@astrale-os/kernel-core 0.4.1

package/dist/auth/expression/encoding.js

@@ -0,0 +1,345 @@
+/**
+ * Binary Varint Encoding for Identity Expressions
+ *
+ * Zero-dependency binary encoding for maximum compression.
+ *
+ * Type Tags:
+ * - 0x01 = Identity
+ * - 0x03 = Scope
+ * - 0x10 = Union
+ * - 0x11 = Intersect
+ * - 0x12 = Exclude
+ * - 0x20 = Reference (for deduped expressions)
+ * - 0x30 = Deduped wrapper (defs + root)
+ *
+ * Union/Intersect: TAG + varint(operand count) + operands
+ * Exclude: TAG + base + varint(excluded count) + excluded operands
+ * Scope: TAG + varint(scope count) + scopes + inner expr
+ */
+import { BufferReader, BufferWriter } from './buffer';
+import { toCompactJSON } from './compact';
+import { isDedupedExpr, isRef } from './dedup';
+// =============================================================================
+// TYPE TAGS
+// =============================================================================
+const TAG_IDENTITY = 0x01;
+const TAG_SCOPE = 0x03;
+const TAG_UNION = 0x10;
+const TAG_INTERSECT = 0x11;
+const TAG_EXCLUDE = 0x12;
+const TAG_REF = 0x20;
+const TAG_DEDUPED = 0x30;
+// Scope flags
+const SCOPE_HAS_NODES = 0x01;
+const SCOPE_HAS_PERMS = 0x02;
+const SCOPE_HAS_PRINCIPALS = 0x04;
+// Depth limit (consistent with compact.ts)
+const MAX_DEPTH = 100;
+// =============================================================================
+// SCOPE ENCODING
+// =============================================================================
+function writeScope(writer, scope) {
+    let flags = 0;
+    if (scope.nodes && scope.nodes.length > 0)
+        flags |= SCOPE_HAS_NODES;
+    if (scope.perms !== undefined)
+        flags |= SCOPE_HAS_PERMS;
+    if (scope.principals && scope.principals.length > 0)
+        flags |= SCOPE_HAS_PRINCIPALS;
+    writer.writeByte(flags);
+    if (flags & SCOPE_HAS_NODES) {
+        writer.writeVarint(scope.nodes.length);
+        for (const node of scope.nodes) {
+            writer.writeString(node);
+        }
+    }
+    if (flags & SCOPE_HAS_PERMS) {
+        writer.writeVarint(scope.perms);
+    }
+    if (flags & SCOPE_HAS_PRINCIPALS) {
+        writer.writeVarint(scope.principals.length);
+        for (const principal of scope.principals) {
+            writer.writeString(principal);
+        }
+    }
+}
+function readScope(reader) {
+    const flags = reader.readByte();
+    const scope = {};
+    if (flags & SCOPE_HAS_NODES) {
+        const count = reader.readVarint();
+        scope.nodes = [];
+        for (let i = 0; i < count; i++) {
+            scope.nodes.push(reader.readString());
+        }
+    }
+    if (flags & SCOPE_HAS_PERMS) {
+        scope.perms = reader.readVarint();
+    }
+    if (flags & SCOPE_HAS_PRINCIPALS) {
+        const count = reader.readVarint();
+        scope.principals = [];
+        for (let i = 0; i < count; i++) {
+            scope.principals.push(reader.readString());
+        }
+    }
+    return scope;
+}
+// =============================================================================
+// EXPRESSION ENCODING
+// =============================================================================
+function writeExpr(writer, expr, depth = 0) {
+    if (depth > MAX_DEPTH) {
+        throw new Error('Expression too deeply nested (binary encoding)');
+    }
+    switch (expr.kind) {
+        case 'identity':
+            writer.writeByte(TAG_IDENTITY);
+            writer.writeString(expr.id);
+            break;
+        case 'scope':
+            writer.writeByte(TAG_SCOPE);
+            writer.writeVarint(expr.scopes.length);
+            for (const scope of expr.scopes) {
+                writeScope(writer, scope);
+            }
+            writeExpr(writer, expr.expr, depth + 1);
+            break;
+        case 'union':
+            writer.writeByte(TAG_UNION);
+            writer.writeVarint(expr.operands.length);
+            for (const op of expr.operands) {
+                writeExpr(writer, op, depth + 1);
+            }
+            break;
+        case 'intersect':
+            writer.writeByte(TAG_INTERSECT);
+            writer.writeVarint(expr.operands.length);
+            for (const op of expr.operands) {
+                writeExpr(writer, op, depth + 1);
+            }
+            break;
+        case 'exclude':
+            writer.writeByte(TAG_EXCLUDE);
+            writeExpr(writer, expr.base, depth + 1);
+            writer.writeVarint(expr.excluded.length);
+            for (const ex of expr.excluded) {
+                writeExpr(writer, ex, depth + 1);
+            }
+            break;
+    }
+}
+function writeRefExpr(writer, expr, depth = 0) {
+    if (depth > MAX_DEPTH) {
+        throw new Error('Expression too deeply nested (binary encoding)');
+    }
+    if (isRef(expr)) {
+        writer.writeByte(TAG_REF);
+        writer.writeVarint(expr.$ref);
+        return;
+    }
+    switch (expr.kind) {
+        case 'identity':
+            writer.writeByte(TAG_IDENTITY);
+            writer.writeString(expr.id);
+            break;
+        case 'scope':
+            writer.writeByte(TAG_SCOPE);
+            writer.writeVarint(expr.scopes.length);
+            for (const scope of expr.scopes) {
+                writeScope(writer, scope);
+            }
+            writeRefExpr(writer, expr.expr, depth + 1);
+            break;
+        case 'union':
+            writer.writeByte(TAG_UNION);
+            writer.writeVarint(expr.operands.length);
+            for (const op of expr.operands) {
+                writeRefExpr(writer, op, depth + 1);
+            }
+            break;
+        case 'intersect':
+            writer.writeByte(TAG_INTERSECT);
+            writer.writeVarint(expr.operands.length);
+            for (const op of expr.operands) {
+                writeRefExpr(writer, op, depth + 1);
+            }
+            break;
+        case 'exclude':
+            writer.writeByte(TAG_EXCLUDE);
+            writeRefExpr(writer, expr.base, depth + 1);
+            writer.writeVarint(expr.excluded.length);
+            for (const ex of expr.excluded) {
+                writeRefExpr(writer, ex, depth + 1);
+            }
+            break;
+    }
+}
+function writeDeduped(writer, deduped) {
+    writer.writeByte(TAG_DEDUPED);
+    writer.writeVarint(deduped.defs.length);
+    for (const def of deduped.defs) {
+        writeExpr(writer, def);
+    }
+    writeRefExpr(writer, deduped.root);
+}
+function readExpr(reader, depth = 0) {
+    if (depth > MAX_DEPTH) {
+        throw new Error('Expression too deeply nested (binary decoding)');
+    }
+    const tag = reader.readByte();
+    switch (tag) {
+        case TAG_IDENTITY:
+            return { kind: 'identity', id: reader.readString() };
+        case TAG_SCOPE: {
+            const scopeCount = reader.readVarint();
+            const scopes = [];
+            for (let i = 0; i < scopeCount; i++) {
+                scopes.push(readScope(reader));
+            }
+            return { kind: 'scope', scopes, expr: readExpr(reader, depth + 1) };
+        }
+        case TAG_UNION: {
+            const count = reader.readVarint();
+            const operands = [];
+            for (let i = 0; i < count; i++) {
+                operands.push(readExpr(reader, depth + 1));
+            }
+            return { kind: 'union', operands };
+        }
+        case TAG_INTERSECT: {
+            const count = reader.readVarint();
+            const operands = [];
+            for (let i = 0; i < count; i++) {
+                operands.push(readExpr(reader, depth + 1));
+            }
+            return { kind: 'intersect', operands };
+        }
+        case TAG_EXCLUDE: {
+            const base = readExpr(reader, depth + 1);
+            const excludedCount = reader.readVarint();
+            const excluded = [];
+            for (let i = 0; i < excludedCount; i++) {
+                excluded.push(readExpr(reader, depth + 1));
+            }
+            return { kind: 'exclude', base, excluded };
+        }
+        default:
+            throw new Error(`Unknown expression tag: 0x${tag.toString(16)}`);
+    }
+}
+function readRefExpr(reader, depth = 0) {
+    if (depth > MAX_DEPTH) {
+        throw new Error('Expression too deeply nested (binary decoding)');
+    }
+    const tag = reader.readByte();
+    switch (tag) {
+        case TAG_REF:
+            return { $ref: reader.readVarint() };
+        case TAG_IDENTITY:
+            return { kind: 'identity', id: reader.readString() };
+        case TAG_SCOPE: {
+            const scopeCount = reader.readVarint();
+            const scopes = [];
+            for (let i = 0; i < scopeCount; i++) {
+                scopes.push(readScope(reader));
+            }
+            return { kind: 'scope', scopes, expr: readRefExpr(reader, depth + 1) };
+        }
+        case TAG_UNION: {
+            const count = reader.readVarint();
+            const operands = [];
+            for (let i = 0; i < count; i++) {
+                operands.push(readRefExpr(reader, depth + 1));
+            }
+            return { kind: 'union', operands };
+        }
+        case TAG_INTERSECT: {
+            const count = reader.readVarint();
+            const operands = [];
+            for (let i = 0; i < count; i++) {
+                operands.push(readRefExpr(reader, depth + 1));
+            }
+            return { kind: 'intersect', operands };
+        }
+        case TAG_EXCLUDE: {
+            const base = readRefExpr(reader, depth + 1);
+            const excludedCount = reader.readVarint();
+            const excluded = [];
+            for (let i = 0; i < excludedCount; i++) {
+                excluded.push(readRefExpr(reader, depth + 1));
+            }
+            return { kind: 'exclude', base, excluded };
+        }
+        default:
+            throw new Error(`Unknown expression tag: 0x${tag.toString(16)}`);
+    }
+}
+function readDeduped(reader) {
+    const defCount = reader.readVarint();
+    const defs = [];
+    for (let i = 0; i < defCount; i++) {
+        defs.push(readExpr(reader));
+    }
+    const root = readRefExpr(reader);
+    return { defs, root };
+}
+// =============================================================================
+// PUBLIC API
+// =============================================================================
+export function encode(expr) {
+    const writer = new BufferWriter();
+    if (isDedupedExpr(expr)) {
+        writeDeduped(writer, expr);
+    }
+    else {
+        writeExpr(writer, expr);
+    }
+    return writer.toUint8Array();
+}
+export function decode(bytes) {
+    if (bytes.length === 0) {
+        throw new Error('Cannot decode empty buffer');
+    }
+    const reader = new BufferReader(bytes);
+    const firstByte = bytes[0];
+    let result;
+    if (firstByte === TAG_DEDUPED) {
+        reader.readByte(); // consume the tag
+        result = readDeduped(reader);
+    }
+    else {
+        result = readExpr(reader);
+    }
+    if (reader.remaining > 0) {
+        throw new Error(`Unexpected ${reader.remaining} bytes after expression`);
+    }
+    return result;
+}
+export function encodeBase64(expr) {
+    const binary = encode(expr);
+    let s = '';
+    for (let i = 0; i < binary.length; i++) {
+        s += String.fromCharCode(binary[i]);
+    }
+    return btoa(s);
+}
+export function decodeBase64(base64) {
+    const s = atob(base64);
+    const bytes = new Uint8Array(s.length);
+    for (let i = 0; i < s.length; i++) {
+        bytes[i] = s.charCodeAt(i);
+    }
+    return decode(bytes);
+}
+// =============================================================================
+// SIZE COMPARISON
+// =============================================================================
+export function compareSizes(expr) {
+    const verbose = JSON.stringify(expr).length;
+    const compact = toCompactJSON(expr).length;
+    const binary = encode(expr).length;
+    const binaryBase64 = encodeBase64(expr).length;
+    return { verbose, compact, binary, binaryBase64 };
+}
+//# sourceMappingURL=encoding.js.map

package/dist/auth/expression/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../../auth/expression/encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAkC,MAAM,SAAS,CAAA;AAE9E,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,SAAS,GAAG,IAAI,CAAA;AACtB,MAAM,SAAS,GAAG,IAAI,CAAA;AACtB,MAAM,aAAa,GAAG,IAAI,CAAA;AAC1B,MAAM,WAAW,GAAG,IAAI,CAAA;AACxB,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,cAAc;AACd,MAAM,eAAe,GAAG,IAAI,CAAA;AAC5B,MAAM,eAAe,GAAG,IAAI,CAAA;AAC5B,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,2CAA2C;AAC3C,MAAM,SAAS,GAAG,GAAG,CAAA;AAErB,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,SAAS,UAAU,CAAC,MAAoB,EAAE,KAAY;IACpD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,IAAI,eAAe,CAAA;IACnE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,IAAI,eAAe,CAAA;IACvD,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,IAAI,oBAAoB,CAAA;IAElF,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAEvB,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAM,CAAC,MAAM,CAAC,CAAA;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAM,EAAE,CAAC;YAChC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAM,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACjC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,UAAW,CAAC,MAAM,CAAC,CAAA;QAC5C,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAW,EAAE,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAoB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAU,EAAE,CAAA;IAEvB,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACjC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAA;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAY,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACnC,CAAC;IAED,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACjC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAA;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAgB,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,SAAS,SAAS,CAAC,MAAoB,EAAE,IAAkB,EAAE,KAAK,GAAW,CAAC;IAC5E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAC9B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3B,MAAK;QAEP,KAAK,OAAO;YACV,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC3B,CAAC;YACD,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACvC,MAAK;QAEP,KAAK,OAAO;YACV,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAClC,CAAC;YACD,MAAK;QAEP,KAAK,WAAW;YACd,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YAC/B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAClC,CAAC;YACD,MAAK;QAEP,KAAK,SAAS;YACZ,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7B,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACvC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAClC,CAAC;YACD,MAAK;IACT,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,IAAa,EAAE,KAAK,GAAW,CAAC;IAC1E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACzB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7B,OAAM;IACR,CAAC;IAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAC9B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC3B,MAAK;QAEP,KAAK,OAAO;YACV,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACtC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC3B,CAAC;YACD,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,MAAK;QAEP,KAAK,OAAO;YACV,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC3B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACrC,CAAC;YACD,MAAK;QAEP,KAAK,WAAW;YACd,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;YAC/B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACrC,CAAC;YACD,MAAK;QAEP,KAAK,SAAS;YACZ,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;YAC7B,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC1C,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC/B,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACrC,CAAC;YACD,MAAK;IACT,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAoB;IAC9D,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAC7B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,MAAoB,EAAE,KAAK,GAAW,CAAC;IACvD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAE7B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAgB,EAAE,CAAA;QAEpE,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACtC,MAAM,MAAM,GAAY,EAAE,CAAA;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YAChC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;QACrE,CAAC;QAED,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACjC,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QACpC,CAAC;QAED,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACjC,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;QACxC,CAAC;QAED,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAmB,EAAE,CAAA;YACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAC5C,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB,EAAE,KAAK,GAAW,CAAC;IAC1D,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAE7B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAA;QAEtC,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAgB,EAAE,CAAA;QAEpE,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACtC,MAAM,MAAM,GAAY,EAAE,CAAA;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YAChC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;QACxE,CAAC;QAED,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACjC,MAAM,QAAQ,GAAc,EAAE,CAAA;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QACpC,CAAC;QAED,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACjC,MAAM,QAAQ,GAAc,EAAE,CAAA;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;QACxC,CAAC;QAED,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAc,EAAE,CAAA;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;YAC/C,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAC5C,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACpC,MAAM,IAAI,GAAmB,EAAE,CAAA;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC;AAED,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,UAAU,MAAM,CAAC,IAAgC;IACrD,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAA;IAEjC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IAE1B,IAAI,MAAkC,CAAA;IACtC,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,QAAQ,EAAE,CAAA,CAAC,kBAAkB;QACpC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,CAAC,SAAS,yBAAyB,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAgC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,MAAM,UAAU,YAAY,CAAC,IAAkB;IAM7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAClC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IAE9C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACnD,CAAC"}

package/dist/auth/expression/index.d.ts

@@ -0,0 +1,11 @@
+export * from './types';
+export * from './builder';
+export * from './scope';
+export * from './prune';
+export * from './compact';
+export * from './dedup';
+export * from './encoding';
+export * from './validation';
+export * from './codec';
+export * from './zod';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/expression/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/expression/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,cAAc,SAAS,CAAA;AACvB,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA;AACvB,cAAc,OAAO,CAAA"}

package/dist/auth/expression/index.js

@@ -0,0 +1,11 @@
+export * from './types';
+export * from './builder';
+export * from './scope';
+export * from './prune';
+export * from './compact';
+export * from './dedup';
+export * from './encoding';
+export * from './validation';
+export * from './codec';
+export * from './zod';
+//# sourceMappingURL=index.js.map

package/dist/auth/expression/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/expression/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,cAAc,SAAS,CAAA;AACvB,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA;AACvB,cAAc,OAAO,CAAA"}

package/dist/auth/expression/prune.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Expression Pruning — Scope Evaluation + Algebraic Simplification
+ *
+ * Transforms IdentityExpr → PrunedIdentityExpr | null by:
+ * 1. Evaluating scope nodes: check principal + perm restrictions
+ * 2. Propagating node restrictions to identity leaves via intersection
+ * 3. Simplifying dead branches (algebraic rules)
+ *
+ * Pure function — no I/O. Runs before the adapter (Cypher generation).
+ *
+ * Algebraic simplification rules:
+ * - A ∪ ∅ = A (filter null operands from union)
+ * - A ∩ ∅ = ∅ (any null operand → whole intersect is null)
+ * - ∅ \ A = ∅ (null base → null)
+ * - A \ ∅ = A (null excluded → drop from excluded list)
+ * - union/intersect with single remaining operand → unwrap
+ * - exclude with empty excluded list → just base
+ */
+import type { Permission } from '#auth/permissions';
+import type { IdentityId, NodeId } from '#ids';
+import type { IdentityExpr, PrunedIdentityExpr } from './types';
+/**
+ * Prune an expression tree by evaluating scope nodes and propagating
+ * node restrictions to identity leaves.
+ *
+ * @param expr - The expression to prune
+ * @param principal - The requesting principal (checked against scope.principals)
+ * @param perm - The requested permission (checked against scope.perms)
+ * @returns Pruned expression with nodeRestriction on leaves, or null if entirely filtered
+ */
+export declare function pruneExpression(expr: IdentityExpr, principal: IdentityId | undefined, perm: Permission): PrunedIdentityExpr | null;
+/**
+ * Intersect two node restrictions.
+ *
+ * undefined = unrestricted (all nodes allowed).
+ * NodeId[] = only these nodes allowed.
+ *
+ * @returns Intersection of restrictions (undefined if both unrestricted)
+ */
+export declare function intersectNodeRestrictions(a: NodeId[] | undefined, b: NodeId[] | undefined): NodeId[] | undefined;
+//# sourceMappingURL=prune.d.ts.map

package/dist/auth/expression/prune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.d.ts","sourceRoot":"","sources":["../../../auth/expression/prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAQ/D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,UAAU,GAAG,SAAS,EACjC,IAAI,EAAE,UAAU,GACf,kBAAkB,GAAG,IAAI,CAE3B;AAyID;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,EACvB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,GACtB,MAAM,EAAE,GAAG,SAAS,CAMtB"}

package/dist/auth/expression/prune.js

@@ -0,0 +1,144 @@
+/**
+ * Expression Pruning — Scope Evaluation + Algebraic Simplification
+ *
+ * Transforms IdentityExpr → PrunedIdentityExpr | null by:
+ * 1. Evaluating scope nodes: check principal + perm restrictions
+ * 2. Propagating node restrictions to identity leaves via intersection
+ * 3. Simplifying dead branches (algebraic rules)
+ *
+ * Pure function — no I/O. Runs before the adapter (Cypher generation).
+ *
+ * Algebraic simplification rules:
+ * - A ∪ ∅ = A (filter null operands from union)
+ * - A ∩ ∅ = ∅ (any null operand → whole intersect is null)
+ * - ∅ \ A = ∅ (null base → null)
+ * - A \ ∅ = A (null excluded → drop from excluded list)
+ * - union/intersect with single remaining operand → unwrap
+ * - exclude with empty excluded list → just base
+ */
+import { scopePasses } from './scope';
+// =============================================================================
+// PUBLIC API
+// =============================================================================
+/**
+ * Prune an expression tree by evaluating scope nodes and propagating
+ * node restrictions to identity leaves.
+ *
+ * @param expr - The expression to prune
+ * @param principal - The requesting principal (checked against scope.principals)
+ * @param perm - The requested permission (checked against scope.perms)
+ * @returns Pruned expression with nodeRestriction on leaves, or null if entirely filtered
+ */
+export function pruneExpression(expr, principal, perm) {
+    return pruneInternal(expr, principal, perm, undefined);
+}
+// =============================================================================
+// INTERNAL
+// =============================================================================
+function pruneInternal(expr, principal, perm, parentNodeRestriction) {
+    switch (expr.kind) {
+        case 'identity':
+            return parentNodeRestriction
+                ? { kind: 'identity', id: expr.id, nodeRestriction: parentNodeRestriction }
+                : { kind: 'identity', id: expr.id };
+        case 'scope':
+            return pruneScope(expr, principal, perm, parentNodeRestriction);
+        case 'union':
+            return pruneUnion(expr.operands, principal, perm, parentNodeRestriction);
+        case 'intersect':
+            return pruneIntersect(expr.operands, principal, perm, parentNodeRestriction);
+        case 'exclude':
+            return pruneExclude(expr.base, expr.excluded, principal, perm, parentNodeRestriction);
+    }
+}
+/**
+ * Evaluate a scope node:
+ * - Check each scope against principal + perm (OR semantics: any scope passing = allowed)
+ * - If all scopes fail → return null (dead branch)
+ * - If some pass → collect their node restrictions, intersect with parent, propagate
+ */
+function pruneScope(expr, principal, perm, parentNodeRestriction) {
+    const { scopes, expr: inner } = expr;
+    // Find scopes that pass principal + perm checks
+    const applicableScopes = scopes.filter((scope) => scopePasses(scope, principal, perm).passes);
+    if (applicableScopes.length === 0) {
+        return null; // All scopes rejected → dead branch
+    }
+    // Collect node restrictions from applicable scopes (OR'd together = union of nodes)
+    const hasUnrestrictedScope = applicableScopes.some((s) => s.nodes === undefined);
+    let scopeNodeRestriction;
+    if (!hasUnrestrictedScope) {
+        // All applicable scopes have node restrictions → union them (any scope's nodes are valid)
+        scopeNodeRestriction = [...new Set(applicableScopes.flatMap((s) => s.nodes ?? []))];
+    }
+    // else: at least one scope has no node restriction → unrestricted
+    // Intersect with parent node restriction
+    const mergedRestriction = intersectNodeRestrictions(parentNodeRestriction, scopeNodeRestriction);
+    // Empty intersection = impossible (no valid nodes) → dead branch
+    if (mergedRestriction !== undefined && mergedRestriction.length === 0) {
+        return null;
+    }
+    return pruneInternal(inner, principal, perm, mergedRestriction);
+}
+function pruneUnion(operands, principal, perm, parentNodeRestriction) {
+    const pruned = [];
+    for (const op of operands) {
+        const result = pruneInternal(op, principal, perm, parentNodeRestriction);
+        if (result !== null) {
+            pruned.push(result);
+        }
+    }
+    if (pruned.length === 0)
+        return null;
+    if (pruned.length === 1)
+        return pruned[0];
+    return { kind: 'union', operands: pruned };
+}
+function pruneIntersect(operands, principal, perm, parentNodeRestriction) {
+    const pruned = [];
+    for (const op of operands) {
+        const result = pruneInternal(op, principal, perm, parentNodeRestriction);
+        if (result === null)
+            return null; // A ∩ ∅ = ∅
+        pruned.push(result);
+    }
+    if (pruned.length === 1)
+        return pruned[0];
+    return { kind: 'intersect', operands: pruned };
+}
+function pruneExclude(base, excluded, principal, perm, parentNodeRestriction) {
+    const prunedBase = pruneInternal(base, principal, perm, parentNodeRestriction);
+    if (prunedBase === null)
+        return null; // ∅ \ A = ∅
+    const prunedExcluded = [];
+    for (const ex of excluded) {
+        const result = pruneInternal(ex, principal, perm, parentNodeRestriction);
+        if (result !== null) {
+            prunedExcluded.push(result);
+        }
+        // null excluded items are dropped: A \ ∅ = A
+    }
+    if (prunedExcluded.length === 0)
+        return prunedBase; // Nothing to exclude
+    return { kind: 'exclude', base: prunedBase, excluded: prunedExcluded };
+}
+// =============================================================================
+// HELPERS
+// =============================================================================
+/**
+ * Intersect two node restrictions.
+ *
+ * undefined = unrestricted (all nodes allowed).
+ * NodeId[] = only these nodes allowed.
+ *
+ * @returns Intersection of restrictions (undefined if both unrestricted)
+ */
+export function intersectNodeRestrictions(a, b) {
+    if (a === undefined)
+        return b;
+    if (b === undefined)
+        return a;
+    const setA = new Set(a);
+    return b.filter((id) => setA.has(id));
+}
+//# sourceMappingURL=prune.js.map

package/dist/auth/expression/prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune.js","sourceRoot":"","sources":["../../../auth/expression/prune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErC,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAkB,EAClB,SAAiC,EACjC,IAAgB;IAEhB,OAAO,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,SAAS,aAAa,CACpB,IAAkB,EAClB,SAAiC,EACjC,IAAgB,EAChB,qBAA2C;IAE3C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,qBAAqB;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,qBAAqB,EAAE;gBAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAA;QAEvC,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAEjE,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAE1E,KAAK,WAAW;YACd,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QAE9E,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;IACzF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,IAA8C,EAC9C,SAAiC,EACjC,IAAgB,EAChB,qBAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAEpC,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;IAE7F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAClD,CAAC;IAED,oFAAoF;IACpF,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAEhF,IAAI,oBAA0C,CAAA;IAC9C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,0FAA0F;QAC1F,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACrF,CAAC;IACD,kEAAkE;IAElE,yCAAyC;IACzC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAA;IAEhG,iEAAiE;IACjE,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,UAAU,CACjB,QAAwB,EACxB,SAAiC,EACjC,IAAgB,EAChB,qBAA2C;IAE3C,MAAM,MAAM,GAAyB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QACxE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAA;IAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,cAAc,CACrB,QAAwB,EACxB,SAAiC,EACjC,IAAgB,EAChB,qBAA2C;IAE3C,MAAM,MAAM,GAAyB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QACxE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA,CAAC,YAAY;QAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAA;IAC1C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,YAAY,CACnB,IAAkB,EAClB,QAAwB,EACxB,SAAiC,EACjC,IAAgB,EAChB,qBAA2C;IAE3C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;IAC9E,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA,CAAC,YAAY;IAEjD,MAAM,cAAc,GAAyB,EAAE,CAAA;IAC/C,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAA;QACxE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;QACD,6CAA6C;IAC/C,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA,CAAC,qBAAqB;IACxE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;AACxE,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,CAAuB,EACvB,CAAuB;IAEvB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC"}