@nmnmcc/ability 0.2.0 → 0.3.0

package/dist/HttpApi.js

@@ -0,0 +1,95 @@
+import { Forbidden, Pending, PolicyUnavailable } from "./Authorizer.js";
+import { layer as layer$1, requires as requires$1 } from "./internal/httpApi.js";
+import * as Context from "effect/Context";
+import { HttpApiSchema } from "effect/http-api";
+// src/HttpApi.ts
+/**
+* Tools to check authorization in an `effect/http-api` server.
+*
+* Each endpoint says what it needs with the {@link Required} annotation. A
+* group can give a default with {@link GroupRequired}: one list for GET
+* requests and one list for all other methods. A middleware checks the
+* requirements before the handler runs. An endpoint with no annotation is a
+* defect, so a new endpoint is closed until you say what it needs. An empty
+* list means the endpoint is open.
+*
+* ```ts
+* class Authorization extends HttpApiMiddleware.Service<
+*   Authorization,
+*   { requires: Identity }
+* >()("app/Authorization", { error: HttpApi.errors }) {}
+*
+* const endpoint = HttpApiEndpoint.patch("update", "/bots/:id", { ... })
+*   .annotate(HttpApi.Required, [
+*     HttpApi.requires(Auth, "update", "Bot", (params) => Bots.find(params.id)),
+*   ])
+*
+* const AuthorizationLive = HttpApi.layer(Authorization, Auth)
+* ```
+*
+* This module is a separate entry point, `@nmnmcc/ability/HttpApi`, because
+* `effect/http-api` is not stable yet.
+*
+* @stability unstable
+* @since 0.3.0
+*/
+/**
+* The checks that an endpoint needs.
+*
+* @stability unstable
+* @category annotations
+* @since 0.3.0
+*/
+var Required = class extends Context.Service()("@nmnmcc/ability/HttpApi/Required") {};
+/**
+* The checks for every endpoint of a group with no {@link Required}
+* annotation. `read` is for GET requests. `write` is for all other methods.
+*
+* @stability unstable
+* @category annotations
+* @since 0.3.0
+*/
+var GroupRequired = class extends Context.Service()("@nmnmcc/ability/HttpApi/GroupRequired") {};
+/**
+* Makes a {@link Requirement} with the types of an authorizer. The action must
+* be an action of the kind, and `load` must give a value of the kind.
+*
+* `load` may fail. Its errors must be errors of the middleware, and the
+* services that it needs must be given to {@link layer}.
+*
+* @stability unstable
+* @category constructors
+* @since 0.3.0
+*/
+const requires = requires$1;
+/**
+* The errors of the middleware, with HTTP status codes: 403 for
+* `Forbidden`, 503 for `PolicyUnavailable`, and 409 for `Pending`.
+*
+* @stability unstable
+* @category errors
+* @since 0.3.0
+*/
+const errors = [
+	Forbidden.pipe(HttpApiSchema.status(403)),
+	PolicyUnavailable.pipe(HttpApiSchema.status(503)),
+	Pending.pipe(HttpApiSchema.status(409))
+];
+/**
+* Makes the layer of an authorization middleware. The middleware reads the
+* {@link Required} and {@link GroupRequired} annotations and checks each
+* requirement with the authorizer.
+*
+* The layer takes the authorizer when it is built. The middleware must
+* require the services of the authorizer, such as the identity of the
+* caller. `R` is the type of the services that the `load` functions need. The
+* layer takes them when it is built too.
+*
+* @stability unstable
+* @category layers
+* @since 0.3.0
+*/
+const layer = layer$1;
+export { GroupRequired, Required, errors, layer, requires };
+
+//# sourceMappingURL=HttpApi.js.map

package/dist/HttpApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpApi.js","names":["internal.requires","internal.layer"],"sources":["../src/HttpApi.ts"],"sourcesContent":["/**\n * Tools to check authorization in an `effect/http-api` server.\n *\n * Each endpoint says what it needs with the {@link Required} annotation. A\n * group can give a default with {@link GroupRequired}: one list for GET\n * requests and one list for all other methods. A middleware checks the\n * requirements before the handler runs. An endpoint with no annotation is a\n * defect, so a new endpoint is closed until you say what it needs. An empty\n * list means the endpoint is open.\n *\n * ```ts\n * class Authorization extends HttpApiMiddleware.Service<\n *   Authorization,\n *   { requires: Identity }\n * >()(\"app/Authorization\", { error: HttpApi.errors }) {}\n *\n * const endpoint = HttpApiEndpoint.patch(\"update\", \"/bots/:id\", { ... })\n *   .annotate(HttpApi.Required, [\n *     HttpApi.requires(Auth, \"update\", \"Bot\", (params) => Bots.find(params.id)),\n *   ])\n *\n * const AuthorizationLive = HttpApi.layer(Authorization, Auth)\n * ```\n *\n * This module is a separate entry point, `@nmnmcc/ability/HttpApi`, because\n * `effect/http-api` is not stable yet.\n *\n * @stability unstable\n * @since 0.3.0\n */\nimport * as Context from \"effect/Context\"\nimport type * as Effect from \"effect/Effect\"\nimport type * as Layer from \"effect/Layer\"\nimport { HttpApiSchema } from \"effect/http-api\"\nimport * as Authorizer from \"./Authorizer.ts\"\nimport type * as Domain from \"./Domain.ts\"\nimport * as internal from \"./internal/httpApi.ts\"\n\n/**\n * One check that an endpoint needs: an action on a kind of resource. With\n * `load`, the middleware loads the resource value from the path parameters\n * and checks the action on that value. Without `load`, it checks the action\n * on the kind.\n *\n * @stability unstable\n * @category models\n * @since 0.3.0\n */\nexport interface Requirement {\n\treadonly action: string\n\treadonly kind: string\n\treadonly load?: (\n\t\tparams: Readonly<Record<string, string | undefined>>,\n\t) => Effect.Effect<object, unknown, unknown>\n}\n\n/**\n * The checks that an endpoint needs.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class Required extends Context.Service<\n\tRequired,\n\tReadonlyArray<Requirement>\n>()(\"@nmnmcc/ability/HttpApi/Required\") {}\n\n/**\n * The checks for every endpoint of a group with no {@link Required}\n * annotation. `read` is for GET requests. `write` is for all other methods.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class GroupRequired extends Context.Service<\n\tGroupRequired,\n\t{\n\t\treadonly read: ReadonlyArray<Requirement>\n\t\treadonly write: ReadonlyArray<Requirement>\n\t}\n>()(\"@nmnmcc/ability/HttpApi/GroupRequired\") {}\n\n/**\n * Makes a {@link Requirement} with the types of an authorizer. The action must\n * be an action of the kind, and `load` must give a value of the kind.\n *\n * `load` may fail. Its errors must be errors of the middleware, and the\n * services that it needs must be given to {@link layer}.\n *\n * @stability unstable\n * @category constructors\n * @since 0.3.0\n */\nexport const requires: <\n\tA extends { readonly domain: Domain.Any },\n\tconst K extends Domain.Kind<A[\"domain\"]>,\n>(\n\tauthorizer: A,\n\taction: Domain.ActionOf<A[\"domain\"], K>,\n\tkind: K,\n\tload?: (\n\t\tparams: Readonly<Record<string, string | undefined>>,\n\t) => Effect.Effect<Domain.ValueOf<A[\"domain\"], K>, unknown, unknown>,\n) => Requirement = internal.requires\n\n/**\n * The errors of the middleware, with HTTP status codes: 403 for\n * `Forbidden`, 503 for `PolicyUnavailable`, and 409 for `Pending`.\n *\n * @stability unstable\n * @category errors\n * @since 0.3.0\n */\nexport const errors = [\n\tAuthorizer.Forbidden.pipe(HttpApiSchema.status(403)),\n\tAuthorizer.PolicyUnavailable.pipe(HttpApiSchema.status(503)),\n\tAuthorizer.Pending.pipe(HttpApiSchema.status(409)),\n] as const\n\n/**\n * Makes the layer of an authorization middleware. The middleware reads the\n * {@link Required} and {@link GroupRequired} annotations and checks each\n * requirement with the authorizer.\n *\n * The layer takes the authorizer when it is built. The middleware must\n * require the services of the authorizer, such as the identity of the\n * caller. `R` is the type of the services that the `load` functions need. The\n * layer takes them when it is built too.\n *\n * @stability unstable\n * @category layers\n * @since 0.3.0\n */\nexport const layer: <\n\tSelf,\n\tId extends string,\n\tA extends Authorizer.AnyServiceClass,\n\tR = never,\n>(\n\tmiddleware: Context.ServiceClass<Self, Id, any>,\n\tauthorizer: A,\n) => Layer.Layer<\n\tSelf,\n\tnever,\n\t(A extends Context.Key<infer I, any> ? I : never) | R\n> = internal.layer as never\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,IAAa,WAAb,cAA8B,QAAQ,QAGpC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC;;;;;;;;;AAUzC,IAAa,gBAAb,cAAmC,QAAQ,QAMzC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;;;;;;;;;;;;AAa9C,MAAa,WAUMA;;;;;;;;;AAUnB,MAAa,SAAS;CACA,UAAA,KAAK,cAAc,OAAO,GAAG,CAAC;CACtB,kBAAA,KAAK,cAAc,OAAO,GAAG,CAAC;CACxC,QAAA,KAAK,cAAc,OAAO,GAAG,CAAC;AAClD;;;;;;;;;;;;;;;AAgBA,MAAa,QAYTC"}

package/dist/Policy.d.ts

@@ -0,0 +1,429 @@
+import { Condition, Encoded, FieldPath, Variance } from "./Condition.js";
+import { ActionOf, Any as Any$1, DataOf, Kind, Principal, ValueOf } from "./Domain.js";
+import { Any as Any$2, Builder, Error as Error$1, OpaqueOf as OpaqueOf$1, Services as Services$1 } from "./Rule.js";
+import { Decision } from "./Decision.js";
+import * as Effect from "effect/Effect";
+import * as Equal from "effect/Equal";
+import * as Schema from "effect/Schema";
+import * as Inspectable from "effect/Inspectable";
+import * as Pipeable from "effect/Pipeable";
+declare namespace Policy_d_exports {
+  export { Algorithm, AllNode, Any, AnyNode, AnyRequest, CeilingNode, DomainOf, EncodedNode, EncodedRule, Error, Explanation, FirstOfNode, KindRequest, KindTarget, Node, OpaqueOf, Options, Policy, Request, RulesNode, Services, Step, Target, TypeId, all, any, ceiling, decide, decideSync, define, empty, explain, firstOf, isPolicy, permittedFields, residual, rules, schema };
+}
+/**
+ * @stability stable
+ * @category type IDs
+ * @since 0.3.0
+ */
+export declare const TypeId: "~@nmnmcc/ability/Policy";
+/**
+ * @stability stable
+ * @category type IDs
+ * @since 0.3.0
+ */
+export type TypeId = typeof TypeId;
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Algorithm = "denyOverrides" | "permitOverrides" | "firstApplicable" | "lastApplicable";
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface RulesNode {
+  readonly _tag: "Rules";
+  readonly algorithm: Algorithm;
+  readonly rules: ReadonlyArray<Any$2>;
+}
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface AllNode {
+  readonly _tag: "All";
+  readonly policies: ReadonlyArray<Node>;
+}
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface AnyNode {
+  readonly _tag: "Any";
+  readonly policies: ReadonlyArray<Node>;
+}
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface FirstOfNode {
+  readonly _tag: "FirstOf";
+  readonly policies: ReadonlyArray<Node>;
+}
+/**
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface CeilingNode {
+  readonly _tag: "Ceiling";
+  readonly cap: Node;
+  readonly policy: Node;
+}
+/**
+ * The nodes of a policy tree.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode;
+/**
+ * A policy for the domain `D`. `E`, `R` and `O` come from the conditions of
+ * its rules. See `Condition.Condition`.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Policy<D extends Any$1, E = never, R = never, O = never> extends Equal.Equal, Inspectable.Inspectable, Pipeable.Pipeable {
+  readonly [TypeId]: TypeId;
+  readonly domain: D;
+  readonly node: Node;
+  readonly "~Policy"?: Variance<E, R, O>;
+}
+/**
+ * Any policy.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Any = Policy<any, any, any, any>;
+/**
+ * The domain of a policy.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type DomainOf<P> = P extends Policy<infer D, any, any, any> ? D : never;
+/**
+ * The error type of a policy.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type Error<P> = P extends {
+  readonly "~Policy"?: Variance<infer E, infer _R, infer _O>;
+} ? E : never;
+/**
+ * The service type of a policy.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type Services<P> = P extends {
+  readonly "~Policy"?: Variance<infer _E, infer R, infer _O>;
+} ? R : never;
+/**
+ * `Condition.Opaque` when a policy has a predicate.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type OpaqueOf<P> = P extends {
+  readonly "~Policy"?: Variance<infer _E, infer _R, infer O>;
+} ? O : never;
+/**
+ * One act on one resource value, for each kind of the domain. The action must
+ * be an action of the kind, and the field must be a field of the kind.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Target<D> = { [K in Kind<D>]: {
+  readonly action: ActionOf<D, K>;
+  readonly resource: ValueOf<D, K>;
+  readonly field?: FieldPath<DataOf<D, K>>;
+}; }[Kind<D>];
+/**
+ * One act on one kind of resource, with no value.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type KindTarget<D> = { [K in Kind<D>]: {
+  readonly action: ActionOf<D, K>;
+  readonly kind: K;
+  readonly field?: FieldPath<DataOf<D, K>>;
+}; }[Kind<D>];
+/**
+ * A request: a principal, an action, and a resource value.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Request<D> = Target<D> & {
+  readonly principal: Principal<D>;
+};
+/**
+ * A request about a kind of resource, with no value.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type KindRequest<D> = KindTarget<D> & {
+  readonly principal: Principal<D>;
+};
+/**
+ * A request with no types.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface AnyRequest {
+  readonly principal: object;
+  readonly action: string;
+  readonly resource: object;
+  readonly field?: string | undefined;
+}
+/**
+ * One rule that a decision tested. `path` gives the place of the rule in the
+ * policy tree: the index of each child, then the index of the rule.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Step {
+  readonly path: ReadonlyArray<number>;
+  readonly rule: Any$2;
+  readonly applies: boolean;
+}
+/**
+ * A decision, and the rules that were tested to make it, in order. Keep it in
+ * an audit log.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Explanation {
+  readonly decision: Decision;
+  readonly steps: ReadonlyArray<Step>;
+}
+/**
+ * The options of a list of rules.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Options {
+  /** The default is `denyOverrides`. */
+  readonly algorithm?: Algorithm;
+}
+/**
+ * Makes a policy from a generator function that gives rules. It is pure and it
+ * gives its result at once.
+ *
+ * @example
+ * ```ts
+ * const policy = Policy.define(App)(function* (_) {
+ *   yield* _.allow("read", Bot)
+ *   yield* _.allow(["update", "delete"], Bot, {
+ *     when: ($) => $.eq("ownerUserId", $.principal("userId")),
+ *   })
+ * })
+ * ```
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export declare const define: <D extends Any$1>(domain: D, options?: Options) => <Rules extends Any$2, A>(body: (builder: Builder<D>) => Generator<Rules, A, unknown>) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
+/**
+ * Makes a policy from a list of rules.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export declare const rules: <D extends Any$1, Rules extends Any$2>(domain: D, rules: Iterable<Rules>, options?: Options) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
+/**
+ * A policy with no rules. It is not applicable to any request.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export declare const empty: <D extends Any$1>(domain: D) => Policy<D>;
+type Combined<D extends Any$1, Ps extends ReadonlyArray<Any>> = Policy<D, Error<Ps[number]>, Services<Ps[number]>, OpaqueOf<Ps[number]>>;
+/**
+ * Every policy must allow, and one deny is enough to deny. With some policies
+ * not applicable and none that deny, the result is not applicable.
+ *
+ * @stability stable
+ * @category combinators
+ * @since 0.3.0
+ */
+export declare const all: <const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>]>(policies: Ps) => Combined<DomainOf<Ps[0]>, Ps>;
+/**
+ * One allow is enough. Without an allow, one deny gives a deny.
+ *
+ * @stability stable
+ * @category combinators
+ * @since 0.3.0
+ */
+export declare const any: <const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>]>(policies: Ps) => Combined<DomainOf<Ps[0]>, Ps>;
+/**
+ * The first policy that allows or denies gives the answer.
+ *
+ * @stability stable
+ * @category combinators
+ * @since 0.3.0
+ */
+export declare const firstOf: <const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>]>(policies: Ps) => Combined<DomainOf<Ps[0]>, Ps>;
+/**
+ * Puts a limit on a policy. A deny from `cap` always wins. An allow from `cap`
+ * does nothing.
+ *
+ * @stability stable
+ * @category combinators
+ * @since 0.3.0
+ */
+export declare const ceiling: {
+  <D extends Any$1, E2, R2, O2>(cap: Policy<D, E2, R2, O2>): <E, R, O>(policy: Policy<D, E, R, O>) => Policy<D, E | E2, R | R2, O | O2>;
+  <D extends Any$1, E, R, O, E2, R2, O2>(policy: Policy<D, E, R, O>, cap: Policy<D, E2, R2, O2>): Policy<D, E | E2, R | R2, O | O2>;
+};
+/**
+ * Gives the decision of a policy for a request.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const decide: {
+  <D extends Any$1>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Decision, E, R>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Request<NoInfer<D>>): Effect.Effect<Decision, E, R>;
+};
+/**
+ * Gives the decision of a policy with no predicates, at once.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const decideSync: {
+  <D extends Any$1>(request: Request<D>): (policy: Policy<D>) => Decision;
+  <D extends Any$1>(policy: Policy<D>, request: Request<NoInfer<D>>): Decision;
+};
+/**
+ * Gives the decision of a policy and the rules that were tested to make it.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const explain: {
+  <D extends Any$1>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Explanation, E, R>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Request<NoInfer<D>>): Effect.Effect<Explanation, E, R>;
+};
+/**
+ * Gives the condition on resource values for which the policy allows a
+ * request. It has no principal fields and no `Under` nodes, so you can give it
+ * to `Condition.fold`. It is `True` when the policy allows every value of the
+ * kind, and `False` when it allows none.
+ *
+ * Predicates stay in the condition. They take the principal with them.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const residual: {
+  <D extends Any$1>(request: KindRequest<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Condition<E, R, O>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: KindRequest<NoInfer<D>>): Condition<E, R, O>;
+};
+/**
+ * Gives the fields of a resource value that the policy lets a request use. It
+ * tests each field of the resource Schema, with dots for nested fields.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const permittedFields: {
+  <D extends Any$1>(request: Omit<Request<D>, "field">): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<ReadonlyArray<string>, E, R>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Omit<Request<NoInfer<D>>, "field">): Effect.Effect<ReadonlyArray<string>, E, R>;
+};
+/**
+ * The JSON form of a rule.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface EncodedRule {
+  readonly _tag: "Allow" | "Deny";
+  readonly actions: ReadonlyArray<string>;
+  readonly resources: ReadonlyArray<string>;
+  readonly when?: Encoded;
+  readonly fields?: ReadonlyArray<string>;
+  readonly reason?: string;
+  readonly id?: string;
+  readonly meta?: unknown;
+}
+/**
+ * The JSON form of a policy.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type EncodedNode = {
+  readonly _tag: "Rules";
+  readonly algorithm: Algorithm;
+  readonly rules: ReadonlyArray<EncodedRule>;
+} | {
+  readonly _tag: "All" | "Any" | "FirstOf";
+  readonly policies: ReadonlyArray<EncodedNode>;
+} | {
+  readonly _tag: "Ceiling";
+  readonly cap: EncodedNode;
+  readonly policy: EncodedNode;
+};
+/**
+ * The Schema of the policies of a domain with no predicates. Decoding checks
+ * every kind, action, field and principal field against the domain, and the
+ * `meta` of each rule against the `meta` Schema of the domain.
+ *
+ * @stability stable
+ * @category schemas
+ * @since 0.3.0
+ */
+export declare const schema: <D extends Any$1>(domain: D) => Schema.Codec<Policy<D>, EncodedNode>;
+/**
+ * Tests if a value is a policy.
+ *
+ * @stability stable
+ * @category guards
+ * @since 0.3.0
+ */
+export declare const isPolicy: (u: unknown) => u is Any;
+export { Policy_d_exports };
+//# sourceMappingURL=Policy.d.ts.map

package/dist/Policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Policy.d.ts","names":["Rule.Any","Domain.Any","Condition.Variance","Domain.Kind","Domain.ActionOf","Domain.ValueOf","Domain.DataOf","Condition.FieldPath","Domain.Principal","Decision.Decision","Rule.Builder","Rule.Error","Rule.Services","Rule.OpaqueOf","Condition.Condition","Condition.Encoded"],"sources":["../src/Policy.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAgDa;;;;;;YAOD,gBAAgB;;;;;;YAOhB;;;;;;iBAQK;WACP;WACA,WAAW;WACX,OAAO,cAAcA;;;;;;;iBAQd;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,KAAK;WACL,QAAQ;;;;;;;;;YAUN,OAAO,YAAY,UAAU,UAAU,cAAc;;;;;;;;;iBAUhD,OAAO,UAAUC,OAAY,WAAW,WAAW,mBAC3D,MAAM,OAAO,YAAY,aAAa,SAAS;YAC7C,SAAS;WACV,QAAQ;WACR,MAAM;WACN,YAAYC,SAAmB,GAAG,GAAG;;;;;;;;;YAUnC,MAAM;;;;;;;;YASN,SAAS,KAAK,UAAU,aAAa,oBAAoB;;;;;;;;YASzD,MAAM,KAAK;WACb,YAAYA,eAAyB,SAAS,UAAU;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,SAAS;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,UAAU;IAEhE;;;;;;;;;YAWS,OAAO,QACjB,KAAKC,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,UAAUC,QAAe,GAAG;WAC5B,QAAQE,UAAoBD,OAAc,GAAG;KAEtDH,KAAY;;;;;;;;YASF,WAAW,QACrB,KAAKA,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,MAAM;WACN,QAAQG,UAAoBD,OAAc,GAAG;KAEtDH,KAAY;;;;;;;;YASF,QAAQ,KAAK,OAAO;WAAgB,WAAWK,UAAiB;;;;;;;;;YAShE,YAAY,KAAK,WAAW;WAC9B,WAAWA,UAAiB;;;;;;;;;iBAUrB;WACP;WACA;WACA;WACA;;;;;;;;;;iBAWO;WACP,MAAM;WACN,MAAMR;WACN;;;;;;;;;;iBAWO;WACP,UAAUS;WACV,OAAO,cAAc;;;;;;;;;iBAUd;;WAEP,YAAY;;;;;;;;;;;;;;;;;;;;qBAqBT,SAAS,UAAUR,OAC/B,QAAQ,GACR,UAAU,aACL,cAAcD,OAAU,GAC7B,OAAO,SAASU,QAAa,OAAO,UAAU,OAAO,gBACjD,OAAO,GAAGC,QAAW,QAAQC,WAAc,QAAQC,WAAc;;;;;;;;qBAUzD,QAAQ,UAAUZ,OAAY,cAAcD,OACxD,QAAQ,GACR,OAAO,SAAS,QAChB,UAAU,YACN,OAAO,GAAGW,QAAW,QAAQC,WAAc,QAAQC,WAAc;;;;;;;;qBAUzD,QAAQ,UAAUZ,OAAY,QAAQ,MAAM,OAAO;KAG3D,SAAS,UAAUA,OAAY,WAAW,cAAc,QAAQ,OACpE,GACA,MAAM,aACN,SAAS,aACT,SAAS;;;;;;;;;qBAWG,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,gBACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;;qBAUlB;GACX,UAAUA,OAAY,IAAI,IAAI,IAC9B,KAAK,OAAO,GAAG,IAAI,IAAI,OACpB,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;GACzE,UAAUA,OAAY,GAAG,GAAG,GAAG,IAAI,IAAI,IACvC,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,KAAK,OAAO,GAAG,IAAI,IAAI,MACrB,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;;;;;;;;;qBAUrB;GACX,UAAUA,OACV,SAAS,QAAQ,MACd,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAOQ,UAAmB,GAAG;GACxC,UAAUR,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAOQ,UAAmB,GAAG;;;;;;;;;qBAU3B;GACX,UAAUR,OACV,SAAS,QAAQ,MACd,QAAQ,OAAO,OAAOQ;GACzB,UAAUR,OACV,QAAQ,OAAO,IACf,SAAS,QAAQ,QAAQ,MACvBQ;;;;;;;;;qBAUS;GACX,UAAUR,OACV,SAAS,QAAQ,MACd,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,OAAO,aAAa,GAAG;GACzE,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAO,aAAa,GAAG;;;;;;;;;;;;;;qBAerB;GACX,UAAUA,OACV,SAAS,YAAY,MAClB,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAOa,UAAoB,GAAG,GAAG;GACrE,UAAUb,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,YAAY,QAAQ,MAC3Ba,UAAoB,GAAG,GAAG;;;;;;;;;;qBAWjB;GACX,UAAUb,OACV,SAAS,KAAK,QAAQ,gBACnB,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAO,uBAAuB,GAAG;GAC5C,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,KAAK,QAAQ,QAAQ,gBAC5B,OAAO,OAAO,uBAAuB,GAAG;;;;;;;;;iBAU3B;WACP;WACA,SAAS;WACT,WAAW;WACX,OAAOc;WACP,SAAS;WACT;WACA;WACA;;;;;;;;;YAUE;WAEA;WACA,WAAW;WACX,OAAO,cAAc;;WAGrB;WACA,UAAU,cAAc;;WAGxB;WACA,KAAK;WACL,QAAQ;;;;;;;;;;;qBAYP,SAAS,UAAUd,OAC/B,QAAQ,MACJ,OAAO,MAAM,OAAO,IAAI;;;;;;;;qBAShB,WAAW,eAAe,KAAK"}