feat(authz): export registry, store, engine, and middleware surface

Appends the Task 1-8 modules (defineAuthz, catalog merge helpers,
permission stores, audit sinks, resolver engine, and authzMiddleware/
can/guards) to the public @wrnexus/authz surface, and regenerates the
public-api-0.8.json baseline to match.

docs/public-api-0.8.json

@@ -457,11 +457,31 @@
     },
     "@wrnexus/authz": {
       ".": [
+        "AUTHZ_LOCALS_KEY",
+        "AttributeMeta",
         "AuthorizationDecision",
+        "AuthorizeDecisionOptions",
+        "AuthzAuditEvent",
+        "AuthzAuditSink",
+        "AuthzCatalog",
+        "AuthzModule",
+        "AuthzResolver",
+        "AuthzResolverOptions",
+        "AuthzScope",
+        "CacheOptions",
+        "CachedPermissionStore",
+        "CatalogSource",
+        "DecideInput",
         "DecisionPolicy",
+        "GrantEffect",
+        "GuardOptions",
+        "MemoryAuditSink",
+        "PermissionMeta",
+        "PermissionStore",
         "Policy",
         "Rbac",
         "Subject",
+        "SubjectAssignments",
         "all",
         "allDecisions",
         "allow",
@@ -470,14 +490,32 @@
         "attr",
         "authorize",
         "authorizeDecision",
+        "authzMiddleware",
+        "cachedPermissionStore",
+        "can",
+        "consoleAuditSink",
+        "createAuthzResolver",
+        "decideFor",
         "decision",
+        "defineAuthz",
         "defineRbac",
+        "deniedBy",
         "deny",
+        "emptyCatalog",
+        "expandRoles",
         "filterAuthorized",
+        "filterCan",
+        "guardPermission",
         "hasRole",
+        "memoryAuditSink",
+        "memoryPermissionStore",
+        "mergeCatalogs",
         "owner",
+        "permissionMatches",
         "requirePermission",
-        "requireRole"
+        "requireRole",
+        "safeRecord",
+        "scopeKey"
       ]
     },
     "@wrnexus/benchmark": {

packages/authz/src/index.ts

@@ -140,3 +140,30 @@ export {
   filterAuthorized,
 } from "./advanced.ts";
 export type { AuthorizationDecision, DecisionPolicy } from "./advanced.ts";
+export { defineAuthz } from "./registry.ts";
+export { mergeCatalogs, emptyCatalog } from "./catalog.ts";
+export type { CatalogSource } from "./catalog.ts";
+export { memoryPermissionStore, cachedPermissionStore, scopeKey } from "./store.ts";
+export type { PermissionStore, CachedPermissionStore, CacheOptions, GrantEffect } from "./store.ts";
+export { memoryAuditSink, consoleAuditSink, safeRecord } from "./audit.ts";
+export type { AuthzAuditEvent, AuthzAuditSink, MemoryAuditSink } from "./audit.ts";
+export { createAuthzResolver, expandRoles, permissionMatches, deniedBy } from "./engine.ts";
+export type { AuthzResolver, AuthzResolverOptions, DecideInput } from "./engine.ts";
+export {
+  authzMiddleware,
+  can,
+  decideFor,
+  guardPermission,
+  filterCan,
+  AUTHZ_LOCALS_KEY,
+} from "./middleware.ts";
+export type { GuardOptions } from "./middleware.ts";
+export type {
+  AuthzScope,
+  AuthzCatalog,
+  AuthzModule,
+  AttributeMeta,
+  PermissionMeta,
+  SubjectAssignments,
+} from "./types.ts";
+export type { AuthorizeDecisionOptions } from "./advanced.ts";

packages/authz/test/exports.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, test } from "bun:test";
+import * as authz from "../src/index.ts";
+
+describe("@wrnexus/authz exports", () => {
+  test("keeps the pre-existing surface", () => {
+    for (const name of [
+      "defineRbac",
+      "hasRole",
+      "any",
+      "all",
+      "attr",
+      "authorize",
+      "requireRole",
+      "requirePermission",
+      "allow",
+      "deny",
+      "decision",
+      "owner",
+      "anyDecision",
+      "allDecisions",
+      "authorizeDecision",
+      "filterAuthorized",
+    ]) {
+      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
+    }
+  });
+
+  test("adds the registry, store, engine, and middleware surface", () => {
+    for (const name of [
+      "defineAuthz",
+      "mergeCatalogs",
+      "emptyCatalog",
+      "memoryPermissionStore",
+      "cachedPermissionStore",
+      "memoryAuditSink",
+      "consoleAuditSink",
+      "createAuthzResolver",
+      "expandRoles",
+      "permissionMatches",
+      "deniedBy",
+      "authzMiddleware",
+      "can",
+      "decideFor",
+      "guardPermission",
+      "filterCan",
+    ]) {
+      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
+    }
+  });
+});