feat(authz): export registry, store, engine, and middleware surface

Appends the Task 1-8 modules (defineAuthz, catalog merge helpers,
permission stores, audit sinks, resolver engine, and authzMiddleware/
can/guards) to the public @wrnexus/authz surface, and regenerates the
public-api-0.8.json baseline to match.

packages/authz/src/index.ts

@@ -140,3 +140,30 @@ export {
   filterAuthorized,
 } from "./advanced.ts";
 export type { AuthorizationDecision, DecisionPolicy } from "./advanced.ts";
+export { defineAuthz } from "./registry.ts";
+export { mergeCatalogs, emptyCatalog } from "./catalog.ts";
+export type { CatalogSource } from "./catalog.ts";
+export { memoryPermissionStore, cachedPermissionStore, scopeKey } from "./store.ts";
+export type { PermissionStore, CachedPermissionStore, CacheOptions, GrantEffect } from "./store.ts";
+export { memoryAuditSink, consoleAuditSink, safeRecord } from "./audit.ts";
+export type { AuthzAuditEvent, AuthzAuditSink, MemoryAuditSink } from "./audit.ts";
+export { createAuthzResolver, expandRoles, permissionMatches, deniedBy } from "./engine.ts";
+export type { AuthzResolver, AuthzResolverOptions, DecideInput } from "./engine.ts";
+export {
+  authzMiddleware,
+  can,
+  decideFor,
+  guardPermission,
+  filterCan,
+  AUTHZ_LOCALS_KEY,
+} from "./middleware.ts";
+export type { GuardOptions } from "./middleware.ts";
+export type {
+  AuthzScope,
+  AuthzCatalog,
+  AuthzModule,
+  AttributeMeta,
+  PermissionMeta,
+  SubjectAssignments,
+} from "./types.ts";
+export type { AuthorizeDecisionOptions } from "./advanced.ts";

packages/authz/test/exports.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, test } from "bun:test";
+import * as authz from "../src/index.ts";
+
+describe("@wrnexus/authz exports", () => {
+  test("keeps the pre-existing surface", () => {
+    for (const name of [
+      "defineRbac",
+      "hasRole",
+      "any",
+      "all",
+      "attr",
+      "authorize",
+      "requireRole",
+      "requirePermission",
+      "allow",
+      "deny",
+      "decision",
+      "owner",
+      "anyDecision",
+      "allDecisions",
+      "authorizeDecision",
+      "filterAuthorized",
+    ]) {
+      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
+    }
+  });
+
+  test("adds the registry, store, engine, and middleware surface", () => {
+    for (const name of [
+      "defineAuthz",
+      "mergeCatalogs",
+      "emptyCatalog",
+      "memoryPermissionStore",
+      "cachedPermissionStore",
+      "memoryAuditSink",
+      "consoleAuditSink",
+      "createAuthzResolver",
+      "expandRoles",
+      "permissionMatches",
+      "deniedBy",
+      "authzMiddleware",
+      "can",
+      "decideFor",
+      "guardPermission",
+      "filterCan",
+    ]) {
+      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
+    }
+  });
+});