@nmnmcc/ability 0.2.0 → 1.0.0

package/dist/Authorizer.d.ts

@@ -0,0 +1,241 @@
+import { Condition, Opaque } from "./Condition.js";
+import { Any, CommonAction, Kind, Principal } from "./Domain.js";
+import { Decision } from "./Decision.js";
+import { Coverage, FieldlessTarget, KindRequest, KindTarget, Policy, Request, ResidualReads, Target as Target$1 } from "./Policy.js";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Duration from "effect/Duration";
+declare namespace Authorizer_d_exports {
+  export { AnyServiceClass, Authorizer, Config, DeciderRequest, Forbidden, GuardOptions, Options, Pending, PolicyUnavailable, Service, ServiceClass, Target, layer };
+}
+declare const Forbidden_base: Schema.Class<Forbidden, Schema.TaggedStruct<"Forbidden", {
+  readonly action: Schema.String;
+  readonly kind: Schema.String;
+  readonly field: Schema.optionalKey<Schema.String>;
+  readonly reason: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error when a policy says no.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export declare class Forbidden extends Forbidden_base {}
+declare const PolicyUnavailable_base: Schema.Class<PolicyUnavailable, Schema.TaggedStruct<"PolicyUnavailable", {
+  readonly cause: Schema.Defect;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error when the policy of the principal can not be loaded. The cause is
+ * kept, but it is not shown to the client.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export declare class PolicyUnavailable extends PolicyUnavailable_base {}
+declare const Pending_base: Schema.Class<Pending, Schema.TaggedStruct<"Pending", {
+  readonly ticket: Schema.String;
+  readonly reason: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The error when a decider must wait for an answer. `ticket` names the
+ * request that waits, so the client can come back for the answer.
+ *
+ * @stability stable
+ * @category errors
+ * @since 0.3.0
+ */
+export declare class Pending extends Pending_base {}
+/**
+ * The services and the errors of the principal and the decider of an
+ * authorizer.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Config {
+  readonly requires?: unknown;
+  readonly error?: unknown;
+}
+type RequiresOf<C> = C extends {
+  readonly requires: infer R;
+} ? R : never;
+type ErrorOf<C> = C extends {
+  readonly error: infer E;
+} ? E : never;
+/**
+ * What a check is about: an act on a resource value, or an act on a kind of
+ * resource. A check on a kind passes only when the policy allows the act on
+ * every value of the kind. With a scope (`within`), it passes when the policy
+ * allows the act on every value in the scope, and the scope is not empty.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type Target<D> = Target$1<D> | KindTarget<D>;
+/**
+ * A request to the decider.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type DeciderRequest<D> = Request<D> | KindRequest<D>;
+/**
+ * The options of a guard.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type GuardOptions<D, E2, K extends string = Kind<D>> = {
+  /** The error when the principal may not see the resource. */
+  readonly hide: () => E2;
+} & ("read" extends CommonAction<D, K> ? {
+  /**
+   * The action that lets the principal see the resource. It must be an
+   * action of every kind in `K`. The default is `"read"`.
+   */
+  readonly read?: CommonAction<D, K>;
+} : {
+  /**
+   * The action that lets the principal see the resource. It must be an
+   * action of every kind in `K`. Some kind in `K` has no `"read"`
+   * action, so you must give it.
+   */
+  readonly read: CommonAction<D, K>;
+});
+/**
+ * The service.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Authorizer<D extends Any, E, R> {
+  readonly domain: D;
+  /** The principal of the current request. */
+  readonly principal: Effect.Effect<Principal<D>, E, R>;
+  /**
+   * The policy of the principal of the current request. Its predicates have
+   * the services of the layer. It may have predicates, so it is opaque.
+   */
+  readonly policy: Effect.Effect<Policy<D, E, never, Opaque>, PolicyUnavailable | E, R>;
+  /** Gives the decision of the policy. It does not ask the decider. */
+  readonly decide: (target: Target$1<D>) => Effect.Effect<Decision, PolicyUnavailable | E, R>;
+  /** Succeeds when the principal may do the act, and fails when it may not. */
+  readonly check: (target: Target<D>) => Effect.Effect<void, Forbidden | Pending | PolicyUnavailable | E, R>;
+  /**
+   * Checks the read action first, and fails with the error of `hide` when the
+   * principal may not see the resource. Then it checks the act. Use it to
+   * answer "not found" to a principal that may not know that a resource
+   * exists.
+   */
+  readonly guard: <const T extends Target$1<D>, E2>(target: T, options: GuardOptions<D, E2, T["resource"]["_tag"]>) => Effect.Effect<void, E2 | Forbidden | Pending | PolicyUnavailable | E, R>;
+  /**
+   * Gives the condition on resource values that the principal may act on,
+   * inside the scope of the target when it has one. Change it into a query
+   * with `Condition.fold`. It is `False` when the principal may act on no
+   * value, so the list is empty: it is not an error.
+   */
+  readonly filter: <const T extends KindTarget<D>>(target: T) => Effect.Effect<Condition<E, never, Opaque, ResidualReads<D, T["kind"]>>, PolicyUnavailable | E, R>;
+  /**
+   * Tells if the principal may act on all, none or some of the values in
+   * the scope of the target. See `Policy.coverage`. Use it to show a button
+   * only when the answer is not `None`.
+   */
+  readonly coverage: <const T extends KindTarget<D>>(target: T) => Effect.Effect<Coverage<E, never, Opaque, ResidualReads<D, T["kind"]>>, PolicyUnavailable | E, R>;
+  /** Gives the fields of a value that the principal may use. */
+  readonly permittedFields: (target: FieldlessTarget<D>) => Effect.Effect<ReadonlyArray<string>, PolicyUnavailable | E, R>;
+  /**
+   * Removes the cached policy of a principal, or of every principal. Call it
+   * after a change to the rules or roles of a principal.
+   */
+  readonly invalidate: (principal?: Principal<D>) => Effect.Effect<void>;
+}
+/**
+ * The class made by {@link Service}. The static functions use the service
+ * from the context.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface ServiceClass<Self, Id extends string, D extends Any, E, R> extends Context.ServiceClass<Self, Id, Authorizer<D, E, R>> {
+  readonly domain: D;
+  readonly decide: (target: Target$1<D>) => Effect.Effect<Decision, PolicyUnavailable | E, R | Self>;
+  readonly check: (target: Target<D>) => Effect.Effect<void, Forbidden | Pending | PolicyUnavailable | E, R | Self>;
+  readonly guard: <const T extends Target$1<D>, E2>(target: T, options: GuardOptions<D, E2, T["resource"]["_tag"]>) => Effect.Effect<void, E2 | Forbidden | Pending | PolicyUnavailable | E, R | Self>;
+  readonly filter: <const T extends KindTarget<D>>(target: T) => Effect.Effect<Condition<E, never, Opaque, ResidualReads<D, T["kind"]>>, PolicyUnavailable | E, R | Self>;
+  readonly coverage: <const T extends KindTarget<D>>(target: T) => Effect.Effect<Coverage<E, never, Opaque, ResidualReads<D, T["kind"]>>, PolicyUnavailable | E, R | Self>;
+  readonly permittedFields: (target: FieldlessTarget<D>) => Effect.Effect<ReadonlyArray<string>, PolicyUnavailable | E, R | Self>;
+}
+/**
+ * Any service class made by {@link Service}.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type AnyServiceClass = Context.Key<any, any> & {
+  readonly domain: Any;
+};
+/**
+ * Makes an authorizer service class for a domain.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export declare const Service: <Self, C extends Config = {}>() => <const Id extends string, D extends Any>(id: Id, domain: D) => ServiceClass<Self, Id, D, ErrorOf<C>, RequiresOf<C>>;
+/**
+ * The options of {@link layer}.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Options<D extends Any, E, R, EL, RL, RP> {
+  /** Gives the principal of the current request. */
+  readonly principal: Effect.Effect<Principal<D>, E, R>;
+  /**
+   * Loads the policy of a principal. A failure becomes
+   * {@link PolicyUnavailable}. The services of the predicates of the policy
+   * are taken when the layer is built.
+   */
+  readonly policy: (principal: Principal<D>) => Effect.Effect<Policy<D, E, RP, any>, EL, RL>;
+  /**
+   * Answers when no rule gives an answer. Without a decider, such a request
+   * fails with {@link Forbidden}.
+   */
+  readonly decider?: (request: DeciderRequest<D>) => Effect.Effect<Decision, Pending | E, R>;
+  /**
+   * How the policies are kept. The default keeps 1000 policies for 30 seconds.
+   * Give `false` to load the policy for each check.
+   *
+   * Two principals with the same data get one policy from the cache. So the
+   * loader must decide by the data of the principal only. When it tests that
+   * an object of the principal is a given object, as `role === admin` does,
+   * give `false`. A principal with objects in an array, a set or the keys of
+   * a map is not kept, because such tests are usual there.
+   */
+  readonly cache?: {
+    readonly capacity?: number;
+    readonly timeToLive?: Duration.Input;
+  } | false;
+}
+/**
+ * Makes the layer of an authorizer.
+ *
+ * @stability stable
+ * @category layers
+ * @since 0.3.0
+ */
+export declare const layer: <Self, Id extends string, D extends Any, E, R, EL = never, RL = never, RP = never>(service: ServiceClass<Self, Id, D, E, R>, options: Options<D, NoInfer<E>, NoInfer<R>, EL, RL, RP>) => Layer.Layer<Self, never, RL | RP>;
+export { Authorizer_d_exports };
+//# sourceMappingURL=Authorizer.d.ts.map

package/dist/Authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Authorizer.d.ts","names":["Policy.Target","Policy.KindTarget","Policy.Request","Policy.KindRequest","Domain.Kind","Domain.CommonAction","Domain.Any","Domain.Principal","Condition.Opaque","Policy.Policy","Decision.Decision","Policy.ResidualReads","Condition.Condition","Policy.Coverage","Policy.FieldlessTarget"],"sources":["../src/Authorizer.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;qBAgEa,kBAAkB;;;;;;;;;;;;qBAiBlB,0BAA0B;;;;;;;;;;;;;qBAY1B,gBAAgB;;;;;;;;;iBAeZ;WACP;WACA;;KAGL,WAAW,KAAK;WAAqB,gBAAgB;IAAM;KAC3D,QAAQ,KAAK;WAAqB,aAAa;IAAM;;;;;;;;;;;YAY9C,OAAO,KAAKA,SAAc,KAAKC,WAAkB;;;;;;;;YASjD,eAAe,KAAKC,QAAe,KAAKC,YAAmB;;;;;;;;YAS3D,aAAa,GAAG,IAAI,mBAAmBC,KAAY;;WAErD,YAAY;oBACFC,aAAoB,GAAG;;;;;WAM/B,OAAOA,aAAoB,GAAG;;;;;;;WAQ9B,MAAMA,aAAoB,GAAG;;;;;;;;;iBAUxB,WAAW,UAAUC,KAAY,GAAG;WAC3C,QAAQ;;WAER,WAAW,OAAO,OAAOC,UAAiB,IAAI,GAAG;;;;;WAKjD,QAAQ,OAAO,OACvBE,OAAc,GAAG,UAAUD,SAC3B,oBAAoB,GACpB;;WAGQ,SACR,QAAQR,SAAc,OAClB,OAAO,OAAOU,UAAmB,oBAAoB,GAAG;;WAEpD,QACR,QAAQ,OAAO,OACX,OAAO,aAAa,YAAY,UAAU,oBAAoB,GAAG;;;;;;;WAO7D,cAAc,UAAUV,SAAc,IAAI,IAClD,QAAQ,GACR,SAAS,aAAa,GAAG,IAAI,2BACzB,OAAO,aAAa,KAAK,YAAY,UAAU,oBAAoB,GAAG;;;;;;;WAOlE,eAAe,UAAUC,WAAkB,IACnD,QAAQ,MACJ,OAAO,OACXW,UACC,UAEAJ,QACAG,cAAqB,GAAG,aAEzB,oBAAoB,GACpB;;;;;;WAOQ,iBAAiB,UAAUV,WAAkB,IACrD,QAAQ,MACJ,OAAO,OACXY,SACC,UAEAL,QACAG,cAAqB,GAAG,aAEzB,oBAAoB,GACpB;;WAGQ,kBACR,QAAQG,gBAAuB,OAC3B,OAAO,OAAO,uBAAuB,oBAAoB,GAAG;;;;;WAKxD,aAAa,YAAYP,UAAiB,OAAO,OAAO;;;;;;;;;;iBAWjD,aAChB,MACA,mBACA,UAAUD,KACV,GACA,WACS,QAAQ,aAAa,MAAM,IAAI,WAAW,GAAG,GAAG;WAChD,QAAQ;WACR,SACR,QAAQN,SAAc,OAClB,OAAO,OAAOU,UAAmB,oBAAoB,GAAG,IAAI;WACxD,QACR,QAAQ,OAAO,OACX,OAAO,aAEX,YAAY,UAAU,oBAAoB,GAC1C,IAAI;WAEI,cAAc,UAAUV,SAAc,IAAI,IAClD,QAAQ,GACR,SAAS,aAAa,GAAG,IAAI,2BACzB,OAAO,aAEX,KAAK,YAAY,UAAU,oBAAoB,GAC/C,IAAI;WAEI,eAAe,UAAUC,WAAkB,IACnD,QAAQ,MACJ,OAAO,OACXW,UACC,UAEAJ,QACAG,cAAqB,GAAG,aAEzB,oBAAoB,GACpB,IAAI;WAEI,iBAAiB,UAAUV,WAAkB,IACrD,QAAQ,MACJ,OAAO,OACXY,SACC,UAEAL,QACAG,cAAqB,GAAG,aAEzB,oBAAoB,GACpB,IAAI;WAEI,kBACR,QAAQG,gBAAuB,OAC3B,OAAO,OAAO,uBAAuB,oBAAoB,GAAG,IAAI;;;;;;;;;YAU1D,kBAAkB,QAAQ;WAC5B,QAAQR;;;;;;;;;qBAUL,UAAU,MAAM,UAAU,yBAChC,mBACN,UAAUA,KAEV,IAAI,IACJ,QAAQ,MACJ,aAAa,MAAM,IAAI,GAAG,QAAQ,IAAI,WAAW;;;;;;;;iBAmCrC,QAAQ,UAAUA,KAAY,GAAG,GAAG,IAAI,IAAI;;WAEnD,WAAW,OAAO,OAAOC,UAAiB,IAAI,GAAG;;;;;;WAMjD,SACR,WAAWA,UAAiB,OACxB,OAAO,OAAOE,OAAc,GAAG,GAAG,UAAU,IAAI;;;;;WAK5C,WACR,SAAS,eAAe,OACpB,OAAO,OAAOC,UAAmB,UAAU,GAAG;;;;;;;;;;;WAW1C;aAEG;aACA,aAAa,SAAS;;;;;;;;;;qBAgetB,QACZ,MACA,mBACA,UAAUJ,KACV,GACA,GACA,YACA,YACA,YAEA,SAAS,aAAa,MAAM,IAAI,GAAG,GAAG,IACtC,SAAS,QAAQ,GAAG,QAAQ,IAAI,QAAQ,IAAI,IAAI,IAAI,QAChD,MAAM,MAAM,aAAa,KAAK"}

package/dist/Authorizer.js

@@ -0,0 +1,340 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { kindOf } from "./Resource.js";
+import { satisfiable } from "./Condition.js";
+import { Allow, Deny, NotApplicable, reason } from "./Decision.js";
+import { descriptorOf } from "./Domain.js";
+import { coverage, decide, fitsKind, permittedFields, provideContext, residual, residuals, scopeHasValue } from "./Policy.js";
+import * as Arr from "effect/Array";
+import * as Cache from "effect/Cache";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Equal from "effect/Equal";
+import * as Hash from "effect/Hash";
+import * as Layer from "effect/Layer";
+import * as MutableHashMap from "effect/MutableHashMap";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+// src/Authorizer.ts
+/**
+* An authorizer is an Effect service that makes decisions for the principal
+* of the current request.
+*
+* You make the service class, in the same way as `Context.Service`. Give the
+* services that the principal and the decider need as `requires`, and their
+* errors as `error`:
+*
+* ```ts
+* class Auth extends Authorizer.Service<Auth, { requires: Identity }>()(
+*   "app/Auth",
+*   App,
+* ) {}
+* ```
+*
+* Then give a layer with {@link layer}. It says where the principal comes
+* from and how to load its policy. The policy of each principal is loaded
+* once and kept in a cache for a short time.
+*
+* Then use the service in a handler:
+*
+* ```ts
+* yield* Auth.check({ action: "update", resource: bot })
+* ```
+*
+* A "no" answer goes into the error channel as {@link Forbidden}. When the
+* policy can not be loaded, the check fails with {@link PolicyUnavailable}.
+* So the check fails closed: an error is never a "yes".
+*
+* When no rule gives an answer, the authorizer asks the decider, if there is
+* one. A decider may answer at once, or fail with {@link Pending} when a person
+* or a Bot must answer later.
+*
+* @stability stable
+* @since 0.3.0
+*/
+var Authorizer_exports = /* @__PURE__ */ __exportAll({
+	Forbidden: () => Forbidden,
+	Pending: () => Pending,
+	PolicyUnavailable: () => PolicyUnavailable,
+	Service: () => Service,
+	layer: () => layer
+});
+/**
+* The error when a policy says no.
+*
+* @stability stable
+* @category errors
+* @since 0.3.0
+*/
+var Forbidden = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/Forbidden")("Forbidden", {
+	action: Schema.String,
+	kind: Schema.String,
+	field: Schema.optionalKey(Schema.String),
+	reason: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* The error when the policy of the principal can not be loaded. The cause is
+* kept, but it is not shown to the client.
+*
+* @stability stable
+* @category errors
+* @since 0.3.0
+*/
+var PolicyUnavailable = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/PolicyUnavailable")("PolicyUnavailable", { cause: Schema.Defect() }) {};
+/**
+* The error when a decider must wait for an answer. `ticket` names the
+* request that waits, so the client can come back for the answer.
+*
+* @stability stable
+* @category errors
+* @since 0.3.0
+*/
+var Pending = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/Pending")("Pending", {
+	ticket: Schema.String,
+	reason: Schema.optionalKey(Schema.String)
+}) {};
+/**
+* Makes an authorizer service class for a domain.
+*
+* @stability stable
+* @category constructors
+* @since 0.3.0
+*/
+const Service = (() => (id, domain) => {
+	const Base = Context.Service()(id);
+	return class extends Base {
+		static domain = domain;
+		static decide = (target) => this.use((service) => service.decide(target));
+		static check = (target) => this.use((service) => service.check(target));
+		static guard = (target, options) => this.use((service) => service.guard(target, options));
+		static filter = (target) => this.use((service) => service.filter(target));
+		static coverage = (target) => this.use((service) => service.coverage(target));
+		static permittedFields = (target) => this.use((service) => service.permittedFields(target));
+	};
+});
+/**
+* A cache key for a principal. Two keys are equal when they have the same
+* text, so two principals with the same value share one policy. The key also
+* keeps the principal, so the cache can load its policy. A plain `Data` value
+* can not do both, so the key gives its own equality with `Equal.Equal`.
+*/
+var PrincipalKey = class PrincipalKey {
+	principal;
+	text;
+	constructor(principal, text) {
+		this.principal = principal;
+		this.text = text;
+	}
+	[Equal.symbol](that) {
+		return that instanceof PrincipalKey && that.text === this.text;
+	}
+	[Hash.symbol]() {
+		return Hash.string(this.text);
+	}
+};
+/**
+* Tests if an array has a plain field at each index below its length. With
+* one more own key for `length`, it then has no other own keys.
+*/
+const hasEveryIndex = (value) => Arr.every(Array.from({ length: value.length }, (_, index) => index), (index) => isPlainField(value, String(index)));
+/**
+* Tests if an own key of an object holds plain data that the text shows: it
+* can be seen in a loop over the keys, and it is not a getter.
+*/
+const isPlainField = (value, key) => {
+	const descriptor = Object.getOwnPropertyDescriptor(value, key);
+	return descriptor !== void 0 && descriptor.enumerable === true && "value" in descriptor;
+};
+const isObjectLike = (value) => typeof value === "object" && value !== null || typeof value === "function";
+/** Gives a number that is only for this class, in this layer. */
+const classId = (classes, constructor) => {
+	const id = Option.getOrElse(MutableHashMap.get(classes, constructor), () => {
+		const fresh = MutableHashMap.size(classes);
+		MutableHashMap.set(classes, constructor, fresh);
+		return fresh;
+	});
+	return `#${String(id)}`;
+};
+/** The most levels of objects in a principal that the cache takes. */
+const maxKeyDepth = 256;
+/**
+* Gives a text that names a principal value. Two values get one text only when
+* they have the same types and the same data. So a string `"1"` and a bigint
+* `1n` get two texts. The text keeps the class of each object, by a number
+* that is its own, because two classes may have one name.
+*
+* It reads only the fields of plain objects and of `Schema.Class` values, and
+* only when each own key is a plain field that a loop over the keys can see.
+* An object of another class may keep its data where the text can not see it,
+* as a `URL` does. So it gives `undefined` for such an object, unless it is a
+* plain `Date`, `URL`, array, `Map` or `Set` with no extra own keys. It also
+* gives `undefined` for a function, a symbol, or a value with one object in two
+* places. The text can not show that two places hold the same object, and a
+* loader may test it, as `set.has(value)` does.
+* The private fields (`#name`) of a class can not be seen, so a principal
+* class must not keep its data in them.
+*
+* It also gives `undefined` for a value with more than {@link maxKeyDepth}
+* levels of objects. The walk calls itself for each level, so a deeper value
+* could fill the stack. Such a principal is not cached.
+*/
+const keyText = (value, seen, classes, depth = 0) => {
+	const plain = (text) => text;
+	switch (typeof value) {
+		case "string": return plain(`s${JSON.stringify(value)}`);
+		case "number": return plain(Object.is(value, -0) ? "n-0" : `n${String(value)}`);
+		case "bigint": return plain(`b${String(value)}`);
+		case "boolean": return plain(value ? "true" : "false");
+		case "undefined": return plain("undefined");
+		case "object": break;
+		default: return;
+	}
+	if (value === null) return plain("null");
+	if (seen.has(value) || depth >= maxKeyDepth) return;
+	seen.add(value);
+	const list = (items, wrap) => {
+		const texts = Arr.map(items, (item) => keyText(item, seen, classes, depth + 1));
+		return Arr.every(texts, (text) => text !== void 0) ? wrap(texts) : void 0;
+	};
+	const prototype = Object.getPrototypeOf(value);
+	const own = Reflect.ownKeys(value);
+	if (prototype === Date.prototype && own.length === 0) return `d${String(value.getTime())}`;
+	if (prototype === URL.prototype && own.length === 0) return `u${JSON.stringify(value.href)}`;
+	if (prototype === Array.prototype && own.length === value.length + 1 && hasEveryIndex(value) && !Arr.some(value, isObjectLike)) return list(value, (texts) => `[${texts.join(",")}]`);
+	if (prototype === Map.prototype && own.length === 0 && !Arr.some(Array.from(value.keys()), isObjectLike)) return list(Arr.flatMap(Array.from(value), ([key, item]) => [key, item]), (texts) => `Map{${texts.join(",")}}`);
+	if (prototype === Set.prototype && own.length === 0 && !Arr.some(Array.from(value), isObjectLike)) return list(Array.from(value), (texts) => `Set{${texts.join(",")}}`);
+	if ((prototype === null || prototype === Object.prototype || Schema.isSchema(prototype.constructor) && prototype.constructor.prototype === prototype) && Arr.every(own, (key) => typeof key === "string" && isPlainField(value, key))) {
+		const keys = own;
+		const name = prototype === null ? "" : classId(classes, prototype.constructor);
+		return list(Arr.map(keys, (key) => value[key]), (texts) => `${name}{${Arr.map(keys, (key, index) => `${JSON.stringify(key)}:${texts[index]}`).join(",")}}`);
+	}
+};
+const forbidden = (target, kind, reason) => Forbidden.make({
+	action: target.action,
+	kind,
+	...target.field === void 0 ? {} : { field: target.field },
+	...reason === void 0 ? {} : { reason }
+});
+const makeLayer = (service, options) => {
+	const domain = service.domain;
+	const classes = MutableHashMap.empty();
+	const keyOf = (principal) => {
+		const text = keyText(principal, /* @__PURE__ */ new Set(), classes);
+		return text === void 0 ? void 0 : new PrincipalKey(principal, text);
+	};
+	return Layer.effect(service, Effect.gen(function* () {
+		const services = yield* Effect.context();
+		const load = (principal) => options.policy(principal).pipe(Effect.provideContext(services), Effect.filterOrFail((value) => value.domain === domain, () => new globalThis.Error("The loaded policy is not a policy of this domain")), Effect.mapError((cause) => PolicyUnavailable.make({ cause })), Effect.map((value) => provideContext(value, services)));
+		const cache = options.cache === false ? void 0 : yield* Cache.make({
+			capacity: options.cache?.capacity ?? 1e3,
+			timeToLive: options.cache?.timeToLive ?? "30 seconds",
+			lookup: (key) => load(key.principal)
+		});
+		const policyFor = (principal) => {
+			const key = cache === void 0 ? void 0 : keyOf(principal);
+			if (cache === void 0 || key === void 0) return load(principal);
+			return Cache.get(cache, key).pipe(Effect.tapError(() => Cache.invalidate(cache, key)));
+		};
+		const withServices = (effect) => Effect.provideContext(effect, services);
+		const current = Effect.gen(function* () {
+			const principal = yield* options.principal;
+			return {
+				principal,
+				policy: yield* policyFor(principal)
+			};
+		});
+		const decideWith = Effect.fnUntraced(function* ({ principal, policy: value }, target) {
+			return yield* withServices(decide(value, {
+				...target,
+				principal
+			}));
+		});
+		const decide$1 = (target) => Effect.flatMap(current, (snapshot) => decideWith(snapshot, target));
+		const kindDecision = (value, principal, target) => {
+			const request = {
+				...target,
+				principal
+			};
+			const covered = coverage(value, request);
+			if (covered._tag === "All") return Allow({});
+			if (covered._tag !== "Unknown" && scopeHasValue(value, request)) {
+				const deny = residuals(value, request).deny;
+				const schema = descriptorOf(value.domain, target.kind ?? "")?.schema;
+				if (deny._tag === "False" || satisfiable(deny, { schema })._tag === "Unsatisfiable") return NotApplicable;
+			}
+			return Deny({});
+		};
+		const checkWith = Effect.fnUntraced(function* ({ principal, policy: value }, target) {
+			const kind = target.resource === void 0 ? target.kind ?? "" : kindOf(target.resource) ?? "";
+			const descriptor = descriptorOf(domain, kind);
+			if (descriptor === void 0 || !fitsKind(descriptor, target)) return yield* forbidden(target, kind, void 0);
+			const fromPolicy = target.resource === void 0 ? kindDecision(value, principal, target) : yield* withServices(decide(value, {
+				...target,
+				principal
+			}));
+			const decision = fromPolicy._tag === "NotApplicable" && options.decider !== void 0 ? yield* options.decider({
+				...target,
+				principal
+			}) : fromPolicy;
+			if (decision._tag !== "Allow") return yield* forbidden(target, kind, reason(decision));
+		});
+		const check = (target) => Effect.flatMap(current, (snapshot) => checkWith(snapshot, target));
+		const guard = Effect.fnUntraced(function* (target, guardOptions) {
+			const snapshot = yield* current;
+			const read = guardOptions.read ?? "read";
+			const { field: _field, ...rest } = target;
+			if ((yield* decideWith(snapshot, {
+				...rest,
+				action: read
+			}))._tag !== "Allow") return yield* Effect.fail(guardOptions.hide());
+			if (target.action !== read || target.field !== void 0) yield* checkWith(snapshot, target);
+		});
+		const filter = (target) => Effect.map(current, ({ principal, policy: value }) => {
+			const request = {
+				...target,
+				principal
+			};
+			const covered = coverage(value, request);
+			return covered._tag === "Unknown" ? residual(value, request) : covered.condition;
+		});
+		const coverage$1 = (target) => Effect.map(current, ({ principal, policy: value }) => coverage(value, {
+			...target,
+			principal
+		}));
+		const permittedFields$1 = Effect.fnUntraced(function* (target) {
+			const { principal, policy: value } = yield* current;
+			return yield* withServices(permittedFields(value, {
+				...target,
+				principal
+			}));
+		});
+		const invalidate = (principal) => {
+			if (cache === void 0) return Effect.void;
+			if (principal === void 0) return Cache.invalidateAll(cache);
+			const key = keyOf(principal);
+			return key === void 0 ? Effect.void : Cache.invalidate(cache, key);
+		};
+		return {
+			domain,
+			principal: options.principal,
+			policy: Effect.map(current, ({ policy: value }) => value),
+			decide: decide$1,
+			check,
+			guard,
+			filter,
+			coverage: coverage$1,
+			permittedFields: permittedFields$1,
+			invalidate
+		};
+	}));
+};
+/**
+* Makes the layer of an authorizer.
+*
+* @stability stable
+* @category layers
+* @since 0.3.0
+*/
+const layer = makeLayer;
+export { Authorizer_exports, Forbidden, Pending, PolicyUnavailable, Service, layer };
+
+//# sourceMappingURL=Authorizer.js.map