@cerbos/orm-prisma 4.0.0 → 5.0.0

package/lib/timestamp.js

@@ -0,0 +1,225 @@
+"use strict";
+// RFC 3339 timestamp literals, validated to CEL's instant range and Prisma's millisecond precision.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeRfc3339Milliseconds = normalizeRfc3339Milliseconds;
+exports.parseRfc3339Instant = parseRfc3339Instant;
+exports.roundSubMillisecond = roundSubMillisecond;
+exports.rewriteTemporalComparison = rewriteTemporalComparison;
+const plan_1 = require("./plan");
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+const RFC3339_MILLISECOND_TIMESTAMP = /^((?!0000)\d{4})-(\d{2})-(\d{2})[Tt](?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.(\d{1,9}))?(?:[Zz]|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+const MIN_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("0001-01-01T00:00:00.000Z");
+const MAX_RFC3339_TIMESTAMP_MILLISECONDS = Date.parse("9999-12-31T23:59:59.999Z");
+/**
+ * Parses an RFC 3339 literal into the ISO string Prisma binds. Anything a lenient `Date` parse
+ * would coerce into some other instant — a missing time part, a day that does not exist, digits
+ * past the millisecond, an instant outside CEL's range — is refused instead.
+ */
+function normalizeRfc3339Milliseconds(value) {
+    const { iso, subMillisecond } = parseRfc3339Instant(value);
+    if (subMillisecond) {
+        throw new errors_1.UnsupportedQueryPlanError(`Timestamp value exceeds millisecond precision: ${value}`);
+    }
+    return iso;
+}
+/**
+ * Parses an RFC 3339 literal like normalizeRfc3339Milliseconds, except that an instant between
+ * two milliseconds is accepted: `iso` is then the NEXT millisecond, and `subMillisecond` says so.
+ * A comparison against it has to be rewritten for that rounding (see roundSubMillisecond).
+ */
+function parseRfc3339Instant(value) {
+    const match = RFC3339_MILLISECOND_TIMESTAMP.exec(value);
+    const yearText = match?.[1];
+    const monthText = match?.[2];
+    const dayText = match?.[3];
+    const fraction = match?.[4] ?? "";
+    if (!yearText || !monthText || !dayText) {
+        throw new errors_1.UnsupportedQueryPlanError(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    const subMillisecond = [...fraction.slice(3)].some((digit) => digit !== "0");
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const calendarDate = new Date(0);
+    calendarDate.setUTCHours(0, 0, 0, 0);
+    calendarDate.setUTCFullYear(year, month - 1, day);
+    if (calendarDate.getUTCFullYear() !== year ||
+        calendarDate.getUTCMonth() !== month - 1 ||
+        calendarDate.getUTCDate() !== day) {
+        throw new errors_1.UnsupportedQueryPlanError(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    const milliseconds = Date.parse(value);
+    if (Number.isNaN(milliseconds)) {
+        throw new errors_1.UnsupportedQueryPlanError(`Invalid RFC 3339 timestamp value: ${value}`);
+    }
+    if (milliseconds < MIN_RFC3339_TIMESTAMP_MILLISECONDS ||
+        milliseconds > MAX_RFC3339_TIMESTAMP_MILLISECONDS) {
+        throw new errors_1.UnsupportedQueryPlanError(`Timestamp value is outside CEL's supported instant range: ${value}`);
+    }
+    // Date.parse drops the digits past the millisecond, so a sub-millisecond instant lies strictly
+    // between `milliseconds` and the next one.
+    const rounded = subMillisecond ? milliseconds + 1 : milliseconds;
+    if (rounded > MAX_RFC3339_TIMESTAMP_MILLISECONDS) {
+        throw new errors_1.UnsupportedQueryPlanError(`Timestamp value is outside CEL's supported instant range: ${value}`);
+    }
+    return { iso: new Date(rounded).toISOString(), subMillisecond };
+}
+/**
+ * A Prisma `DateTime` carries milliseconds, so the attribute an application builds from one is a
+ * whole millisecond `a`, truncated from whatever the column stores. Against an instant `T` strictly
+ * between two milliseconds, with `C` the millisecond after it: `a < T` and `a <= T` both mean
+ * `column < C`, `a > T` and `a >= T` both mean `column >= C`, and `a == T` never holds. Returns the
+ * operator to compare against `C`, or null for the equality family.
+ */
+function roundSubMillisecond(operator) {
+    switch (operator) {
+        case "lt":
+        case "le":
+            return "lt";
+        case "gt":
+        case "ge":
+            return "ge";
+        default:
+            return null;
+    }
+}
+// -- timestamp arithmetic, solved for the column -------------------------------------------------
+const MIN_INSTANT = MIN_RFC3339_TIMESTAMP_MILLISECONDS;
+const MAX_INSTANT = MAX_RFC3339_TIMESTAMP_MILLISECONDS;
+/**
+ * A comparison over timestamp arithmetic, rewritten as a comparison of the bare `timestamp(x)`
+ * against a literal instant, or undefined for any other shape:
+ *
+ * - `timeSince(timestamp(x)) CMP duration(d)`: timeSince is `now - x`, read from the clock when
+ *   the query runs, so it holds exactly when `x` lies on the mirrored side of `now - d`. Cerbos
+ *   computes it with Go's saturating `time.Sub`, which raises no error.
+ * - `timestamp(x) ± duration(d) CMP timestamp(t)`: the shift is monotone, so it holds exactly when
+ *   `x CMP t ∓ d`. CEL raises an error when the shifted instant leaves 0001-01-01..9999-12-31,
+ *   which the comparison alone cannot carry: `positive` says whether the leaf sits under an even
+ *   number of negations, and the rows that overflow are then excluded from (positive) or included
+ *   in (negative) the leaf, so the enclosing negations never select them.
+ *
+ * Both sides may come in either order. A duration or instant that is not a whole millisecond, or a
+ * bound outside CEL's range, is left alone for the translator to refuse.
+ */
+function rewriteTemporalComparison(expr, positive, now = Date.now()) {
+    if (!plan_1.COMPARISON_OPERATORS.has(expr.operator) || expr.operands.length !== 2)
+        return undefined;
+    let [left, right] = (0, narrowing_1.pair)(expr.operands);
+    let operator = expr.operator;
+    if (!isTemporalArithmetic(left) && isTemporalArithmetic(right)) {
+        [left, right] = [right, left];
+        operator = (0, plan_1.mirrorOperator)(operator);
+    }
+    if (!(0, plan_1.isOperatorOperand)(left))
+        return undefined;
+    if (left.operator === "timeSince") {
+        const [column] = left.operands;
+        const duration = durationMilliseconds(right);
+        if (left.operands.length !== 1 || !isTimestampColumn(column) || duration === undefined) {
+            return undefined;
+        }
+        const bound = instantLiteral(now - duration);
+        // now - x CMP d  <=>  x mirror(CMP) now - d
+        return bound && compareInstant((0, plan_1.mirrorOperator)(operator), column, bound);
+    }
+    if ((left.operator !== "add" && left.operator !== "sub") || left.operands.length !== 2) {
+        return undefined;
+    }
+    const [a, b] = (0, narrowing_1.pair)(left.operands);
+    let column;
+    let duration;
+    if (isTimestampColumn(a) && durationMilliseconds(b) !== undefined) {
+        [column, duration] = [a, durationMilliseconds(b)];
+    }
+    else if (left.operator === "add" && isTimestampColumn(b)) {
+        [column, duration] = [b, durationMilliseconds(a)];
+    }
+    else {
+        return undefined;
+    }
+    const instant = instantMilliseconds(right);
+    if (duration === undefined || instant === undefined)
+        return undefined;
+    const shift = left.operator === "add" ? duration : -duration;
+    const bound = instantLiteral(instant - shift);
+    if (bound === undefined)
+        return undefined;
+    const solved = compareInstant(operator, column, bound);
+    if (shift === 0)
+        return solved;
+    const limit = instantLiteral(shift > 0 ? MAX_INSTANT - shift : MIN_INSTANT - shift);
+    if (limit === undefined)
+        return undefined;
+    const inRange = compareInstant(shift > 0 ? "le" : "ge", column, limit);
+    return positive
+        ? { operator: "and", operands: [solved, inRange] }
+        : { operator: "or", operands: [solved, { operator: "not", operands: [inRange] }] };
+}
+function isTemporalArithmetic(operand) {
+    return ((0, plan_1.isOperatorOperand)(operand) &&
+        (operand.operator === "timeSince" ||
+            ((operand.operator === "add" || operand.operator === "sub") &&
+                operand.operands.some(isTimestampColumn))));
+}
+/** `timestamp(column)`. */
+function isTimestampColumn(operand) {
+    return (operand !== undefined &&
+        (0, plan_1.isOperatorOperand)(operand) &&
+        operand.operator === "timestamp" &&
+        operand.operands.length === 1 &&
+        (0, plan_1.isNamedOperand)(operand.operands[0]));
+}
+const PROTOBUF_DURATION = /^(-)?(\d+)(?:\.(\d{1,9}))?s$/;
+/** A `duration("...")` literal in the planner's protobuf spelling, in whole milliseconds. */
+function durationMilliseconds(operand) {
+    if (!(0, plan_1.isOperatorOperand)(operand) ||
+        operand.operator !== "duration" ||
+        operand.operands.length !== 1) {
+        return undefined;
+    }
+    const [literal] = operand.operands;
+    if (!(0, plan_1.isValueOperand)(literal) || !(0, narrowing_1.isString)(literal.value))
+        return undefined;
+    const match = PROTOBUF_DURATION.exec(literal.value);
+    if (!match)
+        return undefined;
+    const fraction = (match[3] ?? "").padEnd(9, "0");
+    if (fraction.slice(3) !== "000000")
+        return undefined;
+    const milliseconds = Number(match[2]) * 1000 + Number(fraction.slice(0, 3));
+    if (!Number.isSafeInteger(milliseconds))
+        return undefined;
+    return match[1] ? -milliseconds : milliseconds;
+}
+/** A `timestamp("...")` literal at a whole millisecond. */
+function instantMilliseconds(operand) {
+    if (!(0, plan_1.isOperatorOperand)(operand) ||
+        operand.operator !== "timestamp" ||
+        operand.operands.length !== 1) {
+        return undefined;
+    }
+    const [literal] = operand.operands;
+    if (!(0, plan_1.isValueOperand)(literal) || !(0, narrowing_1.isString)(literal.value))
+        return undefined;
+    try {
+        const { iso, subMillisecond } = parseRfc3339Instant(literal.value);
+        return subMillisecond ? undefined : Date.parse(iso);
+    }
+    catch {
+        return undefined;
+    }
+}
+function instantLiteral(milliseconds) {
+    if (!Number.isFinite(milliseconds) ||
+        milliseconds < MIN_INSTANT ||
+        milliseconds > MAX_INSTANT) {
+        return undefined;
+    }
+    return { operator: "timestamp", operands: [{ value: new Date(milliseconds).toISOString() }] };
+}
+function compareInstant(operator, column, instant) {
+    return { operator, operands: [column, instant] };
+}
+//# sourceMappingURL=timestamp.js.map

package/lib/timestamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../src/timestamp.ts"],"names":[],"mappings":";AAAA,oGAAoG;;AA+BpG,oEAUC;AAYD,kDAsDC;AASD,kDAWC;AAuBD,8DAgEC;AAlND,iCAMgB;AAEhB,qCAAqD;AACrD,2CAA6C;AAE7C,MAAM,6BAA6B,GACjC,8HAA8H,CAAC;AAEjI,MAAM,kCAAkC,GAAG,IAAI,CAAC,KAAK,CACnD,0BAA0B,CAC3B,CAAC;AAEF,MAAM,kCAAkC,GAAG,IAAI,CAAC,KAAK,CACnD,0BAA0B,CAC3B,CAAC;AAEF;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,KAAa;IACxD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE3D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,IAAI,kCAAyB,CACjC,kDAAkD,KAAK,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAOD;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,kCAAyB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAElD,IACE,YAAY,CAAC,cAAc,EAAE,KAAK,IAAI;QACtC,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,GAAG,CAAC;QACxC,YAAY,CAAC,UAAU,EAAE,KAAK,GAAG,EACjC,CAAC;QACD,MAAM,IAAI,kCAAyB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,kCAAyB,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IACE,YAAY,GAAG,kCAAkC;QACjD,YAAY,GAAG,kCAAkC,EACjD,CAAC;QACD,MAAM,IAAI,kCAAyB,CACjC,6DAA6D,KAAK,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,2CAA2C;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEjE,IAAI,OAAO,GAAG,kCAAkC,EAAE,CAAC;QACjD,MAAM,IAAI,kCAAyB,CACjC,6DAA6D,KAAK,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,QAAgB;IAClD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI,CAAC;QACV,KAAK,IAAI;YACP,OAAO,IAAI,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,IAAI;YACP,OAAO,IAAI,CAAC;QACd;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,mGAAmG;AAEnG,MAAM,WAAW,GAAG,kCAAkC,CAAC;AACvD,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,yBAAyB,CACvC,IAAqB,EACrB,QAAiB,EACjB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,2BAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9B,QAAQ,GAAG,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/C,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;QAE7C,4CAA4C;QAC5C,OAAO,KAAK,IAAI,cAAc,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAuB,CAAC;IAC5B,IAAI,QAA4B,CAAC;IAEjC,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAClE,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAE3C,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IAE9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEvD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC;IAEpF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAEvE,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;QAClD,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA8B;IAC1D,OAAO,CACL,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC1B,CAAC,OAAO,CAAC,QAAQ,KAAK,WAAW;YAC/B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC;gBACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,2BAA2B;AAC3B,SAAS,iBAAiB,CACxB,OAA0C;IAE1C,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC1B,OAAO,CAAC,QAAQ,KAAK,WAAW;QAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC7B,IAAA,qBAAc,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEzD,6FAA6F;AAC7F,SAAS,oBAAoB,CAAC,OAA8B;IAC1D,IACE,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,KAAK,UAAU;QAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAEnC,IAAI,CAAC,IAAA,qBAAc,EAAC,OAAQ,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEjD,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;AACjD,CAAC;AAED,2DAA2D;AAC3D,SAAS,mBAAmB,CAAC,OAA8B;IACzD,IACE,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC3B,OAAO,CAAC,QAAQ,KAAK,WAAW;QAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAEnC,IAAI,CAAC,IAAA,qBAAc,EAAC,OAAQ,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEnE,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC9B,YAAY,GAAG,WAAW;QAC1B,YAAY,GAAG,WAAW,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,MAA6B,EAC7B,OAA8B;IAE9B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/lib/translate.d.ts

@@ -0,0 +1,20 @@
+import type { PlanExpressionOperand, Value } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { ResolvedOperand, TranslationContext } from "./mapping";
+import type { OperatorOperand } from "./plan";
+/**
+ * Builds a Prisma filter from a Cerbos expression.
+ */
+export declare function buildPrismaFilterFromCerbosExpression(expression: PlanExpressionOperand, context: TranslationContext): PrismaFilter;
+export declare function buildNegatedFilter(operand: PlanExpressionOperand, context: TranslationContext): PrismaFilter;
+/**
+ * Resolves a plan operand into a column reference or a constant. A nested expression that is
+ * neither a timestamp nor foldable arithmetic resolves to the filter it translates to.
+ *
+ * A timestamp literal between two milliseconds is refused unless `allowSubMillisecond` is set, by
+ * a caller that compares it against a column and applies roundSubMillisecond.
+ */
+export declare function resolveOperand(operand: PlanExpressionOperand, context: TranslationContext, allowSubMillisecond?: boolean): ResolvedOperand;
+/** The value of arithmetic over two constant operands, or null when it cannot be folded. */
+export declare function tryFoldValueExpression(expr: OperatorOperand, context: TranslationContext): Value | null;
+//# sourceMappingURL=translate.d.ts.map

package/lib/translate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.d.ts","sourceRoot":"","sources":["../src/translate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAqBjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAQrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAW9C;;GAEG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,qBAAqB,EACjC,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAkFd;AAqCD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,GAC1B,YAAY,CAiHd;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,EAC3B,mBAAmB,UAAQ,GAC1B,eAAe,CAyBjB;AAuED,4FAA4F;AAC5F,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,kBAAkB,GAC1B,KAAK,GAAG,IAAI,CAmBd"}

package/lib/translate.js

@@ -0,0 +1,287 @@
+"use strict";
+// The translator's core: one dispatch from a plan operator to its handler, the negation that
+// every handler shares, and the resolution of an operand into a column or a constant.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPrismaFilterFromCerbosExpression = buildPrismaFilterFromCerbosExpression;
+exports.buildNegatedFilter = buildNegatedFilter;
+exports.resolveOperand = resolveOperand;
+exports.tryFoldValueExpression = tryFoldValueExpression;
+const collections_1 = require("./collections");
+const comparison_1 = require("./comparison");
+const evaluate_1 = require("./evaluate");
+const fields_1 = require("./fields");
+const hierarchy_1 = require("./hierarchy");
+const mapping_1 = require("./mapping");
+const plan_1 = require("./plan");
+const presence_1 = require("./presence");
+const relations_1 = require("./relations");
+const rewrite_1 = require("./rewrite");
+const regex_1 = require("./regex");
+const strings_1 = require("./strings");
+const ternary_1 = require("./ternary");
+const timestamp_1 = require("./timestamp");
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+/**
+ * Builds a Prisma filter from a Cerbos expression.
+ */
+function buildPrismaFilterFromCerbosExpression(expression, context) {
+    // A bare named operand represents a boolean field reference (e.g. `R.attr.booleanAttr`)
+    if ((0, plan_1.isNamedOperand)(expression)) {
+        return (0, fields_1.buildFieldFilter)(booleanFieldReference(expression.name, context), "equals", true);
+    }
+    if (!(0, plan_1.isOperatorOperand)(expression)) {
+        throw new errors_1.UnsupportedQueryPlanError("Invalid Cerbos expression structure");
+    }
+    // Every plan operator this adapter translates. Adding an operator is adding a case here;
+    // anything else is refused as unsupported.
+    const { operator, operands } = expression;
+    (0, plan_1.assertLogicalOperands)(operator, operands);
+    switch (operator) {
+        case "and":
+            return {
+                AND: operands.map((operand) => buildPrismaFilterFromCerbosExpression(operand, context)),
+            };
+        case "or":
+            return {
+                OR: operands.map((operand) => buildPrismaFilterFromCerbosExpression(operand, context)),
+            };
+        case "not": {
+            const operand = operands[0];
+            if (!operand) {
+                throw new errors_1.UnsupportedQueryPlanError("not operator requires an operand");
+            }
+            return buildNegatedFilter(operand, context);
+        }
+        case "if":
+            return (0, ternary_1.handleBooleanTernaryOperator)(operands, context);
+        case "eq":
+        case "ne":
+        case "lt":
+        case "le":
+        case "gt":
+        case "ge":
+            return (0, comparison_1.handleRelationalOperator)(operator, operands, context);
+        case "in":
+            return (0, comparison_1.handleInOperator)(operands, context);
+        case "contains":
+        case "startsWith":
+        case "endsWith":
+            return (0, strings_1.handleStringOperator)(operator, operands, context);
+        case "matches":
+            return (0, regex_1.handleMatchesOperator)(operands, context);
+        case "has":
+            return (0, presence_1.handleHasOperator)(operands, context, false);
+        case "hasIntersection":
+            return (0, collections_1.handleHasIntersectionOperator)(operands, context);
+        case "lambda":
+            return (0, collections_1.handleLambdaOperator)(operands, context);
+        case "exists":
+        case "exists_one":
+        case "all":
+        case "except":
+        case "filter":
+            return (0, collections_1.handleCollectionOperator)(operator, operands, context);
+        case "map":
+            return (0, collections_1.handleMapOperator)(operands, context);
+        case "overlaps":
+            return (0, hierarchy_1.handleOverlapsOperator)(operands, context);
+        case "ancestorOf":
+            return (0, hierarchy_1.handleAncestorDescendantOperator)(operands, context, "ancestor");
+        case "descendentOf":
+            return (0, hierarchy_1.handleAncestorDescendantOperator)(operands, context, "descendant");
+        default:
+            throw new errors_1.UnsupportedQueryPlanError(`Unsupported operator: ${operator}`);
+    }
+}
+/**
+ * Builds the filter for `!expr`. Plain field predicates negate correctly with Prisma's NOT
+ * (SQL three-valued logic keeps NULL rows excluded under both polarities), but relation
+ * subqueries collapse UNKNOWN to false at the EXISTS boundary, so `NOT(some(P))` would
+ * wrongly include rows whose elements make P UNKNOWN (a NULL element column is a missing
+ * attribute — a CEL error — on the check side, which Cerbos treats as deny). Negation is
+ * therefore pushed down to the collection operators, which encode CEL's exact error
+ * semantics:
+ *
+ * - exists(c,P) is TRUE with a true witness, FALSE if every element is definitively false,
+ *   and an ERROR otherwise — so `!exists` admits only rows with no P-match AND no
+ *   UNKNOWN-element (the nullable-field guard).
+ * - all(c,P) is FALSE only with a definitive false witness (a false witness absorbs error
+ *   elements) — so `!all` is `some(NOT P)`, which SQL already evaluates definitively.
+ */
+/**
+ * A field read where CEL needs a boolean. A field declared another type is a no-overload error,
+ * which no Prisma filter keeps out under both polarities, so it is refused.
+ */
+function booleanFieldReference(name, context) {
+    if ((0, mapping_1.lookupMapping)(context.mapper, name)?.relation?.type === "many") {
+        throw new errors_1.UnsupportedQueryPlanError("A list in boolean position is a CEL type error");
+    }
+    const fieldRef = (0, mapping_1.resolveFieldReference)(name, context);
+    if (fieldRef.valueType !== undefined && fieldRef.valueType !== "boolean") {
+        throw new errors_1.UnsupportedQueryPlanError(`A ${fieldRef.valueType} field in boolean position is a CEL type error`);
+    }
+    return fieldRef;
+}
+function buildNegatedFilter(operand, context) {
+    if ((0, plan_1.isOperatorOperand)(operand)) {
+        if (operand.operator === "not") {
+            return buildPrismaFilterFromCerbosExpression((0, plan_1.assertDefined)(operand.operands[0], "not requires an operand"), context);
+        }
+        if (operand.operator === "has") {
+            return (0, presence_1.handleHasOperator)(operand.operands, context, true);
+        }
+        const ternary = (0, ternary_1.tryHandleTernaryComparison)(operand.operator, operand.operands, context, true);
+        if (ternary !== null)
+            return ternary;
+        const lookup = (0, comparison_1.tryHandleMapLiteralLookup)(operand.operator, operand.operands, context, true);
+        if (lookup !== null)
+            return lookup;
+    }
+    if ((0, plan_1.isNamedOperand)(operand)) {
+        const { relations, ...fieldRef } = booleanFieldReference(operand.name, context);
+        if (!relations || relations.length === 0) {
+            return (0, fields_1.buildFieldFilter)(fieldRef, "equals", false);
+        }
+        return (0, relations_1.negateRequiringHops)(operand, buildPrismaFilterFromCerbosExpression(operand, context), context);
+    }
+    // `and`/`or` must be pushed through with De Morgan whenever a branch can be UNKNOWN, so
+    // CEL's error absorption survives: `!(A && B)` with A erroring and B false is TRUE in CEL,
+    // and `OR[!A, !B]` reproduces that where a single outer NOT over the conjunction — with the
+    // hop requirement ANDed outside it — would deny. A to-one hop is the second source of UNKNOWN
+    // besides the collection macros, so it opens the same push-down, and each leaf requires only
+    // the hops it reads itself. (A nested `not` was already unwrapped above.) A lookup into a map literal
+    // is the third: a missing key is an error, which the comparison's own negation leaves out.
+    if ((0, plan_1.isOperatorOperand)(operand) &&
+        ((0, rewrite_1.containsCollectionOperator)(operand) ||
+            (0, comparison_1.containsMapLiteralLookup)(operand) ||
+            (0, relations_1.referencesRequiredHop)(operand, context))) {
+        switch (operand.operator) {
+            case "and":
+                return {
+                    OR: operand.operands.map((o) => buildNegatedFilter(o, context)),
+                };
+            case "or":
+                return {
+                    AND: operand.operands.map((o) => buildNegatedFilter(o, context)),
+                };
+            // `!(c ? a : b)` is `c ? !a : !b`, errors included: a condition that errors errors either
+            // way. A NOT over the guarded-branch disjunction instead selects the rows where the
+            // condition is UNKNOWN, which neither guarded branch matched.
+            case "if":
+                if (operand.operands.length === 3) {
+                    const [condition, thenBranch, elseBranch] = (0, narrowing_1.triple)(operand.operands);
+                    return (0, ternary_1.handleBooleanTernaryOperator)([
+                        condition,
+                        { operator: "not", operands: [thenBranch] },
+                        { operator: "not", operands: [elseBranch] },
+                    ], context);
+                }
+                break;
+            case "exists":
+            case "all":
+            case "except":
+            case "exists_one":
+            case "filter":
+                return (0, collections_1.buildNegatedCollectionFilter)(operand.operator, operand.operands, context);
+        }
+        if ((0, comparison_1.containsMapLiteralLookup)(operand)) {
+            // A missing key is an error under both polarities, which a NOT over the positive filter
+            // would turn into a match; only and/or and the comparison itself push the negation down.
+            throw new errors_1.UnsupportedQueryPlanError(`Cannot negate ${operand.operator} over an index into a map literal: a missing key is an ` +
+                "error under both polarities, and a NOT over its filter would select it");
+        }
+    }
+    return (0, relations_1.negateRequiringHops)(operand, buildPrismaFilterFromCerbosExpression(operand, context), context);
+}
+/**
+ * Resolves a plan operand into a column reference or a constant. A nested expression that is
+ * neither a timestamp nor foldable arithmetic resolves to the filter it translates to.
+ *
+ * A timestamp literal between two milliseconds is refused unless `allowSubMillisecond` is set, by
+ * a caller that compares it against a column and applies roundSubMillisecond.
+ */
+function resolveOperand(operand, context, allowSubMillisecond = false) {
+    if ((0, plan_1.isNamedOperand)(operand)) {
+        return (0, mapping_1.resolveFieldReference)(operand.name, context);
+    }
+    if ((0, plan_1.isValueOperand)(operand)) {
+        return { value: operand.value };
+    }
+    if ((0, plan_1.isOperatorOperand)(operand)) {
+        if (operand.operator === "timestamp") {
+            return resolveTimestampOperand(operand, context, allowSubMillisecond);
+        }
+        const identity = resolveIdentityCast(operand, context);
+        if (identity !== undefined)
+            return identity;
+        const folded = tryFoldValueExpression(operand, context);
+        if (folded !== null)
+            return { value: folded };
+        return { value: buildPrismaFilterFromCerbosExpression(operand, context) };
+    }
+    throw new errors_1.UnsupportedQueryPlanError("Operand must have name, value, or be an expression");
+}
+/**
+ * `string(column)` over a string column and `double(column)` over a number column convert nothing:
+ * the column itself, except that the cast of a null VALUE is an error. The reference is resolved
+ * as one whose NULL is missing, so no comparison against it can select a NULL row.
+ */
+function resolveIdentityCast(expression, context) {
+    const target = (0, narrowing_1.lookup)(IDENTITY_CASTS, expression.operator);
+    const [operand] = expression.operands;
+    if (target === undefined ||
+        expression.operands.length !== 1 ||
+        operand === undefined ||
+        !(0, plan_1.isNamedOperand)(operand)) {
+        return undefined;
+    }
+    const fieldRef = (0, mapping_1.resolveFieldReference)(operand.name, context);
+    if (fieldRef.valueType !== target)
+        return undefined;
+    return { ...fieldRef, nullAttributeRepresentation: "omitted" };
+}
+const IDENTITY_CASTS = { string: "string", double: "number" };
+function resolveTimestampOperand(expression, context, allowSubMillisecond) {
+    if (expression.operands.length !== 1) {
+        throw new errors_1.UnsupportedQueryPlanError("timestamp() requires exactly one operand");
+    }
+    const operand = (0, plan_1.assertDefined)(expression.operands[0], "timestamp() requires an operand");
+    if ((0, plan_1.isNamedOperand)(operand)) {
+        const fieldRef = (0, mapping_1.resolveFieldReference)(operand.name, context);
+        if (fieldRef.valueType !== "dateTime") {
+            throw new errors_1.UnsupportedQueryPlanError(`timestamp() field ${operand.name} must be mapped with valueType: \"dateTime\"`);
+        }
+        return { ...fieldRef, timestampWrapped: true };
+    }
+    if (!(0, plan_1.isValueOperand)(operand) || !(0, narrowing_1.isString)(operand.value)) {
+        throw new errors_1.UnsupportedQueryPlanError("timestamp() requires a field reference or RFC 3339 string");
+    }
+    if (!allowSubMillisecond) {
+        return { value: (0, timestamp_1.normalizeRfc3339Milliseconds)(operand.value) };
+    }
+    const { iso, subMillisecond } = (0, timestamp_1.parseRfc3339Instant)(operand.value);
+    return subMillisecond ? { value: iso, subMillisecond } : { value: iso };
+}
+/** The value of arithmetic over two constant operands, or null when it cannot be folded. */
+function tryFoldValueExpression(expr, context) {
+    if (!evaluate_1.ARITHMETIC_OPERATORS.has(expr.operator))
+        return null;
+    const leftOp = expr.operands[0];
+    const rightOp = expr.operands[1];
+    if (!leftOp || !rightOp)
+        return null;
+    const left = resolveOperand(leftOp, context);
+    if (!(0, mapping_1.isResolvedValue)(left))
+        return null;
+    const right = resolveOperand(rightOp, context);
+    if (!(0, mapping_1.isResolvedValue)(right))
+        return null;
+    try {
+        return (0, evaluate_1.foldArithmetic)(expr.operator, left.value, right.value);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=translate.js.map

package/lib/translate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.js","sourceRoot":"","sources":["../src/translate.ts"],"names":[],"mappings":";AAAA,6FAA6F;AAC7F,sFAAsF;;AA+CtF,sFAqFC;AAqCD,gDAoHC;AASD,wCA6BC;AAwED,wDAsBC;AA7ZD,+CAMuB;AACvB,6CAKsB;AACtB,yCAAkE;AAClE,qCAA4C;AAC5C,2CAGqB;AAErB,uCAAkF;AAElF,iCAMgB;AAEhB,yCAA+C;AAC/C,2CAAyE;AACzE,uCAAuD;AACvD,mCAAgD;AAChD,uCAAiD;AACjD,uCAAqF;AACrF,2CAAgF;AAChF,qCAAqD;AACrD,2CAAuD;AAEvD;;GAEG;AACH,SAAgB,qCAAqC,CACnD,UAAiC,EACjC,OAA2B;IAE3B,wFAAwF;IACxF,IAAI,IAAA,qBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAA,yBAAgB,EACrB,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAC/C,QAAQ,EACR,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAA,wBAAiB,EAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,kCAAyB,CAAC,qCAAqC,CAAC,CAAC;IAC7E,CAAC;IAED,yFAAyF;IACzF,2CAA2C;IAC3C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAC1C,IAAA,4BAAqB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO;gBACL,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,CACxD;aACF,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3B,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,CACxD;aACF,CAAC;QACJ,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,kCAAyB,CAAC,kCAAkC,CAAC,CAAC;YAC1E,CAAC;YAED,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,IAAI;YACP,OAAO,IAAA,sCAA4B,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzD,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,IAAI,CAAC;QACV,KAAK,IAAI;YACP,OAAO,IAAA,qCAAwB,EAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/D,KAAK,IAAI;YACP,OAAO,IAAA,6BAAgB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,IAAA,8BAAoB,EAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,KAAK,SAAS;YACZ,OAAO,IAAA,6BAAqB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,KAAK,KAAK;YACR,OAAO,IAAA,4BAAiB,EAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,iBAAiB;YACpB,OAAO,IAAA,2CAA6B,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,QAAQ;YACX,OAAO,IAAA,kCAAoB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,IAAA,sCAAwB,EAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/D,KAAK,KAAK;YACR,OAAO,IAAA,+BAAiB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,KAAK,UAAU;YACb,OAAO,IAAA,kCAAsB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,KAAK,YAAY;YACf,OAAO,IAAA,4CAAgC,EAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACzE,KAAK,cAAc;YACjB,OAAO,IAAA,4CAAgC,EAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3E;YACE,MAAM,IAAI,kCAAyB,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAA2B;IACtE,IAAI,IAAA,uBAAa,EAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,kCAAyB,CAAC,gDAAgD,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,kCAAyB,CACjC,KAAK,QAAQ,CAAC,SAAS,gDAAgD,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,kBAAkB,CAChC,OAA8B,EAC9B,OAA2B;IAE3B,IAAI,IAAA,wBAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,qCAAqC,CAC1C,IAAA,oBAAa,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,EAC7D,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAA,4BAAiB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,oCAA0B,EACxC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,OAAO,EACP,IAAI,CACL,CAAC;QAEF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QAErC,MAAM,MAAM,GAAG,IAAA,sCAAyB,EACtC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,OAAO,EACP,IAAI,CACL,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IAED,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEhF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,IAAA,yBAAgB,EAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,IAAA,+BAAmB,EACxB,OAAO,EACP,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,EACvD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,8FAA8F;IAC9F,6FAA6F;IAC7F,sGAAsG;IACtG,2FAA2F;IAC3F,IACE,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAC1B,CAAC,IAAA,oCAA0B,EAAC,OAAO,CAAC;YAClC,IAAA,qCAAwB,EAAC,OAAO,CAAC;YACjC,IAAA,iCAAqB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAC1C,CAAC;QACD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,KAAK;gBACR,OAAO;oBACL,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;iBAChE,CAAC;YACJ,KAAK,IAAI;gBACP,OAAO;oBACL,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;iBACjE,CAAC;YACJ,0FAA0F;YAC1F,oFAAoF;YACpF,8DAA8D;YAC9D,KAAK,IAAI;gBACP,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAA,kBAAM,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAErE,OAAO,IAAA,sCAA4B,EACjC;wBACE,SAAS;wBACT,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;wBAC3C,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;qBAC5C,EACD,OAAO,CACR,CAAC;gBACJ,CAAC;gBAED,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,KAAK,CAAC;YACX,KAAK,QAAQ,CAAC;YACd,KAAK,YAAY,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,IAAA,0CAA4B,EACjC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,EAChB,OAAO,CACR,CAAC;QACN,CAAC;QAED,IAAI,IAAA,qCAAwB,EAAC,OAAO,CAAC,EAAE,CAAC;YACtC,wFAAwF;YACxF,yFAAyF;YACzF,MAAM,IAAI,kCAAyB,CACjC,iBAAiB,OAAO,CAAC,QAAQ,yDAAyD;gBACxF,wEAAwE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAA,+BAAmB,EACxB,OAAO,EACP,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,EACvD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,OAA8B,EAC9B,OAA2B,EAC3B,mBAAmB,GAAG,KAAK;IAE3B,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAA,+BAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAA,wBAAiB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACrC,OAAO,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAExD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAE9C,OAAO,EAAE,KAAK,EAAE,qCAAqC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,IAAI,kCAAyB,CAAC,oDAAoD,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,UAA2B,EAC3B,OAA2B;IAE3B,MAAM,MAAM,GAAG,IAAA,kBAAM,EAAC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;IAEtC,IACE,MAAM,KAAK,SAAS;QACpB,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAChC,OAAO,KAAK,SAAS;QACrB,CAAC,IAAA,qBAAc,EAAC,OAAO,CAAC,EACxB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE9D,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEpD,OAAO,EAAE,GAAG,QAAQ,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,cAAc,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAmC,CAAC;AAE/F,SAAS,uBAAuB,CAC9B,UAA2B,EAC3B,OAA2B,EAC3B,mBAA4B;IAE5B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kCAAyB,CAAC,0CAA0C,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,oBAAa,EAC3B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EACtB,iCAAiC,CAClC,CAAC;IAEF,IAAI,IAAA,qBAAc,EAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAA,+BAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAyB,CACjC,qBAAqB,OAAO,CAAC,IAAI,8CAA8C,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,IAAA,qBAAc,EAAC,OAAO,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,kCAAyB,CAAC,2DAA2D,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,IAAA,wCAA4B,EAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,IAAA,+BAAmB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEnE,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,4FAA4F;AAC5F,SAAgB,sBAAsB,CACpC,IAAqB,EACrB,OAA2B;IAE3B,IAAI,CAAC,+BAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE7C,IAAI,CAAC,IAAA,yBAAe,EAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/C,IAAI,CAAC,IAAA,yBAAe,EAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,OAAO,IAAA,yBAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/lib/types.d.ts

@@ -0,0 +1,29 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { ResolvedFieldReference, TranslationContext } from "./mapping";
+import type { NamedOperand } from "./plan";
+/**
+ * Replaces every leaf whose outcome the mapped value types settle with the constant that decides
+ * the same rows, then leaves the rest of the plan to the translator.
+ *
+ * CEL's `&&`, `||` and `!` are Kleene's strong three-valued logic with an error in the role of
+ * UNKNOWN, and `exists`/`all` are its disjunction and conjunction over the elements. Kleene logic
+ * is regular — a formula that is TRUE with an UNKNOWN operand is TRUE whatever that operand is —
+ * so under an even number of negations a leaf that is only ever FALSE or an error decides every
+ * row exactly as a constant FALSE does, and under an odd number a leaf that is only ever TRUE or
+ * an error decides every row exactly as a constant TRUE does. A leaf that can be both TRUE and
+ * FALSE, or that sits where its polarity is not fixed (a ternary condition, an operand of `==`,
+ * the body of `exists_one`), is left for the translator to lower or refuse.
+ */
+export declare function settleTypeMismatches(expr: PlanExpressionOperand, context: TranslationContext, positive?: boolean): PlanExpressionOperand;
+/**
+ * CEL's string() of a double: cel-go's `fmt.Sprintf("%g", d)`, the shortest digits that
+ * round-trip, in exponent form below 1e-4 or from 1e+06.
+ */
+export declare function formatCelDouble(x: number): string;
+/**
+ * A predicate TRUE for a present value of the column and UNKNOWN for a NULL one, spelled with
+ * the plain comparisons the translator leaves to SQL's three-valued logic. Undefined for a column
+ * whose type is not declared.
+ */
+export declare function presence(column: NamedOperand, fieldRef: ResolvedFieldReference): PlanExpressionOperand | undefined;
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAS,MAAM,cAAc,CAAC;AAKjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAM5E,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,QAAQ,CAAC;AAuC5D;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,UAAO,GACd,qBAAqB,CAsEvB;AAqkBD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BjD;AAwPD;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,sBAAsB,GAC/B,qBAAqB,GAAG,SAAS,CAgBnC"}