@diister/quick-permission 0.9.0-beta.5

package/dist/sift/operations.js

@@ -0,0 +1,257 @@
+// Vendored from sift.js (https://github.com/crcn/sift.js) — MIT licensed.
+// `$where` operator removed (security: arbitrary code execution).
+import { BaseOperation, containsOperation, createQueryOperation, createTester, EqualsOperation, NamedGroupOperation, numericalOperation, } from "./core.js";
+import { comparable, isArray } from "./utils.js";
+class $Ne extends BaseOperation {
+    propop = true;
+    init() {
+        this._test = createTester(this.params, this.options.compare);
+    }
+    reset() {
+        super.reset();
+        this.keep = true;
+    }
+    next(item) {
+        if (this._test(item)) {
+            this.done = true;
+            this.keep = false;
+        }
+    }
+}
+class $ElemMatch extends BaseOperation {
+    propop = true;
+    init() {
+        if (!this.params || typeof this.params !== "object") {
+            throw new Error(`Malformed query. $elemMatch must by an object.`);
+        }
+        this._queryOperation = createQueryOperation(this.params, this.owneryQuery, this.options);
+    }
+    reset() {
+        super.reset();
+        this._queryOperation.reset();
+    }
+    next(item) {
+        if (isArray(item)) {
+            for (let i = 0, { length } = item; i < length; i++) {
+                // Reset between elements: a passing element must satisfy ALL child ops on its own.
+                this._queryOperation.reset();
+                const child = item[i];
+                this._queryOperation.next(child, i, item, false);
+                this.keep = this.keep || this._queryOperation.keep;
+            }
+            this.done = true;
+        }
+        else {
+            this.done = false;
+            this.keep = false;
+        }
+    }
+}
+class $Not extends BaseOperation {
+    propop = true;
+    init() {
+        this._queryOperation = createQueryOperation(this.params, this.owneryQuery, this.options);
+    }
+    reset() {
+        super.reset();
+        this._queryOperation.reset();
+    }
+    next(item, key, owner, root) {
+        this._queryOperation.next(item, key, owner, root);
+        this.done = this._queryOperation.done;
+        this.keep = !this._queryOperation.keep;
+    }
+}
+export class $Size extends BaseOperation {
+    propop = true;
+    next(item) {
+        if (isArray(item) && item.length === this.params) {
+            this.done = true;
+            this.keep = true;
+        }
+    }
+}
+const assertGroupNotEmpty = (values) => {
+    if (values.length === 0) {
+        throw new Error(`$and/$or/$nor must be a nonempty array`);
+    }
+};
+class $Or extends BaseOperation {
+    propop = false;
+    init() {
+        assertGroupNotEmpty(this.params);
+        this._ops = this.params.map((op) => createQueryOperation(op, null, this.options));
+    }
+    reset() {
+        this.done = false;
+        this.keep = false;
+        for (let i = 0, { length } = this._ops; i < length; i++) {
+            this._ops[i].reset();
+        }
+    }
+    next(item, key, owner) {
+        let done = false;
+        let success = false;
+        for (let i = 0, { length } = this._ops; i < length; i++) {
+            const op = this._ops[i];
+            op.next(item, key, owner);
+            if (op.keep) {
+                done = true;
+                success = op.keep;
+                break;
+            }
+        }
+        this.keep = success;
+        this.done = done;
+    }
+}
+class $Nor extends $Or {
+    propop = false;
+    next(item, key, owner) {
+        super.next(item, key, owner);
+        this.keep = !this.keep;
+    }
+}
+class $In extends BaseOperation {
+    propop = true;
+    init() {
+        const params = Array.isArray(this.params) ? this.params : [this.params];
+        this._testers = params.map((value) => {
+            if (containsOperation(value, this.options)) {
+                throw new Error(`cannot nest $ under ${(this.name ?? "").toLowerCase()}`);
+            }
+            return createTester(value, this.options.compare);
+        });
+    }
+    next(item, _key, _owner) {
+        let done = false;
+        let success = false;
+        for (let i = 0, { length } = this._testers; i < length; i++) {
+            const test = this._testers[i];
+            if (test(item)) {
+                done = true;
+                success = true;
+                break;
+            }
+        }
+        this.keep = success;
+        this.done = done;
+    }
+}
+class $Nin extends BaseOperation {
+    propop = true;
+    _in;
+    constructor(params, ownerQuery, options, name) {
+        super(params, ownerQuery, options, name);
+        this._in = new $In(params, ownerQuery, options, name);
+    }
+    next(item, key, owner, root) {
+        this._in.next(item, key, owner);
+        if (isArray(owner) && !root) {
+            if (this._in.keep) {
+                this.keep = false;
+                this.done = true;
+            }
+            else if (key == owner.length - 1) {
+                this.keep = true;
+                this.done = true;
+            }
+        }
+        else {
+            this.keep = !this._in.keep;
+            this.done = true;
+        }
+    }
+    reset() {
+        super.reset();
+        this._in.reset();
+    }
+}
+class $Exists extends BaseOperation {
+    propop = true;
+    next(_item, key, owner, _root, leaf) {
+        if (!leaf) {
+            this.done = true;
+            this.keep = !this.params;
+        }
+        else if (owner != null &&
+            Object.prototype.hasOwnProperty.call(owner, key) ===
+                this.params) {
+            this.done = true;
+            this.keep = true;
+        }
+    }
+}
+class $And extends NamedGroupOperation {
+    propop = false;
+    constructor(params, owneryQuery, options, name) {
+        super(params, owneryQuery, options, params.map((query) => createQueryOperation(query, owneryQuery, options)), name);
+        assertGroupNotEmpty(params);
+    }
+    next(item, key, owner, root) {
+        this.childrenNext(item, key, owner, root ?? false);
+    }
+}
+class $All extends NamedGroupOperation {
+    propop = true;
+    constructor(params, owneryQuery, options, name) {
+        super(params, owneryQuery, options, params.map((query) => createQueryOperation(query, owneryQuery, options)), name);
+    }
+    next(item, key, owner, root) {
+        this.childrenNext(item, key, owner, root ?? false);
+    }
+}
+export const $eq = (params, owneryQuery, options) => new EqualsOperation(params, owneryQuery, options);
+export const $ne = (params, owneryQuery, options, name) => new $Ne(params, owneryQuery, options, name);
+export const $or = (params, owneryQuery, options, name) => new $Or(params, owneryQuery, options, name);
+export const $nor = (params, owneryQuery, options, name) => new $Nor(params, owneryQuery, options, name);
+export const $elemMatch = (params, owneryQuery, options, name) => new $ElemMatch(params, owneryQuery, options, name);
+export const $nin = (params, owneryQuery, options, name) => new $Nin(params, owneryQuery, options, name);
+export const $in = (params, owneryQuery, options, name) => new $In(params, owneryQuery, options, name);
+export const $lt = numericalOperation((params) => (b) => b != null && b < params);
+export const $lte = numericalOperation((params) => (b) => b === params || (b != null && b <= params));
+export const $gt = numericalOperation((params) => (b) => b != null && b > params);
+export const $gte = numericalOperation((params) => (b) => b === params || (b != null && b >= params));
+export const $mod = (modParams, owneryQuery, options) => {
+    const [mod, equalsValue] = modParams;
+    return new EqualsOperation(
+    // EqualsOperation accepts a Tester; cast retains that contract.
+    ((b) => comparable(b) % mod === equalsValue), owneryQuery, options);
+};
+export const $exists = (params, owneryQuery, options, name) => new $Exists(params, owneryQuery, options, name);
+export const $regex = (pattern, owneryQuery, options) => new EqualsOperation(new RegExp(pattern, owneryQuery.$options), owneryQuery, options);
+export const $not = (params, owneryQuery, options, name) => new $Not(params, owneryQuery, options, name);
+const typeAliases = {
+    number: (v) => typeof v === "number",
+    string: (v) => typeof v === "string",
+    bool: (v) => typeof v === "boolean",
+    array: (v) => Array.isArray(v),
+    null: (v) => v === null,
+    timestamp: (v) => v instanceof Date,
+};
+export const $type = (
+// deno-lint-ignore ban-types
+clazz, owneryQuery, options) => new EqualsOperation(
+// EqualsOperation accepts a Tester; cast retains that contract.
+((b) => {
+    if (typeof clazz === "string") {
+        const alias = typeAliases[clazz];
+        if (!alias) {
+            throw new Error(`Type alias does not exist`);
+        }
+        return alias(b);
+    }
+    return b != null
+        ? b instanceof clazz ||
+            b.constructor === clazz
+        : false;
+}), owneryQuery, options);
+export const $and = (params, ownerQuery, options, name) => new $And(params, ownerQuery, options, name);
+export const $all = (params, ownerQuery, options, name) => new $All(params, ownerQuery, options, name);
+export const $size = (params, ownerQuery, options) => new $Size(params, ownerQuery, options, "$size");
+export const $options = () => null;
+// $where intentionally removed from this fork.
+// Upstream evaluated arbitrary JS via `new Function()`. Forbidden in a permission
+// system whose grants come from the DB — code-execution risk.
+// `validateSpec()` in mongo-query.ts is the second barrier.
+//# sourceMappingURL=operations.js.map

package/dist/sift/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../sift/operations.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,kEAAkE;AAElE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,kBAAkB,GAMnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAY,MAAM,YAAY,CAAC;AAE3D,MAAM,GAAI,SAAQ,aAAsB;IAC7B,MAAM,GAAG,IAAI,CAAC;IAGd,IAAI;QACX,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAa;QAChB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAW,SAAQ,aAA6B;IAC3C,MAAM,GAAG,IAAI,CAAC;IAEd,IAAI;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,oBAAoB,CACzC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IACQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAa;QAChB,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnD,mFAAmF;gBACnF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;gBAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;CACF;AAED,MAAM,IAAK,SAAQ,aAA6B;IACrC,MAAM,GAAG,IAAI,CAAC;IAEd,IAAI;QACX,IAAI,CAAC,eAAe,GAAG,oBAAoB,CACzC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,OAAO,CACb,CAAC;IACJ,CAAC;IACQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe,EAAE,IAAc;QAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,KAAM,SAAQ,aAAqB;IACrC,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,IAAa;QAChB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,MAAM,mBAAmB,GAAG,CAAC,MAAiB,EAAQ,EAAE;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,GAAI,SAAQ,aAA+B;IACtC,MAAM,GAAG,KAAK,CAAC;IAEf,IAAI;QACX,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACjC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAC7C,CAAC;IACJ,CAAC;IACQ,KAAK;QACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe;QAC5C,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,IAAK,SAAQ,GAAG;IACF,MAAM,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe;QACrD,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAED,MAAM,GAAI,SAAQ,aAAsB;IAC7B,MAAM,GAAG,IAAI,CAAC;IAEd,IAAI;QACX,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5C,IAAI,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,uBAAuB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACzD,CAAC;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,IAAU,EAAE,MAAgB;QAC9C,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACf,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,IAAK,SAAQ,aAAsB;IAC9B,MAAM,GAAG,IAAI,CAAC;IACf,GAAG,CAAM;IACjB,YACE,MAAe,EACf,UAAmB,EACnB,OAAgB,EAChB,IAAY;QAEZ,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe,EAAE,IAAc;QAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEhC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACQ,KAAK;QACZ,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAQ,SAAQ,aAAsB;IACjC,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CACF,KAAc,EACd,GAAS,EACT,KAAe,EACf,KAAe,EACf,IAAc;QAEd,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;aAAM,IACL,KAAK,IAAI,IAAI;YACb,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAkB,CAAC;gBAC7D,IAAI,CAAC,MAAM,EACb,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,MAAM,IAAK,SAAQ,mBAAmB;IAC3B,MAAM,GAAG,KAAK,CAAC;IACxB,YACE,MAAwB,EACxB,WAA2B,EAC3B,OAAgB,EAChB,IAAY;QAEZ,KAAK,CACH,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,EACxE,IAAI,CACL,CAAC;QAEF,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe,EAAE,IAAc;QAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,IAAK,SAAQ,mBAAmB;IAC3B,MAAM,GAAG,IAAI,CAAC;IACvB,YACE,MAAwB,EACxB,WAA2B,EAC3B,OAAgB,EAChB,IAAY;QAEZ,KAAK,CACH,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,EACxE,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAa,EAAE,GAAS,EAAE,KAAe,EAAE,IAAc;QAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EACU,EAAE,CAC5B,IAAI,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACP,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAAwB,EACxB,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACP,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAwB,EACxB,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACN,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACA,EAAE,CACd,IAAI,UAAU,CAAC,MAAwB,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACN,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACP,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,GAAG,GAAG,kBAAkB,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAK,CAAY,GAAI,MAAiB,CACnE,CAAC;AACF,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CACpC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,IAAK,CAAY,IAAK,MAAiB,CAAC,CACrE,CAAC;AACF,MAAM,CAAC,MAAM,GAAG,GAAG,kBAAkB,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAK,CAAY,GAAI,MAAiB,CACnE,CAAC;AACF,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CACpC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,IAAK,CAAY,IAAK,MAAiB,CAAC,CACrE,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,SAAmB,EACnB,WAA2B,EAC3B,OAAgB,EACU,EAAE;IAC5B,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC;IACrC,OAAO,IAAI,eAAe;IACxB,gEAAgE;IAChE,CAAC,CAAC,CAAU,EAAE,EAAE,CACb,UAAU,CAAC,CAAC,CAAY,GAAG,GAAG,KAAK,WAAW,CAAY,EAC7D,WAAW,EACX,OAAO,CACR,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACH,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,OAAe,EACf,WAA2B,EAC3B,OAAgB,EACS,EAAE,CAC3B,IAAI,eAAe,CACjB,IAAI,MAAM,CAAC,OAAO,EAAG,WAAqC,CAAC,QAAQ,CAAC,EACpE,WAAW,EACX,OAAO,CACR,CAAC;AAEJ,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAe,EACf,WAA2B,EAC3B,OAAgB,EAChB,IAAY,EACN,EAAE,CAAC,IAAI,IAAI,CAAC,MAAwB,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAE1E,MAAM,WAAW,GAA4C;IAC3D,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;IACpC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ;IACpC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS;IACnC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI;IACvB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG;AACnB,6BAA6B;AAC7B,KAAwB,EACxB,WAA2B,EAC3B,OAAgB,EACU,EAAE,CAC5B,IAAI,eAAe;AACjB,gEAAgE;AAChE,CAAC,CAAC,CAAU,EAAE,EAAE;IACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,IAAI;QACd,CAAC,CAAC,CAAC,YAAa,KAA6C;YACxD,CAA+B,CAAC,WAAW,KAAK,KAAK;QAC1D,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC,CAAY,EACb,WAAW,EACX,OAAO,CACR,CAAC;AAEJ,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAwB,EACxB,UAA0B,EAC1B,OAAgB,EAChB,IAAY,EACN,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAwB,EACxB,UAA0B,EAC1B,OAAgB,EAChB,IAAY,EACN,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAc,EACd,UAA0B,EAC1B,OAAgB,EACT,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC;AAEzC,+CAA+C;AAC/C,kFAAkF;AAClF,8DAA8D;AAC9D,4DAA4D"}

package/dist/sift/utils.d.ts

@@ -0,0 +1,12 @@
+export type Key = string | number;
+export type Comparator = (a: unknown, b: unknown) => boolean;
+export declare const typeChecker: <TType>(type: string) => (value: unknown) => value is TType;
+export declare const comparable: (value: unknown) => unknown;
+export declare const coercePotentiallyNull: (value: unknown) => unknown;
+export declare const isArray: (value: unknown) => value is unknown[];
+export declare const isObject: (value: unknown) => value is Object;
+export declare const isFunction: (value: unknown) => value is Function;
+export declare const isProperty: (item: object, key: PropertyKey) => boolean;
+export declare const isVanillaObject: (value: unknown) => boolean;
+export declare const equals: (a: unknown, b: unknown) => boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/sift/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../sift/utils.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;AAClC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;AAE7D,eAAO,MAAM,WAAW,GAAI,KAAK,EAAE,MAAM,MAAM,MAE5B,OAAO,OAAO,KAAG,KAAK,IAAI,KAG5C,CAAC;AAKF,eAAO,MAAM,UAAU,GAAI,OAAO,OAAO,KAAG,OAa3C,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,OAAO,OAAO,KAAG,OACzB,CAAC;AAE/B,eAAO,MAAM,OAAO,UA1BM,OAAO,KAAG,KAAK,aA0Ba,CAAC;AAEvD,eAAO,MAAM,QAAQ,UA5BK,OAAO,KAAG,KAAK,UA4BY,CAAC;AAEtD,eAAO,MAAM,UAAU,UA9BG,OAAO,KAAG,KAAK,YA8BkB,CAAC;AAE5D,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,KAAK,WAAW,KAAG,OAK3D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,OAahD,CAAC;AAEF,eAAO,MAAM,MAAM,GAAI,GAAG,OAAO,EAAE,GAAG,OAAO,KAAG,OAiC/C,CAAC"}

package/dist/sift/utils.js

@@ -0,0 +1,80 @@
+// Vendored from sift.js (https://github.com/crcn/sift.js) — MIT licensed.
+// `$where` operator removed (security: arbitrary code execution).
+export const typeChecker = (type) => {
+    const typeString = "[object " + type + "]";
+    return function (value) {
+        return getClassName(value) === typeString;
+    };
+};
+const getClassName = (value) => Object.prototype.toString.call(value);
+export const comparable = (value) => {
+    if (value instanceof Date) {
+        return value.getTime();
+    }
+    else if (isArray(value)) {
+        return value.map(comparable);
+    }
+    else if (value != null &&
+        typeof value.toJSON === "function") {
+        return value.toJSON();
+    }
+    return value;
+};
+export const coercePotentiallyNull = (value) => value == null ? null : value;
+export const isArray = typeChecker("Array");
+// deno-lint-ignore ban-types
+export const isObject = typeChecker("Object");
+// deno-lint-ignore ban-types
+export const isFunction = typeChecker("Function");
+export const isProperty = (item, key) => {
+    return (Object.prototype.hasOwnProperty.call(item, key) &&
+        !isFunction(item[key]));
+};
+export const isVanillaObject = (value) => {
+    if (value == null || typeof value !== "object")
+        return false;
+    const ctor = value.constructor;
+    if (!ctor)
+        return false;
+    return ((ctor === Object ||
+        ctor === Array ||
+        ctor.toString() === "function Object() { [native code] }" ||
+        ctor.toString() === "function Array() { [native code] }") &&
+        !value.toJSON);
+};
+export const equals = (a, b) => {
+    if (a == null && a == b) {
+        return true;
+    }
+    if (a === b) {
+        return true;
+    }
+    if (Object.prototype.toString.call(a) !== Object.prototype.toString.call(b)) {
+        return false;
+    }
+    if (isArray(a)) {
+        const arrB = b;
+        if (a.length !== arrB.length) {
+            return false;
+        }
+        for (let i = 0, { length } = a; i < length; i++) {
+            if (!equals(a[i], arrB[i]))
+                return false;
+        }
+        return true;
+    }
+    else if (isObject(a)) {
+        const objA = a;
+        const objB = b;
+        if (Object.keys(objA).length !== Object.keys(objB).length) {
+            return false;
+        }
+        for (const key in objA) {
+            if (!equals(objA[key], objB[key]))
+                return false;
+        }
+        return true;
+    }
+    return false;
+};
+//# sourceMappingURL=utils.js.map

package/dist/sift/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../sift/utils.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,kEAAkE;AAKlE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAQ,IAAY,EAAE,EAAE;IACjD,MAAM,UAAU,GAAG,UAAU,GAAG,IAAI,GAAG,GAAG,CAAC;IAC3C,OAAO,UAAU,KAAc;QAC7B,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAC9C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAc,EAAW,EAAE;IACpD,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;SAAM,IACL,KAAK,IAAI,IAAI;QACb,OAAQ,KAA8B,CAAC,MAAM,KAAK,UAAU,EAC5D,CAAC;QACD,OAAQ,KAAmC,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAW,EAAE,CAC/D,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAE/B,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAY,OAAO,CAAC,CAAC;AACvD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAS,QAAQ,CAAC,CAAC;AACtD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAW,UAAU,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,GAAgB,EAAW,EAAE;IACpE,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/C,CAAC,UAAU,CAAE,IAAqC,CAAC,GAAa,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAW,EAAE;IACzD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,IAAI,GAAI,KAAmC,CAAC,WAErC,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,CAAC,IAAI,KAAK,MAAM;QACd,IAAI,KAAK,KAAK;QACd,IAAI,CAAC,QAAQ,EAAE,KAAK,qCAAqC;QACzD,IAAI,CAAC,QAAQ,EAAE,KAAK,oCAAoC,CAAC;QAC3D,CAAE,KAA8B,CAAC,MAAM,CACxC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE;IACxD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,CAAc,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/system.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Moteur d'orchestration resource-pipe.
+ *
+ * Responsabilités :
+ *  - Maintenir un cache `(resource.id, dedupKey) → Promise<T>` par context()
+ *  - Filtrer les rules actives (activeWhen) avant de fetcher leurs needs
+ *  - Lancer les fetches en parallèle (Promise.all) avec dedup
+ *  - Évaluer les rules d'un grant en série (préserve l'ordre des reasons)
+ *  - OR sémantique entre grants : un grant qui passe = `ok: true`
+ *  - Validation d'arity du target au boot et au check
+ *
+ * Cf. RFC §"Sémantique d'exécution".
+ */
+import type { CanResult, Grant, IndirectResourceInfo, ListEntry, Permission, Resource, Subject, TreeNode } from "./types.ts";
+import { type IndirectResource } from "./indirect-resource.ts";
+export type ProviderFn = (subject: Subject, key: string, target?: readonly unknown[]) => readonly Grant[] | Promise<readonly Grant[]>;
+/**
+ * Provider sous forme objet : permet d'opt-in à la dedup de grants
+ * (cacheKey) et au filtrage par préfixe de key (keys/matches).
+ *
+ * - `keys`/`matches` : le provider est skip si la key demandée ne match pas
+ * - `cacheKey` : grants memoizés par (subject, key, target) au sein d'un context
+ */
+export type ProviderObject = {
+    readonly keys?: readonly string[];
+    readonly matches?: (key: string) => boolean;
+    readonly cacheKey?: (subject: Subject, key: string, target?: readonly unknown[]) => string;
+    readonly fetch: ProviderFn;
+};
+export type Provider = ProviderFn | ProviderObject;
+export type CanContext = {
+    readonly checkDate?: Date;
+    readonly checkIp?: string;
+    /** True : le target peut contenir des wildcards et matche les grants overlap. */
+    readonly broadMatch?: boolean;
+    /**
+     * Check-time payload exposed to rules as `ctx.input`. Distinct from
+     * `grant.payload` (static, seed-time). Consumed by `inputMatch()` to
+     * validate a CREATE body against `grant.with`.
+     */
+    readonly input?: unknown;
+};
+export type System<TMeta = unknown> = {
+    list(): readonly ListEntry<TMeta>[];
+    tree(): {
+        readonly children: Readonly<Record<string, TreeNode<TMeta>>>;
+    };
+    schema(key: string): Permission<TMeta> | undefined;
+    /**
+     * Every distinct indirect resource referenced by the schema's rules,
+     * deduped by id. Returned in declaration-walk order (first-occurrence
+     * wins for dedup). Function fields are stripped — see
+     * `IndirectResourceInfo`. Empty if no permission uses `.match()` on an
+     * `indirectResource`.
+     */
+    indirectResources(): readonly IndirectResourceInfo[];
+    /**
+     * Indirect resources referenced by a single permission's rules.
+     * `[]` if `key` is unknown or has no `indirect-match` rule. Useful so
+     * matrix UIs only render the indirect-match editor on permissions where
+     * it has a semantic.
+     */
+    indirectsUsedBy(key: string): readonly IndirectResourceInfo[];
+    /** Check direct (sans cache cross-can) — préfère `context()` en HTTP. */
+    can(subject: Subject, key: string, target?: readonly unknown[], context?: CanContext): Promise<CanResult>;
+    /**
+     * Crée un context request-scoped avec cache de fetches partagé entre
+     * tous les `can()` qui en découlent.
+     */
+    context(bound: {
+        readonly subject: Subject;
+    } & CanContext): {
+        /**
+         * `perCall` overrides the bound `CanContext` for this single check.
+         * Canonical use : passing `input` for a CREATE while keeping the
+         * shared (per-request) context. Other fields stay bound — override
+         * only when truly per-call.
+         */
+        can(key: string, target?: readonly unknown[], perCall?: CanContext): Promise<CanResult>;
+        /**
+         * Inject pre-loaded docs into the resource cache so subsequent
+         * `can()` calls skip the fetch. Typical use : after a paginated
+         * list, the caller has all docs in memory — pre-seed them so the
+         * per-doc projection check doesn't hit the DB again.
+         *
+         * `dedupKey(doc)` MUST return the same target segments the resource's
+         * `dedupKey` would compute at fetch time — otherwise the cache key
+         * won't match and the preseed is silently ineffective. For most
+         * resources whose dedupKey is `target[i]`, just return `[doc._id]`
+         * (or the relevant segments).
+         *
+         * `value(doc)` is optional. Defaults to identity (the doc itself,
+         * used for direct resources). Provide it for indirect resources
+         * where the cached value is an array of joined docs nested under
+         * an alias (e.g. `d => d._memberships_of_participant`).
+         */
+        preseed<T, V = T>(resource: Resource<unknown> | IndirectResource | string, docs: ReadonlyArray<T>, opts: {
+            dedupKey: (doc: T) => readonly unknown[];
+            value?: (doc: T) => V;
+        }): void;
+        /** Compteurs de fetches par resource.id (debug / observabilité). */
+        getFetchCounters(): Readonly<Record<string, number>>;
+        /** Reset des compteurs (pas du cache). */
+        clearCounters(): void;
+        /** Dump des grants émis dans ce context (debug). */
+        dumpGrants(): Promise<readonly Grant[]>;
+    };
+};
+export declare function createSystem<TMeta = unknown>(opts: {
+    readonly schema: Readonly<Record<string, Permission<TMeta>>>;
+    readonly providers?: readonly Provider[];
+}): System<TMeta>;
+//# sourceMappingURL=system.d.ts.map

package/dist/system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../system.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAEV,SAAS,EAET,KAAK,EACL,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,QAAQ,EAGR,OAAO,EACP,QAAQ,EACT,MAAM,YAAY,CAAC;AASpB,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KACxB,SAAS,KAAK,EAAE,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KACxB,MAAM,CAAC;IACZ,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;AAiBnD,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,MAAM,CAAC,KAAK,GAAG,OAAO,IAAI;IACpC,IAAI,IAAI,SAAS,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACpC,IAAI,IAAI;QAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;IACzE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACnD;;;;;;OAMG;IACH,iBAAiB,IAAI,SAAS,oBAAoB,EAAE,CAAC;IACrD;;;;;OAKG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAAC;IAC9D,yEAAyE;IACzE,GAAG,CACD,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,EAC3B,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG,UAAU,GAAG;QAC1D;;;;;WAKG;QACH,GAAG,CACD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,EAC3B,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB;;;;;;;;;;;;;;;;WAgBG;QACH,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EACd,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,gBAAgB,GAAG,MAAM,EACvD,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,EACtB,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,SAAS,OAAO,EAAE,CAAC;YACzC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;SACvB,GACA,IAAI,CAAC;QACR,oEAAoE;QACpE,gBAAgB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,0CAA0C;QAC1C,aAAa,IAAI,IAAI,CAAC;QACtB,oDAAoD;QACpD,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;KACzC,CAAC;CACH,CAAC;AAsVF,wBAAgB,YAAY,CAAC,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE;IAClD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC1C,GAAG,MAAM,CAAC,KAAK,CAAC,CA2chB"}