@kutur-kit/access 0.0.0-stage → 0.1.0-alpha.1

package/dist/Permission.js

@@ -0,0 +1,114 @@
+import { Context, Effect, Layer, Predicate, Schema, SchemaTransformation } from "effect";
+import * as Decision from "./Decision.js";
+/**
+ * The keys of the permissions the caller may use, or undefined for all.
+ * Keys rather than ids, so permissions sharing an id stay apart.
+ */
+export class Restriction extends Context.Reference("@kutur-kit/access/Permission/Restriction", { defaultValue: () => undefined }) {
+}
+// True while a check runs, so requires inside its policies only answer it too.
+const Answering = Context.Reference("@kutur-kit/access/Permission/Answering", {
+    defaultValue: () => false,
+});
+// A WeakMap rather than a field keeps services from Layer.succeed valid.
+const internals = new WeakMap();
+const make = (internal) => {
+    const { key, id, decide } = internal;
+    const run = Effect.fnUntraced(function* (via, target) {
+        const answering = (yield* Answering) || via === "check";
+        const { decision } = yield* decide(answering ? "check" : via, target).pipe(Effect.provideService(Answering, answering));
+        yield* Effect.annotateCurrentSpan({
+            "access.permission": id,
+            "access.decision": decision._tag,
+            ...(Predicate.isTagged(decision, "Deny") && {
+                "access.denied_by": decision.by,
+                ...(decision.reason !== undefined && { "access.reason": decision.reason }),
+                ...(decision.requirement !== undefined && { "access.requirement": decision.requirement }),
+            }),
+        });
+        return decision;
+    });
+    const check = Effect.fn(`${key}.check`)(function* (...target) {
+        return yield* run("check", target);
+    });
+    const require = Effect.fn(`${key}.require`)(function* (...target) {
+        const decision = yield* run("require", target);
+        // A required permission's refusal fails as that permission's, as it would
+        // without this one, so callers can still tell which refused.
+        return yield* Predicate.isTagged(decision, "Deny")
+            ? Effect.fail(new Decision.Denied({ permission: decision.requirement ?? id }))
+            : Effect.void;
+    });
+    // SAFETY: Callers pass the arguments TargetArgs<D> describes, and Denied
+    // carries this permission's id.
+    const service = { check, require };
+    internals.set(service, internal);
+    return service;
+};
+/**
+ * Runs `f` after every decision of a permission service built by `toLayer`,
+ * inside the check's span and before `require` fails.
+ */
+export const tap = (f) => (service) => {
+    // SAFETY: make stored the Internals of this service's I, D and R.
+    const internal = internals.get(service);
+    if (internal === undefined)
+        throw new Error("Permission.tap needs a permission service built by toLayer");
+    return make({
+        ...internal,
+        decide: (via, target) => Effect.tap(internal.decide(via, target), f),
+    });
+};
+/** Whether the caller's restriction excludes a permission, so it must refuse. */
+export const isRestricted = (permission) => Effect.map(Restriction, (allowed) => allowed !== undefined && !allowed.has(permission.key));
+export const restrictTo = (permissions) => (effect) => Effect.flatMap(Restriction, (current) => {
+    const allowed = Array.from(permissions, ({ key }) => key);
+    return Effect.provideService(effect, Restriction, new Set(current === undefined ? allowed : allowed.filter((key) => current.has(key))));
+});
+export const set = (permissions) => {
+    const ids = permissions.map((permission) => permission.id);
+    const duplicate = ids.find((id, index) => ids.indexOf(id) !== index);
+    if (duplicate !== undefined)
+        throw new Error(`Permission id ${duplicate} is used by more than one permission`);
+    // Ids name permissions outside the code, such as in stored token scopes.
+    const byId = new Map(permissions.map((permission) => [permission.id, permission]));
+    const isKnown = (id) => byId.has(id);
+    const schema = Schema.Array(Schema.String).pipe(Schema.decodeTo(Schema.Array(Schema.Literals(ids)), SchemaTransformation.transform({
+        decode: (stored) => stored.filter(isKnown),
+        encode: (decoded) => decoded,
+    })));
+    return {
+        schema,
+        restrictTo: (allowed) => restrictTo(Array.from(allowed).flatMap((id) => byId.get(id) ?? [])),
+    };
+};
+export const Service = () => (key, definition) => {
+    // SAFETY: IdOf<Key, D> is the declared id, or the key without one.
+    const id = (definition.id ?? key);
+    const Tag = Context.Service()(key);
+    const restricted = isRestricted({ id, key });
+    const toLayer = (policy) => Layer.effect(Tag, Effect.gen(function* () {
+        // SAFETY: Callers pass the arguments TargetArgs<D> describes.
+        const resolved = (Effect.isEffect(policy) ? yield* policy : policy);
+        const decide = Effect.fnUntraced(function* (via, target) {
+            const result = (yield* restricted) ? Decision.restricted() : resolved(...target);
+            const refusal = (error) => Schema.is(Decision.Denied)(error);
+            const answered = (answer) => answer.pipe(Effect.catchIf(refusal, (denied) => Effect.succeed(Decision.unmet(denied.permission))));
+            const decision = Effect.isEffect(result) ? yield* answered(result) : result;
+            // SAFETY: Callers pass the arguments TargetArgs<D> describes.
+            return { permission: id, via, target: target, decision };
+        });
+        return Tag.of(make({ key, id, decide }));
+    }));
+    const check = (...target) => Tag.use((permission) => permission.check(...target));
+    const require = (...target) => Tag.use((permission) => permission.require(...target));
+    return Object.assign(Tag, {
+        id,
+        definition,
+        Denied: Decision.deniedBy(id),
+        toLayer,
+        check,
+        require,
+    });
+};
+//# sourceMappingURL=Permission.js.map

package/dist/Permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Permission.js","sourceRoot":"","sources":["../src/Permission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAEzF,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAwF1C;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,SAAS,CAChD,0CAA0C,EAC1C,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAClC;CAAG;AAkBJ,+EAA+E;AAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAU,wCAAwC,EAAE;IACrF,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;CAC1B,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,SAAS,GAAG,IAAI,OAAO,EAAmB,CAAC;AAEjD,MAAM,IAAI,GAAG,CACX,QAA4B,EACd,EAAE;IAChB,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAsB,EAAE,MAA8B;QAC7F,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC;QAExD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CACxE,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAC5C,CAAC;QAEF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAChC,mBAAmB,EAAE,EAAE;YACvB,iBAAiB,EAAE,QAAQ,CAAC,IAAI;YAChC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI;gBAC1C,kBAAkB,EAAE,QAAQ,CAAC,EAAE;gBAC/B,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC1E,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;aAC1F,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,MAA8B;QAClF,OAAO,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,MAA8B;QACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAE/C,0EAA0E;QAC1E,6DAA6D;QAC7D,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,EAAkB,CAAC;IAEnD,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEjC,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,GAAG,GACd,CAAuB,CAA+C,EAAE,EAAE,CAC1E,CAAsB,OAAqB,EAAgB,EAAE;IAC3D,kEAAkE;IAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAmC,CAAC;IAE1E,IAAI,QAAQ,KAAK,SAAS;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAEhF,OAAO,IAAI,CAAC;QACV,GAAG,QAAQ;QACX,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;KACrE,CAAC,CAAC;AACL,CAAC,CAAC;AAEJ,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAe,EAAE,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,UAAU,GACrB,CAAC,WAA0B,EAAE,EAAE,CAC/B,CAAU,MAA8B,EAA0B,EAAE,CAClE,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,cAAc,CAC1B,MAAM,EACN,WAAW,EACX,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CACrF,CAAC;AACJ,CAAC,CAAC,CAAC;AASP,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,WAAe,EACY,EAAE;IAG7B,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAW,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;IAErE,IAAI,SAAS,KAAK,SAAS;QACzB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,sCAAsC,CAAC,CAAC;IAEpF,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClC,oBAAoB,CAAC,SAAS,CAAgD;QAC5E,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1C,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;KAC7B,CAAC,CACH,CACF,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;KAC7F,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAClB,GAAgC,EAAE,CAClC,CACE,GAAQ,EACR,UAAa,EAC0B,EAAE;IAGzC,mEAAmE;IACnE,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,CAAiB,CAAC;IAElD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAiC,CAAC,GAAG,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAiD,CAAC,MAAM,EAAE,EAAE,CACvE,KAAK,CAAC,MAAM,CACV,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAEU,CAAC;QAE7E,MAAM,MAAM,GAA4C,MAAM,CAAC,UAAU,CACvE,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM;YACpB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC;YAEjF,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAuB,EAAE,CAC7D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAEpC,MAAM,QAAQ,GAAG,CAAC,MAA2D,EAAE,EAAE,CAC/E,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACjC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAClD,CACF,CAAC;YAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAE5E,8DAA8D;YAC9D,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAuB,EAAE,QAAQ,EAAE,CAAC;QAC5E,CAAC,CACF,CAAC;QAEF,OAAO,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CACH,CAAC;IAEJ,MAAM,KAAK,GAA+C,CAAC,GAAG,MAAM,EAAE,EAAE,CACtE,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAEvD,MAAM,OAAO,GAAiD,CAAC,GAAG,MAAM,EAAE,EAAE,CAC1E,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAEzD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;QACxB,EAAE;QACF,UAAU;QACV,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;QACP,KAAK;QACL,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/PermissionFilter.d.ts

@@ -0,0 +1,25 @@
+import type { Scope } from "effect";
+import { Context, Effect, Layer } from "effect";
+import * as Condition from "./Condition.ts";
+import * as Permission from "./Permission.ts";
+export type Policy<D extends Permission.Definition, R> = (where: Condition.Builder<Permission.TargetOf<D>>) => Condition.Condition<Permission.TargetOf<D>> | Effect.Effect<Condition.Condition<Permission.TargetOf<D>>, Permission.CheckError<D>, R>;
+export interface Api<D extends Permission.Definition, R> {
+    /** The targets the permission allows, or none outside the caller's restriction. */
+    readonly condition: Effect.Effect<Condition.Condition<Permission.TargetOf<D>>, Permission.CheckError<D>, R>;
+}
+export interface Statics<Self, D extends Permission.Definition, R> {
+    readonly condition: Effect.Effect<Condition.Condition<Permission.TargetOf<D>>, Permission.CheckError<D>, Self | R>;
+    readonly toLayer: <E = never, RL = never>(policy: Policy<D, R> | Effect.Effect<Policy<D, R>, E, RL>) => Layer.Layer<Self, E, Exclude<RL, Scope.Scope>>;
+}
+export type PermissionFilter<Self, D extends Permission.Definition, R> = Context.ServiceClass<Self, string, Api<D, R>> & Statics<Self, D, R>;
+/**
+ * Defines the query form of a permission: the condition its policy allows,
+ * for listing targets in one query. Its key is the permission's with
+ * `/Filter`, so name the class after the permission too, such as
+ * `ViewInvoiceFilter`. Its policy must agree with the permission's;
+ * `PermissionTesting.assertFilterAgrees` checks that.
+ */
+export declare const Service: <Self>() => <PermissionSelf, I extends string, D extends Permission.Definition & {
+    readonly target: Permission.Codec;
+}, R>(permission: Permission.Tag<PermissionSelf, I, D, R>) => PermissionFilter<Self, D, R>;
+//# sourceMappingURL=PermissionFilter.d.ts.map

package/dist/PermissionFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionFilter.d.ts","sourceRoot":"","sources":["../src/PermissionFilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAE9C,MAAM,MAAM,MAAM,CAAC,CAAC,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,CACvD,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAE9C,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAC3C,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE5F,MAAM,WAAW,GAAG,CAAC,CAAC,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC;IACrD,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAC/B,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3C,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EACxB,CAAC,CACF,CAAC;CACH;AAED,MAAM,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAC/B,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3C,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EACxB,IAAI,GAAG,CAAC,CACT,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,GAAG,KAAK,EACtC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KACtD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,OAAO,CAAC,YAAY,CAC3F,IAAI,EACJ,MAAM,EACN,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CACV,GACC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,GACjB,IAAI,QAEH,cAAc,EACd,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,UAAU,CAAC,UAAU,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAA;CAAE,EACvE,CAAC,cAEW,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAClD,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAoC7B,CAAC"}

package/dist/PermissionFilter.js

@@ -0,0 +1,33 @@
+import { Context, Effect, Layer } from "effect";
+import * as Condition from "./Condition.js";
+import * as Permission from "./Permission.js";
+/**
+ * Defines the query form of a permission: the condition its policy allows,
+ * for listing targets in one query. Its key is the permission's with
+ * `/Filter`, so name the class after the permission too, such as
+ * `ViewInvoiceFilter`. Its policy must agree with the permission's;
+ * `PermissionTesting.assertFilterAgrees` checks that.
+ */
+export const Service = () => (permission) => {
+    const key = `${permission.key}/Filter`;
+    const Tag = Context.Service()(key);
+    const toLayer = (policy) => Layer.effect(Tag, Effect.gen(function* () {
+        const resolved = Effect.isEffect(policy) ? yield* policy : policy;
+        const condition = Effect.gen(function* () {
+            const refused = yield* Permission.isRestricted(permission);
+            if (refused)
+                return Condition.make().none();
+            const result = resolved(Condition.make());
+            return Effect.isEffect(result) ? yield* result : result;
+        }).pipe(Effect.tap((result) => Effect.annotateCurrentSpan({
+            "access.permission": permission.id,
+            "access.condition": result._tag,
+        })), Effect.withSpan(`${key}.condition`));
+        return Tag.of({ condition });
+    }));
+    return Object.assign(Tag, {
+        condition: Tag.use((filter) => filter.condition),
+        toLayer,
+    });
+};
+//# sourceMappingURL=PermissionFilter.js.map

package/dist/PermissionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionFilter.js","sourceRoot":"","sources":["../src/PermissionFilter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAmC9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAClB,GAAS,EAAE,CACX,CAME,UAAmD,EACrB,EAAE;IAChC,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,GAAG,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAmB,CAAC,GAAG,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAmC,CAAC,MAAM,EAAE,EAAE,CACzD,KAAK,CAAC,MAAM,CACV,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAElE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAE3D,IAAI,OAAO;gBAAE,OAAO,SAAS,CAAC,IAAI,EAA0B,CAAC,IAAI,EAAE,CAAC;YAEpE,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YAE1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACpB,MAAM,CAAC,mBAAmB,CAAC;YACzB,mBAAmB,EAAE,UAAU,CAAC,EAAE;YAClC,kBAAkB,EAAE,MAAM,CAAC,IAAI;SAChC,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,YAAY,CAAC,CACpC,CAAC;QAEF,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CACH,CAAC;IAEJ,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;QACxB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QAChD,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,27 @@
+import * as Audit from "@kutur-kit/audit/Audit";
+import { Layer, Schema } from "effect";
+import * as Permission from "./Permission.ts";
+/** What refused a denied decision. Allowed decisions have no details. */
+export declare const Details: Schema.UndefinedOr<Schema.Struct<{
+    readonly deniedBy: Schema.Literals<readonly ["restriction", "policy", "requirement"]>;
+    readonly requirement: Schema.optionalKey<Schema.String>;
+}>>;
+type CheckView<D extends Permission.Definition, V> = [V] extends [never] ? unknown : [V] extends [Permission.Codec] ? D extends {
+    readonly target: Permission.Codec;
+} ? [Permission.TargetOf<D>] extends [V["Type"]] ? unknown : {
+    readonly view: Schema.Codec<Permission.TargetOf<D>, unknown>;
+} : {
+    readonly view?: false;
+} : unknown;
+export interface Options<V> {
+    /** See `AuditEvent.Definition["view"]`. */
+    readonly view?: V;
+}
+/**
+ * Records the decisions of a permission's `require`s as audit events named by
+ * its id; `check`s only answer questions, so they are not recorded. Refusals
+ * fail the request whose transaction would store them, so writes are isolated.
+ */
+export declare const record: <Self, I extends string, D extends Permission.Definition, R, const V extends Permission.Codec | false = never>(permission: Permission.Tag<Self, I, D, R>, options?: Options<V> & CheckView<D, V>) => <E, RL>(layer: Layer.Layer<Self, E, RL>) => Layer.Layer<Self, E, RL | Audit.AuditLog>;
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAU,KAAK,EAAa,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAE9C,yEAAyE;AACzE,eAAO,MAAM,OAAO;;;GAKnB,CAAC;AAEF,KAAK,SAAS,CAAC,CAAC,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACpE,OAAO,GACP,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,GAC5B,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAA;CAAE,GAC7C,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAC1C,OAAO,GACP;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;CAAE,GAC3B,OAAO,CAAC;AAEd,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,MAAM,GACjB,IAAI,EACJ,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,UAAU,CAAC,UAAU,EAC/B,CAAC,EACD,KAAK,CAAC,CAAC,SAAS,UAAU,CAAC,KAAK,GAAG,KAAK,GAAG,KAAK,cAEpC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,YAC/B,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAa9B,CAAC,EAAE,EAAE,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,CA0B1F,CAAC"}

package/dist/audit.js

@@ -0,0 +1,46 @@
+import * as Audit from "@kutur-kit/audit/Audit";
+import * as AuditEvent from "@kutur-kit/audit/AuditEvent";
+import { Effect, Layer, Predicate, Schema } from "effect";
+import * as Permission from "./Permission.js";
+/** What refused a denied decision. Allowed decisions have no details. */
+export const Details = Schema.UndefinedOr(Schema.Struct({
+    deniedBy: Schema.Literals(["restriction", "policy", "requirement"]),
+    requirement: Schema.optionalKey(Schema.String),
+}));
+/**
+ * Records the decisions of a permission's `require`s as audit events named by
+ * its id; `check`s only answer questions, so they are not recorded. Refusals
+ * fail the request whose transaction would store them, so writes are isolated.
+ */
+export const record = (permission, options) => {
+    const view = options?.view;
+    // Permissions without a target log Schema.Undefined, which records nothing.
+    const event = AuditEvent.make(permission.id, {
+        target: permission.definition.target ?? Schema.Undefined,
+        ...(view !== undefined && { view }),
+        outcomes: ["Allow", "Deny"],
+        details: Details,
+        isolated: true,
+    });
+    return (layer) => Layer.effect(permission, Effect.gen(function* () {
+        const inner = yield* permission;
+        const auditLog = yield* Audit.AuditLog;
+        return Permission.tap(({ via, target: args, decision }) => {
+            if (via === "check")
+                return Effect.void;
+            const denied = Predicate.isTagged(decision, "Deny") ? decision : undefined;
+            return event
+                .log({
+                target: args[0],
+                outcome: decision._tag,
+                ...(denied?.reason !== undefined && { reason: denied.reason }),
+                details: denied && {
+                    deniedBy: denied.by,
+                    ...(denied.requirement !== undefined && { requirement: denied.requirement }),
+                },
+            })
+                .pipe(Effect.provideService(Audit.AuditLog, auditLog));
+        })(inner);
+    })).pipe(Layer.provide(layer));
+};
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,UAAU,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE1D,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAE9C,yEAAyE;AACzE,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACnE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CAC/C,CAAC,CACH,CAAC;AAiBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAOpB,UAAyC,EACzC,OAAsC,EACtC,EAAE;IACF,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;IAE3B,4EAA4E;IAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;QACxD,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;QACnC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAU;QACpC,OAAO,EAAE,OAAO;QAChB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,OAAO,CAAQ,KAA+B,EAA6C,EAAE,CAC3F,KAAK,CAAC,MAAM,CACV,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAEvC,OAAO,UAAU,CAAC,GAAG,CAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC3D,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAE3E,OAAO,KAAK;iBACT,GAAG,CAAC;gBACH,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;gBACf,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9D,OAAO,EAAE,MAAM,IAAI;oBACjB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;iBAC7E;aACF,CAAC;iBACD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACZ,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC"}

package/dist/drizzle/postgres.d.ts

@@ -0,0 +1,18 @@
+import type * as Condition from "../Condition.ts";
+import { type Column, type SQL } from "drizzle-orm";
+/**
+ * Column kinds whose SQL equality is JavaScript's, so a query selects exactly
+ * the rows Condition.matches accepts. Excluded: numeric (decimal text), char
+ * (space padded), string-mode bigints, citext and other custom types.
+ */
+type Comparable = "string" | "string enum" | "string uuid" | "number int16" | "number int32" | "number int53" | "bigint int64" | "boolean" | "number float" | "number double";
+/** A comparable column for every field a condition over `T` can compare; a Drizzle table qualifies. */
+export type Columns<T> = {
+    readonly [K in Condition.Field<T>]: Column & {
+        readonly dataType: Comparable;
+    };
+};
+/** Translates a condition, such as a PermissionFilter's, into a PostgreSQL `where` clause. */
+export declare const where: <T>(columns: Columns<T>, condition: Condition.Condition<T>) => SQL;
+export {};
+//# sourceMappingURL=postgres.d.ts.map

package/dist/drizzle/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/drizzle/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAO,KAAK,MAAM,EAAkB,KAAK,GAAG,EAAO,MAAM,aAAa,CAAC;AAG9E;;;;GAIG;AACH,KAAK,UAAU,GACX,QAAQ,GACR,aAAa,GACb,aAAa,GACb,cAAc,GACd,cAAc,GACd,cAAc,GACd,cAAc,GACd,SAAS,GACT,cAAc,GACd,eAAe,CAAC;AAsBpB,uGAAuG;AACvG,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IACvB,QAAQ,EAAE,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;KAAE;CAC/E,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,KAAK,GAAI,CAAC,WAAW,OAAO,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAG,GA2DjF,CAAC"}

package/dist/drizzle/postgres.js

@@ -0,0 +1,65 @@
+import { and, eq, isNull, or, sql } from "drizzle-orm";
+import { Match, Predicate } from "effect";
+// char shares text's dataType and numeric's bigint mode shares bigint's, so
+// the runtime check names column classes too.
+const comparable = new Set([
+    "PgText",
+    "PgVarchar",
+    "PgEnumColumn",
+    "PgEnumObjectColumn",
+    "PgUUID",
+    "PgSmallInt",
+    "PgInteger",
+    "PgBigInt53",
+    "PgBigInt64",
+    "PgBoolean",
+    "PgReal",
+    "PgDoublePrecision",
+]);
+// PostgreSQL reads uuids in any case and writes them lowercase.
+const canonicalUuid = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/;
+/** Translates a condition, such as a PermissionFilter's, into a PostgreSQL `where` clause. */
+export const where = (columns, condition) => {
+    const byField = new Map(Object.entries(columns));
+    const column = (field) => {
+        const found = byField.get(field);
+        if (found === undefined)
+            throw new Error(`No column for condition field ${field}`);
+        if (!comparable.has(found.columnType))
+            throw new Error(`Column ${field} (${found.getSQLType()}) compares differently in PostgreSQL than in JavaScript`);
+        return found;
+    };
+    const value = (target, compared) => {
+        if (target.columnType === "PgUUID" &&
+            !(Predicate.isString(compared) && canonicalUuid.test(compared)))
+            throw new Error(`Uuid ${String(compared)} is not lowercase and canonical`);
+        return compared;
+    };
+    const translate = Match.type().pipe(Match.tagsExhaustive({
+        All: () => sql `true`,
+        None: () => sql `false`,
+        Eq: ({ field, value: compared }) => {
+            const target = column(field);
+            return compared === null ? isNull(target) : eq(target, value(target, compared));
+        },
+        OneOf: ({ field, values }) => {
+            const target = column(field);
+            const known = values.filter((each) => each !== null).map((each) => value(target, each));
+            // One array parameter however long the list: @effect/sql-pg sends at
+            // most 32767 parameters per statement.
+            const listed = known.length === 0
+                ? sql `false`
+                : sql `${target} = any(${sql.param(known)}::${sql.raw(target.getSQLType())}[])`;
+            // IN and ANY never match NULL, while Condition.matches finds null in the list.
+            return values.includes(null) ? (or(listed, isNull(target)) ?? listed) : listed;
+        },
+        And: ({ conditions }) => and(sql `true`, ...conditions.map(translate)) ?? sql `true`,
+        Or: ({ conditions }) => or(sql `false`, ...conditions.map(translate)) ?? sql `false`,
+        // Comparisons with NULL columns are NULL, which WHERE, AND and OR treat as
+        // false like Condition.matches does; NOT would keep it NULL, so negate with
+        // IS NOT TRUE instead.
+        Not: ({ condition: inner }) => sql `(${translate(inner)}) is not true`,
+    }));
+    return translate(condition);
+};
+//# sourceMappingURL=postgres.js.map

package/dist/drizzle/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/drizzle/postgres.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAY,GAAG,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAmB1C,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,QAAQ;IACR,WAAW;IACX,cAAc;IACd,oBAAoB;IACpB,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,mBAAmB;CACpB,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,aAAa,GAAG,2DAA2D,CAAC;AAOlF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,KAAK,GAAG,CAAI,OAAmB,EAAE,SAAiC,EAAO,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEjC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,KAAK,KAAK,CAAC,UAAU,EAAE,yDAAyD,CAChG,CAAC;QAEJ,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,QAAyB,EAAE,EAAE;QAC1D,IACE,MAAM,CAAC,UAAU,KAAK,QAAQ;YAC9B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE/D,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QAE7E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,SAAS,GAAkC,KAAK,CAAC,IAAI,EAAkB,CAAC,IAAI,CAChF,KAAK,CAAC,cAAc,CAAC;QACnB,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAA,MAAM;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAA,OAAO;QACtB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7B,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAExF,qEAAqE;YACrE,uCAAuC;YACvC,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,CAAC;gBAChB,CAAC,CAAC,GAAG,CAAA,OAAO;gBACZ,CAAC,CAAC,GAAG,CAAA,GAAG,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;YAEnF,+EAA+E;YAC/E,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjF,CAAC;QACD,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAA,MAAM;QAClF,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAA,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAA,OAAO;QAClF,2EAA2E;QAC3E,4EAA4E;QAC5E,uBAAuB;QACvB,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAA,IAAI,SAAS,CAAC,KAAK,CAAC,eAAe;KACtE,CAAC,CACH,CAAC;IAEF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * as Condition from "./Condition.ts";
+export * as Decision from "./Decision.ts";
+export * as Permission from "./Permission.ts";
+export * as PermissionFilter from "./PermissionFilter.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * as Condition from "./Condition.js";
+export * as Decision from "./Decision.js";
+export * as Permission from "./Permission.js";
+export * as PermissionFilter from "./PermissionFilter.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAC"}

package/dist/testing/PermissionTesting.d.ts

@@ -0,0 +1,17 @@
+import type * as Decision from "../Decision.ts";
+import { Effect } from "effect";
+import * as Condition from "../Condition.ts";
+export interface Checkable<T, E, R> {
+    readonly id: string;
+    readonly check: (target: T) => Effect.Effect<Decision.Decision, E, R>;
+}
+export interface Filter<T, E, R> {
+    readonly condition: Effect.Effect<Condition.Condition<T>, E, R>;
+}
+/**
+ * Dies unless a PermissionFilter's condition matches exactly the targets its
+ * permission allows, so lists never show what a direct read would refuse, or
+ * hide what it would allow.
+ */
+export declare const assertFilterAgrees: <T extends object, E, RCheck, RFilter>(permission: Checkable<T, E, RCheck>, filter: Filter<T, E, RFilter>, targets: Iterable<T>) => Effect.Effect<void, E, RCheck | RFilter>;
+//# sourceMappingURL=PermissionTesting.d.ts.map

package/dist/testing/PermissionTesting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionTesting.d.ts","sourceRoot":"","sources":["../../src/testing/PermissionTesting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAE7C,MAAM,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;CACjE;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,CAAC,SAAS,MAAM,EAChB,CAAC,EACD,MAAM,EACN,OAAO,uIAsBP,CAAC"}

package/dist/testing/PermissionTesting.js

@@ -0,0 +1,19 @@
+import { Effect, Predicate } from "effect";
+import * as Condition from "../Condition.js";
+/**
+ * Dies unless a PermissionFilter's condition matches exactly the targets its
+ * permission allows, so lists never show what a direct read would refuse, or
+ * hide what it would allow.
+ */
+export const assertFilterAgrees = Effect.fnUntraced(function* (permission, filter, targets) {
+    const condition = yield* filter.condition;
+    const decided = yield* Effect.forEach(targets, (target) => Effect.map(permission.check(target), (decision) => ({
+        target,
+        allowed: Predicate.isTagged(decision, "Allow"),
+    })));
+    const mismatch = decided.find(({ target, allowed }) => allowed !== Condition.matches(condition, target));
+    return yield* mismatch === undefined
+        ? Effect.void
+        : Effect.die(new Error(`The filter of permission ${permission.id} ${mismatch.allowed ? "excludes" : "matches"} a target the permission ${mismatch.allowed ? "allows" : "refuses"}: ${JSON.stringify(mismatch.target)}`));
+});
+//# sourceMappingURL=PermissionTesting.js.map

package/dist/testing/PermissionTesting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionTesting.js","sourceRoot":"","sources":["../../src/testing/PermissionTesting.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAW7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAK3D,UAAmC,EAAE,MAA6B,EAAE,OAAoB;IACxF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAE1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC/C,CAAC,CAAC,CACJ,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAC1E,CAAC;IAEF,OAAO,KAAK,CAAC,CAAC,QAAQ,KAAK,SAAS;QAClC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,GAAG,CACR,IAAI,KAAK,CACP,4BAA4B,UAAU,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,4BAA4B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChM,CACF,CAAC;AACR,CAAC,CAAC,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,2 @@
+export * as PermissionTesting from "./PermissionTesting.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAC"}

package/dist/testing/index.js

@@ -0,0 +1,2 @@
+export * as PermissionTesting from "./PermissionTesting.js";
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -1,6 +1,91 @@
 {
   "name": "@kutur-kit/access",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0-alpha.1",
+  "description": "Effect permissions as services: typed checks, caller restrictions, list filters and audit.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kutur-labs/kit.git",
+    "directory": "packages/access"
+  },
+  "files": [
+    "src",
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./Condition": {
+      "types": "./dist/Condition.d.ts",
+      "default": "./dist/Condition.js"
+    },
+    "./Decision": {
+      "types": "./dist/Decision.d.ts",
+      "default": "./dist/Decision.js"
+    },
+    "./Permission": {
+      "types": "./dist/Permission.d.ts",
+      "default": "./dist/Permission.js"
+    },
+    "./PermissionFilter": {
+      "types": "./dist/PermissionFilter.d.ts",
+      "default": "./dist/PermissionFilter.js"
+    },
+    "./audit": {
+      "types": "./dist/audit.d.ts",
+      "default": "./dist/audit.js"
+    },
+    "./drizzle/postgres": {
+      "types": "./dist/drizzle/postgres.d.ts",
+      "default": "./dist/drizzle/postgres.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@effect/sql-pg": "4.0.5",
+    "@effect/tsgo": "0.53.3",
+    "@effect/vitest": "4.0.5",
+    "@kutur-kit/audit": "0.1.0-alpha.1",
+    "@kutur-kit/testcontainers": "0.0.0",
+    "@kutur-kit/tsconfig": "0.1.0-alpha.0",
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@types/node": "24.19.2",
+    "drizzle-kit": "1.0.0-rc.4",
+    "drizzle-orm": "1.0.0-rc.4",
+    "effect": "4.0.5",
+    "publint": "0.3.25",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "@kutur-kit/audit": "^0.1.0-alpha.1",
+    "drizzle-orm": "1.0.0-rc.4",
+    "effect": "^4.0.5"
+  },
+  "peerDependenciesMeta": {
+    "@kutur-kit/audit": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "node --input-type=module -e 'import { rmSync } from \"node:fs\"; rmSync(\"dist\", { recursive: true, force: true });' && tsc -p tsconfig.build.json",
+    "lint:package": "publint --pack pnpm --strict",
+    "test": "vitest run",
+    "test:mutation": "stryker run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
 }