaluationContext = RecordTarget & {
+  name: string | string[];
+  options?: PermissionEvaluationOptions;
+};
+export type RecordUpdateEvaluationContext = {
+  name: string | string[];
+  options?: PermissionEvaluationOptions;
+  /** The stored row: the actor must reach it to change it at all. */
+  current: RecordTarget;
+  /** The updated row: it must stay in reach afterwards. */
+  next: RecordTarget;
+};
+//#endregion
+//#region src/permission/record/module.d.ts
+/**
+ * Throws a permission error unless `name` passes for the record: each grant's
+ * `realm_scope` is matched against the record's realm and its policies are
+ * evaluated against the record. An array of names must ALL pass, like
+ * `evaluate()`.
+ */
+export declare function evaluateRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
+export declare function evaluateRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/**
+ * {@link evaluateRecord} as a predicate. Only a permission error reads as
+ * `false`; anything else propagates, so a failure on the authorization path
+ * never turns into a quiet "not authorized".
+ */
+export declare function reachesRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
+export declare function reachesRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/**
+ * An update passes only when `name` passes for BOTH the stored row (the actor
+ * may only change a row it can already reach) and the updated row (the row
+ * must stay in reach afterwards). Evaluating the updated row alone lets an
+ * update move a row INTO reach.
+ */
+export declare function evaluateRecordUpdate(evaluator: IPermissionEvaluator, ctx: RecordUpdateEvaluationContext): Promise<void>;
+/**
+ * Whether a grant of `name` (any of, for an array) reaches every realm with
+ * no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
+ * verdict, so it relies on the binding policy (`system.default`) being bound
+ * to the permission: without it a grant's reach is never evaluated and any
+ * grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
+ * compiles to `conditional` and reads as `false`.
+ */
+export declare function hasUnboundedReach(evaluator: IPermissionEvaluator, name: string | string[]): Promise<boolean>;
+//#endregion
 //#region src/permission/authorization/error.d.ts
 export declare const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE: unique symbol;
 /**

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/context/transition.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;;;;;;;;;;YC5CG;EACR,OAAO,IAAI;;YAGH;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;;;;;WAMA,cAAc;;YAGf,+BAA+B,QAAQ;;;wBC1CnC,8BACZ,QAAO,+BACP;;;YCHQ,4BAA4B;;;;WAI3B,MAAM;;;;;;wBAOH,mCAAoC;;;YCTxC,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;;;;YCrDxE,mBAAmB,eAAe,UAAU;YAE5C,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCnBF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCwCA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBC9C1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,0BAA0B,yCAC1B,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBChDK,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;;;;;EAQA,SAAS;;;;cCnBA,oCAAoC,UAAU;EAC9C;;;;qBCfA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCnCrE,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;qBC6BA,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC;EASM,WAAW,KAAK,0BAA2B,QAAQ;;;;;EAqBzD,aACI,KAAK,yBACL,UAAU,qBACV;EAcE,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBC1FzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBCgGA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBC5GtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCYT;;;;;;;;;;;;;;;;;;;qBAoBA,yBAA0B,SAAS;;;;;;;;;;;iBC7B/B;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;;;;;;EAOA,cAAc;;YAGN;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBClEO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAsH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;qBC1O9C;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;YAGH;;;;;EAKR,aAAa;;;;;;;EAOb,aAAa;;;;;;;;;;;;;;;YAgBL,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCrIF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC8GS,6BAClB,OAAO,6BACP,UAAS,gCACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6NU,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;;;;;;;wBC9SU,2BAClB,gBACA,aAAY,mBACZ,QAAQ;;;;;;;;;wBAyDI,qBAAqB,QAAQ;;;;;;;;;;qBCpFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/context/transition.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/record/types.ts","../src/permission/record/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;;;;;;;;;;YC5CG;EACR,OAAO,IAAI;;YAGH;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;;;;;WAMA,cAAc;;YAGf,+BAA+B,QAAQ;;;wBC1CnC,8BACZ,QAAO,+BACP;;;YCHQ,4BAA4B;;;;WAI3B,MAAM;;;;;;wBAOH,mCAAoC;;;YCTxC,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;;;;YCrDxE,mBAAmB,eAAe,UAAU;YAE5C,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCnBF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCwCA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBC9C1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,0BAA0B,yCAC1B,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBChDK,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;;;;;EAQA,SAAS;;;;cCnBA,oCAAoC,UAAU;EAC9C;;;;qBCfA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCnCrE,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;qBC6BA,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC;EASM,WAAW,KAAK,0BAA2B,QAAQ;;;;;EAqBzD,aACI,KAAK,yBACL,UAAU,qBACV;EAcE,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBC1FzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBCgGA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBC5GtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCYT;;;;;;;;;;;;;;;;;;;qBAoBA,yBAA0B,SAAS;;;;;;;;;;;iBC7B/B;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;;;;;;EAOA,cAAc;;YAGN;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBClEO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAsH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;;;;;;YCpO/C;;YAGA;;;;;;;;;EASR,OAAO;;;;;;;;EAQP,OAAO,aAAa;;YAGZ,0BAA0B;EAClC;EACA,UAAU;;YAGF;EACR;EACA,UAAU;;EAEV,SAAS;;EAET,MAAM;;;;;;;;;;wBC2BY,eAClB,WAAW,sBACX,KAAK,0BACN;;wBAKmB,oBAClB,WAAW,sBACX,KAAK,0BACN;;;;;;wBAsBmB,cAClB,WAAW,sBACX,KAAK,0BACN;;wBAKmB,mBAClB,WAAW,sBACX,KAAK,0BACN;;;;;;;wBAUmB,qBAClB,WAAW,sBACX,KAAK,gCACN;;;;;;;;;wBAuBmB,kBAClB,WAAW,sBACX,0BACD;;;qBCtJU;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;YAGH;;;;;EAKR,aAAa;;;;;;;EAOb,aAAa;;;;;;;;;;;;;;;YAgBL,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCrIF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC8GS,6BAClB,OAAO,6BACP,UAAS,gCACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6NU,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;;;;;;;wBC9SU,2BAClB,gBACA,aAAY,mBACZ,QAAQ;;;;;;;;;wBAyDI,qBAAqB,QAAQ;;;;;;;;;;qBCpFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}

package/dist/index.mjs

@@ -1715,6 +1715,105 @@ var PermissionEvaluator = class {
 	}
 };
 //#endregion
+//#region src/permission/record/module.ts
+function describeName(name) {
+	return Array.isArray(name) ? name.join(", ") : name;
+}
+/**
+* An IPolicyData that is not this package's PolicyData (another
+* implementation, or a second copy of the package). Spreading one as a record
+* would keep only its internal fields and drop every key it carries.
+*/
+function isPolicyDataLike(input) {
+	return isObject(input) && typeof input.has === "function" && typeof input.get === "function" && typeof input.clone === "function";
+}
+/**
+* A fresh policy data bag for one record: the caller's data is cloned, never
+* written to, so one bag can be reused across records.
+*/
+function buildRecordData(name, target) {
+	if (typeof target.realm === "undefined") throw new Error(`The record realm for permission ${describeName(name)} is undefined.`);
+	let data;
+	if (target.data instanceof PolicyData) data = target.data.clone();
+	else if (isPolicyDataLike(target.data)) throw new Error(`The policy data for permission ${describeName(name)} must be a PolicyData instance of this package or a plain record.`);
+	else data = new PolicyData({ ...target.data || {} });
+	if (data.has("realmMatch")) throw new Error(`The policy data for permission ${describeName(name)} must not carry realmMatch.`);
+	data.set("realmMatch", target.realm);
+	return data;
+}
+function buildEvaluationContext(ctx) {
+	return {
+		name: ctx.name,
+		data: buildRecordData(ctx.name, ctx),
+		options: ctx.options
+	};
+}
+/**
+* Throws a permission error unless `name` passes for the record: each grant's
+* `realm_scope` is matched against the record's realm and its policies are
+* evaluated against the record. An array of names must ALL pass, like
+* `evaluate()`.
+*/
+async function evaluateRecord(evaluator, ctx) {
+	await evaluator.evaluate(buildEvaluationContext(ctx));
+}
+/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
+async function evaluateRecordOneOf(evaluator, ctx) {
+	await evaluator.evaluateOneOf(buildEvaluationContext(ctx));
+}
+async function asPredicate(fn) {
+	try {
+		await fn();
+		return true;
+	} catch (error) {
+		if (isPermissionError(error)) return false;
+		throw error;
+	}
+}
+/**
+* {@link evaluateRecord} as a predicate. Only a permission error reads as
+* `false`; anything else propagates, so a failure on the authorization path
+* never turns into a quiet "not authorized".
+*/
+async function reachesRecord(evaluator, ctx) {
+	return asPredicate(() => evaluateRecord(evaluator, ctx));
+}
+/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
+async function reachesRecordOneOf(evaluator, ctx) {
+	return asPredicate(() => evaluateRecordOneOf(evaluator, ctx));
+}
+/**
+* An update passes only when `name` passes for BOTH the stored row (the actor
+* may only change a row it can already reach) and the updated row (the row
+* must stay in reach afterwards). Evaluating the updated row alone lets an
+* update move a row INTO reach.
+*/
+async function evaluateRecordUpdate(evaluator, ctx) {
+	await evaluateRecord(evaluator, {
+		realm: ctx.current.realm,
+		data: ctx.current.data,
+		name: ctx.name,
+		options: ctx.options
+	});
+	await evaluateRecord(evaluator, {
+		realm: ctx.next.realm,
+		data: ctx.next.data,
+		name: ctx.name,
+		options: ctx.options
+	});
+}
+/**
+* Whether a grant of `name` (any of, for an array) reaches every realm with
+* no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
+* verdict, so it relies on the binding policy (`system.default`) being bound
+* to the permission: without it a grant's reach is never evaluated and any
+* grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
+* compiles to `conditional` and reads as `false`.
+*/
+async function hasUnboundedReach(evaluator, name) {
+	return (await evaluator.compile({ name })).verdict === "allow";
+}
+//#endregion
 //#region src/permission/authorization/error.ts
 const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE = Symbol.for("@authup/access/AuthorizationCatalogStaleError");
 /**
@@ -2294,6 +2393,6 @@ async function createAuthorizationCheckEvaluator(input) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
+export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyDefaultValidators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, createPolicyTransitionCollector, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, evaluateRecord, evaluateRecordOneOf, evaluateRecordUpdate, grantDominates, hasUnboundedReach, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, reachesRecord, reachesRecordOneOf, realmScopeMatches };
 
 //# sourceMappingURL=index.mjs.map