@aventara/core 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/compiler/managed-elsewhere.projector.js

@@ -0,0 +1,179 @@
+import { isRecord } from "../runtime/record.guard.js";
+const WRITE_FAMILIES = [
+    "create",
+    "update",
+    "delete",
+    "upsert",
+];
+const SOURCE_ROW_DIRECTIVES = [
+    "$connect",
+    "$disconnect",
+];
+export function managedElsewhereOf(rootTree) {
+    const managed = new Set();
+    if (!isRecord(rootTree)) {
+        return managed;
+    }
+    for (const [name, entry] of Object.entries(rootTree)) {
+        if (isRecord(entry) &&
+            entry.managedElsewhere === true) {
+            managed.add(name);
+        }
+    }
+    return managed;
+}
+function keptDirectives(capability, kept) {
+    if (Array.isArray(capability)) {
+        const left = capability.filter((directive) => kept.includes(directive));
+        return left.length > 0 ? left : undefined;
+    }
+    if (isRecord(capability) &&
+        Array.isArray(capability.directives)) {
+        const left = capability.directives.filter((directive) => kept.includes(directive));
+        return left.length > 0 ? { ...capability, directives: left } : undefined;
+    }
+    return capability;
+}
+function narrowWrites(field, kept) {
+    const capabilities = field.capabilities;
+    if (!isRecord(capabilities)) {
+        return;
+    }
+    for (const stage of ["create", "update"]) {
+        if (!Object.hasOwn(capabilities, stage)) {
+            continue;
+        }
+        const narrowed = keptDirectives(capabilities[stage], kept);
+        if (narrowed === undefined) {
+            delete capabilities[stage];
+        }
+        else {
+            capabilities[stage] = narrowed;
+        }
+    }
+}
+export function withholdManagedWrites(baseline, managed) {
+    if (managed.size === 0) {
+        return;
+    }
+    for (const [name, resource] of Object.entries(baseline.resources)) {
+        const isManaged = managed.has(name);
+        if (isManaged) {
+            for (const family of WRITE_FAMILIES) {
+                delete resource.operations[family];
+            }
+        }
+        for (const field of Object.values(resource.fields)) {
+            if (isManaged) {
+                narrowWrites(field, []);
+                continue;
+            }
+            if (field.kind !== "relation" || !managed.has(String(field.target))) {
+                continue;
+            }
+            narrowWrites(field, Array.isArray(field.referenceFields) && field.referenceFields.length > 0
+                ? SOURCE_ROW_DIRECTIVES
+                : []);
+        }
+    }
+}
+export function hideManagedElsewhere(view, managed) {
+    for (const name of managed) {
+        delete view.resources[name];
+    }
+    if (managed.size === 0) {
+        return;
+    }
+    for (const resource of Object.values(view.resources)) {
+        for (const [fieldName, field] of Object.entries(resource.fields)) {
+            if (field.kind === "relation" && managed.has(String(field.target))) {
+                delete resource.fields[fieldName];
+            }
+        }
+    }
+}
+function enumOf(field) {
+    const type = field.kind === "scalar" ? field.type : undefined;
+    return typeof type === "object" &&
+        type !== null &&
+        typeof type.enum === "string"
+        ? type.enum
+        : undefined;
+}
+function enumsUsed(resources) {
+    const used = new Set();
+    for (const resource of resources) {
+        for (const field of Object.values(resource.fields)) {
+            const name = enumOf(field);
+            if (name !== undefined) {
+                used.add(name);
+            }
+        }
+    }
+    return used;
+}
+export function pruneManagedEnums(view, unhidden, managed) {
+    const managedUse = enumsUsed([...managed].flatMap((name) => Object.hasOwn(unhidden.resources, name)
+        ? [unhidden.resources[name]]
+        : []));
+    if (managedUse.size === 0) {
+        return;
+    }
+    const served = enumsUsed(Object.values(view.resources));
+    for (const name of managedUse) {
+        if (!served.has(name)) {
+            delete view.enums[name];
+        }
+    }
+}
+export function markCoreResources(projection, model, managed) {
+    for (const [name, resource] of Object.entries(projection.resources)) {
+        const schema = Object.hasOwn(model.resources, name)
+            ? model.resources[name]?.schema
+            : undefined;
+        if (typeof schema === "string") {
+            resource.schema = schema;
+        }
+        if (managed.has(name)) {
+            resource.managedElsewhere = true;
+        }
+    }
+}
+export function managedWriteReason(managed, resource, family) {
+    return managed.has(resource) && WRITE_FAMILIES.includes(family)
+        ? `operation family "${family}" is not available for resource "${resource}": it is managed elsewhere (resources.${resource}.managedElsewhere), read and joined, never written`
+        : undefined;
+}
+export function explainManagedRefusals(diagnostics, from, layer, universe, managed) {
+    if (managed.size === 0) {
+        return;
+    }
+    const prefix = `${layer}.exemptions.resources.`;
+    for (let index = from; index < diagnostics.length; index += 1) {
+        const diagnostic = diagnostics[index];
+        if (diagnostic?.code !== "COMPILER_HIDDEN_REQUIRED_FIELD" ||
+            !diagnostic.path.startsWith(prefix)) {
+            continue;
+        }
+        const [resource, fieldsKey, field] = diagnostic.path
+            .slice(prefix.length)
+            .split(".");
+        const relation = resource !== undefined &&
+            fieldsKey === "fields" &&
+            field !== undefined &&
+            Object.hasOwn(universe.resources, resource)
+            ? universe.resources[resource]?.fields[field]
+            : undefined;
+        const target = String(relation?.target);
+        if (relation?.kind !== "relation" || !managed.has(target)) {
+            continue;
+        }
+        const references = Array.isArray(relation.referenceFields)
+            ? relation.referenceFields.map((name) => `"${String(name)}"`)
+            : [];
+        diagnostics[index] = {
+            ...diagnostic,
+            message: `${diagnostic.message}; "${field}" points at resource "${target}", which is managed elsewhere (resources.${target}.managedElsewhere): the ${layer} layer never writes it${references.length === 0 ? "" : `, so expose ${references.join(" and ")}`}`,
+        };
+    }
+}

package/dist/compiler/managed-elsewhere.validator.d.ts

@@ -0,0 +1,9 @@
+import type { AvConfigDiagnostic } from "../config/config-diagnostic.js";
+import type { ReferentialActionTable } from "../runtime/referential-action.js";
+import type { AvContracts } from "./contract.compiler.js";
+/**
+ * One `CONFIG_INVALID_VALUE` per deletable Resource whose delete — directly, or
+ * through the cascades it sets off — does `cascade`, `setNull` or `setDefault`
+ * to the rows of a Resource managed elsewhere.
+ */
+export declare function validateManagedDeletes(contracts: AvContracts, referentialActions: ReferentialActionTable | undefined): readonly AvConfigDiagnostic[];

package/dist/compiler/managed-elsewhere.validator.js

@@ -0,0 +1,74 @@
+import { advertisedDirectives } from "../contracts/field.js";
+function deletable(contracts) {
+    const names = new Set();
+    for (const contract of contracts) {
+        for (const [name, resource] of Object.entries(contract.resources)) {
+            if (Object.hasOwn(resource.operations, "delete")) {
+                names.add(name);
+            }
+            for (const field of Object.values(resource.fields)) {
+                if (field.kind !== "relation") {
+                    continue;
+                }
+                const { create, update } = field.capabilities;
+                if (advertisedDirectives(create)?.includes("$delete") === true ||
+                    advertisedDirectives(update)?.includes("$delete") === true) {
+                    names.add(field.target);
+                }
+            }
+        }
+    }
+    return names;
+}
+function hopLabel(resource, edge) {
+    return `${resource}.${edge.field} → ${edge.target}`;
+}
+export function validateManagedDeletes(contracts, referentialActions) {
+    const core = contracts.core;
+    const managed = new Set(Object.entries(core.resources)
+        .filter(([, resource]) => resource.managedElsewhere === true)
+        .map(([name]) => name));
+    if (managed.size === 0 || referentialActions === undefined) {
+        return [];
+    }
+    const firedBy = new Map();
+    for (const [resource, edges] of Object.entries(referentialActions)) {
+        for (const edge of edges) {
+            firedBy.set(edge.target, [
+                ...(firedBy.get(edge.target) ?? []),
+                { edge, from: resource },
+            ]);
+        }
+    }
+    const diagnostics = [];
+    const deleters = [
+        ...deletable([contracts.application, contracts.client, contracts.agent]),
+    ]
+        .filter((name) => !managed.has(name))
+        .sort();
+    for (const deleted of deleters) {
+        const reachedBy = new Map([[deleted, []]]);
+        const queue = [deleted];
+        for (let next = queue.shift(); next !== undefined; next = queue.shift()) {
+            const chain = reachedBy.get(next) ?? [];
+            for (const { edge, from } of firedBy.get(next) ?? []) {
+                const hop = [hopLabel(from, edge), ...chain];
+                if (managed.has(from)) {
+                    if (edge.onDelete !== "restrict" && edge.onDelete !== "noAction") {
+                        diagnostics.push({
+                            code: "CONFIG_INVALID_VALUE",
+                            path: `resources.${from}.managedElsewhere`,
+                            message: `resources.${from}.managedElsewhere: deleting a "${deleted}" row does ${edge.onDelete} to "${from}" rows (${hop.join(", ")}), and another service owns "${from}"; take every delete of "${deleted}" away at the root (exemptions.resources.${deleted}.operations: ["delete"], and every $delete into it), or make the reference refuse the delete (onDelete: Restrict or NoAction)`,
+                        });
+                    }
+                    continue;
+                }
+                if (edge.onDelete === "cascade" && !reachedBy.has(from)) {
+                    reachedBy.set(from, hop);
+                    queue.push(from);
+                }
+            }
+        }
+    }
+    return diagnostics;
+}

package/dist/config/cache-stage.factory.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A read's cache stage, for `pipelines.cache` at the root or client layer, a
+ * Resource, the `find` family or one of its variants:
+ * `pipelines: { cache: cache({ for: "user", maxAge: 60 }) }`. The read is then
+ * also served as a GET a browser or a CDN may keep for `maxAge` seconds.
+ *
+ * Always write `for`, even for the default `"user"`: the audience is the
+ * promise this read makes, and it should be visible in the code.
+ */
+export declare function cache(stage: {
+    /**
+     * Who may share one answer: `"user"` (the default; each caller's own
+     * browser keeps its own), `"anonymous"` (anonymous callers share one answer a
+     * CDN may keep; a signed-in caller's stays private) or `"everyone"` (one
+     * answer for every caller, which a CDN may hand to anyone). Always write it,
+     * even for `"user"`: the audience is the promise this read makes.
+     */
+    readonly for?: "user" | "anonymous" | "everyone";
+    /** How long an answer may be kept, in whole seconds (`max-age`). */
+    readonly maxAge: number;
+}): {
+    readonly for: "user" | "anonymous" | "everyone";
+    readonly maxAge: number;
+};

package/dist/config/cache-stage.factory.js

@@ -0,0 +1,3 @@
+export function cache(stage) {
+    return Object.freeze({ for: stage.for ?? "user", maxAge: stage.maxAge });
+}

package/dist/config/computed-fields.d.ts

@@ -0,0 +1,62 @@
+import type { AvConfigAgentParent, AvConfigLayerName } from "./config-layer.js";
+/** The fields one layer's write compute fills, per Resource and phase. */
+type LayerComputedFields = Readonly<Record<string, {
+    /** Fields with a `compute.create` stage, sorted. */
+    readonly create?: readonly string[];
+    /** Fields with a `compute.update` stage, sorted. */
+    readonly update?: readonly string[];
+}>>;
+/**
+ * Which fields a configuration's write compute fills: per layer, the
+ * Resources, and per Resource the fields with a `compute.create` and a
+ * `compute.update` stage, each list sorted; and the layer the agent layer
+ * extends. Written by an adapter's generate step from the configuration's type,
+ * and compared with the configuration at startup.
+ */
+export type AvConfigComputedFields = {
+    readonly agent: LayerComputedFields;
+    /** The agent layer's `extends`: `"client"` when the configuration leaves it out. */
+    readonly agentExtends: Exclude<AvConfigLayerName, "agent">;
+    readonly application: LayerComputedFields;
+    readonly client: LayerComputedFields;
+    readonly root: LayerComputedFields;
+};
+/** The layers whose compute may have filled a field when a stage of layer `L` runs. */
+type ComputingLayers<Facts extends AvConfigComputedFields, L extends AvConfigLayerName> = L extends "root" ? AvConfigLayerName : L extends "agent" ? "root" | "agent" | Exclude<Facts["agentExtends"], "root"> : "root" | L | (Facts["agentExtends"] extends L ? "agent" : never);
+/** `"<Resource>.<field>"` for every field a layer's `compute.create` fills. */
+type CreateComputedOf<Layer> = Layer extends object ? {
+    [R in keyof Layer]: Layer[R] extends {
+        readonly create?: readonly (infer Field extends string)[];
+    } ? `${R & string}.${Field}` : never;
+}[keyof Layer] : never;
+/**
+ * The create fields a variant's guards, pipes and filters of layer `L` may be
+ * told without, as `"<Resource>.<field>"`: those a layer whose compute runs for
+ * the stage's origins fills on create. `string` (every field) when the model's
+ * type carries no statement of them.
+ */
+export type AvPreComputeLift<M, L extends AvConfigLayerName> = M extends {
+    readonly "~computedFields"?: infer Facts;
+} ? Exclude<Facts, undefined> extends infer Stated extends AvConfigComputedFields ? string extends keyof Stated["root"] ? string : CreateComputedOf<Stated[ComputingLayers<Stated, L>]> : string : string;
+/** The configuration's layers' `resources` trees and the agent's parent. */
+type ComputedFieldsSource = {
+    readonly trees: Readonly<Record<AvConfigLayerName, unknown>>;
+    readonly agentExtends: AvConfigAgentParent;
+};
+/** The computed fields of a configuration, in the form a generate step writes them. */
+export declare function computedFieldsOf(source: ComputedFieldsSource): AvConfigComputedFields;
+/**
+ * How the configuration's computed fields differ from the ones the generated
+ * types were written with, one sentence per difference; empty when they agree.
+ */
+export declare function computedFieldsDrift(generated: AvConfigComputedFields, configured: AvConfigComputedFields): string[];
+/** The warning's code, as `process.emitWarning` reports it. */
+export declare const STALE_GENERATED_TYPES_WARNING = "AVENTARA_STALE_GENERATED_TYPES";
+/**
+ * Warns, through `process.emitWarning` (code
+ * {@link STALE_GENERATED_TYPES_WARNING}), when the generated types' computed
+ * fields differ from the configuration's. Nothing to compare (an Adapter that
+ * carries none) warns nothing.
+ */
+export declare function warnOnStaleComputedFields(generated: AvConfigComputedFields | undefined, configured: AvConfigComputedFields): void;
+export {};

package/dist/config/computed-fields.js

@@ -0,0 +1,73 @@
+import { emitFrameworkWarning } from "../runtime/framework-warning.emitter.js";
+import { computeOfLayer } from "./field-compute.resolver.js";
+function layerComputedFields(resources) {
+    const result = {};
+    const compute = computeOfLayer(resources);
+    for (const resource of Object.keys(compute).sort()) {
+        const fields = compute[resource] ?? {};
+        const create = Object.keys(fields)
+            .filter((field) => fields[field]?.create !== undefined)
+            .sort();
+        const update = Object.keys(fields)
+            .filter((field) => fields[field]?.update !== undefined)
+            .sort();
+        if (create.length === 0 && update.length === 0) {
+            continue;
+        }
+        result[resource] = {
+            ...(create.length === 0 ? {} : { create }),
+            ...(update.length === 0 ? {} : { update }),
+        };
+    }
+    return result;
+}
+export function computedFieldsOf(source) {
+    return {
+        agent: layerComputedFields(source.trees.agent),
+        agentExtends: source.agentExtends,
+        application: layerComputedFields(source.trees.application),
+        client: layerComputedFields(source.trees.client),
+        root: layerComputedFields(source.trees.root),
+    };
+}
+const LAYERS = ["root", "application", "client", "agent"];
+const PHASES = ["create", "update"];
+function missingFrom(left, right) {
+    const missing = [];
+    for (const layer of LAYERS) {
+        for (const [resource, phases] of Object.entries(left[layer])) {
+            for (const phase of PHASES) {
+                for (const field of phases[phase] ?? []) {
+                    if (!right[layer][resource]?.[phase]?.includes(field)) {
+                        missing.push(`${layer} ${resource}.${field} (${phase})`);
+                    }
+                }
+            }
+        }
+    }
+    return missing;
+}
+export function computedFieldsDrift(generated, configured) {
+    const drift = [
+        ...missingFrom(configured, generated).map((entry) => `computed in the configuration, not in the types: ${entry}`),
+        ...missingFrom(generated, configured).map((entry) => `computed in the types, not in the configuration: ${entry}`),
+    ];
+    if (generated.agentExtends !== configured.agentExtends) {
+        drift.push(`the agent layer extends "${configured.agentExtends}", the types say "${generated.agentExtends}"`);
+    }
+    return drift;
+}
+export const STALE_GENERATED_TYPES_WARNING = "AVENTARA_STALE_GENERATED_TYPES";
+export function warnOnStaleComputedFields(generated, configured) {
+    if (generated === undefined) {
+        return;
+    }
+    const drift = computedFieldsDrift(generated, configured);
+    if (drift.length === 0) {
+        return;
+    }
+    const message = `generated types are stale: run aventara:prepare. The computed fields the pre-compute stages are typed with differ from the configuration's:\n${drift
+        .map((line) => `  - ${line}`)
+        .join("\n")}`;
+    emitFrameworkWarning(message, STALE_GENERATED_TYPES_WARNING);
+}

package/dist/config/config-diagnostic.guidance.d.ts

@@ -0,0 +1,6 @@
+import type { ErrorCodeDescription } from "../runtime/error-guidance.js";
+import type { AvConfigDiagnosticCode } from "./config-diagnostic.js";
+/** Meaning, cause and fix of every configuration diagnostic code. */
+export declare const CONFIG_DIAGNOSTIC_GUIDANCE: {
+    readonly [C in AvConfigDiagnosticCode]: ErrorCodeDescription;
+};

package/dist/config/config-diagnostic.guidance.js

@@ -0,0 +1,32 @@
+export const CONFIG_DIAGNOSTIC_GUIDANCE = {
+    CONFIG_REQUIRED: {
+        message: "A required configuration key is missing.",
+        cause: "A key that must be present is absent: api, adapter, or an overlay's exposed when the overlay sets exemptions, or policy.engine or policy.principal when policy is set.",
+        fix: "Add the key at the diagnostic's path.",
+    },
+    CONFIG_UNKNOWN_PROPERTY: {
+        message: "Unknown configuration key.",
+        cause: "A key the configuration does not define at that place: a typo, or a key written at the wrong level of the tree. `policy` and `prebuilt` are root-only keys; in an overlay they read as unknown.",
+        fix: 'Remove it, or move it where it belongs (the configuration reference\'s "Where a key can go").',
+    },
+    CONFIG_INVALID_TYPE: {
+        message: "A configuration key has the wrong type.",
+        cause: "A value of the wrong type, or a key set to an explicit undefined.",
+        fix: "Give the value the type the reference states; leave a key out rather than setting it to undefined.",
+    },
+    CONFIG_INVALID_VALUE: {
+        message: "A configuration value is not allowed.",
+        cause: "A malformed api or mcp path, a negative limit, an unknown transactionsStyle, a format that is not a named zod format, forceTransaction under an effective transactionsStyle \"none\", an after check on any action but update, or a policy engine's governed, paths or afterChecks naming a Resource, field or path the Core Contract does not have, or its unheld naming a Resource the data source's model does not have (the message names the Resource or the rule).",
+        fix: "Use a value the message allows.",
+    },
+    CONFIG_MOVED_PROPERTY: {
+        message: "A configuration key moved in rc.1.",
+        cause: "Configuration written for 1.0.0-rc.0: restrictions, entrypoint, fields, behaviors, transactions or pipelines.before/after.",
+        fix: "Move it where the message says: restrictions to exposed + exemptions, entrypoint to api, fields to `resources.<R>.fields.<f>.definition`, transactions to transactionsStyle, before/after to pipelines.hooks.",
+    },
+    CONFIG_FORBIDDEN_IN_OVERLAY: {
+        message: "A root-only key is written in an overlay.",
+        cause: "A field definition in application, client or agent.",
+        fix: "Define the field once at the root (`resources.<R>.fields.<f>.definition`); an overlay only chooses its visibility.",
+    },
+};

package/dist/config/config.resolver.d.ts

@@ -1,6 +1,8 @@
 import type { AvAdapter } from "../adapters/adapter.interface.js";
 import type { AvAdapterModel } from "../adapters/adapter-model.js";
+import type { AvContractClientAccess } from "../contracts/contract-access.js";
 import type { AvTransactionCapability } from "../contracts/transaction-capability.js";
+import type { AvPolicyEngine } from "../policy/policy-engine.js";
 import type { AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
 import type { AvMisuseSink } from "../runtime/misuse-reporter.js";
 import type { AvConfigAgentParent } from "./config-layer.js";
@@ -8,6 +10,21 @@ import { type ResolvedComputeConfig } from "./field-compute.resolver.js";
 import type { AvConfig, AvConfigLimits } from "./framework-config.js";
 import type { AvConfigFieldDefinition } from "./framework-field-definition.js";
 import { type ResolvedPipelineTree } from "./pipeline-tree.resolver.js";
+/** The root's `policy`, its engine's passive lists read once. */
+export type ResolvedPolicyConfig = {
+    /** Where the engine was configured, for the startup diagnostics' paths. */
+    readonly at: "policy.engine" | "access.policy";
+    readonly engine: AvPolicyEngine;
+    readonly principal: NonNullable<AvConfig["policy"]>["principal"];
+    /** The governed fields and relations, by Resource. */
+    readonly governed: Readonly<Record<string, readonly string[]>>;
+    /** The rule paths, by rule name, each a list of segments. */
+    readonly paths: Readonly<Record<string, readonly (readonly string[])[]>>;
+    /** The writes whose grants carry an `after` condition, by Resource. */
+    readonly afterChecks: Readonly<Record<string, readonly string[]>>;
+    /** The Resources the rules read in conditions and decide no read of. */
+    readonly unheld: readonly string[];
+};
 /** The root's field definitions, by Resource and field name. */
 export type ResolvedFieldDefinitions = Readonly<Record<string, Readonly<Record<string, AvConfigFieldDefinition>>>>;
 /** One resolved layer of the configuration: root, application, client or agent. */
@@ -63,6 +80,13 @@ export type ResolvedFrameworkConfig<M extends AvAdapterModel = AvAdapterModel> =
     readonly diagnostics: AvDiagnosticsSink | undefined;
     /** The misuse sink, from the root configuration only. */
     readonly misuse: AvMisuseSink | undefined;
+    /** The policy, from the root configuration only; absent, nothing is checked. */
+    readonly policy: ResolvedPolicyConfig | undefined;
+    /**
+     * The ClientContract's `access` section: present exactly when `access` is
+     * configured, with `url` and `verbs` when its provider has `client`.
+     */
+    readonly access: AvContractClientAccess | undefined;
     /** Every field definition, from the root only; the same for all three layers. */
     readonly definitions: ResolvedFieldDefinitions;
     /** Each layer's `resources` tree as authored: the compiler checks its names. */

package/dist/config/config.resolver.js

@@ -1,16 +1,11 @@
 import { AvConstructionError } from "../framework/framework-construction.error.js";
+import { ACCESS_VERB_NAMES, providerVerb, } from "../policy/access-verb.table.js";
+import { isPlainRecord } from "../runtime/record.guard.js";
 import { mountPathRefusalDiagnostic } from "./config.validator.js";
 import { normalizeEntrypoint } from "./entrypoint.normalizer.js";
 import { chainCompute, computeOfLayer, } from "./field-compute.resolver.js";
 import { resolvePipelineTree, } from "./pipeline-tree.resolver.js";
 const hasOwn = (value, key) => Object.hasOwn(value, key);
-function isPlainRecord(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 function cloneConfigValue(value) {
     if (Array.isArray(value)) {
         return [...value];
@@ -140,6 +135,68 @@ function resolveMcp(mcp) {
             }),
         });
 }
+function frozenLists(value) {
+    if (!isPlainRecord(value)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, names]) => [
+        key,
+        Object.freeze([...names]),
+    ])));
+}
+function frozenPathLists(value) {
+    if (!isPlainRecord(value)) {
+        return Object.freeze({});
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, paths]) => [
+        key,
+        Object.freeze(paths.map((path) => Object.freeze([...path]))),
+    ])));
+}
+const accessPrincipal = ({ $state, }) => $state.me ?? null;
+function resolveAccessSection(access) {
+    if (access === undefined) {
+        return undefined;
+    }
+    const client = access.client;
+    if (client === undefined) {
+        return {};
+    }
+    const verbs = {};
+    for (const name of ACCESS_VERB_NAMES) {
+        const verb = providerVerb(client.verbs, name);
+        if (verb !== undefined) {
+            const { method, path, args, result } = verb;
+            verbs[name] = {
+                method,
+                path,
+                ...(args === undefined ? {} : { args: args }),
+                result: result,
+            };
+        }
+    }
+    return {
+        url: client.url,
+        verbs: verbs,
+    };
+}
+function resolvePolicy(configured, access) {
+    const policy = access === undefined
+        ? configured
+        : { engine: access.policy, principal: accessPrincipal };
+    if (policy === undefined) {
+        return undefined;
+    }
+    return Object.freeze({
+        at: access === undefined ? "policy.engine" : "access.policy",
+        engine: policy.engine,
+        principal: policy.principal,
+        governed: frozenLists(policy.engine.governed),
+        paths: frozenPathLists(policy.engine.paths),
+        afterChecks: frozenLists(policy.engine.afterChecks),
+        unheld: Object.freeze(Array.isArray(policy.engine.unheld) ? [...policy.engine.unheld] : []),
+    });
+}
 export function resolveFrameworkConfig(config) {
     const root = config;
     const application = config.application;
@@ -158,6 +215,8 @@ export function resolveFrameworkConfig(config) {
         adapter: config.adapter,
         diagnostics: config.diagnostics,
         misuse: config.misuse,
+        policy: resolvePolicy(config.policy, config.access),
+        access: resolveAccessSection(config.access),
         definitions: definitionsOf(root.resources),
         trees: {
             root: root.resources,