@cerbos/orm-prisma 4.0.0 → 5.0.0

package/lib/solve.js

@@ -0,0 +1,77 @@
+"use strict";
+// Solving `f(column) CMP v` for a monotone IEEE-754 function f exactly, over the doubles.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.solveMonotone = solveMonotone;
+exports.negateInterval = negateInterval;
+const view = new DataView(new ArrayBuffer(8));
+const SIGN = 1n << 63n;
+/** An integer key that orders finite doubles as the doubles themselves (+0 and -0 share one). */
+function toKey(x) {
+    view.setFloat64(0, x);
+    const bits = view.getBigUint64(0);
+    return bits & SIGN ? -(bits & ~SIGN) : bits;
+}
+function fromKey(key) {
+    view.setBigUint64(0, key < 0n ? -key | SIGN : key);
+    return view.getFloat64(0);
+}
+const MIN_KEY = toKey(-Number.MAX_VALUE);
+const MAX_KEY = toKey(Number.MAX_VALUE);
+/** The least key in [MIN_KEY, MAX_KEY] whose double satisfies `holds`, or undefined. */
+function leastKey(holds) {
+    if (!holds(fromKey(MAX_KEY)))
+        return undefined;
+    let low = MIN_KEY;
+    let high = MAX_KEY;
+    while (low < high) {
+        const mid = low + (high - low) / 2n;
+        if (holds(fromKey(mid)))
+            high = mid;
+        else
+            low = mid + 1n;
+    }
+    return low;
+}
+/**
+ * The doubles `x` with `f(x) CMP v`, for `f` non-decreasing over the finite doubles — IEEE-754
+ * addition and multiplication by a positive constant are, whatever rounding does to them, which
+ * is what makes this exact where subtracting the constant from `v` is not.
+ */
+function solveMonotone(f, operator, v) {
+    // {x : f(x) >= v} and {x : f(x) > v} are both upward-closed.
+    const atLeast = leastKey((x) => f(x) >= v);
+    const above = leastKey((x) => f(x) > v);
+    const interval = (lo, hi) => {
+        if (lo !== undefined && hi !== undefined && lo > hi)
+            return { empty: true };
+        return {
+            empty: false,
+            lo: lo === undefined || lo === MIN_KEY ? undefined : fromKey(lo),
+            hi: hi === undefined || hi === MAX_KEY ? undefined : fromKey(hi),
+        };
+    };
+    const below = (key) => (key === undefined ? MAX_KEY : key - 1n);
+    switch (operator) {
+        case "ge":
+            return atLeast === undefined ? { empty: true } : interval(atLeast, undefined);
+        case "gt":
+            return above === undefined ? { empty: true } : interval(above, undefined);
+        case "le":
+            return above === MIN_KEY ? { empty: true } : interval(undefined, below(above));
+        case "lt":
+            return atLeast === MIN_KEY ? { empty: true } : interval(undefined, below(atLeast));
+        case "eq":
+            return atLeast === undefined ? { empty: true } : interval(atLeast, below(above));
+    }
+}
+/** The interval of `-x` for `x` in `interval`. */
+function negateInterval(interval) {
+    if (interval.empty)
+        return interval;
+    return {
+        empty: false,
+        lo: interval.hi === undefined ? undefined : -interval.hi,
+        hi: interval.lo === undefined ? undefined : -interval.lo,
+    };
+}
+//# sourceMappingURL=solve.js.map

package/lib/solve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solve.js","sourceRoot":"","sources":["../src/solve.ts"],"names":[],"mappings":";AAAA,0FAA0F;;AAmD1F,sCAiCC;AAGD,wCAQC;AArFD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,MAAM,IAAI,GAAG,EAAE,IAAI,GAAG,CAAC;AAEvB,iGAAiG;AACjG,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAElC,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEnD,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAExC,wFAAwF;AACxF,SAAS,QAAQ,CAAC,KAA6B;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,IAAI,GAAG,OAAO,CAAC;IAEnB,OAAO,GAAG,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,IAAI,GAAG,GAAG,CAAC;;YAC/B,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,CAAwB,EACxB,QAA0C,EAC1C,CAAS;IAET,6DAA6D;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,CAAC,EAAsB,EAAE,EAAsB,EAAkB,EAAE;QAClF,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAE5E,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,EAAE,EAAE,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,EAAE,EAAE,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAEpF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChF,KAAK,IAAI;YACP,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5E,KAAK,IAAI;YACP,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,KAAK,IAAI;YACP,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,KAAK,IAAI;YACP,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,SAAgB,cAAc,CAAC,QAAwB;IACrD,IAAI,QAAQ,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAEpC,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACxD,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;KACzD,CAAC;AACJ,CAAC"}

package/lib/strings.d.ts

@@ -0,0 +1,12 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { TranslationContext } from "./mapping";
+/**
+ * Helper function to handle string operators (contains, startsWith, endsWith).
+ *
+ * These operators are receiver-sensitive and the planner preserves policy source order:
+ * operand 0 is the receiver (haystack), operand 1 the needle. Swapping them silently
+ * inverts the match direction, so unlike symmetric comparisons they are never normalized.
+ */
+export declare function handleStringOperator(operator: string, operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+//# sourceMappingURL=strings.d.ts.map

package/lib/strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.d.ts","sourceRoot":"","sources":["../src/strings.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAG1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAM5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAmCpD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CA8Fd"}

package/lib/strings.js

@@ -0,0 +1,110 @@
+"use strict";
+// The receiver-sensitive string operators: `contains`, `startsWith`, `endsWith`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleStringOperator = handleStringOperator;
+const fields_1 = require("./fields");
+const mapping_1 = require("./mapping");
+const plan_1 = require("./plan");
+const translate_1 = require("./translate");
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+// Upper bound on the IN-list produced when enumerating a constant receiver's substrings.
+const MAX_ENUMERATED_NEEDLES = 1000;
+/**
+ * Every needle `haystack.<operator>(needle)` is true for: its prefixes for startsWith, its
+ * suffixes for endsWith, its substrings for contains — and the empty string for all three.
+ */
+function candidateNeedles(operator, haystack) {
+    const candidates = new Set([""]);
+    if (operator === "startsWith") {
+        for (let i = 1; i <= haystack.length; i++) {
+            candidates.add(haystack.slice(0, i));
+        }
+    }
+    else if (operator === "endsWith") {
+        for (let i = 0; i < haystack.length; i++) {
+            candidates.add(haystack.slice(i));
+        }
+    }
+    else {
+        for (let start = 0; start < haystack.length; start++) {
+            for (let end = start + 1; end <= haystack.length; end++) {
+                candidates.add(haystack.slice(start, end));
+            }
+        }
+    }
+    return candidates;
+}
+/**
+ * Helper function to handle string operators (contains, startsWith, endsWith).
+ *
+ * These operators are receiver-sensitive and the planner preserves policy source order:
+ * operand 0 is the receiver (haystack), operand 1 the needle. Swapping them silently
+ * inverts the match direction, so unlike symmetric comparisons they are never normalized.
+ */
+function handleStringOperator(operator, operands, context) {
+    if (operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} requires exactly two operands`);
+    }
+    const receiver = (0, translate_1.resolveOperand)((0, plan_1.assertDefined)(operands[0], `${operator} requires a receiver operand`), context);
+    const needle = (0, translate_1.resolveOperand)((0, plan_1.assertDefined)(operands[1], `${operator} requires a needle operand`), context);
+    if ((0, mapping_1.isResolvedFieldReference)(receiver))
+        (0, fields_1.assertStringField)(receiver, operator);
+    if ((0, mapping_1.isResolvedFieldReference)(needle))
+        (0, fields_1.assertStringField)(needle, operator);
+    // A null element of a projected list is a value, and a string function over it is an error.
+    (0, mapping_1.recordErroringNullElement)(context, operands[0], receiver);
+    (0, mapping_1.recordErroringNullElement)(context, operands[1], needle);
+    // Column receiver, constant needle: Prisma's LIKE-based filter.
+    if ((0, mapping_1.isResolvedFieldReference)(receiver) && (0, mapping_1.isResolvedValue)(needle)) {
+        const { value } = needle;
+        if (!(0, narrowing_1.isString)(value)) {
+            throw new errors_1.UnsupportedQueryPlanError(`${operator} operator requires string value`);
+        }
+        if (value.includes("\u0000")) {
+            throw new errors_1.UnsupportedQueryPlanError(`${operator} with a needle holding a NUL character: PostgreSQL text cannot hold one, and SQLite's LIKE stops reading the pattern at it, so %NUL% matched every row`);
+        }
+        // A prefix is matched by the range of strings it bounds, so startsWith needs no LIKE escaping
+        // (see buildPrefixFilter). Prisma emits LIKE without an ESCAPE clause and does not escape
+        // wildcard characters, so a contains or endsWith needle containing % or _ would match as a
+        // pattern instead of literally (contains("a_b") wrongly matches "axb"), and a suffix or
+        // substring bounds no range. Fail loudly rather than filter wrong.
+        //
+        // A backslash is the same hazard reached from the other direction, and only an executed
+        // PostgreSQL leg surfaces it (cerbos/query-plan-adapters#320): SQLite's LIKE has no escape
+        // character at all, so `\` is literal there, while PostgreSQL and MySQL treat it as the
+        // DEFAULT escape character even with no ESCAPE clause. `endsWith("\\")` is then a pattern
+        // ending in an escape character — a hard error on PostgreSQL — and a `\x` anywhere inside
+        // silently drops the backslash, so `contains("a\\b")` matches "ab", a row the PDP denies.
+        if (operator === "startsWith") {
+            return (0, fields_1.buildPrefixFilter)(receiver, value);
+        }
+        if (/[%_\\]/.test(value)) {
+            throw new errors_1.UnsupportedQueryPlanError(`Cannot translate ${operator} with a needle containing LIKE metacharacters (%, _ or \\): ` +
+                "Prisma does not escape wildcards in string filters, and \\ is the default LIKE " +
+                "escape character on PostgreSQL and MySQL");
+        }
+        return (0, fields_1.buildFieldFilter)(receiver, operator, value);
+    }
+    // Constant receiver, column needle (e.g. `"a-b-c".contains(R.attr.x)`): enumerate every
+    // candidate needle the constant admits into an exact IN filter. No LIKE, so no escaping
+    // hazards; a NULL needle column stays excluded (CEL missing-attribute deny).
+    if ((0, mapping_1.isResolvedValue)(receiver) && (0, mapping_1.isResolvedFieldReference)(needle)) {
+        if (!(0, narrowing_1.isString)(receiver.value)) {
+            throw new errors_1.UnsupportedQueryPlanError(`${operator} operator requires a string receiver`);
+        }
+        const candidates = candidateNeedles(operator, receiver.value);
+        if (candidates.size > MAX_ENUMERATED_NEEDLES) {
+            throw new errors_1.UnsupportedQueryPlanError(`Cannot translate ${operator} with a constant receiver of this length: ` +
+                `enumerating its ${candidates.size} candidate needles exceeds the ${MAX_ENUMERATED_NEEDLES}-entry limit`);
+        }
+        return (0, fields_1.buildFieldFilter)(needle, "in", [...candidates]);
+    }
+    if ((0, mapping_1.isResolvedFieldReference)(receiver) && (0, mapping_1.isResolvedFieldReference)(needle)) {
+        // A column-valued needle would need its LIKE metacharacters escaped per row, which
+        // Prisma's filters cannot do (and Prisma leaks wildcards from field references).
+        throw new errors_1.UnsupportedQueryPlanError(`Cannot translate ${operator} between two columns: Prisma cannot escape LIKE wildcards held in a column`);
+    }
+    throw new errors_1.UnsupportedQueryPlanError(`${operator} between two constants must be folded by the Cerbos planner`);
+}
+//# sourceMappingURL=strings.js.map

package/lib/strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.js","sourceRoot":"","sources":["../src/strings.ts"],"names":[],"mappings":";AAAA,iFAAiF;;AAqDjF,oDAkGC;AAnJD,qCAAkF;AAElF,uCAImB;AAEnB,iCAAuC;AACvC,2CAA6C;AAC7C,qCAAqD;AACrD,2CAAuC;AAEvC,yFAAyF;AACzF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;IAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzC,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,KAAK,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;gBACxD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,QAAgB,EAChB,QAAiC,EACjC,OAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CAAC,GAAG,QAAQ,gCAAgC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,0BAAc,EAC7B,IAAA,oBAAa,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,8BAA8B,CAAC,EACrE,OAAO,CACR,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,0BAAc,EAC3B,IAAA,oBAAa,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,4BAA4B,CAAC,EACnE,OAAO,CACR,CAAC;IAEF,IAAI,IAAA,kCAAwB,EAAC,QAAQ,CAAC;QAAE,IAAA,0BAAiB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9E,IAAI,IAAA,kCAAwB,EAAC,MAAM,CAAC;QAAE,IAAA,0BAAiB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1E,4FAA4F;IAC5F,IAAA,mCAAyB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAA,mCAAyB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC;IAEzD,gEAAgE;IAChE,IAAI,IAAA,kCAAwB,EAAC,QAAQ,CAAC,IAAI,IAAA,yBAAe,EAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAEzB,IAAI,CAAC,IAAA,oBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,kCAAyB,CAAC,GAAG,QAAQ,iCAAiC,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,wJAAwJ,CACpK,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,mEAAmE;QACnE,EAAE;QACF,wFAAwF;QACxF,2FAA2F;QAC3F,wFAAwF;QACxF,0FAA0F;QAC1F,0FAA0F;QAC1F,0FAA0F;QAC1F,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,IAAA,0BAAiB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,kCAAyB,CACjC,oBAAoB,QAAQ,8DAA8D;gBACxF,iFAAiF;gBACjF,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,wFAAwF;IACxF,wFAAwF;IACxF,6EAA6E;IAC7E,IAAI,IAAA,yBAAe,EAAC,QAAQ,CAAC,IAAI,IAAA,kCAAwB,EAAC,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,IAAA,oBAAQ,EAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kCAAyB,CAAC,GAAG,QAAQ,sCAAsC,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE9D,IAAI,UAAU,CAAC,IAAI,GAAG,sBAAsB,EAAE,CAAC;YAC7C,MAAM,IAAI,kCAAyB,CACjC,oBAAoB,QAAQ,4CAA4C;gBACtE,mBAAmB,UAAU,CAAC,IAAI,kCAAkC,sBAAsB,cAAc,CAC3G,CAAC;QACJ,CAAC;QAED,OAAO,IAAA,yBAAgB,EAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,IAAA,kCAAwB,EAAC,QAAQ,CAAC,IAAI,IAAA,kCAAwB,EAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,mFAAmF;QACnF,iFAAiF;QACjF,MAAM,IAAI,kCAAyB,CACjC,oBAAoB,QAAQ,4EAA4E,CACzG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,6DAA6D,CACzE,CAAC;AACJ,CAAC"}

package/lib/ternary.d.ts

@@ -0,0 +1,12 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { TranslationContext } from "./mapping";
+export declare function handleBooleanTernaryOperator(operands: PlanExpressionOperand[], context: TranslationContext): PrismaFilter;
+/**
+ * A comparison or membership test with a ternary operand (`(c ? a : b) == x`,
+ * `x in (c ? a : b)`), translated by distributing the
+ * comparison into both branches; or null when `operator` is not a comparison or no operand is a
+ * ternary. `negated` builds the filter for the comparison's negation instead.
+ */
+export declare function tryHandleTernaryComparison(operator: string, operands: PlanExpressionOperand[], context: TranslationContext, negated?: boolean): PrismaFilter | null;
+//# sourceMappingURL=ternary.d.ts.map

package/lib/ternary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ternary.d.ts","sourceRoot":"","sources":["../src/ternary.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAS,MAAM,cAAc,CAAC;AAKjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAuJpD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAmBd;AA6GD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,UAAQ,GACd,YAAY,GAAG,IAAI,CAwDrB"}

package/lib/ternary.js

@@ -0,0 +1,192 @@
+"use strict";
+// `cond ? a : b`, in boolean position and as an operand of a comparison. Both lower to the same
+// guarded disjunction, which keeps CEL's error semantics when the condition is UNKNOWN.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleBooleanTernaryOperator = handleBooleanTernaryOperator;
+exports.tryHandleTernaryComparison = tryHandleTernaryComparison;
+const comparison_1 = require("./comparison");
+const evaluate_1 = require("./evaluate");
+const fields_1 = require("./fields");
+const plan_1 = require("./plan");
+const translate_1 = require("./translate");
+const timestamp_1 = require("./timestamp");
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+// The comparison that holds exactly when `operator` does not, over two definite operands.
+const COMPLEMENT_OPERATOR = {
+    eq: "ne",
+    ne: "eq",
+    lt: "ge",
+    le: "gt",
+    gt: "le",
+    ge: "lt",
+};
+function getTernaryOperands(operands) {
+    if (operands.length !== 3) {
+        throw new errors_1.UnsupportedQueryPlanError(`if (ternary) requires exactly 3 operands (condition, then, else), got ${operands.length}`);
+    }
+    return {
+        condition: (0, plan_1.assertDefined)(operands[0], "if (ternary) requires a condition operand"),
+        thenBranch: (0, plan_1.assertDefined)(operands[1], "if (ternary) requires a then operand"),
+        elseBranch: (0, plan_1.assertDefined)(operands[2], "if (ternary) requires an else operand"),
+    };
+}
+function getConstantBooleanCondition(condition) {
+    if (!(0, plan_1.isValueOperand)(condition)) {
+        return undefined;
+    }
+    if (!(0, narrowing_1.isBoolean)(condition.value)) {
+        throw new errors_1.UnsupportedQueryPlanError("if (ternary) condition must be a boolean expression");
+    }
+    return condition.value;
+}
+function buildBooleanBranchFilter(branch, context) {
+    if (!(0, plan_1.isValueOperand)(branch)) {
+        return {
+            kind: "filter",
+            filter: (0, translate_1.buildPrismaFilterFromCerbosExpression)(branch, context),
+        };
+    }
+    if (!(0, narrowing_1.isBoolean)(branch.value)) {
+        throw new errors_1.UnsupportedQueryPlanError("if (ternary) branch in boolean position must be a boolean");
+    }
+    return { kind: "constant", value: branch.value };
+}
+/**
+ * `(cond AND then) OR (NOT cond AND else) OR (cond AND NOT cond)`, dropping any arm a constant
+ * branch makes redundant.
+ *
+ * "The condition is definitively FALSE" is buildNegatedFilter's contract — three-valued, so a
+ * condition that is UNKNOWN (a NULL column, an erroring lambda body, an absent to-one parent)
+ * selects NEITHER branch. It delegates rather than spelling a second negation. A private copy is
+ * how the ternary missed the hop requirement #315/#316 added: a bare `NOT` over a chain filter is
+ * TRUE when the to-one parent is absent, so the else-branch was selected for rows CEL denies
+ * outright — the missing path is an evaluation error, not a false condition
+ * (cerbos/query-plan-adapters#334). Delegating also gives the ternary the De Morgan push-down,
+ * which a chained `and`/`or` condition needs for CEL's error absorption to survive.
+ */
+function buildGuardedTernaryFilter(condition, thenFilter, elseFilter, context) {
+    const conditionTrue = (0, translate_1.buildPrismaFilterFromCerbosExpression)(condition, context);
+    const conditionFalse = (0, translate_1.buildNegatedFilter)(condition, context);
+    const guardedBranches = [];
+    if (thenFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionTrue, thenFilter.filter] });
+    }
+    else if (thenFilter.value) {
+        guardedBranches.push(conditionTrue);
+    }
+    if (elseFilter.kind === "filter") {
+        guardedBranches.push({ AND: [conditionFalse, elseFilter.filter] });
+    }
+    else if (elseFilter.value) {
+        guardedBranches.push(conditionFalse);
+    }
+    // For a known condition this contradiction is false. If the condition is
+    // NULL/error-derived, both sides are SQL UNKNOWN, which keeps the whole
+    // ternary UNKNOWN under an outer NOT instead of authorizing the row.
+    guardedBranches.push({ AND: [conditionTrue, conditionFalse] });
+    return { OR: guardedBranches };
+}
+function finalizeTernaryBranchPredicate(predicate) {
+    if (predicate.kind === "filter") {
+        return predicate.filter;
+    }
+    return predicate.value ? {} : (0, fields_1.rejectConstantFalse)();
+}
+function handleBooleanTernaryOperator(operands, context) {
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(operands);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(buildBooleanBranchFilter(constantCondition ? thenBranch : elseBranch, context));
+    }
+    return buildGuardedTernaryFilter(condition, buildBooleanBranchFilter(thenBranch, context), buildBooleanBranchFilter(elseBranch, context), context);
+}
+/** The comparison with its ternary operand replaced by `branch`, as a branch predicate. */
+// A timestamp() literal compares as its canonical instant, never against a bare string.
+function constantOf(operand) {
+    if (operand === undefined)
+        return undefined;
+    if ((0, plan_1.isValueOperand)(operand))
+        return { value: operand.value, timestamp: false };
+    if ((0, plan_1.isOperatorOperand)(operand) &&
+        operand.operator === "timestamp" &&
+        operand.operands.length === 1) {
+        const literal = operand.operands[0];
+        if (literal !== undefined && (0, plan_1.isValueOperand)(literal) && (0, narrowing_1.isString)(literal.value)) {
+            return { value: (0, timestamp_1.normalizeRfc3339Milliseconds)(literal.value), timestamp: true };
+        }
+    }
+    return undefined;
+}
+function buildTernaryComparisonBranch(operator, operands, ternaryIndex, branch, context, negated) {
+    const substitutedOperands = operands.map((operand, index) => index === ternaryIndex ? branch : operand);
+    (0, plan_1.assertDefined)(substitutedOperands[0], `${operator} requires a left operand`);
+    (0, plan_1.assertDefined)(substitutedOperands[1], `${operator} requires a right operand`);
+    // Membership is not symmetric: its member stays first even when it is the constant.
+    const normalized = operator === "in"
+        ? { operator, operands: substitutedOperands }
+        : (0, plan_1.normalizeBinaryOperands)(operator, substitutedOperands);
+    const [normalizedFirst, normalizedSecond] = normalized.operands;
+    const first = constantOf(normalizedFirst);
+    const second = constantOf(normalizedSecond);
+    if (normalized.operands.length === 2 &&
+        first !== undefined &&
+        second !== undefined &&
+        first.timestamp === second.timestamp) {
+        return {
+            kind: "constant",
+            value: (0, evaluate_1.evaluateConstantComparison)(normalized.operator, first.value, second.value) !== negated,
+        };
+    }
+    if (!negated) {
+        return {
+            kind: "filter",
+            filter: (0, translate_1.buildPrismaFilterFromCerbosExpression)(normalized, context),
+        };
+    }
+    const nested = tryHandleTernaryComparison(normalized.operator, normalized.operands, context, true);
+    if (nested !== null)
+        return { kind: "filter", filter: nested };
+    if (normalized.operator === "in") {
+        return {
+            kind: "filter",
+            filter: (0, translate_1.buildNegatedFilter)({ operator: "in", operands: normalized.operands }, context),
+        };
+    }
+    // Keep missing-value and relation guards inside the selected branch. Constants
+    // are negated above, since !(NaN <= n) is true but NaN > n is false in CEL 0.30.
+    return {
+        kind: "filter",
+        filter: (0, comparison_1.handleRelationalOperator)((0, plan_1.assertDefined)((0, narrowing_1.lookup)(COMPLEMENT_OPERATOR, normalized.operator), "Unsupported negated comparison"), normalized.operands, context),
+    };
+}
+/**
+ * A comparison or membership test with a ternary operand (`(c ? a : b) == x`,
+ * `x in (c ? a : b)`), translated by distributing the
+ * comparison into both branches; or null when `operator` is not a comparison or no operand is a
+ * ternary. `negated` builds the filter for the comparison's negation instead.
+ */
+function tryHandleTernaryComparison(operator, operands, context, negated = false) {
+    if ((0, narrowing_1.lookup)(plan_1.CERBOS_TO_PRISMA_OPERATOR, operator) === undefined && operator !== "in") {
+        return null;
+    }
+    const ternaryIndex = operands.findIndex((operand) => (0, plan_1.isOperatorOperand)(operand) && operand.operator === "if");
+    if (ternaryIndex === -1) {
+        return null;
+    }
+    if (operands.length !== 2) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} with a ternary requires exactly 2 operands, got ${operands.length}`);
+    }
+    const ternary = (0, plan_1.assertDefined)(operands[ternaryIndex], "Ternary comparison operand is missing");
+    if (!(0, plan_1.isOperatorOperand)(ternary)) {
+        throw new errors_1.UnsupportedQueryPlanError("Ternary comparison operand must be an expression");
+    }
+    const { condition, thenBranch, elseBranch } = getTernaryOperands(ternary.operands);
+    const branchFor = (branch) => buildTernaryComparisonBranch(operator, operands, ternaryIndex, branch, context, negated);
+    const constantCondition = getConstantBooleanCondition(condition);
+    if (constantCondition !== undefined) {
+        return finalizeTernaryBranchPredicate(branchFor(constantCondition ? thenBranch : elseBranch));
+    }
+    return buildGuardedTernaryFilter(condition, branchFor(thenBranch), branchFor(elseBranch), context);
+}
+//# sourceMappingURL=ternary.js.map

package/lib/ternary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ternary.js","sourceRoot":"","sources":["../src/ternary.ts"],"names":[],"mappings":";AAAA,gGAAgG;AAChG,wFAAwF;;AA+JxF,oEAsBC;AAmHD,gEA6DC;AAjWD,6CAAwD;AACxD,yCAAwD;AACxD,qCAA+C;AAG/C,iCAMgB;AAChB,2CAGqB;AACrB,2CAA2D;AAC3D,qCAAqD;AACrD,2CAA0D;AAO1D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG;IAC1B,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;CACwB,CAAC;AAQnC,SAAS,kBAAkB,CAAC,QAAiC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CACjC,yEAAyE,QAAQ,CAAC,MAAM,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,IAAA,oBAAa,EACtB,QAAQ,CAAC,CAAC,CAAC,EACX,2CAA2C,CAC5C;QACD,UAAU,EAAE,IAAA,oBAAa,EACvB,QAAQ,CAAC,CAAC,CAAC,EACX,sCAAsC,CACvC;QACD,UAAU,EAAE,IAAA,oBAAa,EACvB,QAAQ,CAAC,CAAC,CAAC,EACX,uCAAuC,CACxC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,SAAgC;IAEhC,IAAI,CAAC,IAAA,qBAAc,EAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,IAAA,qBAAS,EAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CAAC,qDAAqD,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC;AACzB,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA6B,EAC7B,OAA2B;IAE3B,IAAI,CAAC,IAAA,qBAAc,EAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAA,iDAAqC,EAAC,MAAM,EAAE,OAAO,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,qBAAS,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,kCAAyB,CACjC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,yBAAyB,CAChC,SAAgC,EAChC,UAAkC,EAClC,UAAkC,EAClC,OAA2B;IAE3B,MAAM,aAAa,GAAG,IAAA,iDAAqC,EACzD,SAAS,EACT,OAAO,CACR,CAAC;IAEF,MAAM,cAAc,GAAG,IAAA,8BAAkB,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAmB,EAAE,CAAC;IAE3C,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC5B,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC5B,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IAE/D,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,8BAA8B,CACrC,SAAiC;IAEjC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,4BAAmB,GAAE,CAAC;AACtD,CAAC;AAED,SAAgB,4BAA4B,CAC1C,QAAiC,EACjC,OAA2B;IAE3B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAEjE,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,8BAA8B,CACnC,wBAAwB,CACtB,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAC3C,OAAO,CACR,CACF,CAAC;IACJ,CAAC;IAED,OAAO,yBAAyB,CAC9B,SAAS,EACT,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,EAC7C,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,EAC7C,OAAO,CACR,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,wFAAwF;AACxF,SAAS,UAAU,CACjB,OAA0C;IAE1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAE/E,IACE,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC1B,OAAO,CAAC,QAAQ,KAAK,WAAW;QAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEpC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC,IAAI,IAAA,oBAAQ,EAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,KAAK,EAAE,IAAA,wCAA4B,EAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B,CACnC,QAAgB,EAChB,QAAiC,EACjC,YAAoB,EACpB,MAA6B,EAC7B,OAA2B,EAC3B,OAAgB;IAEhB,MAAM,mBAAmB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAC1D,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAC1C,CAAC;IAEF,IAAA,oBAAa,EAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,0BAA0B,CAAC,CAAC;IAC7E,IAAA,oBAAa,EAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,2BAA2B,CAAC,CAAC;IAE9E,oFAAoF;IACpF,MAAM,UAAU,GACd,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE;QAC7C,CAAC,CAAC,IAAA,8BAAuB,EAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAE7D,MAAM,CAAC,eAAe,EAAE,gBAAgB,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAE5C,IACE,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAChC,KAAK,KAAK,SAAS;QACnB,MAAM,KAAK,SAAS;QACpB,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EACpC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,KAAK,EACH,IAAA,qCAA0B,EACxB,UAAU,CAAC,QAAQ,EACnB,KAAK,CAAC,KAAK,EACX,MAAM,CAAC,KAAK,CACb,KAAK,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAA,iDAAqC,EAAC,UAAU,EAAE,OAAO,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CACvC,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,QAAQ,EACnB,OAAO,EACP,IAAI,CACL,CAAC;IAEF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE/D,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,IAAA,8BAAkB,EACxB,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,EACjD,OAAO,CACR;SACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAA,qCAAwB,EAC9B,IAAA,oBAAa,EACX,IAAA,kBAAM,EAAC,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,EAChD,gCAAgC,CACjC,EACD,UAAU,CAAC,QAAQ,EACnB,OAAO,CACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,QAAiC,EACjC,OAA2B,EAC3B,OAAO,GAAG,KAAK;IAEf,IAAI,IAAA,kBAAM,EAAC,gCAAyB,EAAE,QAAQ,CAAC,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CACrC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CACrE,CAAC;IAEF,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,oDAAoD,QAAQ,CAAC,MAAM,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,oBAAa,EAC3B,QAAQ,CAAC,YAAY,CAAC,EACtB,uCAAuC,CACxC,CAAC;IAEF,IAAI,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kCAAyB,CAAC,kDAAkD,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAC9D,OAAO,CAAC,QAAQ,CACjB,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,MAA6B,EAAE,EAAE,CAClD,4BAA4B,CAC1B,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,OAAO,EACP,OAAO,CACR,CAAC;IAEJ,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAEjE,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,8BAA8B,CACnC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,yBAAyB,CAC9B,SAAS,EACT,SAAS,CAAC,UAAU,CAAC,EACrB,SAAS,CAAC,UAAU,CAAC,EACrB,OAAO,CACR,CAAC;AACJ,CAAC"}

package/lib/timestamp.d.ts

@@ -0,0 +1,45 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { OperatorOperand } from "./plan";
+/**
+ * Parses an RFC 3339 literal into the ISO string Prisma binds. Anything a lenient `Date` parse
+ * would coerce into some other instant — a missing time part, a day that does not exist, digits
+ * past the millisecond, an instant outside CEL's range — is refused instead.
+ */
+export declare function normalizeRfc3339Milliseconds(value: string): string;
+type ParsedInstant = {
+    iso: string;
+    subMillisecond: boolean;
+};
+/**
+ * Parses an RFC 3339 literal like normalizeRfc3339Milliseconds, except that an instant between
+ * two milliseconds is accepted: `iso` is then the NEXT millisecond, and `subMillisecond` says so.
+ * A comparison against it has to be rewritten for that rounding (see roundSubMillisecond).
+ */
+export declare function parseRfc3339Instant(value: string): ParsedInstant;
+/**
+ * A Prisma `DateTime` carries milliseconds, so the attribute an application builds from one is a
+ * whole millisecond `a`, truncated from whatever the column stores. Against an instant `T` strictly
+ * between two milliseconds, with `C` the millisecond after it: `a < T` and `a <= T` both mean
+ * `column < C`, `a > T` and `a >= T` both mean `column >= C`, and `a == T` never holds. Returns the
+ * operator to compare against `C`, or null for the equality family.
+ */
+export declare function roundSubMillisecond(operator: string): string | null;
+/**
+ * A comparison over timestamp arithmetic, rewritten as a comparison of the bare `timestamp(x)`
+ * against a literal instant, or undefined for any other shape:
+ *
+ * - `timeSince(timestamp(x)) CMP duration(d)`: timeSince is `now - x`, read from the clock when
+ *   the query runs, so it holds exactly when `x` lies on the mirrored side of `now - d`. Cerbos
+ *   computes it with Go's saturating `time.Sub`, which raises no error.
+ * - `timestamp(x) ± duration(d) CMP timestamp(t)`: the shift is monotone, so it holds exactly when
+ *   `x CMP t ∓ d`. CEL raises an error when the shifted instant leaves 0001-01-01..9999-12-31,
+ *   which the comparison alone cannot carry: `positive` says whether the leaf sits under an even
+ *   number of negations, and the rows that overflow are then excluded from (positive) or included
+ *   in (negative) the leaf, so the enclosing negations never select them.
+ *
+ * Both sides may come in either order. A duration or instant that is not a whole millisecond, or a
+ * bound outside CEL's range, is left alone for the translator to refuse.
+ */
+export declare function rewriteTemporalComparison(expr: OperatorOperand, positive: boolean, now?: number): PlanExpressionOperand | undefined;
+export {};
+//# sourceMappingURL=timestamp.d.ts.map

package/lib/timestamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.d.ts","sourceRoot":"","sources":["../src/timestamp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAS1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAe9C;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAsDhE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWnE;AAOD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,OAAO,EACjB,GAAG,GAAE,MAAmB,GACvB,qBAAqB,GAAG,SAAS,CA4DnC"}