@nmnmcc/ability 0.3.0 → 1.0.1

package/dist/internal/domain.js

@@ -1,34 +0,0 @@
-import { descriptor } from "./resource.js";
-import * as Predicate from "effect/Predicate";
-// src/internal/domain.ts
-/** @internal */
-const TypeId = "~@nmnmcc/ability/Domain";
-/** @internal */
-const make = (options) => {
-	const resources = /* @__PURE__ */ new Map();
-	for (const resource of options.resources) {
-		const value = descriptor(resource);
-		if (resources.has(value.kind)) throw new Error(`Two resources have the kind name "${value.kind}"`);
-		if (value.kind === "*") throw new Error(`A resource may not have the kind name "*"`);
-		resources.set(value.kind, value);
-	}
-	return Object.freeze({
-		[TypeId]: TypeId,
-		principal: options.principal,
-		resources,
-		meta: options.meta
-	});
-};
-/** @internal */
-const isDomain = (u) => Predicate.hasProperty(u, TypeId);
-/** @internal */
-const getDescriptor = (domain, kind) => domain.resources.get(kind);
-/**
-* Gives the kind name of a resource value, from its `_tag` field.
-*
-* @internal
-*/
-const kindOf = (value) => Predicate.hasProperty(value, "_tag") && typeof value._tag === "string" ? value._tag : void 0;
-export { TypeId, getDescriptor, isDomain, kindOf, make };
-
-//# sourceMappingURL=domain.js.map

package/dist/internal/domain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain.js","names":[],"sources":["../../src/internal/domain.ts"],"sourcesContent":["import * as Predicate from \"effect/Predicate\"\nimport type * as Schema from \"effect/Schema\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Principal from \"../Principal.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport { descriptor } from \"./resource.ts\"\n\n/** @internal */\nexport const TypeId = \"~@nmnmcc/ability/Domain\" as const\n\n/** @internal */\nexport const make = (options: {\n\treadonly principal: Principal.Any\n\treadonly resources: ReadonlyArray<Resource.Any>\n\treadonly meta?: Schema.Top\n}): any => {\n\tconst resources = new Map<string, Resource.Descriptor>()\n\tfor (const resource of options.resources) {\n\t\tconst value = descriptor(resource)\n\t\tif (resources.has(value.kind)) {\n\t\t\t// Two resources with one kind name is a mistake in the code, not in the\n\t\t\t// data, so it is a defect.\n\t\t\tthrow new Error(`Two resources have the kind name \"${value.kind}\"`)\n\t\t}\n\t\tif (value.kind === \"*\") {\n\t\t\tthrow new Error(`A resource may not have the kind name \"*\"`)\n\t\t}\n\t\tresources.set(value.kind, value)\n\t}\n\treturn Object.freeze({\n\t\t[TypeId]: TypeId,\n\t\tprincipal: options.principal,\n\t\tresources,\n\t\tmeta: options.meta,\n\t})\n}\n\n/** @internal */\nexport const isDomain = (u: unknown): u is Domain.Any =>\n\tPredicate.hasProperty(u, TypeId)\n\n/** @internal */\nexport const getDescriptor = (\n\tdomain: Domain.Any,\n\tkind: string,\n): Resource.Descriptor | undefined => domain.resources.get(kind)\n\n/**\n * Gives the kind name of a resource value, from its `_tag` field.\n *\n * @internal\n */\nexport const kindOf = (value: unknown): string | undefined =>\n\tPredicate.hasProperty(value, \"_tag\") && typeof value._tag === \"string\"\n\t\t? value._tag\n\t\t: undefined\n"],"mappings":";;;;AAQA,MAAa,SAAS;;AAGtB,MAAa,QAAQ,YAIV;CACV,MAAM,4BAAY,IAAI,IAAiC;CACvD,KAAK,MAAM,YAAY,QAAQ,WAAW;EACzC,MAAM,QAAQ,WAAW,QAAQ;EACjC,IAAI,UAAU,IAAI,MAAM,IAAI,GAG3B,MAAM,IAAI,MAAM,qCAAqC,MAAM,KAAK,EAAE;EAEnE,IAAI,MAAM,SAAS,KAClB,MAAM,IAAI,MAAM,2CAA2C;EAE5D,UAAU,IAAI,MAAM,MAAM,KAAK;CAChC;CACA,OAAO,OAAO,OAAO;GACnB,SAAS;EACV,WAAW,QAAQ;EACnB;EACA,MAAM,QAAQ;CACf,CAAC;AACF;;AAGA,MAAa,YAAY,MACxB,UAAU,YAAY,GAAG,MAAM;;AAGhC,MAAa,iBACZ,QACA,SACqC,OAAO,UAAU,IAAI,IAAI;;;;;;AAO/D,MAAa,UAAU,UACtB,UAAU,YAAY,OAAO,MAAM,KAAK,OAAO,MAAM,SAAS,WAC3D,MAAM,OACN,KAAA"}

package/dist/internal/httpApi.js

@@ -1,41 +0,0 @@
-import { GroupRequired, Required } from "../HttpApi.js";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
-import { HttpRouter } from "effect/http";
-// src/internal/httpApi.ts
-/** @internal */
-const requires = (_authorizer, action, kind, load) => Object.freeze(load === void 0 ? {
-	action,
-	kind
-} : {
-	action,
-	kind,
-	load
-});
-/** @internal */
-const layer = (middleware, authorizer) => Layer.effect(middleware, Effect.gen(function* () {
-	const service = yield* authorizer;
-	const services = yield* Effect.context();
-	return Effect.fnUntraced(function* (httpEffect, options) {
-		const requirements = Option.orElse(Context.getOption(options.endpoint.annotations, Required), () => Option.map(Context.getOption(options.group.annotations, GroupRequired), (rules) => options.endpoint.method === "GET" ? rules.read : rules.write));
-		if (Option.isNone(requirements)) return yield* Effect.die(/* @__PURE__ */ new Error(`The endpoint ${options.group.identifier}.${options.endpoint.name} does not say what it needs. Give it the HttpApi.Required annotation.`));
-		for (const requirement of requirements.value) if (requirement.load === void 0) yield* service.check({
-			action: requirement.action,
-			kind: requirement.kind
-		});
-		else {
-			const params = yield* HttpRouter.params;
-			const value = yield* Effect.provideContext(requirement.load(params), services);
-			yield* service.check({
-				action: requirement.action,
-				resource: value
-			});
-		}
-		return yield* httpEffect;
-	});
-}));
-export { layer, requires };
-
-//# sourceMappingURL=httpApi.js.map

package/dist/internal/httpApi.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"httpApi.js","names":[],"sources":["../../src/internal/httpApi.ts"],"sourcesContent":["// A `load` function of a requirement is kept in an annotation, so its error\n// type and its service type are erased to `unknown`. The language service\n// check for `unknown` in an Effect is off here.\n// @effect-diagnostics anyUnknownInErrorContext:off\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport { HttpRouter } from \"effect/http\"\nimport type * as Authorizer from \"../Authorizer.ts\"\nimport type * as HttpApi from \"../HttpApi.ts\"\nimport { GroupRequired, Required } from \"../HttpApi.ts\"\n\n/** @internal */\nexport const requires = (\n\t_authorizer: unknown,\n\taction: string,\n\tkind: string,\n\tload?: HttpApi.Requirement[\"load\"],\n): HttpApi.Requirement =>\n\tObject.freeze(load === undefined ? { action, kind } : { action, kind, load })\n\n/** @internal */\nexport const layer = (\n\tmiddleware: Context.ServiceClass<any, string, any>,\n\tauthorizer: Authorizer.AnyServiceClass,\n) =>\n\tLayer.effect(\n\t\tmiddleware,\n\t\tEffect.gen(function* () {\n\t\t\tconst service = yield* authorizer\n\t\t\tconst services = yield* Effect.context<never>()\n\t\t\treturn Effect.fnUntraced(function* (\n\t\t\t\thttpEffect: Effect.Effect<unknown, unknown, unknown>,\n\t\t\t\toptions: {\n\t\t\t\t\treadonly endpoint: {\n\t\t\t\t\t\treadonly name: string\n\t\t\t\t\t\treadonly method: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t\treadonly group: {\n\t\t\t\t\t\treadonly identifier: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t) {\n\t\t\t\tconst requirements = Option.orElse(\n\t\t\t\t\tContext.getOption(options.endpoint.annotations, Required),\n\t\t\t\t\t() =>\n\t\t\t\t\t\tOption.map(\n\t\t\t\t\t\t\tContext.getOption(options.group.annotations, GroupRequired),\n\t\t\t\t\t\t\t(rules) =>\n\t\t\t\t\t\t\t\toptions.endpoint.method === \"GET\" ? rules.read : rules.write,\n\t\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\tif (Option.isNone(requirements)) {\n\t\t\t\t\treturn yield* Effect.die(\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`The endpoint ${options.group.identifier}.${options.endpoint.name} does not say what it needs. Give it the HttpApi.Required annotation.`,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t\tfor (const requirement of requirements.value) {\n\t\t\t\t\tif (requirement.load === undefined) {\n\t\t\t\t\t\tyield* service.check({\n\t\t\t\t\t\t\taction: requirement.action,\n\t\t\t\t\t\t\tkind: requirement.kind,\n\t\t\t\t\t\t} as never)\n\t\t\t\t\t} else {\n\t\t\t\t\t\tconst params = yield* HttpRouter.params\n\t\t\t\t\t\tconst value = yield* Effect.provideContext(\n\t\t\t\t\t\t\trequirement.load(params),\n\t\t\t\t\t\t\tservices,\n\t\t\t\t\t\t)\n\t\t\t\t\t\tyield* service.check({\n\t\t\t\t\t\t\taction: requirement.action,\n\t\t\t\t\t\t\tresource: value,\n\t\t\t\t\t\t} as never)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn yield* httpEffect\n\t\t\t})\n\t\t}),\n\t)\n"],"mappings":";;;;;;;;AAcA,MAAa,YACZ,aACA,QACA,MACA,SAEA,OAAO,OAAO,SAAS,KAAA,IAAY;CAAE;CAAQ;AAAK,IAAI;CAAE;CAAQ;CAAM;AAAK,CAAC;;AAG7E,MAAa,SACZ,YACA,eAEA,MAAM,OACL,YACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO;CACvB,MAAM,WAAW,OAAO,OAAO,QAAe;CAC9C,OAAO,OAAO,WAAW,WACxB,YACA,SAWC;EACD,MAAM,eAAe,OAAO,OAC3B,QAAQ,UAAU,QAAQ,SAAS,aAAa,QAAQ,SAEvD,OAAO,IACN,QAAQ,UAAU,QAAQ,MAAM,aAAa,aAAa,IACzD,UACA,QAAQ,SAAS,WAAW,QAAQ,MAAM,OAAO,MAAM,KACzD,CACF;EACA,IAAI,OAAO,OAAO,YAAY,GAC7B,OAAO,OAAO,OAAO,oBACpB,IAAI,MACH,gBAAgB,QAAQ,MAAM,WAAW,GAAG,QAAQ,SAAS,KAAK,sEACnE,CACD;EAED,KAAK,MAAM,eAAe,aAAa,OACtC,IAAI,YAAY,SAAS,KAAA,GACxB,OAAO,QAAQ,MAAM;GACpB,QAAQ,YAAY;GACpB,MAAM,YAAY;EACnB,CAAU;OACJ;GACN,MAAM,SAAS,OAAO,WAAW;GACjC,MAAM,QAAQ,OAAO,OAAO,eAC3B,YAAY,KAAK,MAAM,GACvB,QACD;GACA,OAAO,QAAQ,MAAM;IACpB,QAAQ,YAAY;IACpB,UAAU;GACX,CAAU;EACX;EAED,OAAO,OAAO;CACf,CAAC;AACF,CAAC,CACF"}

package/dist/internal/policy.js

@@ -1,524 +0,0 @@
-import { Allow, Deny, NotApplicable } from "../Decision.js";
-import { getDescriptor, kindOf } from "./domain.js";
-import { and as and$1, condition_exports, evaluateOf, fields, not as not$1, or as or$1, partialOf, schema as schema$1 } from "./condition.js";
-import { builder, make, matchesTarget, toData } from "./rule.js";
-import * as Effect from "effect/Effect";
-import * as Equal from "effect/Equal";
-import * as Hash from "effect/Hash";
-import * as Schema from "effect/Schema";
-import * as Predicate from "effect/Predicate";
-import * as Formatter from "effect/Formatter";
-import { dual } from "effect/Function";
-import * as Inspectable from "effect/Inspectable";
-import * as Pipeable from "effect/Pipeable";
-import * as SchemaTransformation from "effect/SchemaTransformation";
-// src/internal/policy.ts
-/** @internal */
-const TypeId = "~@nmnmcc/ability/Policy";
-/** @internal */
-const encodeNode = (node) => {
-	switch (node._tag) {
-		case "Rules": return {
-			_tag: "Rules",
-			algorithm: node.algorithm,
-			rules: node.rules.map((value) => toData(value))
-		};
-		case "All":
-		case "Any":
-		case "FirstOf": return {
-			_tag: node._tag,
-			policies: node.policies.map(encodeNode)
-		};
-		case "Ceiling": return {
-			_tag: "Ceiling",
-			cap: encodeNode(node.cap),
-			policy: encodeNode(node.policy)
-		};
-	}
-};
-const Proto = {
-	...Pipeable.Prototype,
-	[TypeId]: TypeId,
-	[Equal.symbol](that) {
-		return isPolicy(that) && this.domain === that.domain && Equal.equals(this.node, that.node);
-	},
-	[Hash.symbol]() {
-		return Hash.hash(this.node);
-	},
-	toJSON() {
-		return encodeNode(this.node);
-	},
-	toString() {
-		return Formatter.format(encodeNode(this.node), { space: 2 });
-	},
-	[Inspectable.NodeInspectSymbol]() {
-		return encodeNode(this.node);
-	}
-};
-/** @internal */
-const isPolicy = (u) => Predicate.hasProperty(u, TypeId);
-/** @internal */
-const fromNode = (domain, node) => {
-	const self = Object.create(Proto);
-	self.domain = domain;
-	self.node = node;
-	return Object.freeze(self);
-};
-const nodeOf = (policy) => policy.node;
-const domainOf = (policy) => policy.domain;
-/** @internal */
-const rules = (domain, values, options) => fromNode(domain, Object.freeze({
-	_tag: "Rules",
-	algorithm: options?.algorithm ?? "denyOverrides",
-	rules: Object.freeze(Array.from(values))
-}));
-/** @internal */
-const empty = (domain) => rules(domain, []);
-/** @internal */
-const define = (domain, options) => (body) => {
-	const collected = [];
-	const iterator = body(builder(domain));
-	let state = iterator.next();
-	while (state.done !== true) {
-		collected.push(state.value);
-		state = iterator.next(state.value);
-	}
-	return rules(domain, collected, options);
-};
-const combine = (tag) => (policies) => {
-	const domain = domainOf(policies[0]);
-	for (const policy of policies) if (domainOf(policy) !== domain) throw new Error("Policies from two domains can not be put together");
-	return fromNode(domain, Object.freeze({
-		_tag: tag,
-		policies: Object.freeze(policies.map(nodeOf))
-	}));
-};
-/** @internal */
-const all = combine("All");
-/** @internal */
-const any = combine("Any");
-/** @internal */
-const firstOf = combine("FirstOf");
-/** @internal */
-const ceiling = dual(2, (policy, cap) => {
-	if (domainOf(policy) !== domainOf(cap)) throw new Error("Policies from two domains can not be put together");
-	return fromNode(domainOf(policy), Object.freeze({
-		_tag: "Ceiling",
-		cap: nodeOf(cap),
-		policy: nodeOf(policy)
-	}));
-});
-const ruleApplies = (value, context, path) => {
-	if (!matchesTarget(value, context.action, context.kind, context.field)) return Effect.succeed(false);
-	const test = value.when === void 0 ? Effect.succeed(true) : evaluateOf(value.when, context.input);
-	return context.trace === void 0 ? test : Effect.tap(test, (applies) => Effect.sync(() => {
-		context.trace.push({
-			path,
-			rule: value,
-			applies
-		});
-	}));
-};
-const fromRule = (value) => value._tag === "Allow" ? Allow({ rule: value }) : value.reason === void 0 ? Deny({ rule: value }) : Deny({
-	rule: value,
-	reason: value.reason
-});
-const firstApplying = Effect.fnUntraced(function* (candidates, context, path) {
-	for (const [value, index] of candidates) if (yield* ruleApplies(value, context, [...path, index])) return value;
-});
-const decideRules = Effect.fnUntraced(function* (node, context, path) {
-	const indexed = node.rules.map((value, index) => [value, index]);
-	const denies = indexed.filter(([value]) => value._tag === "Deny");
-	const allows = indexed.filter(([value]) => value._tag === "Allow");
-	let found;
-	switch (node.algorithm) {
-		case "denyOverrides":
-			found = (yield* firstApplying(denies, context, path)) ?? (yield* firstApplying(allows, context, path));
-			break;
-		case "permitOverrides":
-			found = (yield* firstApplying(allows, context, path)) ?? (yield* firstApplying(denies, context, path));
-			break;
-		case "firstApplicable":
-			found = yield* firstApplying(indexed, context, path);
-			break;
-		case "lastApplicable": found = yield* firstApplying(indexed.slice().reverse(), context, path);
-	}
-	return found === void 0 ? NotApplicable : fromRule(found);
-});
-const decideNode = (node, context, path) => {
-	switch (node._tag) {
-		case "Rules": return decideRules(node, context, path);
-		case "All": return Effect.gen(function* () {
-			let firstAllow;
-			let allAllow = node.policies.length > 0;
-			for (const [index, child] of node.policies.entries()) {
-				const result = yield* decideNode(child, context, [...path, index]);
-				if (result._tag === "Deny") return result;
-				if (result._tag === "Allow") firstAllow ??= result;
-				else allAllow = false;
-			}
-			return allAllow && firstAllow !== void 0 ? firstAllow : NotApplicable;
-		});
-		case "Any": return Effect.gen(function* () {
-			let firstDeny;
-			for (const [index, child] of node.policies.entries()) {
-				const result = yield* decideNode(child, context, [...path, index]);
-				if (result._tag === "Allow") return result;
-				if (result._tag === "Deny") firstDeny ??= result;
-			}
-			return firstDeny ?? NotApplicable;
-		});
-		case "FirstOf": return Effect.gen(function* () {
-			for (const [index, child] of node.policies.entries()) {
-				const result = yield* decideNode(child, context, [...path, index]);
-				if (result._tag !== "NotApplicable") return result;
-			}
-			return NotApplicable;
-		});
-		case "Ceiling": return Effect.gen(function* () {
-			const capped = yield* decideNode(node.cap, context, [...path, 0]);
-			if (capped._tag === "Deny") return capped;
-			return yield* decideNode(node.policy, context, [...path, 1]);
-		});
-	}
-};
-const makeContext = (domain, request, trace) => {
-	const kind = kindOf(request.resource);
-	const descriptor = kind === void 0 ? void 0 : getDescriptor(domain, kind);
-	if (kind === void 0 || descriptor === void 0) return;
-	return {
-		principal: request.principal,
-		action: request.action,
-		kind,
-		value: request.resource,
-		field: request.field,
-		input: {
-			value: request.resource,
-			principal: request.principal,
-			path: descriptor.path
-		},
-		trace
-	};
-};
-/** @internal */
-const decideOf = (policy, request) => {
-	const context = makeContext(domainOf(policy), request, void 0);
-	return context === void 0 ? Effect.succeed(NotApplicable) : decideNode(nodeOf(policy), context, []);
-};
-/** @internal */
-const decide = dual(2, decideOf);
-/** @internal */
-const decideSync = dual(2, (policy, request) => Effect.runSync(decideOf(policy, request)));
-/** @internal */
-const explainOf = (policy, request) => {
-	const trace = [];
-	const context = makeContext(domainOf(policy), request, trace);
-	if (context === void 0) return Effect.succeed({
-		decision: NotApplicable,
-		steps: []
-	});
-	return Effect.map(decideNode(nodeOf(policy), context, []), (decision) => ({
-		decision,
-		steps: Object.freeze(trace)
-	}));
-};
-/** @internal */
-const explain = dual(2, explainOf);
-/** @internal */
-const permittedFieldsOf = Effect.fnUntraced(function* (policy, request) {
-	const domain = domainOf(policy);
-	const kind = kindOf(request.resource);
-	const descriptor = kind === void 0 ? void 0 : getDescriptor(domain, kind);
-	if (descriptor === void 0) return [];
-	const output = [];
-	for (const field of descriptor.fieldPaths) if ((yield* decideOf(policy, {
-		...request,
-		field
-	}))._tag === "Allow") output.push(field);
-	return Object.freeze(output);
-});
-/** @internal */
-const permittedFields = dual(2, permittedFieldsOf);
-const { always, never, simplify } = condition_exports;
-const and = (...values) => simplify(and$1(...values));
-const or = (...values) => simplify(or$1(...values));
-const not = (value) => simplify(not$1(value));
-const ruleCondition = (value, context) => !matchesTarget(value, context.action, context.kind, context.field) ? never : value.when === void 0 ? always : partialOf(value.when, context.input);
-/**
-* Gives the conditions for "the first rule that applies is an allow rule" and
-* "the first rule that applies is a deny rule".
-*/
-const firstApplicableResidual = (values, context) => {
-	let allow = never;
-	let deny = never;
-	for (const value of values.slice().reverse()) {
-		const applies = ruleCondition(value, context);
-		if (value._tag === "Allow") {
-			allow = or(applies, allow);
-			deny = and(not(applies), deny);
-		} else {
-			deny = or(applies, deny);
-			allow = and(not(applies), allow);
-		}
-	}
-	return {
-		allow,
-		deny
-	};
-};
-const residualNode = (node, context) => {
-	switch (node._tag) {
-		case "Rules": switch (node.algorithm) {
-			case "denyOverrides": {
-				const deny = or(...node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)));
-				return {
-					allow: and(or(...node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context))), not(deny)),
-					deny
-				};
-			}
-			case "permitOverrides": {
-				const allow = or(...node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)));
-				return {
-					allow,
-					deny: and(or(...node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context))), not(allow))
-				};
-			}
-			case "firstApplicable": return firstApplicableResidual(node.rules, context);
-			case "lastApplicable": return firstApplicableResidual(node.rules.slice().reverse(), context);
-		}
-		case "All": {
-			if (node.policies.length === 0) return {
-				allow: never,
-				deny: never
-			};
-			const pairs = node.policies.map((child) => residualNode(child, context));
-			const deny = or(...pairs.map((pair) => pair.deny));
-			return {
-				allow: and(...pairs.map((pair) => pair.allow), not(deny)),
-				deny
-			};
-		}
-		case "Any": {
-			const pairs = node.policies.map((child) => residualNode(child, context));
-			const allow = or(...pairs.map((pair) => pair.allow));
-			return {
-				allow,
-				deny: and(or(...pairs.map((pair) => pair.deny)), not(allow))
-			};
-		}
-		case "FirstOf": {
-			let allow = never;
-			let deny = never;
-			for (const child of node.policies.slice().reverse()) {
-				const pair = residualNode(child, context);
-				const nextAllow = or(pair.allow, and(not(pair.deny), allow));
-				deny = or(pair.deny, and(not(pair.allow), deny));
-				allow = nextAllow;
-			}
-			return {
-				allow,
-				deny
-			};
-		}
-		case "Ceiling": {
-			const cap = residualNode(node.cap, context);
-			const inner = residualNode(node.policy, context);
-			return {
-				allow: and(not(cap.deny), inner.allow),
-				deny: or(cap.deny, inner.deny)
-			};
-		}
-	}
-};
-/** @internal */
-const residualPair = (policy, request) => {
-	const domain = domainOf(policy);
-	const descriptor = getDescriptor(domain, request.kind);
-	if (descriptor === void 0) return {
-		allow: never,
-		deny: never
-	};
-	return residualNode(nodeOf(policy), {
-		principal: request.principal,
-		action: request.action,
-		kind: request.kind,
-		field: request.field,
-		input: {
-			principal: request.principal,
-			path: descriptor.path
-		}
-	});
-};
-/** @internal */
-const residualOf = (policy, request) => residualPair(policy, request).allow;
-/** @internal */
-const residual = dual(2, residualOf);
-const Algorithm = Schema.Literals([
-	"denyOverrides",
-	"permitOverrides",
-	"firstApplicable",
-	"lastApplicable"
-]);
-const encodedRuleSchema = (meta) => Schema.Struct({
-	_tag: Schema.Literals(["Allow", "Deny"]),
-	actions: Schema.Array(Schema.String),
-	resources: Schema.Array(Schema.String),
-	when: Schema.optionalKey(schema$1),
-	fields: Schema.String.pipe(Schema.Array, Schema.optionalKey),
-	reason: Schema.optionalKey(Schema.String),
-	id: Schema.optionalKey(Schema.String),
-	meta: Schema.optionalKey(meta ?? Schema.Never)
-});
-const encodedNodeSchema = (meta) => {
-	const self = Schema.Union([
-		Schema.TaggedStruct("Rules", {
-			algorithm: Algorithm,
-			rules: Schema.Array(encodedRuleSchema(meta))
-		}),
-		Schema.TaggedStruct("All", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("Any", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("FirstOf", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("Ceiling", {
-			cap: Schema.suspend(() => self),
-			policy: Schema.suspend(() => self)
-		})
-	]);
-	return self;
-};
-const principalFieldPaths = (domain) => {
-	const output = /* @__PURE__ */ new Set();
-	const visit = (schema, prefix) => {
-		if (!Predicate.hasProperty(schema, "fields") || !Predicate.isObject(schema.fields)) return;
-		const fields = schema.fields;
-		for (const key of Object.keys(fields)) {
-			const path = prefix === "" ? key : `${prefix}.${key}`;
-			output.add(path);
-			visit(fields[key], path);
-		}
-	};
-	visit(domain.principal, "");
-	return output;
-};
-const principalRefs = (ast) => {
-	const output = [];
-	const visitOperand = (operand) => {
-		if (operand._tag === "Principal") output.push(operand.path);
-	};
-	const visit = (node) => {
-		switch (node._tag) {
-			case "Compare":
-				visitOperand(node.value);
-				return;
-			case "In":
-				node.values.forEach(visitOperand);
-				return;
-			case "Under":
-				node.prefix.forEach(visitOperand);
-				return;
-			case "And":
-			case "Or":
-				node.conditions.forEach(visit);
-				return;
-			case "Not":
-				visit(node.condition);
-				return;
-			default: return;
-		}
-	};
-	visit(ast);
-	return output;
-};
-/**
-* Checks the names in an encoded policy against the domain. It gives one
-* message for each problem.
-*/
-const validate = (domain, root) => {
-	const issues = [];
-	const principalPaths = principalFieldPaths(domain);
-	const visit = (node, path) => {
-		switch (node._tag) {
-			case "Rules":
-				node.rules.forEach((value, index) => {
-					const at = [
-						...path,
-						"rules",
-						index
-					];
-					const kinds = value.resources.includes("*") ? void 0 : value.resources;
-					const descriptors = [];
-					for (const kind of value.resources) {
-						if (kind === "*") continue;
-						const descriptor = getDescriptor(domain, kind);
-						if (descriptor === void 0) issues.push({
-							path: [...at, "resources"],
-							issue: `There is no resource with the kind "${kind}"`
-						});
-						else descriptors.push(descriptor);
-					}
-					const known = kinds === void 0 ? Array.from(domain.resources.values()) : descriptors;
-					for (const action of value.actions) {
-						if (action === "*") continue;
-						if (!known.some((descriptor) => descriptor.actions.includes(action))) issues.push({
-							path: [...at, "actions"],
-							issue: `The action "${action}" is not an action of these resources`
-						});
-					}
-					const usedFields = [...(value.fields ?? []).filter((field) => !field.includes("*")), ...value.when === void 0 ? [] : fields(value.when)];
-					for (const field of usedFields) if (!(kinds !== void 0 && descriptors.length > 0 && descriptors.every((descriptor) => descriptor.fieldPaths.includes(field)))) issues.push({
-						path: at,
-						issue: `The field "${field}" is not a field of every resource of the rule`
-					});
-					if (value.when !== void 0) {
-						for (const ref of principalRefs(value.when)) if (!principalPaths.has(ref)) issues.push({
-							path: [...at, "when"],
-							issue: `The principal has no field "${ref}"`
-						});
-					}
-				});
-				return;
-			case "All":
-			case "Any":
-			case "FirstOf":
-				node.policies.forEach((child, index) => visit(child, [
-					...path,
-					"policies",
-					index
-				]));
-				return;
-			case "Ceiling":
-				visit(node.cap, [...path, "cap"]);
-				visit(node.policy, [...path, "policy"]);
-				return;
-		}
-	};
-	visit(root, []);
-	return issues;
-};
-const decodeNode = (node) => {
-	switch (node._tag) {
-		case "Rules": return Object.freeze({
-			_tag: "Rules",
-			algorithm: node.algorithm,
-			rules: Object.freeze(node.rules.map((value) => make(value)))
-		});
-		case "All":
-		case "Any":
-		case "FirstOf": return Object.freeze({
-			_tag: node._tag,
-			policies: Object.freeze(node.policies.map(decodeNode))
-		});
-		case "Ceiling": return Object.freeze({
-			_tag: "Ceiling",
-			cap: decodeNode(node.cap),
-			policy: decodeNode(node.policy)
-		});
-	}
-};
-/** @internal */
-const schema = (domain) => encodedNodeSchema(domain.meta).pipe(Schema.check(Schema.makeFilter((node) => validate(domain, node))), Schema.decodeTo(Schema.declare((u) => isPolicy(u) && domainOf(u) === domain), SchemaTransformation.transform({
-	decode: (node) => fromNode(domain, decodeNode(node)),
-	encode: (policy) => encodeNode(policy.node)
-})));
-export { TypeId, all, any, ceiling, decide, decideOf, decideSync, define, empty, encodeNode, explain, explainOf, firstOf, fromNode, isPolicy, permittedFields, permittedFieldsOf, residual, residualOf, residualPair, rules, schema };
-
-//# sourceMappingURL=policy.js.map