@authup/access 1.0.0-beta.69 → 1.0.0-beta.70

package/dist/permission/index.d.ts

@@ -3,6 +3,7 @@ export * from './helpers';
 export * from './provider';
 export * from './evaluator';
 export * from './realm-scope';
+export * from './record';
 export * from './types';
 export * from './authorization';
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC"}

package/dist/permission/record/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/record/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/record/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/permission/record/module.d.ts

@@ -0,0 +1,36 @@
+import type { IPermissionEvaluator } from '../evaluator';
+import type { RecordEvaluationContext, RecordUpdateEvaluationContext } from './types';
+/**
+ * Throws a permission error unless `name` passes for the record: each grant's
+ * `realm_scope` is matched against the record's realm and its policies are
+ * evaluated against the record. An array of names must ALL pass, like
+ * `evaluate()`.
+ */
+export declare function evaluateRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
+export declare function evaluateRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/**
+ * {@link evaluateRecord} as a predicate. Only a permission error reads as
+ * `false`; anything else propagates, so a failure on the authorization path
+ * never turns into a quiet "not authorized".
+ */
+export declare function reachesRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
+export declare function reachesRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/**
+ * An update passes only when `name` passes for BOTH the stored row (the actor
+ * may only change a row it can already reach) and the updated row (the row
+ * must stay in reach afterwards). Evaluating the updated row alone lets an
+ * update move a row INTO reach.
+ */
+export declare function evaluateRecordUpdate(evaluator: IPermissionEvaluator, ctx: RecordUpdateEvaluationContext): Promise<void>;
+/**
+ * Whether a grant of `name` (any of, for an array) reaches every realm with
+ * no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
+ * verdict, so it relies on the binding policy (`system.default`) being bound
+ * to the permission: without it a grant's reach is never evaluated and any
+ * grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
+ * compiles to `conditional` and reads as `false`.
+ */
+export declare function hasUnboundedReach(evaluator: IPermissionEvaluator, name: string | string[]): Promise<boolean>;
+//# sourceMappingURL=module.d.ts.map

package/dist/permission/record/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/record/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,cAAc,CAAC;AACtF,OAAO,KAAK,EACR,uBAAuB,EAEvB,6BAA6B,EAChC,MAAM,SAAS,CAAC;AAuDjB;;;;;GAKG;AACH,wBAAsB,cAAc,CAChC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,sFAAsF;AACtF,wBAAsB,mBAAmB,CACrC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAeD;;;;GAIG;AACH,wBAAsB,aAAa,CAC/B,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,8EAA8E;AAC9E,wBAAsB,kBAAkB,CACpC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACtC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,6BAA6B,GACnC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/permission/record/types.d.ts

@@ -0,0 +1,41 @@
+import type { PolicyData, PolicyInput } from '../../policy';
+import type { PermissionEvaluationOptions } from '../evaluator';
+/**
+ * The realm of the record a check is evaluated against: a realm id, `null`
+ * for a global row, or a list of either when every listed realm must be
+ * reached.
+ */
+export type RecordRealm = string | null | (string | null)[];
+/** One record a single-record check is evaluated against. */
+export type RecordTarget = {
+    /**
+     * The RECORD's realm (`null` = global row), or the target realm on
+     * create. This is what each grant's `realm_scope` is matched against.
+     * It is distinct from `PermissionEvaluationContext.realmId`, which is the
+     * realm the PERMISSION is bound to. Required: `undefined` throws, so a
+     * caller cannot drop the realm by omission and neutral-pass every grant's
+     * `realm_scope`.
+     */
+    realm: RecordRealm;
+    /**
+     * The policy data the record is evaluated with: the row under
+     * `attributes` (for attribute policies on the grant; never synthesized,
+     * so without it an attribute policy stays pending), an identity, a custom
+     * key. Never mutated; must not carry `realmMatch`, which is set from
+     * `realm`.
+     */
+    data?: PolicyData | PolicyInput;
+};
+export type RecordEvaluationContext = RecordTarget & {
+    name: string | string[];
+    options?: PermissionEvaluationOptions;
+};
+export type RecordUpdateEvaluationContext = {
+    name: string | string[];
+    options?: PermissionEvaluationOptions;
+    /** The stored row: the actor must reach it to change it at all. */
+    current: RecordTarget;
+    /** The updated row: it must stay in reach afterwards. */
+    next: RecordTarget;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/permission/record/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/record/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AAE5D,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACvB;;;;;;;OAOG;IACH,KAAK,EAAE,WAAW,CAAC;IACnB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACjD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,2BAA2B,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,2BAA2B,CAAC;IACtC,mEAAmE;IACnE,OAAO,EAAE,YAAY,CAAC;IACtB,yDAAyD;IACzD,IAAI,EAAE,YAAY,CAAC;CACtB,CAAC"}

package/package.json

@@ -1,8 +1,8 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.69",
-    "description": "A library for evaluating permissions and policies.",
+    "version": "1.0.0-beta.70",
+    "description": "Evaluate Authup permissions and policies in your own process, with the same engine the server uses.",
     "license": "Apache-2.0",
     "exports": {
         "./package.json": "./package.json",
@@ -54,8 +54,8 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/errors": "^1.0.0-beta.69",
-        "@authup/kit": "^1.0.0-beta.69",
+        "@authup/errors": "^1.0.0-beta.70",
+        "@authup/kit": "^1.0.0-beta.70",
         "@ebec/core": "^1.3.2",
         "@rapiq/adapter-memory": "^2.4.0",
         "@rapiq/core": "^2.4.0",
@@ -63,7 +63,7 @@
         "@validup/zod": "^2.0.1",
         "smob": "^1.6.1",
         "validup": "^2.0.1",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
     },
     "devDependencies": {
         "unplugin-swc": "^2.0.0",