@aventara/access 0.1.0-rc.0 → 1.0.0-rc.1

package/dist/policies.compiler.js

@@ -7,7 +7,8 @@
 // Nothing here runs per request.
 import { POLICIES_FORMAT, RETIRED_POLICIES_FORMAT, } from "./policies-contract.js";
 import { decimalParts, instantOf } from "./predicate.evaluator.js";
-import { isPlainObject, ownOf } from "./scope.resolver.js";
+import { warnReadGovernedUnique } from "./read-governed-unique.check.js";
+import { governedFor, isPlainObject, ownOf } from "./scope.resolver.js";
 /** The marker a `me` value carries; the compiler writes it as `{ principal: [...] }`. */
 export const PRINCIPAL_REF = Symbol.for("aventara.access.principal-ref");
 export const ACTIONS = [
@@ -33,6 +34,7 @@ const FILE_KEYS = new Set([
     "schema",
     "roles",
     "govern",
+    "governModes",
     "grants",
     "denies",
 ]);
@@ -546,9 +548,28 @@ export const compilePolicies = (definition) => {
     const allocate = idAllocator();
     const grants = definition.grants.map((rule) => compileGrant(definition, rule, allocate));
     const denies = definition.denies.map((rule) => compileDeny(definition, rule, allocate, claimTypes));
-    for (const [resource, fields] of Object.entries(definition.govern)) {
-        for (const field of fields) {
-            fieldOf({ schema: definition.schema, rule: `govern("${resource}")` }, resource, field);
+    // Each governed field once, with one mode: "both" in `govern` alone, "read" or
+    // "write" in `governModes` too.
+    const govern = {};
+    const governModes = {};
+    for (const [resource, entries] of Object.entries(definition.govern)) {
+        const at = `govern("${resource}")`;
+        const modes = new Map();
+        for (const { field, mode } of entries) {
+            fieldOf({ schema: definition.schema, rule: at }, resource, field);
+            if (mode !== "read" && mode !== "write" && mode !== "both") {
+                fail(at, `"${field}" is ${JSON.stringify(mode)}; a mode is "read", "write" or "both"`);
+            }
+            const prior = modes.get(field);
+            if (prior !== undefined && prior !== mode) {
+                fail(at, `"${field}" is governed twice, as "${prior}" and as "${mode}"; govern each field once, with one mode`);
+            }
+            modes.set(field, mode);
+        }
+        govern[resource] = [...modes.keys()];
+        const moded = [...modes].filter(([, mode]) => mode !== "both");
+        if (moded.length > 0) {
+            governModes[resource] = Object.fromEntries(moded);
         }
     }
     const policies = {
@@ -559,14 +580,13 @@ export const compilePolicies = (definition) => {
         claims: Object.fromEntries(Object.entries(claimTypes).sort(([a], [b]) => a.localeCompare(b))),
         schema: schemaFacts(definition.schema),
         roles,
-        govern: Object.fromEntries(Object.entries(definition.govern).map(([resource, fields]) => [
-            resource,
-            [...new Set(fields)],
-        ])),
+        govern: govern,
+        ...(Object.keys(governModes).length > 0 ? { governModes } : {}),
         grants,
         denies,
     };
     checkPolicies(policies);
+    warnReadGovernedUnique(policies);
     return policies;
 };
 // ---------------------------------------------------------------------------
@@ -1088,6 +1108,15 @@ const checkShape = (policies) => {
             fail("policies", `"${block}" is an object`);
         }
     }
+    if (policies.governModes !== undefined && !isRecord(policies.governModes)) {
+        fail("policies", '"governModes" is an object');
+    }
+    // One set of rules, one file: a file whose fields are all governed for both
+    // leaves the member out.
+    if (policies.governModes !== undefined &&
+        Object.keys(policies.governModes).length === 0) {
+        fail("policies", '"governModes" names at least one Resource; a file whose governed fields are all governed for both has no "governModes"');
+    }
     for (const block of ["grants", "denies"]) {
         if (!Array.isArray(policies[block])) {
             fail("policies", `"${block}" is a list`);
@@ -1265,18 +1294,61 @@ const checkTypes = (resource, facts) => {
  * A governed relation seals its reference fields, and a governed reference field its
  * relation: reading either one tells the other. So `govern` names both or neither.
  */
-const checkGovernPairs = (policies, resource, fields) => {
+const checkGovernPairs = (policies, resource) => {
     const relations = ownOf(policies.schema, resource)?.relations ?? {};
+    const read = governedFor(policies, resource, "read");
+    const write = governedFor(policies, resource, "write");
     for (const [relation, fact] of Object.entries(relations)) {
         const references = fact.referenceFields ?? [];
         if (references.length === 0) {
             continue;
         }
         const pair = [relation, ...references];
-        const named = pair.filter((field) => fields.includes(field));
-        if (named.length > 0 && named.length < pair.length) {
-            const missing = pair.filter((field) => !fields.includes(field));
-            fail(`govern("${resource}")`, `governs ${named.map((field) => `"${field}"`).join(", ")} and not ${missing.map((field) => `"${field}"`).join(", ")}: the relation "${relation}" and its reference fields (${references.join(", ")}) each tell the other, so govern them together`);
+        // Checked for each access: reading either one tells the other, and writing
+        // either one sets the other.
+        const gapIn = (fields) => {
+            const named = pair.filter((field) => fields.includes(field));
+            return named.length > 0 && named.length < pair.length ? named : undefined;
+        };
+        const readGap = gapIn(read);
+        const writeGap = gapIn(write);
+        const named = readGap ?? writeGap;
+        if (named === undefined) {
+            continue;
+        }
+        const fields = readGap !== undefined ? read : write;
+        const missing = pair.filter((field) => !fields.includes(field));
+        const access = readGap !== undefined &&
+            writeGap !== undefined &&
+            readGap.join() === writeGap.join()
+            ? ""
+            : readGap !== undefined
+                ? " for reading"
+                : " for writing";
+        fail(`govern("${resource}")`, `governs ${named.map((field) => `"${field}"`).join(", ")} and not ${missing.map((field) => `"${field}"`).join(", ")}${access}: the relation "${relation}" and its reference fields (${references.join(", ")}) each tell the other, so govern them together`);
+    }
+};
+/**
+ * `governModes`: each entry a Resource's fields `govern` lists, each `"read"` or
+ * `"write"`; a field governed for both has no entry, so one set of rules has one file.
+ */
+const checkGovernModes = (policies) => {
+    for (const [resource, modes] of Object.entries(policies.governModes ?? {})) {
+        const at = `governModes("${resource}")`;
+        if (!isRecord(modes)) {
+            fail(at, 'an entry is an object of fields to "read" or "write"');
+        }
+        if (Object.keys(modes).length === 0) {
+            fail(at, "an entry names at least one field");
+        }
+        const governed = ownOf(policies.govern, resource) ?? [];
+        for (const [field, mode] of Object.entries(modes)) {
+            if (!governed.includes(field)) {
+                fail(at, `"${field}" is not governed; govern("${resource}") lists every governed field`);
+            }
+            if (mode !== "read" && mode !== "write") {
+                fail(at, `"${field}" is ${JSON.stringify(mode)}; a mode there is "read" or "write" (a field governed for both has no entry)`);
+            }
         }
     }
 };
@@ -1330,7 +1402,10 @@ export const checkPolicies = (policies, composed = false) => {
                 fail(at, `${resource} has no field "${field}"`);
             }
         }
-        checkGovernPairs(policies, resource, fields);
+    }
+    checkGovernModes(policies);
+    for (const resource of Object.keys(policies.govern)) {
+        checkGovernPairs(policies, resource);
     }
     policies.grants.forEach((grant, index) => {
         checkRuleShape(grant, index, "grant");

package/dist/policies.decider.js

@@ -8,7 +8,7 @@
 import { translateAnswer, translateWhere, } from "./aventara-where.translator.js";
 import { canonicalJson } from "./canonical-json.writer.js";
 import { decideOnRow, evaluateOnRow, } from "./predicate.evaluator.js";
-import { FALSE, foldDenies, foldGrants, nullSafe, orOf, ownOf, principalFactsOf, rulesFor, scopeCondition, TRUE, } from "./scope.resolver.js";
+import { FALSE, foldDenies, foldGrants, governedFor, nullSafe, orOf, ownOf, principalFactsOf, rulesFor, scopeCondition, TRUE, } from "./scope.resolver.js";
 import { sha256Hex } from "./sha256.digest.js";
 /** A trace with nothing in it yet. */
 export const newTrace = () => ({
@@ -102,6 +102,8 @@ export const grantsQuestionProblem = (question) => {
         ? undefined
         : `grantsOf takes \`action: "update"\`; it was asked ${JSON.stringify({ action })}`;
 };
+/** Whether two field lists name the same fields. */
+const sameFields = (a, b) => a.length === b.length && a.every((field) => b.includes(field));
 /** The decisions of one policies file, already checked. */
 export const createDecider = (file) => {
     const locks = lockedFieldsOf(file);
@@ -266,7 +268,13 @@ export const createDecider = (file) => {
             throw new Error(`Aventara Access: ${problem}`);
         }
         const facts = principalFactsOf(question.principal, question.origin);
-        const governed = ownOf(file.govern, question.resource) ?? [];
+        // The fields governed for this access: only a grant that names one opens it.
+        const governed = governedFor(file, question.resource, question.access);
+        // `"all"` stands for every field the read side does not govern (the framework's
+        // default projection, whatever the access): a write answers it only when the
+        // write side governs the same fields.
+        const allStandsFor = question.access === "read" ||
+            sameFields(governed, governedFor(file, question.resource, "read"));
         const actions = question.access === "read"
             ? ["read"]
             : question.action !== undefined
@@ -295,7 +303,7 @@ export const createDecider = (file) => {
             }
         }
         const excluded = new Set(live.flatMap((grant) => question.access === "write" ? [...(locks.get(grant.grant) ?? [])] : []));
-        if (excluded.size === 0) {
+        if (excluded.size === 0 && allStandsFor) {
             return { always: "all", perRow };
         }
         const always = [];

package/dist/policies.hash.js

@@ -7,7 +7,8 @@
 // (members sorted by key, no whitespace) and encoded as UTF-8, with:
 // - the lists whose order the format gives no meaning sorted: `grants` and `denies`
 //   by `id`; a rule's `subjects`, `actions`, `fields` and `write.except`; each
-//   `govern` list; each schema entry's `fields` and `nullable`.
+//   `govern` list; each schema entry's `fields` and `nullable`. `governModes` is objects
+//   only, so its members are sorted like any other.
 // Every other list keeps its order: identifiers (the first is the primary one),
 // relation reference pairs, principal and claim paths, a condition's arguments and
 // an `in` list's values.

package/dist/read-governed-unique.check.d.ts

@@ -0,0 +1,3 @@
+import type { AccessPolicies } from "./policies-contract.js";
+/** Warns once per field governed `"read"` that is part of one of its Resource's identifiers. */
+export declare const warnReadGovernedUnique: (policies: AccessPolicies) => void;

package/dist/read-governed-unique.check.js

@@ -0,0 +1,21 @@
+// The warning ACCESS_READ_GOVERNED_UNIQUE: a field governed for reading only
+// (`"read"`) that is one of its Resource's identifiers. Anyone who may write the row
+// writes the field, and a value another row holds fails on the duplicate: the
+// refusal tells the writer that value exists, which reading it would not. The
+// warning changes nothing the engine decides.
+import { emitAccessWarning } from "./access-warning.emitter.js";
+import { ownOf } from "./scope.resolver.js";
+const WARNING_CODE = "ACCESS_READ_GOVERNED_UNIQUE";
+/** Warns once per field governed `"read"` that is part of one of its Resource's identifiers. */
+export const warnReadGovernedUnique = (policies) => {
+    for (const [resource, modes] of Object.entries(policies.governModes ?? {})) {
+        const identifiers = ownOf(policies.schema, resource)?.identifiers ?? [];
+        for (const [field, mode] of Object.entries(modes)) {
+            if (mode !== "read" ||
+                !identifiers.some((identifier) => identifier.includes(field))) {
+                continue;
+            }
+            emitAccessWarning(WARNING_CODE, policies.namespace, `${resource}.${field} is governed for reading only ("read") and is unique (one of ${resource}'s identifiers): a create or update that sends a value another row holds fails on the duplicate, which tells the writer that value exists. Govern it as "both", so only a grant that names it writes it, or accept that writers learn which values exist.`);
+        }
+    }
+};

package/dist/reference-reads.check.d.ts

@@ -1,12 +1,16 @@
 import type { AccessPolicies } from "./policies-contract.js";
 /**
- * The warnings for `policies` hosted by a framework that holds references to the
- * Resources in `held`, one per writing role and target Resource, each naming every
- * reference that role may write to it.
+ * Better Auth's tables `createAccess` keeps closed and a `resources` key would open,
+ * by Resource: no grant on one is taken until that key opens it, so a warning about
+ * one names the key.
  */
-export declare const referenceReadWarnings: (policies: AccessPolicies, held: ReadonlySet<string>) => readonly string[];
+export type ClosedTables = ReadonlyMap<string, {
+    readonly model: string;
+    readonly key: string;
+}>;
 /**
  * Emits `policies`' warnings under a framework that holds references to the
- * Resources in `held`, each once per process and namespace.
+ * Resources in `held`, each once per process and namespace; a target in `closed`
+ * is named with the `resources` key that opens it.
  */
-export declare const warnReferenceReads: (policies: AccessPolicies, held: ReadonlySet<string>) => void;
+export declare const warnReferenceReads: (policies: AccessPolicies, held: ReadonlySet<string>, closed?: ClosedTables) => void;

package/dist/reference-reads.check.js

@@ -31,7 +31,13 @@
 // which row may be linked, foreign-references.check.ts), and a writing Resource it
 // does not serve (`held` is its Core Contract's Resources, and no write reaches one
 // outside it).
-import { emitAccessWarning } from "./access-warning.emitter.js";
+//
+// Under `createAccess` (or its plugin) a target may be one of Better Auth's tables
+// that stays closed until a `resources` key opens it (`User` until
+// `resources: { users: true }`): no grant on it is taken before that, and the
+// built-in deny refuses a `*` read grant there too, so no read grant reaches it
+// and the warning names the key.
+import { emitAccessWarning, listed } from "./access-warning.emitter.js";
 import { ownOf } from "./scope.resolver.js";
 const WARNING_CODE = "ACCESS_REFERENCE_UNREADABLE";
 /** The Resource a row role is held on, or `undefined` for `signedIn`, `anyone` and a global role. */
@@ -56,15 +62,12 @@ const reaches = (policies, read, writer, target) => read.subjects.some((subject)
     const on = heldOn(policies, writer);
     return on !== undefined && heldOn(policies, subject) === on;
 });
-const listed = (names) => names.length < 2
-    ? names.join("")
-    : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
 /**
  * The warnings for `policies` hosted by a framework that holds references to the
  * Resources in `held`, one per writing role and target Resource, each naming every
  * reference that role may write to it.
  */
-export const referenceReadWarnings = (policies, held) => {
+const referenceReadWarnings = (policies, held, closed) => {
     const reads = policies.grants.filter((grant) => grant.actions.includes("read"));
     const found = new Map();
     for (const grant of policies.grants) {
@@ -97,8 +100,10 @@ export const referenceReadWarnings = (policies, held) => {
                 }
                 // A target the schema does not have takes no grant: `*` does not
                 // reach it (`rulesFor`), and a grant cannot name it.
+                // A Better Auth table createAccess keeps closed takes no read either: the
+                // built-in deny refuses every action on it, `*` grants included.
                 const own = target !== undefined;
-                const readsOfTarget = own
+                const readsOfTarget = own && closed?.has(fact.target) !== true
                     ? reads.filter((read) => read.resource === fact.target || read.resource === "*")
                     : [];
                 for (const writer of grant.subjects) {
@@ -134,15 +139,20 @@ export const referenceReadWarnings = (policies, held) => {
         const to = writer === "signedIn" || writer === "anyone"
             ? writer
             : `${writer} (or to signedIn)`;
-        return `${what}, but no read grant on "${target}" reaches ${writer}. ${hold} Grant read on "${target}" to ${to}, or leave ${out}`;
+        const table = closed?.get(target);
+        const opening = table === undefined
+            ? ""
+            : ` (Better Auth's \`${table.model}\` table, closed until \`resources: { ${table.key}: true }\` in createAccess opens it)`;
+        return `${what}, but no read grant on "${target}" reaches ${writer}. ${hold} Grant read on "${target}" to ${to}${opening}, or leave ${out}`;
     });
 };
 /**
  * Emits `policies`' warnings under a framework that holds references to the
- * Resources in `held`, each once per process and namespace.
+ * Resources in `held`, each once per process and namespace; a target in `closed`
+ * is named with the `resources` key that opens it.
  */
-export const warnReferenceReads = (policies, held) => {
-    for (const message of referenceReadWarnings(policies, held)) {
+export const warnReferenceReads = (policies, held, closed) => {
+    for (const message of referenceReadWarnings(policies, held, closed)) {
         emitAccessWarning(WARNING_CODE, policies.namespace, message);
     }
 };

package/dist/registry/ownership.check.js

@@ -48,7 +48,10 @@ export const resourcesNamed = (file) => {
             }
         }
     }
-    for (const resource of Object.keys(isRecord(file.govern) ? file.govern : {})) {
+    for (const resource of [
+        ...Object.keys(isRecord(file.govern) ? file.govern : {}),
+        ...Object.keys(isRecord(file.governModes) ? file.governModes : {}),
+    ]) {
         named.add(resource);
     }
     return [...named];
@@ -144,7 +147,10 @@ export const checkNamespaceOwnership = (namespace, file, owners, ownership = "fi
             refuse(`deny ${ruleId(deny)} in namespace "${namespace}" names ${String(resource)}, which ${owns(owner)}. A namespace's denies narrow only its own Resources; narrowing another namespace's is an org guardrail`);
         }
     }
-    for (const resource of Object.keys(isRecord(file.govern) ? file.govern : {})) {
+    for (const resource of new Set([
+        ...Object.keys(isRecord(file.govern) ? file.govern : {}),
+        ...Object.keys(isRecord(file.governModes) ? file.governModes : {}),
+    ])) {
         const owner = ownerOf(resource);
         if (owner !== undefined) {
             refuse(`namespace "${namespace}" governs fields of ${resource}, which ${owns(owner)}. Only the owner governs a Resource's fields`);

package/dist/resources/auth-tables.catalog.d.ts

@@ -13,6 +13,11 @@ type WritableFields = {
 type OpenedTable = {
     readonly key: AuthResourceKey;
     readonly writes: WritableFields;
+    /**
+     * Fields Access governs for writing (`"write"`): read as the rules grant, written
+     * only through a grant that names the field. A role the app's rules read is one.
+     */
+    readonly governed?: readonly string[];
     /** Where the table comes from, when a plugin adds it: named in the refusal when it is missing. */
     readonly plugin?: string;
 };

package/dist/resources/auth-tables.catalog.js

@@ -9,16 +9,23 @@
 // write through Aventara is a plain database write: it skips Better Auth's hooks
 // (`databaseHooks`, plugins' `after` hooks), its cookie cache and its secondary
 // storage, so the writes Access lets through are the ones those do not guard:
-// a user's role and an organization's memberships.
+// a user's role and an organization's memberships. A role is governed for writing,
+// so only a grant that names it sets it.
 /** The tables each key opens, by Better Auth model name. */
 export const OPENED_TABLES = {
     // The users: a user's role may be set; creating or deleting a user, and every
     // other field (name, email, ban), stays with Better Auth's own API.
-    user: { key: "users", writes: { update: ["role"], delete: false } },
+    // The role is governed for writing: only a grant that names `User.role` sets it.
+    user: {
+        key: "users",
+        writes: { update: ["role"], delete: false },
+        governed: ["role"],
+    },
     session: { key: "users", writes: { delete: false } },
     account: { key: "users", writes: { delete: false } },
     // The organization plugin's memberships: a membership is created or removed, and
-    // its role changed; the organization itself is read only.
+    // its role changed; the organization itself is read only. The role is governed
+    // for writing: only a grant that names it sets it, at create or update.
     member: {
         key: "members",
         plugin: "organization()",
@@ -27,6 +34,7 @@ export const OPENED_TABLES = {
             update: ["role"],
             delete: true,
         },
+        governed: ["role"],
     },
     organization: {
         key: "members",

package/dist/resources/auth-tables.guard.d.ts

@@ -1,5 +1,6 @@
 import type { AccessFields, AccessFieldsQuestion } from "../policies.decider.js";
 import type { AccessDenyRule, AccessPolicies } from "../policies-contract.js";
+import type { ClosedTables } from "../reference-reads.check.js";
 import { type AuthResourceKey, type AuthTable, type AuthTableNaming } from "./auth-tables.catalog.js";
 /**
  * The `resources` block: which of Better Auth's tables are Resources of the app's
@@ -53,6 +54,10 @@ export type AuthTablesGuard = {
     readonly sealed: ReadonlyMap<string, ReadonlySet<string>>;
     /** The fields a write may set, by opened Resource. */
     readonly writable: ReadonlyMap<string, WritableSets>;
+    /** The closed tables a `resources` key opens, by Resource: Better Auth's model name and that key. */
+    readonly closed: ClosedTables;
+    /** The fields governed for writing, by opened Resource: a grant that names one sets it. */
+    readonly governed: ReadonlyMap<string, readonly string[]>;
 };
 /** The `resources` block, checked: `users` and `members` `true` or `false`, `authTables` a map of names or `null`. */
 export declare const checkResourcesOptions: (value: unknown) => ResourcesChoice;
@@ -82,6 +87,12 @@ export declare const guardAuthTables: (input: {
     readonly naming: AuthTableNaming;
     readonly policies: AccessPolicies;
 }) => AuthTablesGuard;
+/**
+ * The rules' file with the built-in rules in it: their denies beside the file's, and
+ * each field they govern for writing governed so (a field the rules govern for
+ * reading only is then governed for both; one they govern for writing or both stays).
+ */
+export declare const withBuiltInRules: (policies: AccessPolicies, guard: AuthTablesGuard) => AccessPolicies;
 /**
  * `fieldsOf`'s answer with the built-in rules applied: a secret column is never
  * listed, and a write lists only the fields its action may set on an opened table.

package/dist/resources/auth-tables.guard.js

@@ -309,6 +309,8 @@ export const guardAuthTables = (input) => {
     const denies = [];
     const sealed = new Map();
     const writable = new Map();
+    const closed = new Map();
+    const governed = new Map();
     for (const table of tables.values()) {
         const { resource } = table;
         const facts = resource === undefined ? undefined : ownOf(policies.schema, resource);
@@ -341,6 +343,9 @@ export const guardAuthTables = (input) => {
                 actions: "*",
                 resource,
             });
+            if (opened !== undefined) {
+                closed.set(resource, { model: table.model, key: opened.key });
+            }
             const [grant] = grants;
             if (grant !== undefined) {
                 refuse(opened === undefined
@@ -370,9 +375,61 @@ export const guardAuthTables = (input) => {
             create: writableSet(table, facts, writes.create, true),
             update: writableSet(table, facts, writes.update, false),
         });
+        const writeGoverned = (opened.governed ?? []).flatMap((field) => {
+            const name = fieldOf(table, facts, field);
+            return name === undefined ? [] : [name];
+        });
+        if (writeGoverned.length > 0) {
+            governed.set(resource, writeGoverned);
+        }
     }
     closeBeaconTables(policies, tables, denies, sealed);
-    return { denies, sealed, writable };
+    return { denies, sealed, writable, closed, governed };
+};
+/**
+ * The rules' file with the built-in rules in it: their denies beside the file's, and
+ * each field they govern for writing governed so (a field the rules govern for
+ * reading only is then governed for both; one they govern for writing or both stays).
+ */
+export const withBuiltInRules = (policies, guard) => {
+    if (guard.denies.length === 0 && guard.governed.size === 0) {
+        return policies;
+    }
+    const govern = {
+        ...policies.govern,
+    };
+    const governModes = { ...policies.governModes };
+    for (const [resource, fields] of guard.governed) {
+        const listed = ownOf(policies.govern, resource) ?? [];
+        const modes = Object.hasOwn(governModes, resource)
+            ? { ...governModes[resource] }
+            : {};
+        const added = [];
+        for (const field of fields) {
+            if (!listed.includes(field)) {
+                added.push(field);
+                modes[field] = "write";
+            }
+            else if (Object.hasOwn(modes, field) && modes[field] === "read") {
+                // Governed for reading by the rules, for writing by Access: for both.
+                delete modes[field];
+            }
+        }
+        govern[resource] = [...listed, ...added];
+        if (Object.keys(modes).length > 0) {
+            governModes[resource] = modes;
+        }
+        else {
+            delete governModes[resource];
+        }
+    }
+    const { governModes: _given, ...rest } = policies;
+    return {
+        ...rest,
+        govern,
+        ...(Object.keys(governModes).length > 0 ? { governModes } : {}),
+        denies: [...policies.denies, ...guard.denies],
+    };
 };
 /**
  * `fieldsOf`'s answer with the built-in rules applied: a secret column is never

package/dist/scope.resolver.d.ts

@@ -55,6 +55,12 @@ export declare function ownOf(record: AccessPolicies["claims"] | undefined, key:
 export declare function ownOf(record: {
     readonly [key: string]: readonly string[];
 } | undefined, key: string): readonly string[] | undefined;
+/**
+ * A Resource's governed fields for one access: each field `govern` lists, except one
+ * `governModes` governs for the other access only (`"write"` is read as any other
+ * field, `"read"` written as any other). A field with no mode is governed for both.
+ */
+export declare const governedFor: (policies: Pick<AccessPolicies, "govern" | "governModes">, resource: string, access: "read" | "write") => readonly string[];
 /** A plain object: made by `{}` or JSON, not an array, a `Date`, a `Map` or a class instance. */
 export declare const isPlainObject: (value: unknown) => value is {
     readonly [key: string]: unknown;

package/dist/scope.resolver.js

@@ -44,6 +44,23 @@ export function ownOf(record, key) {
         ? record[key]
         : undefined;
 }
+/**
+ * A Resource's governed fields for one access: each field `govern` lists, except one
+ * `governModes` governs for the other access only (`"write"` is read as any other
+ * field, `"read"` written as any other). A field with no mode is governed for both.
+ */
+export const governedFor = (policies, resource, access) => {
+    const fields = ownOf(policies.govern, resource);
+    const modes = policies.governModes !== undefined &&
+        Object.hasOwn(policies.governModes, resource)
+        ? policies.governModes[resource]
+        : undefined;
+    if (fields === undefined || modes === undefined) {
+        return fields ?? [];
+    }
+    const other = access === "read" ? "write" : "read";
+    return fields.filter((field) => !(Object.hasOwn(modes, field) && modes[field] === other));
+};
 /** A plain object: made by `{}` or JSON, not an array, a `Date`, a `Map` or a class instance. */
 export const isPlainObject = (value) => {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/access",
-  "version": "0.1.0-rc.0",
+  "version": "1.0.0-rc.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A policy engine for Aventara: role-first rules typed from your schema, compiled to a passive policies file.",
   "type": "module",
@@ -57,6 +57,7 @@
     "src/policies.decider.ts",
     "src/beacon/beacon.check.ts",
     "src/generator/prisma7/prisma-where.translator.ts",
+    "skill",
     "LICENSE-ADDITIONAL-PERMISSION.md",
     "CHANGELOG.md"
   ],
@@ -89,7 +90,7 @@
     }
   },
   "devDependencies": {
-    "@aventara/core": "1.0.0-rc.9",
+    "@aventara/core": "1.0.0-rc.11",
     "@better-auth/cimd": "1.7.14",
     "@better-auth/expo": "1.7.14",
     "@better-auth/oauth-provider": "1.7.14",