@xemahq/contracts 0.31.0 → 0.33.0

package/dist/authorization-module/server/platform-module-files.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_AUTHORIZATION_MODULE_DIRECTORY = void 0;
+exports.loadPlatformAuthorizationModuleFiles = loadPlatformAuthorizationModuleFiles;
+exports.fillXemaCoreParentSlots = fillXemaCoreParentSlots;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const platform_authorization_modules_1 = require("../lib/platform-authorization-modules");
+exports.PLATFORM_AUTHORIZATION_MODULE_DIRECTORY = (0, node_path_1.join)(__dirname, '..', 'platform');
+function loadPlatformAuthorizationModuleFiles() {
+    return Object.values(platform_authorization_modules_1.PlatformAuthorizationModule).map((module) => {
+        const read = (name) => ({
+            name,
+            contents: (0, node_fs_1.readFileSync)((0, node_path_1.join)(exports.PLATFORM_AUTHORIZATION_MODULE_DIRECTORY, name), 'utf8'),
+        });
+        return {
+            module,
+            moduleFile: read(`${module}.fga`),
+            testFile: read(`${module}.fga.yaml`),
+        };
+    });
+}
+const SLOT_TEXT = `, ${platform_authorization_modules_1.XEMA_PARENT_TYPES_SLOT}`;
+function fillXemaCoreParentSlots(template, implementers) {
+    const isComment = (line) => line.trimStart().startsWith('#');
+    const lines = template.split('\n');
+    const executable = lines.filter((line) => !isComment(line)).join('\n');
+    const occurrences = executable.split(platform_authorization_modules_1.XEMA_PARENT_TYPES_SLOT).length - 1;
+    const slotted = executable.split(SLOT_TEXT).length - 1;
+    if (occurrences !== platform_authorization_modules_1.XEMA_INHERITING_PLATFORM_TYPES.length ||
+        slotted !== occurrences) {
+        return null;
+    }
+    const fill = [...implementers]
+        .sort()
+        .map((type) => `, ${type}`)
+        .join('');
+    return lines
+        .map((line) => (isComment(line) ? line : line.split(SLOT_TEXT).join(fill)))
+        .join('\n');
+}
+//# sourceMappingURL=platform-module-files.js.map

package/dist/authorization-module/server/platform-module-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-module-files.js","sourceRoot":"","sources":["../../../src/authorization-module/server/platform-module-files.ts"],"names":[],"mappings":";;;AA8BA,oFAeC;AAeD,0DAsBC;AAlFD,qCAAuC;AACvC,yCAAiC;AAEjC,0FAI+C;AAgBlC,QAAA,uCAAuC,GAAG,IAAA,gBAAI,EACzD,SAAS,EACT,IAAI,EACJ,UAAU,CACX,CAAC;AAGF,SAAgB,oCAAoC;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,4DAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI;YACJ,QAAQ,EAAE,IAAA,sBAAY,EACpB,IAAA,gBAAI,EAAC,+CAAuC,EAAE,IAAI,CAAC,EACnD,MAAM,CACP;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,GAAG,MAAM,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,SAAS,GAAG,KAAK,uDAAsB,EAAE,CAAC;AAYhD,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,YAA+B;IAE/B,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,uDAAsB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvD,IACE,WAAW,KAAK,+DAA8B,CAAC,MAAM;QACrD,OAAO,KAAK,WAAW,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/authzen/index.d.ts

@@ -0,0 +1,7 @@
+export * from './lib/authzen-entities';
+export * from './lib/authzen-evaluation';
+export * from './lib/authzen-search';
+export * from './lib/authzen-metadata';
+export * from './lib/xema-authzen-profile';
+export * from './lib/authzen-snapshot';
+//# sourceMappingURL=index.d.ts.map

package/dist/authzen/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC"}

package/dist/authzen/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/authzen-entities"), exports);
+__exportStar(require("./lib/authzen-evaluation"), exports);
+__exportStar(require("./lib/authzen-search"), exports);
+__exportStar(require("./lib/authzen-metadata"), exports);
+__exportStar(require("./lib/xema-authzen-profile"), exports);
+__exportStar(require("./lib/authzen-snapshot"), exports);
+//# sourceMappingURL=index.js.map

package/dist/authzen/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authzen/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,2DAAyC;AACzC,uDAAqC;AACrC,yDAAuC;AACvC,6DAA2C;AAC3C,yDAAuC"}

package/dist/authzen/lib/authzen-entities.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const AuthzenAttributesSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export type AuthzenAttributes = z.infer<typeof AuthzenAttributesSchema>;
+export declare const AuthzenSubjectSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenSubject = z.infer<typeof AuthzenSubjectSchema>;
+export declare const AuthzenResourceSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenResource = z.infer<typeof AuthzenResourceSchema>;
+export declare const AuthzenActionSchema: z.ZodObject<{
+    name: z.ZodString;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenAction = z.infer<typeof AuthzenActionSchema>;
+export declare const AuthzenContextSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export type AuthzenContext = AuthzenAttributes;
+export declare const AuthzenDecisionSchema: z.ZodObject<{
+    decision: z.ZodBoolean;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenDecision = z.infer<typeof AuthzenDecisionSchema>;
+export declare const AuthzenSubjectQuerySchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenSubjectQuery = z.infer<typeof AuthzenSubjectQuerySchema>;
+export declare const AuthzenResourceQuerySchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenResourceQuery = z.infer<typeof AuthzenResourceQuerySchema>;
+//# sourceMappingURL=authzen-entities.d.ts.map

package/dist/authzen/lib/authzen-entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-entities.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,eAAO,MAAM,uBAAuB,wCAAoC,CAAC;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAKxE,eAAO,MAAM,oBAAoB;;;;kBAMtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGlE,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAGpE,eAAO,MAAM,mBAAmB;;;kBAKrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,oBAAoB,wCAA0B,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAS/C,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAOpE,eAAO,MAAM,yBAAyB;;;;kBAM3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAG5E,eAAO,MAAM,0BAA0B;;;;kBAM5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/authzen/lib/authzen-entities.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzenResourceQuerySchema = exports.AuthzenSubjectQuerySchema = exports.AuthzenDecisionSchema = exports.AuthzenContextSchema = exports.AuthzenActionSchema = exports.AuthzenResourceSchema = exports.AuthzenSubjectSchema = exports.AuthzenAttributesSchema = void 0;
+const zod_1 = require("zod");
+exports.AuthzenAttributesSchema = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown());
+const NonEmptyString = zod_1.z.string().min(1);
+exports.AuthzenSubjectSchema = zod_1.z
+    .object({
+    type: NonEmptyString,
+    id: NonEmptyString,
+    properties: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenResourceSchema = zod_1.z
+    .object({
+    type: NonEmptyString,
+    id: NonEmptyString,
+    properties: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenActionSchema = zod_1.z
+    .object({
+    name: NonEmptyString,
+    properties: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenContextSchema = exports.AuthzenAttributesSchema;
+exports.AuthzenDecisionSchema = zod_1.z
+    .object({
+    decision: zod_1.z.boolean(),
+    context: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenSubjectQuerySchema = zod_1.z
+    .object({
+    type: NonEmptyString,
+    id: zod_1.z.string().optional(),
+    properties: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+exports.AuthzenResourceQuerySchema = zod_1.z
+    .object({
+    type: NonEmptyString,
+    id: zod_1.z.string().optional(),
+    properties: exports.AuthzenAttributesSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=authzen-entities.js.map

package/dist/authzen/lib/authzen-entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-entities.js","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-entities.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAoBX,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAGzE,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAG5B,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,cAAc;IAClB,UAAU,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,cAAc;IAClB,UAAU,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,oBAAoB,GAAG,+BAAuB,CAAC;AAU/C,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,OAAO,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAQC,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAIC,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,UAAU,EAAE,+BAAuB,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/authzen/lib/authzen-evaluation.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+export declare const AccessEvaluationRequestSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    action: z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AccessEvaluationRequest = z.infer<typeof AccessEvaluationRequestSchema>;
+export declare const AccessEvaluationResponseSchema: z.ZodObject<{
+    decision: z.ZodBoolean;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AccessEvaluationResponse = z.infer<typeof AccessEvaluationResponseSchema>;
+export declare enum AuthzenEvaluationsSemantic {
+    ExecuteAll = "execute_all",
+    DenyOnFirstDeny = "deny_on_first_deny",
+    PermitOnFirstPermit = "permit_on_first_permit"
+}
+export declare const AuthzenEvaluationsSemanticSchema: z.ZodEnum<typeof AuthzenEvaluationsSemantic>;
+export declare const AuthzenEvaluationsOptionsSchema: z.ZodObject<{
+    evaluations_semantic: z.ZodOptional<z.ZodEnum<typeof AuthzenEvaluationsSemantic>>;
+}, z.core.$catchall<z.ZodUnknown>>;
+export type AuthzenEvaluationsOptions = z.infer<typeof AuthzenEvaluationsOptionsSchema>;
+export declare const AccessEvaluationItemSchema: z.ZodObject<{
+    subject: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    action: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    resource: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AccessEvaluationItem = z.infer<typeof AccessEvaluationItemSchema>;
+export declare const AccessEvaluationsRequestSchema: z.ZodObject<{
+    subject: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    action: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    resource: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    evaluations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        subject: z.ZodOptional<z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        action: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        resource: z.ZodOptional<z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>>;
+        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>>;
+    options: z.ZodOptional<z.ZodObject<{
+        evaluations_semantic: z.ZodOptional<z.ZodEnum<typeof AuthzenEvaluationsSemantic>>;
+    }, z.core.$catchall<z.ZodUnknown>>>;
+}, z.core.$strict>;
+export type AccessEvaluationsRequest = z.infer<typeof AccessEvaluationsRequestSchema>;
+export declare const AccessEvaluationsResponseSchema: z.ZodObject<{
+    decision: z.ZodOptional<z.ZodBoolean>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    evaluations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        decision: z.ZodBoolean;
+        context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type AccessEvaluationsResponse = z.infer<typeof AccessEvaluationsResponseSchema>;
+export declare function expandAccessEvaluations(request: AccessEvaluationsRequest): AccessEvaluationRequest[];
+//# sourceMappingURL=authzen-evaluation.d.ts.map

package/dist/authzen/lib/authzen-evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-evaluation.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-evaluation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;kBAO/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAGF,eAAO,MAAM,8BAA8B;;;kBAAwB,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAGF,oBAAY,0BAA0B;IACpC,UAAU,gBAAgB;IAC1B,eAAe,uBAAuB;IACtC,mBAAmB,2BAA2B;CAC/C;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAOF,eAAO,MAAM,+BAA+B;;kCAIpB,CAAC;AACzB,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAGF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;kBAO5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAQ9E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAoCvC,CAAC;AACL,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AASF,eAAO,MAAM,+BAA+B;;;;;;;kBAUxC,CAAC;AACL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAWF,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,uBAAuB,EAAE,CA0B3B"}

package/dist/authzen/lib/authzen-evaluation.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessEvaluationsResponseSchema = exports.AccessEvaluationsRequestSchema = exports.AccessEvaluationItemSchema = exports.AuthzenEvaluationsOptionsSchema = exports.AuthzenEvaluationsSemanticSchema = exports.AuthzenEvaluationsSemantic = exports.AccessEvaluationResponseSchema = exports.AccessEvaluationRequestSchema = void 0;
+exports.expandAccessEvaluations = expandAccessEvaluations;
+const zod_1 = require("zod");
+const authzen_entities_1 = require("./authzen-entities");
+exports.AccessEvaluationRequestSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectSchema,
+    action: authzen_entities_1.AuthzenActionSchema,
+    resource: authzen_entities_1.AuthzenResourceSchema,
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+})
+    .strict();
+exports.AccessEvaluationResponseSchema = authzen_entities_1.AuthzenDecisionSchema;
+var AuthzenEvaluationsSemantic;
+(function (AuthzenEvaluationsSemantic) {
+    AuthzenEvaluationsSemantic["ExecuteAll"] = "execute_all";
+    AuthzenEvaluationsSemantic["DenyOnFirstDeny"] = "deny_on_first_deny";
+    AuthzenEvaluationsSemantic["PermitOnFirstPermit"] = "permit_on_first_permit";
+})(AuthzenEvaluationsSemantic || (exports.AuthzenEvaluationsSemantic = AuthzenEvaluationsSemantic = {}));
+exports.AuthzenEvaluationsSemanticSchema = zod_1.z.nativeEnum(AuthzenEvaluationsSemantic);
+exports.AuthzenEvaluationsOptionsSchema = zod_1.z
+    .object({
+    evaluations_semantic: exports.AuthzenEvaluationsSemanticSchema.optional(),
+})
+    .catchall(zod_1.z.unknown());
+exports.AccessEvaluationItemSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectSchema.optional(),
+    action: authzen_entities_1.AuthzenActionSchema.optional(),
+    resource: authzen_entities_1.AuthzenResourceSchema.optional(),
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+})
+    .strict();
+exports.AccessEvaluationsRequestSchema = zod_1.z
+    .object({
+    subject: authzen_entities_1.AuthzenSubjectSchema.optional(),
+    action: authzen_entities_1.AuthzenActionSchema.optional(),
+    resource: authzen_entities_1.AuthzenResourceSchema.optional(),
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+    evaluations: zod_1.z.array(exports.AccessEvaluationItemSchema).optional(),
+    options: exports.AuthzenEvaluationsOptionsSchema.optional(),
+})
+    .strict()
+    .superRefine((request, ctx) => {
+    const items = request.evaluations ?? [];
+    const required = ['subject', 'action', 'resource'];
+    if (items.length === 0) {
+        for (const key of required) {
+            if (request[key] === undefined) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [key],
+                    message: `\`${key}\` is required when \`evaluations\` is absent or empty (§7.1).`,
+                });
+            }
+        }
+        return;
+    }
+    items.forEach((item, index) => {
+        for (const key of required) {
+            if (item[key] === undefined && request[key] === undefined) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['evaluations', index, key],
+                    message: `\`${key}\` is missing from evaluation ${index} and has no top-level default (§7.1.1).`,
+                });
+            }
+        }
+    });
+});
+exports.AccessEvaluationsResponseSchema = zod_1.z
+    .object({
+    decision: zod_1.z.boolean().optional(),
+    context: authzen_entities_1.AuthzenContextSchema.optional(),
+    evaluations: zod_1.z.array(authzen_entities_1.AuthzenDecisionSchema).optional(),
+})
+    .strict()
+    .refine((r) => r.evaluations !== undefined || r.decision !== undefined, {
+    message: 'an Access Evaluations response carries `evaluations`, or — for a single-evaluation request — `decision`.',
+});
+function expandAccessEvaluations(request) {
+    const parsed = exports.AccessEvaluationsRequestSchema.parse(request);
+    const items = parsed.evaluations === undefined || parsed.evaluations.length === 0
+        ? [{}]
+        : parsed.evaluations;
+    return items.map((item, index) => {
+        const subject = item.subject ?? parsed.subject;
+        const action = item.action ?? parsed.action;
+        const resource = item.resource ?? parsed.resource;
+        const context = item.context ?? parsed.context;
+        if (subject === undefined ||
+            action === undefined ||
+            resource === undefined) {
+            throw new Error(`expandAccessEvaluations: evaluation ${index} is incomplete after defaults (unreachable after schema validation).`);
+        }
+        return context === undefined
+            ? { subject, action, resource }
+            : { subject, action, resource, context };
+    });
+}
+//# sourceMappingURL=authzen-evaluation.js.map

package/dist/authzen/lib/authzen-evaluation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-evaluation.js","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-evaluation.ts"],"names":[],"mappings":";;;AAwJA,0DA4BC;AApLD,6BAAwB;AAExB,yDAU4B;AAQf,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,uCAAoB;IAC7B,MAAM,EAAE,sCAAmB;IAC3B,QAAQ,EAAE,wCAAqB;IAC/B,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,8BAA8B,GAAG,wCAAqB,CAAC;AAMpE,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,wDAA0B,CAAA;IAC1B,oEAAsC,CAAA;IACtC,4EAA8C,CAAA;AAChD,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAOW,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,oBAAoB,EAAE,wCAAgC,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,QAAQ,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAMZ,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,sCAAmB,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AASC,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,sCAAmB,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,wCAAqB,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,kCAA0B,CAAC,CAAC,QAAQ,EAAE;IAC3D,OAAO,EAAE,uCAA+B,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,KAAK,GAAG,gEAAgE;iBAClF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1D,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC;oBACjC,OAAO,EAAE,KAAK,GAAG,iCAAiC,KAAK,yCAAyC;iBACjG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAYQ,QAAA,+BAA+B,GAAG,OAAC;KAC7C,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,uCAAoB,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAqB,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;IACtE,OAAO,EACL,0GAA0G;CAC7G,CAAC,CAAC;AAcL,SAAgB,uBAAuB,CACrC,OAAiC;IAEjC,MAAM,MAAM,GAAG,sCAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,KAAK,GACT,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACjE,CAAC,CAAC,CAAC,EAAE,CAAC;QACN,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;IACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,OAAO,GAA+B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC3E,MAAM,MAAM,GAA8B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QACvE,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QACnC,MAAM,OAAO,GACX,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QACjC,IACE,OAAO,KAAK,SAAS;YACrB,MAAM,KAAK,SAAS;YACpB,QAAQ,KAAK,SAAS,EACtB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,sEAAsE,CACnH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/authzen/lib/authzen-metadata.d.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+export declare const AUTHZEN_WELL_KNOWN_PATH = "/.well-known/authzen-configuration";
+export declare const AUTHZEN_REQUEST_ID_HEADER = "X-Request-ID";
+export declare enum AuthzenEndpointPath {
+    Evaluation = "/access/v1/evaluation",
+    Evaluations = "/access/v1/evaluations",
+    SearchSubject = "/access/v1/search/subject",
+    SearchResource = "/access/v1/search/resource",
+    SearchAction = "/access/v1/search/action"
+}
+export declare const AuthzenPdpIdentifierSchema: z.ZodString;
+export declare const AuthzenPdpMetadataSchema: z.ZodObject<{
+    policy_decision_point: z.ZodString;
+    access_evaluation_endpoint: z.ZodString;
+    access_evaluations_endpoint: z.ZodOptional<z.ZodString>;
+    search_subject_endpoint: z.ZodOptional<z.ZodString>;
+    search_action_endpoint: z.ZodOptional<z.ZodString>;
+    search_resource_endpoint: z.ZodOptional<z.ZodString>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    signed_metadata: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthzenPdpMetadata = z.infer<typeof AuthzenPdpMetadataSchema>;
+export declare function buildAuthzenPdpMetadata(policyDecisionPoint: string): AuthzenPdpMetadata;
+export declare function assertAuthzenPdpMetadataIdentifier(metadata: AuthzenPdpMetadata, expectedPolicyDecisionPoint: string): void;
+//# sourceMappingURL=authzen-metadata.d.ts.map

package/dist/authzen/lib/authzen-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-metadata.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AAG5E,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAOxD,oBAAY,mBAAmB;IAC7B,UAAU,0BAA0B;IACpC,WAAW,2BAA2B;IACtC,aAAa,8BAA8B;IAC3C,cAAc,+BAA+B;IAC7C,YAAY,6BAA6B;CAC1C;AAKD,eAAO,MAAM,0BAA0B,aAYpC,CAAC;AAYJ,eAAO,MAAM,wBAAwB;;;;;;;;;iBAWnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAO1E,wBAAgB,uBAAuB,CACrC,mBAAmB,EAAE,MAAM,GAC1B,kBAAkB,CAWpB;AAQD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,kBAAkB,EAC5B,2BAA2B,EAAE,MAAM,GAClC,IAAI,CAMN"}

package/dist/authzen/lib/authzen-metadata.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzenPdpMetadataSchema = exports.AuthzenPdpIdentifierSchema = exports.AuthzenEndpointPath = exports.AUTHZEN_REQUEST_ID_HEADER = exports.AUTHZEN_WELL_KNOWN_PATH = void 0;
+exports.buildAuthzenPdpMetadata = buildAuthzenPdpMetadata;
+exports.assertAuthzenPdpMetadataIdentifier = assertAuthzenPdpMetadataIdentifier;
+const zod_1 = require("zod");
+exports.AUTHZEN_WELL_KNOWN_PATH = '/.well-known/authzen-configuration';
+exports.AUTHZEN_REQUEST_ID_HEADER = 'X-Request-ID';
+var AuthzenEndpointPath;
+(function (AuthzenEndpointPath) {
+    AuthzenEndpointPath["Evaluation"] = "/access/v1/evaluation";
+    AuthzenEndpointPath["Evaluations"] = "/access/v1/evaluations";
+    AuthzenEndpointPath["SearchSubject"] = "/access/v1/search/subject";
+    AuthzenEndpointPath["SearchResource"] = "/access/v1/search/resource";
+    AuthzenEndpointPath["SearchAction"] = "/access/v1/search/action";
+})(AuthzenEndpointPath || (exports.AuthzenEndpointPath = AuthzenEndpointPath = {}));
+exports.AuthzenPdpIdentifierSchema = zod_1.z
+    .string()
+    .url()
+    .refine((value) => {
+    const url = new URL(value);
+    return url.protocol === 'https:' && url.search === '' && url.hash === '';
+}, {
+    message: 'policy_decision_point must be an https URL with no query or fragment (§9.1.1).',
+});
+const EndpointUrlSchema = zod_1.z.string().url();
+exports.AuthzenPdpMetadataSchema = zod_1.z.object({
+    policy_decision_point: exports.AuthzenPdpIdentifierSchema,
+    access_evaluation_endpoint: EndpointUrlSchema,
+    access_evaluations_endpoint: EndpointUrlSchema.optional(),
+    search_subject_endpoint: EndpointUrlSchema.optional(),
+    search_action_endpoint: EndpointUrlSchema.optional(),
+    search_resource_endpoint: EndpointUrlSchema.optional(),
+    capabilities: zod_1.z.array(zod_1.z.string().min(1)).min(1).optional(),
+    signed_metadata: zod_1.z.string().min(1).optional(),
+});
+function buildAuthzenPdpMetadata(policyDecisionPoint) {
+    const pdp = exports.AuthzenPdpIdentifierSchema.parse(policyDecisionPoint);
+    const base = pdp.endsWith('/') ? pdp.slice(0, -1) : pdp;
+    return {
+        policy_decision_point: pdp,
+        access_evaluation_endpoint: `${base}${AuthzenEndpointPath.Evaluation}`,
+        access_evaluations_endpoint: `${base}${AuthzenEndpointPath.Evaluations}`,
+        search_subject_endpoint: `${base}${AuthzenEndpointPath.SearchSubject}`,
+        search_resource_endpoint: `${base}${AuthzenEndpointPath.SearchResource}`,
+        search_action_endpoint: `${base}${AuthzenEndpointPath.SearchAction}`,
+    };
+}
+function assertAuthzenPdpMetadataIdentifier(metadata, expectedPolicyDecisionPoint) {
+    if (metadata.policy_decision_point !== expectedPolicyDecisionPoint) {
+        throw new Error(`AuthZEN PDP metadata names "${metadata.policy_decision_point}" but was fetched for "${expectedPolicyDecisionPoint}"; it MUST NOT be used (§9.2.3).`);
+    }
+}
+//# sourceMappingURL=authzen-metadata.js.map

package/dist/authzen/lib/authzen-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-metadata.js","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-metadata.ts"],"names":[],"mappings":";;;AAwEA,0DAaC;AAQD,gFASC;AAtGD,6BAAwB;AAQX,QAAA,uBAAuB,GAAG,oCAAoC,CAAC;AAG/D,QAAA,yBAAyB,GAAG,cAAc,CAAC;AAOxD,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,2DAAoC,CAAA;IACpC,6DAAsC,CAAA;IACtC,kEAA2C,CAAA;IAC3C,oEAA6C,CAAA;IAC7C,gEAAyC,CAAA;AAC3C,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAKY,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CACL,CAAC,KAAK,EAAE,EAAE;IACR,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;AAC3E,CAAC,EACD;IACE,OAAO,EACL,gFAAgF;CACnF,CACF,CAAC;AAEJ,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;AAU9B,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,qBAAqB,EAAE,kCAA0B;IACjD,0BAA0B,EAAE,iBAAiB;IAC7C,2BAA2B,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzD,uBAAuB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrD,sBAAsB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpD,wBAAwB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAEtD,YAAY,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE1D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAQH,SAAgB,uBAAuB,CACrC,mBAA2B;IAE3B,MAAM,GAAG,GAAG,kCAA0B,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,OAAO;QACL,qBAAqB,EAAE,GAAG;QAC1B,0BAA0B,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,UAAU,EAAE;QACtE,2BAA2B,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,WAAW,EAAE;QACxE,uBAAuB,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,aAAa,EAAE;QACtE,wBAAwB,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,cAAc,EAAE;QACxE,sBAAsB,EAAE,GAAG,IAAI,GAAG,mBAAmB,CAAC,YAAY,EAAE;KACrE,CAAC;AACJ,CAAC;AAQD,SAAgB,kCAAkC,CAChD,QAA4B,EAC5B,2BAAmC;IAEnC,IAAI,QAAQ,CAAC,qBAAqB,KAAK,2BAA2B,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,qBAAqB,0BAA0B,2BAA2B,kCAAkC,CACrJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/authzen/lib/authzen-search.d.ts

@@ -0,0 +1,135 @@
+import { z } from 'zod';
+export declare const AuthzenPageRequestSchema: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strict>;
+export type AuthzenPageRequest = z.infer<typeof AuthzenPageRequestSchema>;
+export declare const AuthzenPageResponseSchema: z.ZodObject<{
+    next_token: z.ZodString;
+    count: z.ZodOptional<z.ZodNumber>;
+    total: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type AuthzenPageResponse = z.infer<typeof AuthzenPageResponseSchema>;
+export declare const AUTHZEN_LAST_PAGE_TOKEN = "";
+export declare const SubjectSearchRequestSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    action: z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    page: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        limit: z.ZodOptional<z.ZodNumber>;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SubjectSearchRequest = z.infer<typeof SubjectSearchRequestSchema>;
+export declare const ResourceSearchRequestSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    action: z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    page: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        limit: z.ZodOptional<z.ZodNumber>;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ResourceSearchRequest = z.infer<typeof ResourceSearchRequestSchema>;
+export declare const ActionSearchRequestSchema: z.ZodObject<{
+    subject: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    resource: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    page: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        limit: z.ZodOptional<z.ZodNumber>;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ActionSearchRequest = z.infer<typeof ActionSearchRequestSchema>;
+export declare const SubjectSearchResponseSchema: z.ZodObject<{
+    page: z.ZodOptional<z.ZodObject<{
+        next_token: z.ZodString;
+        count: z.ZodOptional<z.ZodNumber>;
+        total: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    results: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SubjectSearchResponse = z.infer<typeof SubjectSearchResponseSchema>;
+export declare const ResourceSearchResponseSchema: z.ZodObject<{
+    page: z.ZodOptional<z.ZodObject<{
+        next_token: z.ZodString;
+        count: z.ZodOptional<z.ZodNumber>;
+        total: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    results: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ResourceSearchResponse = z.infer<typeof ResourceSearchResponseSchema>;
+export declare const ActionSearchResponseSchema: z.ZodObject<{
+    page: z.ZodOptional<z.ZodObject<{
+        next_token: z.ZodString;
+        count: z.ZodOptional<z.ZodNumber>;
+        total: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    results: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ActionSearchResponse = z.infer<typeof ActionSearchResponseSchema>;
+export declare function searchResultsOutsideQueriedType(results: ReadonlyArray<{
+    readonly type: string;
+}>, queriedType: string): ReadonlyArray<{
+    readonly type: string;
+}>;
+export declare function searchContinuationMatches(previous: {
+    readonly page?: {
+        readonly token?: string;
+    };
+}, next: {
+    readonly page?: {
+        readonly token?: string;
+    };
+}): boolean;
+//# sourceMappingURL=authzen-search.d.ts.map

package/dist/authzen/lib/authzen-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authzen-search.d.ts","sourceRoot":"","sources":["../../../src/authzen/lib/authzen-search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,wBAAwB;;;;kBAM1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,yBAAyB;;;;kBAM3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAG5E,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAG1C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAQ5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAG9E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;kBAQ7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CACzC,OAAO,2BAA2B,CACnC,CAAC;AAOF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAO3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAa5E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;kBACI,CAAC;AAC7C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CACzC,OAAO,2BAA2B,CACnC,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;kBAExC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;kBACI,CAAC;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAQ9E,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACjD,WAAW,EAAE,MAAM,GAClB,aAAa,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAE1C;AAQD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACzD,IAAI,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD,OAAO,CAGT"}