@btst/stack 3.0.0-rc.2 → 3.0.0-rc.3

package/dist/authorization/index.mjs

@@ -0,0 +1,365 @@
+import { z } from 'zod';
+
+const permissionSeedMarker = "__btst.authorization.permission-seed.v1";
+const permissionDescriptorMarker = "__btst.authorization.permission-descriptor.v1";
+const permissionCatalogMarker = "__btst.authorization.permission-catalog.v1";
+const authorizationContractTypes = "__btst.authorization.contract-types.v1";
+function permission(schema) {
+  const seed = {
+    schema
+  };
+  Object.defineProperty(seed, permissionSeedMarker, { value: true });
+  return Object.freeze(seed);
+}
+function isPermissionSeed(value) {
+  return typeof value === "object" && value !== null && value[permissionSeedMarker] === true;
+}
+function isPermissionDescriptor(value) {
+  return typeof value === "function" && value[permissionDescriptorMarker] === true;
+}
+function createPermissionDescriptor(id, schema) {
+  const descriptor = ((...args) => {
+    if (!schema && args.length > 0) {
+      throw new TypeError(`Permission "${id}" does not accept facts.`);
+    }
+    const facts = schema ? schema.parse(args[0]) : void 0;
+    return Object.freeze({ id, permission: descriptor, facts });
+  });
+  Object.defineProperties(descriptor, {
+    id: { value: id, enumerable: true },
+    schema: { value: schema, enumerable: true },
+    [permissionDescriptorMarker]: { value: true }
+  });
+  return Object.freeze(descriptor);
+}
+function bindPermissionTree(namespace, tree, path = "") {
+  const result = {};
+  for (const [key, value] of Object.entries(tree)) {
+    if (key === permissionSeedMarker || key === permissionDescriptorMarker || key === permissionCatalogMarker || key === authorizationContractTypes) {
+      throw new TypeError(`Permission key "${key}" is reserved.`);
+    }
+    const nextPath = path ? `${path}.${key}` : key;
+    result[key] = isPermissionSeed(value) ? createPermissionDescriptor(`${namespace}:${nextPath}`, value.schema) : bindPermissionTree(namespace, value, nextPath);
+  }
+  return Object.freeze(result);
+}
+function definePermissions(name, tree) {
+  const catalog = { ...bindPermissionTree(name, tree) };
+  Object.defineProperty(catalog, permissionCatalogMarker, {
+    value: Object.freeze({ name })
+  });
+  return Object.freeze(catalog);
+}
+function stableJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableJson).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function fingerprint(value) {
+  let hash = 0xcbf29ce484222325n;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= BigInt(value.charCodeAt(index));
+    hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+  }
+  return hash.toString(16).padStart(16, "0");
+}
+const unsupportedPortableSchemaMessage = "Authorization contract schemas must be fully representable as JSON Schema; custom refinements, transforms, and other opaque behavior are unsupported because they cannot be derived into a stable version.";
+const portableSchemaTypes = /* @__PURE__ */ new Set([
+  "string",
+  "number",
+  "int",
+  "boolean",
+  "null",
+  "never",
+  "object",
+  "record",
+  "array",
+  "tuple",
+  "union",
+  "intersection",
+  "enum",
+  "literal",
+  "nullable",
+  "optional",
+  "nonoptional",
+  "readonly",
+  "template_literal"
+]);
+const portableCheckTypes = /* @__PURE__ */ new Set([
+  "less_than",
+  "greater_than",
+  "multiple_of",
+  "number_format",
+  "max_size",
+  "min_size",
+  "size_equals",
+  "max_length",
+  "min_length",
+  "length_equals",
+  "string_format"
+]);
+const portableLengthCheckTypes = /* @__PURE__ */ new Set([
+  "max_length",
+  "min_length",
+  "length_equals"
+]);
+const portableStringFormats = /* @__PURE__ */ new Set([
+  "email",
+  "url",
+  "emoji",
+  "uuid",
+  "guid",
+  "nanoid",
+  "cuid",
+  "cuid2",
+  "ulid",
+  "xid",
+  "ksuid",
+  "datetime",
+  "date",
+  "time",
+  "duration",
+  "ipv4",
+  "ipv6",
+  "mac",
+  "cidrv4",
+  "cidrv6",
+  "base64",
+  "base64url",
+  "json_string",
+  "e164",
+  "jwt",
+  "lowercase",
+  "uppercase",
+  "regex",
+  "starts_with",
+  "ends_with",
+  "includes",
+  "hex",
+  "hostname"
+]);
+function getLengthConstraint(definition) {
+  switch (definition.check) {
+    case "min_length":
+      return definition.minimum;
+    case "max_length":
+      return definition.maximum;
+    case "length_equals":
+      return definition.length;
+    default:
+      return void 0;
+  }
+}
+function isPortableCheckDefinition(definition) {
+  const lengthConstraint = getLengthConstraint(definition);
+  if (!portableCheckTypes.has(definition.check) || Object.values(definition).some(
+    (value) => typeof value === "number" && !Number.isFinite(value)
+  ) || definition.check === "multiple_of" && typeof definition.value === "number" && definition.value <= 0 || lengthConstraint !== void 0 && (!Number.isInteger(lengthConstraint) || lengthConstraint < 0) || definition.when !== void 0 && !portableLengthCheckTypes.has(definition.check)) {
+    return false;
+  }
+  if (definition.check !== "string_format") return true;
+  return definition.format !== void 0 && portableStringFormats.has(definition.format) && (typeof definition.fn !== "function" || definition.pattern !== void 0) && (!definition.pattern || definition.pattern.flags.length === 0) && definition.alg === void 0 && definition.hostname === void 0 && definition.protocol === void 0 && definition.normalize !== true;
+}
+function isJsonLiteral(value) {
+  return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+function inspectPortableSchema(schema, jsonSchema) {
+  const definition = schema._zod.def;
+  if (!portableSchemaTypes.has(definition.type) || "coerce" in definition && definition.coerce === true || schema._zod.traits.has("$ZodExactOptional")) {
+    return true;
+  }
+  jsonSchema["x-btst-zod-type"] = definition.type;
+  if (definition.type === "literal") {
+    const values = definition.values;
+    if (!values.every(isJsonLiteral)) return true;
+  }
+  if (definition.type === "enum") {
+    const entries = definition.entries;
+    if (!Object.values(entries).every(isJsonLiteral)) return true;
+  }
+  if (definition.type === "object") {
+    const catchall = definition.catchall;
+    if (catchall && !portableSchemaTypes.has(catchall._zod.def.type))
+      return true;
+    jsonSchema["x-btst-object-mode"] = !catchall ? "strip" : catchall._zod.def.type === "never" ? "strict" : catchall._zod.def.type === "unknown" ? "passthrough" : "catchall";
+  }
+  if ("check" in definition) {
+    if (!isPortableCheckDefinition(definition)) {
+      return true;
+    }
+  }
+  return definition.checks?.some(
+    (check) => !isPortableCheckDefinition(check._zod.def)
+  ) === true;
+}
+function toPortableJsonSchema(schema) {
+  let containsOpaqueCheck = false;
+  try {
+    const jsonSchema = z.toJSONSchema(schema, {
+      metadata: z.registry(),
+      override: ({ zodSchema, jsonSchema: jsonSchema2 }) => {
+        if (inspectPortableSchema(zodSchema, jsonSchema2)) {
+          containsOpaqueCheck = true;
+        }
+      }
+    });
+    if (containsOpaqueCheck) {
+      throw new TypeError(unsupportedPortableSchemaMessage);
+    }
+    return jsonSchema;
+  } catch (error) {
+    if (error instanceof TypeError && error.message === unsupportedPortableSchemaMessage) {
+      throw error;
+    }
+    throw new TypeError(unsupportedPortableSchemaMessage, { cause: error });
+  }
+}
+function collectDescriptors(catalogs) {
+  const descriptors = /* @__PURE__ */ new Map();
+  const collect = (tree) => {
+    for (const value of Object.values(tree)) {
+      if (isPermissionDescriptor(value)) {
+        if (descriptors.has(value.id)) {
+          throw new TypeError(`Permission "${value.id}" is registered twice.`);
+        }
+        descriptors.set(value.id, value);
+      } else if (typeof value === "object" && value !== null) {
+        collect(value);
+      }
+    }
+  };
+  for (const catalog of catalogs) collect(catalog);
+  return descriptors;
+}
+function defineAuthorizationContract(config) {
+  const permissions = Object.freeze([
+    ...config.permissions
+  ]);
+  const descriptors = collectDescriptors(permissions);
+  const permissionIds = Object.freeze([...descriptors.keys()].sort());
+  const versionSource = stableJson({
+    identity: toPortableJsonSchema(config.identity),
+    permissions: permissionIds.map((id) => {
+      const descriptor = descriptors.get(id);
+      return {
+        id,
+        facts: descriptor?.schema ? toPortableJsonSchema(descriptor.schema) : null
+      };
+    })
+  });
+  return Object.freeze({
+    identitySchema: config.identity,
+    permissions,
+    permissionIds,
+    version: `auth_${fingerprint(versionSource)}`,
+    parseIdentity(identity) {
+      if (identity === null) return null;
+      const parsed = config.identity.parse(identity);
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof parsed.id !== "string") {
+        throw new TypeError(
+          "Authorization identities must be objects with a string id."
+        );
+      }
+      return parsed;
+    },
+    parsePermission(permissionRequest) {
+      if (typeof permissionRequest !== "object" || permissionRequest === null || typeof permissionRequest.id !== "string") {
+        throw new TypeError("A permission request must contain a string id.");
+      }
+      const candidate = permissionRequest;
+      const descriptor = descriptors.get(candidate.id);
+      if (!descriptor) {
+        throw new TypeError(`Permission "${candidate.id}" is not registered.`);
+      }
+      if (!descriptor.schema && candidate.facts !== void 0) {
+        throw new TypeError(
+          `Permission "${candidate.id}" does not accept facts.`
+        );
+      }
+      return descriptor.schema ? descriptor(candidate.facts) : descriptor();
+    }
+  });
+}
+function createRuleTree(tree) {
+  const result = {};
+  for (const [key, value] of Object.entries(tree)) {
+    if (isPermissionDescriptor(value)) {
+      result[key] = Object.freeze({
+        allow: () => ({
+          permission: value,
+          evaluate: () => true
+        }),
+        when: (rule) => ({
+          permission: value,
+          evaluate: rule
+        })
+      });
+    } else if (typeof value === "object" && value !== null) {
+      result[key] = createRuleTree(value);
+    }
+  }
+  return result;
+}
+function defineAuthorization(config) {
+  const contractValue = config.contract ?? defineAuthorizationContract({
+    identity: config.identity,
+    permissions: config.permissions
+  });
+  const contract = contractValue;
+  const descriptors = collectDescriptors(contract.permissions);
+  const ruleCatalogs = {};
+  for (const catalog of contract.permissions) {
+    const name = catalog[permissionCatalogMarker].name;
+    if (name in ruleCatalogs) {
+      throw new TypeError(`Permission catalog "${name}" is registered twice.`);
+    }
+    ruleCatalogs[name] = createRuleTree(catalog);
+  }
+  const rules = /* @__PURE__ */ new Map();
+  for (const definition of config.rules(ruleCatalogs)) {
+    if (!descriptors.has(definition.permission.id)) {
+      throw new TypeError(
+        `Permission "${definition.permission.id}" is not registered.`
+      );
+    }
+    if (rules.has(definition.permission.id)) {
+      throw new TypeError(
+        `Permission "${definition.permission.id}" has more than one rule.`
+      );
+    }
+    rules.set(definition.permission.id, definition.evaluate);
+  }
+  return Object.freeze({
+    contract: contractValue,
+    identitySchema: contract.identitySchema,
+    permissions: contract.permissions,
+    parseIdentity(identity) {
+      return contract.parseIdentity(identity);
+    },
+    can(request, identity) {
+      const candidate = contract.parsePermission(request);
+      const parsedIdentity = contract.parseIdentity(identity);
+      const rule = rules.get(candidate.id);
+      if (!rule) return false;
+      const result = rule({
+        identity: parsedIdentity,
+        facts: candidate.facts
+      });
+      if (typeof result !== "boolean") {
+        throw new TypeError(
+          `Authorization rule for "${candidate.id}" must return a boolean.`
+        );
+      }
+      return result;
+    }
+  });
+}
+function isPermissionRequest(value) {
+  return typeof value === "object" && value !== null && typeof value.id === "string" && isPermissionDescriptor(value.permission);
+}
+
+export { defineAuthorization, defineAuthorizationContract, definePermissions, isPermissionRequest, permission };

package/dist/authorization/remote.cjs

@@ -0,0 +1,117 @@
+'use strict';
+
+const z = require('zod');
+const json = require('../packages/stack/src/authorization/json.cjs');
+
+class AuthorizationContractMismatchError extends Error {
+  constructor(expectedVersion, receivedVersion) {
+    super(
+      `Authorization contract mismatch: expected "${expectedVersion}", received "${receivedVersion}".`
+    );
+    this.expectedVersion = expectedVersion;
+    this.receivedVersion = receivedVersion;
+    this.name = "AuthorizationContractMismatchError";
+  }
+  code = "AUTHORIZATION_CONTRACT_MISMATCH";
+}
+class AuthorizationRequestValidationError extends Error {
+  code = "INVALID_AUTHORIZATION_REQUEST";
+  constructor(cause) {
+    super("Invalid remote authorization request.", { cause });
+    this.name = "AuthorizationRequestValidationError";
+  }
+}
+class AuthorizationResponseValidationError extends Error {
+  code = "INVALID_AUTHORIZATION_RESPONSE";
+  constructor(cause) {
+    super("Invalid remote authorization response.", { cause });
+    this.name = "AuthorizationResponseValidationError";
+  }
+}
+const remoteRequestSchema = z.z.object({
+  version: z.z.string(),
+  permission: z.z.object({
+    id: z.z.string(),
+    facts: z.z.unknown().optional()
+  }).strict()
+}).strict();
+const remoteResponseSchema = z.z.object({
+  version: z.z.string(),
+  allowed: z.z.boolean()
+}).strict();
+function parseRemoteAuthorizationRequest(contract, input) {
+  try {
+    json.assertJsonSafe(input);
+  } catch (error) {
+    throw new AuthorizationRequestValidationError(error);
+  }
+  const parsed = remoteRequestSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new AuthorizationRequestValidationError(parsed.error);
+  }
+  if (parsed.data.version !== contract.version) {
+    throw new AuthorizationContractMismatchError(
+      contract.version,
+      parsed.data.version
+    );
+  }
+  try {
+    const runtimeContract = contract;
+    return {
+      version: parsed.data.version,
+      permission: runtimeContract.parsePermission(
+        parsed.data.permission
+      )
+    };
+  } catch (error) {
+    throw new AuthorizationRequestValidationError(error);
+  }
+}
+function createRemoteAuthorizationEvaluator(config) {
+  const runtimeContract = config.contract;
+  const transport = config.transport;
+  const evaluator = Object.freeze({
+    contract: config.contract,
+    async evaluate(input) {
+      let parsedPermission;
+      try {
+        parsedPermission = runtimeContract.parsePermission(input.permission);
+      } catch (error) {
+        throw new AuthorizationRequestValidationError(error);
+      }
+      const wirePermission = parsedPermission.permission.schema === void 0 ? { id: parsedPermission.id } : { id: parsedPermission.id, facts: parsedPermission.facts };
+      try {
+        json.assertJsonSafe(wirePermission);
+      } catch (error) {
+        throw new AuthorizationRequestValidationError(error);
+      }
+      const response = await transport({
+        version: config.contract.version,
+        permission: wirePermission
+      });
+      try {
+        json.assertJsonSafe(response);
+      } catch (error) {
+        throw new AuthorizationResponseValidationError(error);
+      }
+      const parsedResponse = remoteResponseSchema.safeParse(response);
+      if (!parsedResponse.success) {
+        throw new AuthorizationResponseValidationError(parsedResponse.error);
+      }
+      if (parsedResponse.data.version !== config.contract.version) {
+        throw new AuthorizationContractMismatchError(
+          config.contract.version,
+          parsedResponse.data.version
+        );
+      }
+      return parsedResponse.data.allowed;
+    }
+  });
+  return evaluator;
+}
+
+exports.AuthorizationContractMismatchError = AuthorizationContractMismatchError;
+exports.AuthorizationRequestValidationError = AuthorizationRequestValidationError;
+exports.AuthorizationResponseValidationError = AuthorizationResponseValidationError;
+exports.createRemoteAuthorizationEvaluator = createRemoteAuthorizationEvaluator;
+exports.parseRemoteAuthorizationRequest = parseRemoteAuthorizationRequest;

package/dist/authorization/remote.d.cts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import { AnyAuthorizationContract, AuthorizationContractIdentity, AuthorizationContractPermissionRequest, PermissionRequest } from './index.cjs';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.cjs';
+
+type WirePermission<TPermission> = TPermission extends PermissionRequest<infer TId, infer TSchema> ? TSchema extends z.ZodType<any, any> ? {
+    readonly id: TId;
+    readonly facts: z.output<TSchema>;
+} : {
+    readonly id: TId;
+} : never;
+/** JSON-safe request sent to a managed authorization backend. */
+interface RemoteAuthorizationRequest<TContract extends AnyAuthorizationContract> {
+    readonly version: string;
+    readonly permission: WirePermission<AuthorizationContractPermissionRequest<TContract>>;
+}
+/** Response returned by a managed authorization backend. */
+interface RemoteAuthorizationResponse {
+    readonly version: string;
+    readonly allowed: boolean;
+}
+/** One permission evaluation against either local or remote policy. */
+interface AuthorizationEvaluation<TIdentity extends {
+    id: string;
+}, TPermission> {
+    readonly identity: TIdentity | null;
+    readonly permission: TPermission;
+}
+/** Evaluation seam consumed by the bound client authorization hooks. */
+interface AuthorizationEvaluator<TIdentity extends {
+    id: string;
+} = {
+    id: string;
+}, TPermission = unknown> {
+    readonly contract: AnyAuthorizationContract;
+    evaluate(input: AuthorizationEvaluation<TIdentity, TPermission>): MaybePromise<boolean>;
+}
+/** Evaluator type inferred from one portable contract. */
+type AuthorizationEvaluatorFor<TContract extends AnyAuthorizationContract> = AuthorizationEvaluator<AuthorizationContractIdentity<TContract>, AuthorizationContractPermissionRequest<TContract>> & {
+    readonly contract: TContract;
+};
+/** Typed transport boundary for a managed authorization backend. */
+type RemoteAuthorizationTransport<TContract extends AnyAuthorizationContract> = (request: RemoteAuthorizationRequest<TContract>) => MaybePromise<unknown>;
+/** A frontend/backend contract version mismatch. This is never a denial. */
+declare class AuthorizationContractMismatchError extends Error {
+    readonly expectedVersion: string;
+    readonly receivedVersion: string;
+    readonly code: "AUTHORIZATION_CONTRACT_MISMATCH";
+    constructor(expectedVersion: string, receivedVersion: string);
+}
+/** A malformed request received by a managed authorization backend. */
+declare class AuthorizationRequestValidationError extends Error {
+    readonly code: "INVALID_AUTHORIZATION_REQUEST";
+    constructor(cause: unknown);
+}
+/** A malformed response received from a managed authorization backend. */
+declare class AuthorizationResponseValidationError extends Error {
+    readonly code: "INVALID_AUTHORIZATION_RESPONSE";
+    constructor(cause: unknown);
+}
+/**
+ * Validate a wire request before an authoritative managed backend evaluates
+ * it. The returned permission is rebuilt from the contract's runtime schema.
+ */
+declare function parseRemoteAuthorizationRequest<TContract extends AnyAuthorizationContract>(contract: TContract, input: unknown): {
+    readonly version: string;
+    readonly permission: AuthorizationContractPermissionRequest<TContract>;
+};
+/**
+ * Create an asynchronous evaluator for a managed backend. The transport owns
+ * authentication (for example, credentials on `fetch`) and does not receive
+ * the browser's identity as authoritative input.
+ */
+declare function createRemoteAuthorizationEvaluator<TContract extends AnyAuthorizationContract>(config: {
+    contract: TContract;
+    transport: RemoteAuthorizationTransport<TContract>;
+}): AuthorizationEvaluatorFor<TContract>;
+
+export { AuthorizationContractMismatchError, AuthorizationRequestValidationError, AuthorizationResponseValidationError, createRemoteAuthorizationEvaluator, parseRemoteAuthorizationRequest };
+export type { AuthorizationEvaluation, AuthorizationEvaluator, AuthorizationEvaluatorFor, RemoteAuthorizationRequest, RemoteAuthorizationResponse, RemoteAuthorizationTransport };

package/dist/authorization/remote.d.mts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import { AnyAuthorizationContract, AuthorizationContractIdentity, AuthorizationContractPermissionRequest, PermissionRequest } from './index.mjs';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.mjs';
+
+type WirePermission<TPermission> = TPermission extends PermissionRequest<infer TId, infer TSchema> ? TSchema extends z.ZodType<any, any> ? {
+    readonly id: TId;
+    readonly facts: z.output<TSchema>;
+} : {
+    readonly id: TId;
+} : never;
+/** JSON-safe request sent to a managed authorization backend. */
+interface RemoteAuthorizationRequest<TContract extends AnyAuthorizationContract> {
+    readonly version: string;
+    readonly permission: WirePermission<AuthorizationContractPermissionRequest<TContract>>;
+}
+/** Response returned by a managed authorization backend. */
+interface RemoteAuthorizationResponse {
+    readonly version: string;
+    readonly allowed: boolean;
+}
+/** One permission evaluation against either local or remote policy. */
+interface AuthorizationEvaluation<TIdentity extends {
+    id: string;
+}, TPermission> {
+    readonly identity: TIdentity | null;
+    readonly permission: TPermission;
+}
+/** Evaluation seam consumed by the bound client authorization hooks. */
+interface AuthorizationEvaluator<TIdentity extends {
+    id: string;
+} = {
+    id: string;
+}, TPermission = unknown> {
+    readonly contract: AnyAuthorizationContract;
+    evaluate(input: AuthorizationEvaluation<TIdentity, TPermission>): MaybePromise<boolean>;
+}
+/** Evaluator type inferred from one portable contract. */
+type AuthorizationEvaluatorFor<TContract extends AnyAuthorizationContract> = AuthorizationEvaluator<AuthorizationContractIdentity<TContract>, AuthorizationContractPermissionRequest<TContract>> & {
+    readonly contract: TContract;
+};
+/** Typed transport boundary for a managed authorization backend. */
+type RemoteAuthorizationTransport<TContract extends AnyAuthorizationContract> = (request: RemoteAuthorizationRequest<TContract>) => MaybePromise<unknown>;
+/** A frontend/backend contract version mismatch. This is never a denial. */
+declare class AuthorizationContractMismatchError extends Error {
+    readonly expectedVersion: string;
+    readonly receivedVersion: string;
+    readonly code: "AUTHORIZATION_CONTRACT_MISMATCH";
+    constructor(expectedVersion: string, receivedVersion: string);
+}
+/** A malformed request received by a managed authorization backend. */
+declare class AuthorizationRequestValidationError extends Error {
+    readonly code: "INVALID_AUTHORIZATION_REQUEST";
+    constructor(cause: unknown);
+}
+/** A malformed response received from a managed authorization backend. */
+declare class AuthorizationResponseValidationError extends Error {
+    readonly code: "INVALID_AUTHORIZATION_RESPONSE";
+    constructor(cause: unknown);
+}
+/**
+ * Validate a wire request before an authoritative managed backend evaluates
+ * it. The returned permission is rebuilt from the contract's runtime schema.
+ */
+declare function parseRemoteAuthorizationRequest<TContract extends AnyAuthorizationContract>(contract: TContract, input: unknown): {
+    readonly version: string;
+    readonly permission: AuthorizationContractPermissionRequest<TContract>;
+};
+/**
+ * Create an asynchronous evaluator for a managed backend. The transport owns
+ * authentication (for example, credentials on `fetch`) and does not receive
+ * the browser's identity as authoritative input.
+ */
+declare function createRemoteAuthorizationEvaluator<TContract extends AnyAuthorizationContract>(config: {
+    contract: TContract;
+    transport: RemoteAuthorizationTransport<TContract>;
+}): AuthorizationEvaluatorFor<TContract>;
+
+export { AuthorizationContractMismatchError, AuthorizationRequestValidationError, AuthorizationResponseValidationError, createRemoteAuthorizationEvaluator, parseRemoteAuthorizationRequest };
+export type { AuthorizationEvaluation, AuthorizationEvaluator, AuthorizationEvaluatorFor, RemoteAuthorizationRequest, RemoteAuthorizationResponse, RemoteAuthorizationTransport };