@cerbos/orm-prisma 4.1.0 → 5.0.0

package/lib/mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapping.d.ts","sourceRoot":"","sources":["../src/mapping.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,2BAA2B,EAC3B,YAAY,EACb,MAAM,SAAS,CAAC;AAOjB,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;CACzC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAEjF;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,YAAY,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,GAAG,CAAC;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,sBAAsB,GAAG,aAAa,CAAC;AAErE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,GACvB,OAAO,IAAI,sBAAsB,CAEnC;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,eAAe,GACvB,OAAO,IAAI,aAAa,CAE1B;AAED,oGAAoG;AACpG,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAET;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAQnD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,YAAY,GAAG,SAAS,CAE1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,SAAS,CAwB1C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAqB7E;AAcD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,kBAAkB,GAC1B,sBAAsB,CAoGxB;AAuBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,eAAe,GACxB,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,kBAAkB,EAC3B,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,WAAW,GACjB,kBAAkB,CAiFpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,2BAA2B,GACrC,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,CAAC,EAAE,2BAA2B,GACrC,IAAI,CAoBN"}

package/lib/mapping.js

@@ -0,0 +1,316 @@
+"use strict";
+// Resolving plan references through the caller's mapper, and the per-translation state that
+// resolution reads: the mapper in scope, the root model, the null convention and the lambda scopes.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentScope = currentScope;
+exports.isResolvedFieldReference = isResolvedFieldReference;
+exports.isResolvedValue = isResolvedValue;
+exports.isExplicitNullReference = isExplicitNullReference;
+exports.getLeafField = getLeafField;
+exports.lookupMapping = lookupMapping;
+exports.lookupElementFields = lookupElementFields;
+exports.namesToOneRelation = namesToOneRelation;
+exports.resolveFieldReference = resolveFieldReference;
+exports.recordErroringNullElement = recordErroringNullElement;
+exports.enterLambdaScope = enterLambdaScope;
+exports.assertNullOperandTranslatable = assertNullOperandTranslatable;
+exports.assertStructuralNulls = assertStructuralNulls;
+const plan_1 = require("./plan");
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+/** The innermost lambda scope, if the translation is inside one. */
+function currentScope(context) {
+    return context.scopes[context.scopes.length - 1];
+}
+function isResolvedFieldReference(operand) {
+    return "path" in operand;
+}
+function isResolvedValue(operand) {
+    return "value" in operand;
+}
+/** Whether this reference is one the caller sends as an explicit `null` when the column is NULL. */
+function isExplicitNullReference(fieldRef) {
+    return fieldRef.nullAttributeRepresentation === "explicit";
+}
+function getLeafField(path) {
+    const fieldName = path[path.length - 1];
+    if (!fieldName) {
+        throw new Error("Field path cannot be empty");
+    }
+    return fieldName;
+}
+/** The mapping the caller declared for `key`, through either mapper form. */
+function lookupMapping(mapper, key) {
+    return (0, narrowing_1.isFunction)(mapper) ? mapper(key) : mapper[key];
+}
+/**
+ * The element field mappings of the collection at `collectionPath`. A chained collection
+ * (`R.attr.a.b`) has no mapping of its own, so it is found by descending from the longest mapped
+ * prefix through the nested `relation.fields`, the same walk resolveFieldReference performs.
+ */
+function lookupElementFields(mapper, collectionPath) {
+    const direct = lookupMapping(mapper, collectionPath);
+    if (direct) {
+        return direct.relation?.fields;
+    }
+    const parts = collectionPath.split(".");
+    for (let i = parts.length - 1; i > 0; i--) {
+        let relation = lookupMapping(mapper, parts.slice(0, i).join("."))?.relation;
+        if (!relation) {
+            continue;
+        }
+        for (const part of parts.slice(i)) {
+            relation = relation?.fields?.[part]?.relation;
+        }
+        return relation?.fields;
+    }
+    return undefined;
+}
+/**
+ * Whether `reference` names a to-one relation itself, rather than a column reached through it.
+ * CEL reads such a relation as a map whose keys are the attribute names present on the related
+ * row, and no Prisma filter enumerates those.
+ */
+function namesToOneRelation(mapper, reference) {
+    const direct = lookupMapping(mapper, reference)?.relation;
+    if (direct)
+        return direct.type === "one" && direct.field === undefined;
+    const parts = reference.split(".");
+    for (let i = parts.length - 1; i > 0; i--) {
+        let relation = lookupMapping(mapper, parts.slice(0, i).join("."))?.relation;
+        if (!relation) {
+            continue;
+        }
+        for (const part of parts.slice(i)) {
+            relation = relation?.fields?.[part]?.relation;
+        }
+        return relation?.type === "one" && relation.field === undefined;
+    }
+    return false;
+}
+function toRelationConfig(relation) {
+    return {
+        name: relation.name,
+        type: relation.type,
+        model: relation.model,
+        field: relation.field,
+        subqueryFilter: relation.subqueryFilter,
+    };
+}
+/**
+ * Resolves a field reference considering relations and nested fields.
+ */
+function resolveFieldReference(reference, context) {
+    const parts = reference.split(".");
+    const config = lookupMapping(context.mapper, reference);
+    // Without a direct match, the longest dotted prefix that has a mapping applies.
+    let matchedPrefix = "";
+    let matchedConfig;
+    if (!config) {
+        for (let i = parts.length - 1; i >= 0; i--) {
+            const prefix = parts.slice(0, i + 1).join(".");
+            const prefixConfig = lookupMapping(context.mapper, prefix);
+            if (prefixConfig) {
+                matchedPrefix = prefix;
+                matchedConfig = prefixConfig;
+                break;
+            }
+        }
+    }
+    const activeConfig = config ?? matchedConfig;
+    // A scalar column has no keys: reading one beneath it would compare the column itself.
+    if (!config && matchedConfig && !matchedConfig.relation) {
+        throw new errors_1.UnsupportedQueryPlanError(`"${reference}" reads "${reference.slice(matchedPrefix.length + 1)}" beneath "${matchedPrefix}", which is mapped to a scalar field; map the full reference`);
+    }
+    if (!activeConfig?.relation) {
+        return {
+            path: [activeConfig?.field || reference],
+            valueType: activeConfig?.valueType,
+            nullable: activeConfig?.nullable,
+            nullAttributeRepresentation: activeConfig?.nullAttributeRepresentation,
+        };
+    }
+    const { fields } = activeConfig.relation;
+    const remainingParts = matchedPrefix
+        ? parts.slice(matchedPrefix.split(".").length)
+        : [];
+    const lastPart = parts[parts.length - 1];
+    // A function mapper may return a relation config for the full leaf reference.
+    // Resolve that leaf here too, before any filter is constructed.
+    let field = activeConfig.relation.field ??
+        (config && fields && lastPart
+            ? (fields[lastPart]?.field ?? lastPart)
+            : undefined);
+    const relations = [toRelationConfig(activeConfig.relation)];
+    // Walk the remaining segments through nested relation mappings; the first segment that is
+    // not a relation names the leaf column.
+    let leafConfig;
+    if (fields) {
+        let currentMapper = fields;
+        let currentParts = remainingParts;
+        while (currentParts.length > 0) {
+            const currentPart = currentParts[0];
+            if (!currentPart) {
+                break;
+            }
+            const nextConfig = currentMapper[currentPart];
+            if (!nextConfig?.relation) {
+                const leafPart = currentParts[currentParts.length - 1];
+                if (leafPart) {
+                    field = nextConfig?.field || leafPart;
+                }
+                if (currentParts.length === 1)
+                    leafConfig = nextConfig;
+                break;
+            }
+            relations.push(toRelationConfig(nextConfig.relation));
+            field = nextConfig.relation.field;
+            currentMapper = nextConfig.relation.fields || {};
+            currentParts = currentParts.slice(1);
+        }
+    }
+    return {
+        path: field ? [field] : remainingParts,
+        relations,
+        // A column reached through a relation is typed by its own entry in `relation.fields`.
+        valueType: leafConfig?.valueType ?? activeConfig.valueType,
+        nullable: leafConfig ? leafConfig.nullable : activeConfig.nullable,
+        nullAttributeRepresentation: activeConfig.nullAttributeRepresentation,
+    };
+}
+/**
+ * Records that the lambda body being built touches a nullable element column, so the
+ * enclosing collection operator can add its three-valued-logic guard.
+ *
+ * An element column is nullable unless its mapping says `nullable: false`. Omitting the guard is
+ * what over-grants (a negated `exists`, an `all` or a `hasIntersection` over `map` would admit
+ * rows holding a NULL element the PDP denies), so silence has to mean the safe reading. A
+ * nested relation is not a column and never gets a NULL guard.
+ */
+function recordNullableElementField(context, config, defaultField) {
+    if (config.nullable === false || config.relation) {
+        return;
+    }
+    currentScope(context)?.nullableFields.add(config.field || defaultField);
+}
+/**
+ * Records that `operand`, the bare variable of a projected scalar list (`tagNames.all(t, ...)`),
+ * is read by a function that raises an error on a null element (`t.startsWith(...)`,
+ * `t.upperAscii()`). A null element of such a list is a VALUE, so resolving the variable records
+ * nothing; it is the function that errors, and the enclosing macro needs the same guard as for a
+ * missing element column.
+ */
+function recordErroringNullElement(context, operand, resolved) {
+    if (!(0, plan_1.isNamedOperand)(operand) || !isResolvedFieldReference(resolved))
+        return;
+    if (resolved.nullable === false || (resolved.relations?.length ?? 0) > 0)
+        return;
+    const scope = [...context.scopes]
+        .reverse()
+        .find((candidate) => candidate.variableName === operand.name);
+    scope?.nullableFields.add(getLeafField(resolved.path));
+}
+/**
+ * The context for a lambda body iterating `collectionPath`: `scope` is pushed, and references
+ * to the lambda variable resolve against the collection's element mapping.
+ */
+function enterLambdaScope(context, collectionPath, scope) {
+    const scopedContext = {
+        ...context,
+        scopes: [...context.scopes, scope],
+    };
+    const { variableName } = scope;
+    const fullMapper = context.mapper;
+    const scopedMapper = (key) => {
+        if (key === variableName) {
+            const { relations } = resolveFieldReference(collectionPath, scopedContext);
+            const projection = relations?.[relations.length - 1]?.field;
+            if (projection) {
+                return {
+                    field: projection,
+                    valueType: lookupMapping(fullMapper, collectionPath)?.valueType ??
+                        lookupElementFields(fullMapper, collectionPath)?.[projection]?.valueType,
+                    // A projected list carries null values, unlike missing fields on object elements.
+                    nullAttributeRepresentation: "explicit",
+                    nullable: lookupElementFields(fullMapper, collectionPath)?.[projection]?.nullable,
+                };
+            }
+        }
+        // A key that starts with the variable name accesses the collection element.
+        if (key.startsWith(variableName + ".")) {
+            const strippedKey = key.replace(variableName + ".", "");
+            const baseConfig = lookupElementFields(fullMapper, collectionPath);
+            if (!baseConfig) {
+                const fieldConfig = { field: strippedKey };
+                if (!strippedKey.includes(".")) {
+                    recordNullableElementField(scopedContext, fieldConfig, strippedKey);
+                }
+                return fieldConfig;
+            }
+            // For nested paths, traverse the fields configuration.
+            const parts = strippedKey.split(".");
+            let currentConfig = baseConfig;
+            let field = parts[0] || strippedKey;
+            for (let i = 0; i < parts.length - 1; i++) {
+                const part = parts[i];
+                const nextPart = parts[i + 1];
+                if (!part || !nextPart) {
+                    break;
+                }
+                const nextFields = currentConfig[part]?.relation?.fields;
+                if (!nextFields) {
+                    break;
+                }
+                currentConfig = nextFields;
+                field = nextPart;
+            }
+            // The field config if it exists, otherwise a default one.
+            const fieldConfig = currentConfig[field] || { field };
+            recordNullableElementField(scopedContext, fieldConfig, field);
+            return fieldConfig;
+        }
+        // Keys not referencing the collection element resolve through the enclosing mapper.
+        if ((0, narrowing_1.isFunction)(fullMapper)) {
+            return fullMapper(key);
+        }
+        return fullMapper[key] || { field: key };
+    };
+    return { ...scopedContext, mapper: scopedMapper };
+}
+/**
+ * Guards every site that would emit a NULL-selecting predicate out of a `null` comparison
+ * operand.
+ *
+ * Under the `"omitted"` representation a NULL column carries no attribute, so CEL raises a
+ * missing-attribute error and `check()` denies the row — `IS NULL` would return exactly the rows
+ * the PDP refuses. The rejection is deliberately wider than the over-granting shapes: `ne(x,
+ * null)` on its own is aligned, but Prisma applies negation by wrapping (`{ NOT: ... }`) rather
+ * than by pushing it into the leaf, so a leaf cannot tell whether an enclosing `not` will flip
+ * `IS NOT NULL` back into a NULL-selecting predicate. Rejecting every null operand is correct
+ * under any nesting; narrowing it requires negation-parity tracking.
+ */
+function assertNullOperandTranslatable(translation, context, declared) {
+    if ((declared ?? translation.nullRepresentation) === "omitted") {
+        throw new errors_1.UnsupportedQueryPlanError(`Cannot translate ${context} under nullAttributeRepresentation "omitted": a NULL column ` +
+            "sends no attribute, so Cerbos evaluates the comparison as a missing-attribute error " +
+            "(deny) while a NULL-selecting filter would return those rows. Send NULL columns as " +
+            'explicit nulls and use "explicit", or keep this shape out of the policy.');
+    }
+}
+/**
+ * Applies the null-operand guard to struct literals (`set-field` members) anywhere in the plan,
+ * under the convention of the attribute each literal is compared with.
+ */
+function assertStructuralNulls(operand, context, declared) {
+    if (!(0, plan_1.isOperatorOperand)(operand))
+        return;
+    const sibling = operand.operands.find(plan_1.isNamedOperand);
+    const mapping = sibling && lookupMapping(context.mapper, sibling.name);
+    const convention = mapping?.nullAttributeRepresentation ?? declared;
+    if (operand.operator === "set-field" &&
+        operand.operands.some((part) => (0, plan_1.isValueOperand)(part) && part.value === null)) {
+        assertNullOperandTranslatable(context, "a null member in a struct literal", convention);
+    }
+    operand.operands.forEach((part) => assertStructuralNulls(part, context, convention));
+}
+//# sourceMappingURL=mapping.js.map

package/lib/mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mapping.js","sourceRoot":"","sources":["../src/mapping.ts"],"names":[],"mappings":";AAAA,4FAA4F;AAC5F,oGAAoG;;AA+BpG,oCAEC;AA8BD,4DAIC;AAED,0CAIC;AAGD,0DAIC;AAED,oCAQC;AAGD,sCAKC;AAOD,kDA2BC;AAOD,gDAqBC;AAiBD,sDAuGC;AA8BD,8DAcC;AAMD,4CAqFC;AAcD,sEAaC;AAMD,sDAwBC;AA9cD,iCAA2E;AAC3E,qCAAqD;AACrD,2CAAyC;AAkBzC,oEAAoE;AACpE,SAAgB,YAAY,CAAC,OAA2B;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC;AA8BD,SAAgB,wBAAwB,CACtC,OAAwB;IAExB,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAED,SAAgB,eAAe,CAC7B,OAAwB;IAExB,OAAO,OAAO,IAAI,OAAO,CAAC;AAC5B,CAAC;AAED,oGAAoG;AACpG,SAAgB,uBAAuB,CACrC,QAAgC;IAEhC,OAAO,QAAQ,CAAC,2BAA2B,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAgB,YAAY,CAAC,IAAc;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAExC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAgB,aAAa,CAC3B,MAAc,EACd,GAAW;IAEX,OAAO,IAAA,sBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,MAAc,EACd,cAAsB;IAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAErD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC;QAE5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QAChD,CAAC;QAED,OAAO,QAAQ,EAAE,MAAM,CAAC;IAC1B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,MAAc,EAAE,SAAiB;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;IAE1D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC;QAE5E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QAChD,CAAC;QAED,OAAO,QAAQ,EAAE,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA+C;IAE/C,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,SAAiB,EACjB,OAA2B;IAE3B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAExD,gFAAgF;IAChF,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,aAAuC,CAAC;IAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAE3D,IAAI,YAAY,EAAE,CAAC;gBACjB,aAAa,GAAG,MAAM,CAAC;gBACvB,aAAa,GAAG,YAAY,CAAC;gBAC7B,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAI,aAAa,CAAC;IAE7C,uFAAuF;IACvF,IAAI,CAAC,MAAM,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,kCAAyB,CACjC,IAAI,SAAS,YAAY,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,cAAc,aAAa,8DAA8D,CAC5J,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,IAAI,SAAS,CAAC;YACxC,SAAS,EAAE,YAAY,EAAE,SAAS;YAClC,QAAQ,EAAE,YAAY,EAAE,QAAQ;YAChC,2BAA2B,EAAE,YAAY,EAAE,2BAA2B;SACvE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC;IAEzC,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEzC,8EAA8E;IAC9E,gEAAgE;IAChE,IAAI,KAAK,GACP,YAAY,CAAC,QAAQ,CAAC,KAAK;QAC3B,CAAC,MAAM,IAAI,MAAM,IAAI,QAAQ;YAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,0FAA0F;IAC1F,wCAAwC;IACxC,IAAI,UAAoC,CAAC;IAEzC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,aAAa,GAAiC,MAAM,CAAC;QACzD,IAAI,YAAY,GAAG,cAAc,CAAC;QAElC,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAEpC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM;YACR,CAAC;YAED,MAAM,UAAU,GAA6B,aAAa,CAAC,WAAW,CAAC,CAAC;YAExE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAEvD,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,QAAQ,CAAC;gBACxC,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;oBAAE,UAAU,GAAG,UAAU,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtD,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClC,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;YACjD,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc;QACtC,SAAS;QACT,sFAAsF;QACtF,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,YAAY,CAAC,SAAS;QAC1D,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ;QAClE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,OAA2B,EAC3B,MAAoB,EACpB,YAAoB;IAEpB,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IAED,YAAY,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CACvC,OAA2B,EAC3B,OAA8B,EAC9B,QAAyB;IAEzB,IAAI,CAAC,IAAA,qBAAc,EAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC;QAAE,OAAO;IAE5E,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO;IAEjF,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;SAC9B,OAAO,EAAE;SACT,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,OAA2B,EAC3B,cAAsB,EACtB,KAAkB;IAElB,MAAM,aAAa,GAAuB;QACxC,GAAG,OAAO;QACV,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;KACnC,CAAC;IAEF,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAElC,MAAM,YAAY,GAAW,CAAC,GAAW,EAAE,EAAE;QAC3C,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;YAE5D,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE,UAAU;oBACjB,SAAS,EACP,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,SAAS;wBACpD,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS;oBAC1E,kFAAkF;oBAClF,2BAA2B,EAAE,UAAU;oBACvC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ;iBAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAEnE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBAE3C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,0BAA0B,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;gBACtE,CAAC;gBAED,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,uDAAuD;YACvD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,aAAa,GAAG,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;YAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAE9B,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACvB,MAAM;gBACR,CAAC;gBAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAEzD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM;gBACR,CAAC;gBAED,aAAa,GAAG,UAAU,CAAC;gBAC3B,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YAED,0DAA0D;YAC1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACtD,0BAA0B,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAE9D,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,oFAAoF;QACpF,IAAI,IAAA,sBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,6BAA6B,CAC3C,WAA+B,EAC/B,OAAe,EACf,QAAsC;IAEtC,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAyB,CACjC,oBAAoB,OAAO,8DAA8D;YACvF,sFAAsF;YACtF,qFAAqF;YACrF,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,OAA8B,EAC9B,OAA2B,EAC3B,QAAsC;IAEtC,IAAI,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC;QAAE,OAAO;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,qBAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,EAAE,2BAA2B,IAAI,QAAQ,CAAC;IAEpE,IACE,OAAO,CAAC,QAAQ,KAAK,WAAW;QAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,qBAAc,EAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAC5E,CAAC;QACD,6BAA6B,CAC3B,OAAO,EACP,mCAAmC,EACnC,UAAU,CACX,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/lib/narrowing.d.ts

@@ -0,0 +1,12 @@
+import type { Value } from "@cerbos/core";
+export declare const isString: <T>(value: T) => value is T & string;
+export declare const isNumber: <T>(value: T) => value is T & number;
+export declare const isBoolean: <T>(value: T) => value is T & boolean;
+export declare const isFunction: <T>(value: T) => value is Extract<T, Function>;
+export declare const isObject: <T>(value: T) => value is T & object;
+export declare const typeofValue: (value: Value) => "string" | "number" | "boolean" | "object";
+export declare const lookup: <T extends object>(table: T, key: PropertyKey) => T[keyof T] | undefined;
+export declare const single: <T>([a]: readonly T[]) => [T];
+export declare const pair: <T>([a, b]: readonly T[]) => [T, T];
+export declare const triple: <T>([a, b, c]: readonly T[]) => [T, T, T];
+//# sourceMappingURL=narrowing.d.ts.map

package/lib/narrowing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrowing.d.ts","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,KAAK,IAAI,CAAC,GAAG,MAAmC,CAAC;AAExF,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,KAAK,IAAI,CAAC,GAAG,MAAmC,CAAC;AAExF,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,KAAK,IAAI,CAAC,GAAG,OAAqC,CAAC;AAE3F,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAgC,CAAC;AAEtG,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,KAAK,IAAI,CAAC,GAAG,MAAqD,CAAC;AAE1G,eAAO,MAAM,WAAW,GAAI,OAAO,KAAK,KAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QACsB,CAAC;AAIpG,eAAO,MAAM,MAAM,GAAI,CAAC,SAAS,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,WAAW,KAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,SACtC,CAAC;AAM9C,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,KAAG,CAAC,CAAC,CAA4B,CAAC;AAE7E,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,QAAQ,SAAS,CAAC,EAAE,KAAG,CAAC,CAAC,EAAE,CAAC,CAAmD,CAAC;AAExG,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,WAAW,SAAS,CAAC,EAAE,KAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAI3D,CAAC"}

package/lib/narrowing.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.triple = exports.pair = exports.single = exports.lookup = exports.typeofValue = exports.isObject = exports.isFunction = exports.isBoolean = exports.isNumber = exports.isString = void 0;
+const isString = (value) => typeof value === "string";
+exports.isString = isString;
+const isNumber = (value) => typeof value === "number";
+exports.isNumber = isNumber;
+const isBoolean = (value) => typeof value === "boolean";
+exports.isBoolean = isBoolean;
+const isFunction = (value) => typeof value === "function";
+exports.isFunction = isFunction;
+const isObject = (value) => typeof value === "object" && value !== null;
+exports.isObject = isObject;
+const typeofValue = (value) => (0, exports.isString)(value) ? "string" : (0, exports.isNumber)(value) ? "number" : (0, exports.isBoolean)(value) ? "boolean" : "object";
+exports.typeofValue = typeofValue;
+const hasKey = (table, key) => Object.hasOwn(table, key);
+const lookup = (table, key) => hasKey(table, key) ? table[key] : undefined;
+exports.lookup = lookup;
+const missingOperand = () => {
+    throw new Error("An expression is missing an operand");
+};
+const single = ([a]) => [a ?? missingOperand()];
+exports.single = single;
+const pair = ([a, b]) => [a ?? missingOperand(), b ?? missingOperand()];
+exports.pair = pair;
+const triple = ([a, b, c]) => [
+    a ?? missingOperand(),
+    b ?? missingOperand(),
+    c ?? missingOperand(),
+];
+exports.triple = triple;
+//# sourceMappingURL=narrowing.js.map

package/lib/narrowing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrowing.js","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":";;;AAEO,MAAM,QAAQ,GAAG,CAAI,KAAQ,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;AAA3E,QAAA,QAAQ,YAAmE;AAEjF,MAAM,QAAQ,GAAG,CAAI,KAAQ,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;AAA3E,QAAA,QAAQ,YAAmE;AAEjF,MAAM,SAAS,GAAG,CAAI,KAAQ,EAAwB,EAAE,CAAC,OAAO,KAAK,KAAK,SAAS,CAAC;AAA9E,QAAA,SAAS,aAAqE;AAEpF,MAAM,UAAU,GAAG,CAAI,KAAQ,EAAiC,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC;AAAzF,QAAA,UAAU,cAA+E;AAE/F,MAAM,QAAQ,GAAG,CAAI,KAAQ,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAA7F,QAAA,QAAQ,YAAqF;AAEnG,MAAM,WAAW,GAAG,CAAC,KAAY,EAA8C,EAAE,CACtF,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,gBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,iBAAS,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AADvF,QAAA,WAAW,eAC4E;AAEpG,MAAM,MAAM,GAAG,CAAmB,KAAQ,EAAE,GAAgB,EAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAG,CAAmB,KAAQ,EAAE,GAAgB,EAA0B,EAAE,CAC7F,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AADjC,QAAA,MAAM,UAC2B;AAE9C,MAAM,cAAc,GAAG,GAAU,EAAE;IACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEK,MAAM,MAAM,GAAG,CAAI,CAAC,CAAC,CAAe,EAAO,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;AAAhE,QAAA,MAAM,UAA0D;AAEtE,MAAM,IAAI,GAAG,CAAI,CAAC,CAAC,EAAE,CAAC,CAAe,EAAU,EAAE,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;AAA3F,QAAA,IAAI,QAAuF;AAEjG,MAAM,MAAM,GAAG,CAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAe,EAAa,EAAE,CAAC;IAC/D,CAAC,IAAI,cAAc,EAAE;IACrB,CAAC,IAAI,cAAc,EAAE;IACrB,CAAC,IAAI,cAAc,EAAE;CACtB,CAAC;AAJW,QAAA,MAAM,UAIjB"}

package/lib/plan.d.ts

@@ -0,0 +1,49 @@
+import type { PlanExpressionOperand, Value } from "@cerbos/core";
+export interface NamedOperand {
+    name: string;
+}
+export interface ValueOperand {
+    value: Value;
+}
+export interface OperatorOperand {
+    operator: string;
+    operands: PlanExpressionOperand[];
+}
+export declare function isNamedOperand(operand: PlanExpressionOperand): operand is NamedOperand;
+export declare function isValueOperand(operand: PlanExpressionOperand): operand is ValueOperand;
+export declare function isOperatorOperand(operand: PlanExpressionOperand): operand is OperatorOperand;
+export declare function assertDefined<T>(value: T | undefined, message: string): T;
+/**
+ * Refuses an `and`/`or` with no operands. The planner never emits one, and neither empty form has
+ * a safe rendering: `{ AND: [] }` is true in Prisma and matches every row, and the constant folder
+ * would reduce an empty `and` to `true` (an unconditional filter) before the translator saw it. A
+ * malformed plan is a bug report, never a filter.
+ */
+export declare function assertLogicalOperands(operator: string, operands: PlanExpressionOperand[]): void;
+/** The Prisma scalar filter each Cerbos comparison operator lowers to. */
+export declare const CERBOS_TO_PRISMA_OPERATOR: {
+    eq: string;
+    ne: string;
+    lt: string;
+    le: string;
+    gt: string;
+    ge: string;
+};
+/** The Cerbos comparison operators: exactly the keys of CERBOS_TO_PRISMA_OPERATOR. */
+export declare const COMPARISON_OPERATORS: ReadonlySet<string>;
+/** The operator that holds when the two operands of `operator` swap sides. */
+export declare function mirrorOperator(operator: string): string;
+type BinaryComparison = {
+    operator: string;
+    operands: PlanExpressionOperand[];
+};
+/**
+ * Normalize a binary comparison to field-side-first. The planner preserves policy source
+ * order, so a constant may precede the field it constrains (`1 < R.attr.x` arrives as
+ * `lt(value, variable)`) — swap the operands and mirror directional operators so downstream
+ * handlers can assume the field/expression side is first. Without this, value-first
+ * comparisons are silently inverted (#256).
+ */
+export declare function normalizeBinaryOperands(operator: string, operands: PlanExpressionOperand[]): BinaryComparison;
+export {};
+//# sourceMappingURL=plan.d.ts.map

package/lib/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAIjE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CACnC;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,IAAI,YAAY,CAEzB;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,IAAI,YAAY,CAEzB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,IAAI,eAAe,CAO5B;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAMzE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,GAChC,IAAI,CAQN;AAED,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB;;;;;;;CAOJ,CAAC;AAEnC,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAEpD,CAAC;AAUF,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC;AAEhF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,qBAAqB,EAAE,GAChC,gBAAgB,CAclB"}

package/lib/plan.js

@@ -0,0 +1,86 @@
+"use strict";
+// Reading the planner's expression tree: operand shapes, and the comparison-operator tables every
+// handler shares.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPARISON_OPERATORS = exports.CERBOS_TO_PRISMA_OPERATOR = void 0;
+exports.isNamedOperand = isNamedOperand;
+exports.isValueOperand = isValueOperand;
+exports.isOperatorOperand = isOperatorOperand;
+exports.assertDefined = assertDefined;
+exports.assertLogicalOperands = assertLogicalOperands;
+exports.mirrorOperator = mirrorOperator;
+exports.normalizeBinaryOperands = normalizeBinaryOperands;
+const errors_1 = require("./errors");
+const narrowing_1 = require("./narrowing");
+function isNamedOperand(operand) {
+    return "name" in operand && typeof operand.name === "string";
+}
+function isValueOperand(operand) {
+    return "value" in operand && operand.value !== undefined;
+}
+function isOperatorOperand(operand) {
+    return ("operator" in operand &&
+        typeof operand.operator === "string" &&
+        "operands" in operand &&
+        Array.isArray(operand.operands));
+}
+function assertDefined(value, message) {
+    if (value === undefined) {
+        throw new errors_1.UnsupportedQueryPlanError(message);
+    }
+    return value;
+}
+/**
+ * Refuses an `and`/`or` with no operands. The planner never emits one, and neither empty form has
+ * a safe rendering: `{ AND: [] }` is true in Prisma and matches every row, and the constant folder
+ * would reduce an empty `and` to `true` (an unconditional filter) before the translator saw it. A
+ * malformed plan is a bug report, never a filter.
+ */
+function assertLogicalOperands(operator, operands) {
+    if ((operator === "and" || operator === "or") && operands.length === 0) {
+        throw new errors_1.UnsupportedQueryPlanError(`${operator} requires at least one operand: an empty ${operator} is not something the ` +
+            "planner emits, and translating it would produce an unconditional filter " +
+            "({ AND: [] } matches every row)");
+    }
+}
+/** The Prisma scalar filter each Cerbos comparison operator lowers to. */
+exports.CERBOS_TO_PRISMA_OPERATOR = {
+    eq: "equals",
+    ne: "not",
+    lt: "lt",
+    le: "lte",
+    gt: "gt",
+    ge: "gte",
+};
+/** The Cerbos comparison operators: exactly the keys of CERBOS_TO_PRISMA_OPERATOR. */
+exports.COMPARISON_OPERATORS = new Set(Object.keys(exports.CERBOS_TO_PRISMA_OPERATOR));
+// Directional operators mirror when their operands swap sides; symmetric operators are unchanged.
+const MIRRORED_OPERATOR = {
+    lt: "gt",
+    gt: "lt",
+    le: "ge",
+    ge: "le",
+};
+/** The operator that holds when the two operands of `operator` swap sides. */
+function mirrorOperator(operator) {
+    return (0, narrowing_1.lookup)(MIRRORED_OPERATOR, operator) ?? operator;
+}
+/**
+ * Normalize a binary comparison to field-side-first. The planner preserves policy source
+ * order, so a constant may precede the field it constrains (`1 < R.attr.x` arrives as
+ * `lt(value, variable)`) — swap the operands and mirror directional operators so downstream
+ * handlers can assume the field/expression side is first. Without this, value-first
+ * comparisons are silently inverted (#256).
+ */
+function normalizeBinaryOperands(operator, operands) {
+    const [first, second] = operands;
+    if (operands.length === 2 &&
+        first !== undefined &&
+        second !== undefined &&
+        isValueOperand(first) &&
+        !isValueOperand(second)) {
+        return { operator: mirrorOperator(operator), operands: [second, first] };
+    }
+    return { operator, operands };
+}
+//# sourceMappingURL=plan.js.map

package/lib/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":";AAAA,kGAAkG;AAClG,kBAAkB;;;AAmBlB,wCAIC;AAED,wCAIC;AAED,8CASC;AAED,sCAMC;AAQD,sDAWC;AA0BD,wCAEC;AAWD,0DAiBC;AAxHD,qCAAqD;AACrD,2CAAqC;AAerC,SAAgB,cAAc,CAC5B,OAA8B;IAE9B,OAAO,MAAM,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/D,CAAC;AAED,SAAgB,cAAc,CAC5B,OAA8B;IAE9B,OAAO,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED,SAAgB,iBAAiB,CAC/B,OAA8B;IAE9B,OAAO,CACL,UAAU,IAAI,OAAO;QACrB,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,UAAU,IAAI,OAAO;QACrB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAI,KAAoB,EAAE,OAAe;IACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,kCAAyB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,QAAgB,EAChB,QAAiC;IAEjC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,kCAAyB,CACjC,GAAG,QAAQ,4CAA4C,QAAQ,wBAAwB;YACrF,0EAA0E;YAC1E,iCAAiC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC7D,QAAA,yBAAyB,GAAG;IACvC,EAAE,EAAE,QAAQ;IACZ,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,KAAK;IACT,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,KAAK;CACuB,CAAC;AAEnC,sFAAsF;AACzE,QAAA,oBAAoB,GAAwB,IAAI,GAAG,CAC9D,MAAM,CAAC,IAAI,CAAC,iCAAyB,CAAC,CACvC,CAAC;AAEF,kGAAkG;AAClG,MAAM,iBAAiB,GAAG;IACxB,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;CACwB,CAAC;AAEnC,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAA,kBAAM,EAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;AACzD,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,QAAiC;IAEjC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC;IAEjC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,KAAK,KAAK,SAAS;QACnB,MAAM,KAAK,SAAS;QACpB,cAAc,CAAC,KAAK,CAAC;QACrB,CAAC,cAAc,CAAC,MAAM,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/lib/presence.d.ts

@@ -0,0 +1,25 @@
+import type { PlanExpressionOperand } from "@cerbos/core";
+import type { PrismaFilter } from "./index";
+import type { TranslationContext } from "./mapping";
+import type { OperatorOperand } from "./plan";
+/**
+ * `has(ref)`, or `!has(ref)` when `negated`.
+ *
+ * Presence is a property of the caller's null convention, not of the column: an attribute sent as
+ * an explicit null is present, so `has()` is true for every row, and one omitted when its column
+ * is NULL is present exactly when the column is not NULL. Element columns inside a lambda follow
+ * the omitted convention unless they are declared `nullable: false`, as the collection macros
+ * already assume. A to-one relation is present when the related row exists.
+ *
+ * `has()` itself never errors on a missing value, so `!has()` is a plain NOT. The one error it can
+ * raise is selecting through a missing to-one hop, `has(parent.x)` on a parentless row, which
+ * denies under both polarities, so every hop BEFORE the tested key is required outside the NOT.
+ */
+export declare function handleHasOperator(operands: PlanExpressionOperand[], context: TranslationContext, negated: boolean): PrismaFilter;
+/**
+ * `has(R.attr.x)` on an attribute sent as an explicit null is true on every row, so it becomes the
+ * constant `true` before translation. Left to the translator it lowers to `{}`, which Prisma drops
+ * from an OR or a NOT, losing the rows it admits and, negated, admitting rows it denies.
+ */
+export declare function constantPresence(node: OperatorOperand, context: TranslationContext): PlanExpressionOperand | undefined;
+//# sourceMappingURL=presence.d.ts.map

package/lib/presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presence.d.ts","sourceRoot":"","sources":["../src/presence.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAI9C;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,OAAO,GACf,YAAY,CAmCd;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,kBAAkB,GAC1B,qBAAqB,GAAG,SAAS,CAmBnC"}