@nmnmcc/ability 0.3.0 → 1.0.1

package/dist/Policy.d.ts

@@ -1,27 +1,16 @@
-import { Condition, Encoded, FieldPath, Variance } from "./Condition.js";
+import { Descriptor } from "./Resource.js";
+import { Builder, Condition, Encoded, Example, FieldSelector, Reads, Variance } from "./Condition.js";
 import { ActionOf, Any as Any$1, DataOf, Kind, Principal, ValueOf } from "./Domain.js";
-import { Any as Any$2, Builder, Error as Error$1, OpaqueOf as OpaqueOf$1, Services as Services$1 } from "./Rule.js";
+import { Any as Any$2, Builder as Builder$1, Error as Error$1, OpaqueOf as OpaqueOf$1, Rule, Services as Services$1 } from "./Rule.js";
 import { Decision } from "./Decision.js";
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
-import * as Equal from "effect/Equal";
 import * as Schema from "effect/Schema";
-import * as Inspectable from "effect/Inspectable";
+import * as Data from "effect/Data";
 import * as Pipeable from "effect/Pipeable";
 declare namespace Policy_d_exports {
-  export { Algorithm, AllNode, Any, AnyNode, AnyRequest, CeilingNode, DomainOf, EncodedNode, EncodedRule, Error, Explanation, FirstOfNode, KindRequest, KindTarget, Node, OpaqueOf, Options, Policy, Request, RulesNode, Services, Step, Target, TypeId, all, any, ceiling, decide, decideSync, define, empty, explain, firstOf, isPolicy, permittedFields, residual, rules, schema };
+  export { Algorithm, AllNode, Any, AnyKindRequest, AnyNode, AnyRequest, CeilingNode, Coverage, DomainOf, EncodedNode, EncodedRule, Error, Explanation, FieldlessRequest, FieldlessTarget, FirstOfNode, KindRequest, KindTarget, Node, OpaqueOf, Options, Policy, Request, ResidualReads, Residuals, RulesNode, Scope, Services, Step, Target, TypedNode, all, any, ceiling, coverage, decide, decideSync, define, empty, explain, firstOf, fitsKind, isPolicy, permittedFields, provideContext, residual, residuals, rules, schema, scopeHasValue, scopeIsEmpty };
 }
-/**
- * @stability stable
- * @category type IDs
- * @since 0.3.0
- */
-export declare const TypeId: "~@nmnmcc/ability/Policy";
-/**
- * @stability stable
- * @category type IDs
- * @since 0.3.0
- */
-export type TypeId = typeof TypeId;
 /**
  * @stability stable
  * @category models
@@ -83,6 +72,30 @@ export interface CeilingNode {
  * @since 0.3.0
  */
 export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode;
+/**
+ * The tree of a policy with the types of its predicates and its domain `D`.
+ * Each rule and each child has the types too, and `"~Node"` is only in the types. A node made by
+ * hand does not have it. So the node of one policy, or a part of it, can not
+ * go into a policy with other types.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type TypedNode<E = never, R = never, O = never, D = any> = ({
+  readonly _tag: "Rules";
+  readonly algorithm: Algorithm;
+  readonly rules: ReadonlyArray<Rule<E, R, O, D, never>>;
+} | {
+  readonly _tag: "All" | "Any" | "FirstOf";
+  readonly policies: ReadonlyArray<TypedNode<E, R, O, D>>;
+} | {
+  readonly _tag: "Ceiling";
+  readonly cap: TypedNode<E, R, O, D>;
+  readonly policy: TypedNode<E, R, O, D>;
+}) & {
+  readonly "~Node": Variance<E, R, O>;
+};
 /**
  * A policy for the domain `D`. `E`, `R` and `O` come from the conditions of
  * its rules. See `Condition.Condition`.
@@ -91,11 +104,15 @@ export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode;
  * @category models
  * @since 0.3.0
  */
-export interface Policy<D extends Any$1, E = never, R = never, O = never> extends Equal.Equal, Inspectable.Inspectable, Pipeable.Pipeable {
-  readonly [TypeId]: TypeId;
+export interface Policy<D extends Any$1, E = never, R = never, O = never> extends Pipeable.Pipeable {
   readonly domain: D;
-  readonly node: Node;
-  readonly "~Policy"?: Variance<E, R, O>;
+  readonly node: TypedNode<E, R, O, D>;
+  readonly "~Policy": Variance<E, R, O>;
+  /**
+   * Only in the types. A policy reads the values and the principal of its
+   * domain, so a policy of one domain is not a policy of a wider domain.
+   */
+  readonly "~Domain": (domain: D) => D;
 }
 /**
  * Any policy.
@@ -154,10 +171,36 @@ export type OpaqueOf<P> = P extends {
 export type Target<D> = { [K in Kind<D>]: {
   readonly action: ActionOf<D, K>;
   readonly resource: ValueOf<D, K>;
-  readonly field?: FieldPath<DataOf<D, K>>;
+  readonly field?: FieldSelector<DataOf<D, K>>;
+  /** A target has a resource value or a kind, never both. */
+  readonly kind?: never;
+}; }[Kind<D>];
+/**
+ * A {@link Target} with no field. Each kind keeps its own actions.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type FieldlessTarget<D> = { [K in Kind<D>]: {
+  readonly action: ActionOf<D, K>;
+  readonly resource: ValueOf<D, K>;
+  readonly kind?: never;
 }; }[Kind<D>];
 /**
- * One act on one kind of resource, with no value.
+ * A scope: a part of a kind, as a condition on its values. It gets a builder
+ * with the types of the kind and of the principal, like the condition of a
+ * rule. A scope is plain data, so it can not have a predicate.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type Scope<D, K extends string> = (builder: Builder<DataOf<D, K>, ValueOf<D, K>, Principal<D>>) => Condition<never, never, never, Reads<ValueOf<D, K>, Principal<D>>>;
+/**
+ * One act on one kind of resource, with no value. With `within`, the target is
+ * only the values of the kind in the scope. Without it, the target is every
+ * value of the kind.
  *
  * @stability stable
  * @category models
@@ -166,7 +209,11 @@ export type Target<D> = { [K in Kind<D>]: {
 export type KindTarget<D> = { [K in Kind<D>]: {
   readonly action: ActionOf<D, K>;
   readonly kind: K;
-  readonly field?: FieldPath<DataOf<D, K>>;
+  readonly field?: FieldSelector<DataOf<D, K>>;
+  /** The part of the kind. See {@link Scope}. */
+  readonly within?: Scope<D, K>;
+  /** A target has a resource value or a kind, never both. */
+  readonly resource?: never;
 }; }[Kind<D>];
 /**
  * A request: a principal, an action, and a resource value.
@@ -178,6 +225,16 @@ export type KindTarget<D> = { [K in Kind<D>]: {
 export type Request<D> = Target<D> & {
   readonly principal: Principal<D>;
 };
+/**
+ * A {@link Request} with no field.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type FieldlessRequest<D> = FieldlessTarget<D> & {
+  readonly principal: Principal<D>;
+};
 /**
  * A request about a kind of resource, with no value.
  *
@@ -237,6 +294,14 @@ export interface Options {
   /** The default is `denyOverrides`. */
   readonly algorithm?: Algorithm;
 }
+/**
+ * Makes a policy from a list of rules.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export declare const rules: <D extends Any$1, Rules extends Rule<any, any, any, D, never>>(domain: D, rules: Iterable<Rules>, options?: Options) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
 /**
  * Makes a policy from a generator function that gives rules. It is pure and it
  * gives its result at once.
@@ -244,9 +309,9 @@ export interface Options {
  * @example
  * ```ts
  * const policy = Policy.define(App)(function* (_) {
- *   yield* _.allow("read", Bot)
- *   yield* _.allow(["update", "delete"], Bot, {
- *     when: ($) => $.eq("ownerUserId", $.principal("userId")),
+ *   yield* _.allow("read", Document)
+ *   yield* _.allow(["update", "delete"], Document, {
+ *     when: ($) => $.eq("ownerId", $.principal("id")),
  *   })
  * })
  * ```
@@ -255,15 +320,7 @@ export interface Options {
  * @category constructors
  * @since 0.3.0
  */
-export declare const define: <D extends Any$1>(domain: D, options?: Options) => <Rules extends Any$2, A>(body: (builder: Builder<D>) => Generator<Rules, A, unknown>) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
-/**
- * Makes a policy from a list of rules.
- *
- * @stability stable
- * @category constructors
- * @since 0.3.0
- */
-export declare const rules: <D extends Any$1, Rules extends Any$2>(domain: D, rules: Iterable<Rules>, options?: Options) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
+export declare const define: <D extends Any$1>(domain: D, options?: Options) => <Rules extends Rule<any, any, any, D, never>, A>(body: (builder: Builder$1<D>) => Generator<Rules, A, unknown>) => Policy<D, Error$1<Rules>, Services$1<Rules>, OpaqueOf$1<Rules>>;
 /**
  * A policy with no rules. It is not applicable to any request.
  *
@@ -310,6 +367,33 @@ export declare const ceiling: {
   <D extends Any$1, E2, R2, O2>(cap: Policy<D, E2, R2, O2>): <E, R, O>(policy: Policy<D, E, R, O>) => Policy<D, E | E2, R | R2, O | O2>;
   <D extends Any$1, E, R, O, E2, R2, O2>(policy: Policy<D, E, R, O>, cap: Policy<D, E2, R2, O2>): Policy<D, E | E2, R | R2, O | O2>;
 };
+/**
+ * Gives the services in `context` to every predicate of a policy, so the
+ * policy needs no services when it runs.
+ *
+ * @stability stable
+ * @category services
+ * @since 1.0.0
+ */
+export declare const provideContext: {
+  <R>(context: Context.Context<R>): <D extends Any$1, E, O>(policy: Policy<D, E, R, O>) => Policy<D, E, never, O>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, context: Context.Context<R>): Policy<D, E, never, O>;
+};
+/**
+ * Tests if a request fits its kind: the action is an action of the kind, and
+ * the field, if there is one, is a field of the kind. The types check this,
+ * but a value with a union type, or a value from outside, may get past them.
+ * A rule for every action (`"*"`) must not cover an action that the kind does
+ * not have, so such a request is not applicable.
+ *
+ * @stability stable
+ * @category predicates
+ * @since 1.0.0
+ */
+export declare const fitsKind: (descriptor: Descriptor, request: {
+  readonly action: string;
+  readonly field?: string | undefined;
+}) => boolean;
 /**
  * Gives the decision of a policy for a request.
  *
@@ -318,7 +402,7 @@ export declare const ceiling: {
  * @since 0.3.0
  */
 export declare const decide: {
-  <D extends Any$1>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Decision, E, R>;
+  <D extends Any$1 = never>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Decision, E, R>;
   <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Request<NoInfer<D>>): Effect.Effect<Decision, E, R>;
 };
 /**
@@ -329,47 +413,221 @@ export declare const decide: {
  * @since 0.3.0
  */
 export declare const decideSync: {
-  <D extends Any$1>(request: Request<D>): (policy: Policy<D>) => Decision;
+  <D extends Any$1 = never>(request: Request<D>): (policy: Policy<D>) => Decision;
   <D extends Any$1>(policy: Policy<D>, request: Request<NoInfer<D>>): Decision;
 };
 /**
  * Gives the decision of a policy and the rules that were tested to make it.
  *
+ * One node may be a child of many nodes. A node with no predicate that the
+ * request may use gives the same decision each time, so its rules are tested,
+ * and are in the steps, only the first time. So a small tree with many shared
+ * nodes gives a short list of steps.
+ *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
 export declare const explain: {
-  <D extends Any$1>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Explanation, E, R>;
+  <D extends Any$1 = never>(request: Request<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Explanation, E, R>;
   <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Request<NoInfer<D>>): Effect.Effect<Explanation, E, R>;
 };
+/**
+ * Gives the fields of a resource value that the policy lets a request use. It
+ * tests each field of the resource Schema, with dots for nested fields.
+ *
+ * A field that holds more than one value, such as a record, is left out when a
+ * deny rule names a part of it. The list can not name that part, and the whole
+ * field would show it.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export declare const permittedFields: {
+  <D extends Any$1 = never>(request: FieldlessRequest<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<ReadonlyArray<string>, E, R>;
+  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: FieldlessRequest<NoInfer<D>>): Effect.Effect<ReadonlyArray<string>, E, R>;
+};
+/**
+ * The two residual conditions of a request. See {@link residuals}.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export interface Residuals<E = never, R = never, O = never, I = unknown> {
+  /** The condition on resource values for which the policy allows. */
+  readonly allow: Condition<E, R, O, I>;
+  /** The condition on resource values for which the policy denies. */
+  readonly deny: Condition<E, R, O, I>;
+}
+/**
+ * A request about a kind of resource, with no types.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export interface AnyKindRequest {
+  readonly principal: object;
+  readonly action: string;
+  readonly kind: string;
+  readonly field?: string | undefined;
+  /**
+   * A scope needs the types of the domain for its builder. With the request
+   * first, the domain is not known yet, so give the policy first.
+   */
+  readonly within?: never;
+}
+/**
+ * `unknown` when the request `Req` is a request of the type `T`, and `never`
+ * when it is not. With the request first and the policy later, the request is
+ * checked when the policy, and so the domain, is known. For a union, each
+ * member must be such a request.
+ */
+type Fits<Req, T> = [Req] extends [T] ? unknown : never;
+/**
+ * What a residual condition reads: a value of the kind `K`. The principal is
+ * already in it. A residual is for one kind, so when `K` is a union of kinds,
+ * the value must be a value of each of them. No value is, so such a residual
+ * can not be evaluated on a value of the wrong kind.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 1.0.0
+ */
+export type ResidualReads<D, K> = Reads<(K extends unknown ? (value: ValueOf<D, K & string>) => void : never) extends ((value: infer V) => void) ? V : never, unknown>;
+/** A request about a kind with no types, with the scope of a target. */
+interface ScopedRequest {
+  readonly principal: object;
+  readonly action: string;
+  readonly kind: string;
+  readonly field?: string | undefined;
+  readonly within?: unknown;
+}
 /**
  * Gives the condition on resource values for which the policy allows a
  * request. It has no principal fields and no `Under` nodes, so you can give it
  * to `Condition.fold`. It is `True` when the policy allows every value of the
  * kind, and `False` when it allows none.
  *
- * Predicates stay in the condition. They take the principal with them.
+ * With a scope (`within`), the condition is the scope and the residual
+ * together, so it is false for every value outside the scope. Give the policy
+ * first to use a scope. The condition comes from its parts, with no search. To
+ * know if it allows all of the scope or none of it, use {@link coverage}.
+ *
+ * When a rule that the request may use has a predicate, the condition is one
+ * predicate with the name `"policy"`. It runs the whole policy for each value,
+ * so its answers and its failures are the same as those of {@link decide}. It
+ * takes the principal with it. Give it resource values with their `_tag`. It
+ * is false for a value of another kind.
+ *
+ * A policy tree may use the condition of a child two times, so a small policy
+ * may give a very large condition. When the condition would have more than
+ * 10000 nodes or 500 levels, this function throws an error. In an
+ * `Authorizer`, the error is
+ * a defect, so the check fails.
  *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
 export declare const residual: {
-  <D extends Any$1>(request: KindRequest<D>): <E, R, O>(policy: Policy<D, E, R, O>) => Condition<E, R, O>;
-  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: KindRequest<NoInfer<D>>): Condition<E, R, O>;
+  <const Req extends AnyKindRequest>(request: Req): <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>) => Condition<E, R, O, ResidualReads<D, Req["kind"]>>;
+  <D extends Any$1, E, R, O, const Req extends KindRequest<NoInfer<D>>>(policy: Policy<D, E, R, O>, request: Req): Condition<E, R, O, ResidualReads<D, Req["kind"]>>;
 };
 /**
- * Gives the fields of a resource value that the policy lets a request use. It
- * tests each field of the resource Schema, with dots for nested fields.
+ * Gives both residual conditions of a request: the values that the policy
+ * allows, and the values that it denies. A value in neither is not
+ * applicable. See {@link residual}.
  *
  * @stability stable
  * @category evaluation
- * @since 0.3.0
+ * @since 1.0.0
  */
-export declare const permittedFields: {
-  <D extends Any$1>(request: Omit<Request<D>, "field">): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<ReadonlyArray<string>, E, R>;
-  <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O>, request: Omit<Request<NoInfer<D>>, "field">): Effect.Effect<ReadonlyArray<string>, E, R>;
+export declare const residuals: {
+  <const Req extends AnyKindRequest>(request: Req): <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>) => Residuals<E, R, O, ResidualReads<D, Req["kind"]>>;
+  <D extends Any$1, E, R, O, const Req extends KindRequest<NoInfer<D>>>(policy: Policy<D, E, R, O>, request: Req): Residuals<E, R, O, ResidualReads<D, Req["kind"]>>;
+};
+/**
+ * How much of a scope a policy allows. In each case, `condition` is the exact
+ * condition on the values in the scope that the policy allows: give it to
+ * `Condition.fold` for a list query.
+ * - `All`: the policy allows every value in the scope. `condition` is the
+ *   scope (`True` with no scope).
+ * - `None`: the policy allows no value in the scope. `condition` is `False`.
+ *   An empty scope is `None` too, so a check on a scope that has a mistake,
+ *   such as a principal field with no value, never passes.
+ * - `Some`: the policy allows some values in the scope and not others.
+ *   `allowed` is an example of a value that it allows, and `refused` of a
+ *   value in the scope that it does not allow.
+ * - `Unknown`: the answer needs a predicate, or the search went past its
+ *   budget.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type Coverage<E = never, R = never, O = never, I = unknown> = Data.TaggedEnum<{
+  All: {
+    readonly condition: Condition<E, R, O, I>;
+  };
+  None: {
+    readonly condition: Condition<E, R, O, I>;
+  };
+  Some: {
+    readonly condition: Condition<E, R, O, I>;
+    readonly allowed: Example;
+    readonly refused: Example;
+  };
+  Unknown: {
+    readonly condition: Condition<E, R, O, I>;
+    readonly reason: "predicate" | "budget" | "schema";
+  };
+}>;
+/**
+ * Tests if the scope of a request has a value of the Schema of its kind. The
+ * answer is `true` only when the search finds such a value. When the search
+ * can not say, the answer is `false`. So a "yes" from it is safe to act on,
+ * as for the question "may the decider answer for this scope?".
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export declare const scopeHasValue: (policy: Any, request: ScopedRequest) => boolean;
+/**
+ * Tests if the scope of a request has no value of the Schema of its kind. A
+ * scope with a mistake, such as two values for one field, is empty. With no
+ * scope, the answer is `false` when the kind has a value. When the search can
+ * not say, the answer is `false`.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export declare const scopeIsEmpty: (policy: Any, request: ScopedRequest) => boolean;
+/**
+ * Tells how much of a scope the policy allows: all of it, none of it, or some
+ * of it. See {@link Coverage}. With no scope (`within`), the scope is every
+ * value of the kind.
+ *
+ * The answer comes from {@link Condition.satisfiable} with the Schema of the
+ * resource, so it is exact for the values of the Schema. When a condition
+ * tests a field that is not a plain scalar (see `Resource.isPlainField`),
+ * such as a field with a check other than a finite or integer check, the
+ * answer is `Unknown`, and a check on the kind says no.
+ *
+ * `Some` means that some value of the Schema is allowed. It does not mean that
+ * such a value is in your database. To know that, run `condition` as a query.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export declare const coverage: {
+  <const Req extends AnyKindRequest>(request: Req): <D extends Any$1, E, R, O>(policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>) => Coverage<E, R, O, ResidualReads<D, Req["kind"]>>;
+  <D extends Any$1, E, R, O, const Req extends KindRequest<NoInfer<D>>>(policy: Policy<D, E, R, O>, request: Req): Coverage<E, R, O, ResidualReads<D, Req["kind"]>>;
 };
 /**
  * The JSON form of a rule.
@@ -408,22 +666,22 @@ export type EncodedNode = {
   readonly policy: EncodedNode;
 };
 /**
- * The Schema of the policies of a domain with no predicates. Decoding checks
- * every kind, action, field and principal field against the domain, and the
- * `meta` of each rule against the `meta` Schema of the domain.
+ * Tests if a value is a policy.
  *
  * @stability stable
- * @category schemas
+ * @category guards
  * @since 0.3.0
  */
-export declare const schema: <D extends Any$1>(domain: D) => Schema.Codec<Policy<D>, EncodedNode>;
+export declare const isPolicy: (u: unknown) => u is Any;
 /**
- * Tests if a value is a policy.
+ * The Schema of the policies of a domain with no predicates. Decoding checks
+ * every kind, action, field and principal field against the domain, and the
+ * `meta` of each rule against the `meta` Schema of the domain.
  *
  * @stability stable
- * @category guards
+ * @category schemas
  * @since 0.3.0
  */
-export declare const isPolicy: (u: unknown) => u is Any;
+export declare const schema: <D extends Any$1>(domain: D) => Schema.Codec<Policy<D>, EncodedNode>;
 export { Policy_d_exports };
 //# sourceMappingURL=Policy.d.ts.map

package/dist/Policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Policy.d.ts","names":["Rule.Any","Domain.Any","Condition.Variance","Domain.Kind","Domain.ActionOf","Domain.ValueOf","Domain.DataOf","Condition.FieldPath","Domain.Principal","Decision.Decision","Rule.Builder","Rule.Error","Rule.Services","Rule.OpaqueOf","Condition.Condition","Condition.Encoded"],"sources":["../src/Policy.ts"],"mappings":";;;;;;;;;;;;;;;;;qBAgDa;;;;;;YAOD,gBAAgB;;;;;;YAOhB;;;;;;iBAQK;WACP;WACA,WAAW;WACX,OAAO,cAAcA;;;;;;;iBAQd;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,KAAK;WACL,QAAQ;;;;;;;;;YAUN,OAAO,YAAY,UAAU,UAAU,cAAc;;;;;;;;;iBAUhD,OAAO,UAAUC,OAAY,WAAW,WAAW,mBAC3D,MAAM,OAAO,YAAY,aAAa,SAAS;YAC7C,SAAS;WACV,QAAQ;WACR,MAAM;WACN,YAAYC,SAAmB,GAAG,GAAG;;;;;;;;;YAUnC,MAAM;;;;;;;;YASN,SAAS,KAAK,UAAU,aAAa,oBAAoB;;;;;;;;YASzD,MAAM,KAAK;WACb,YAAYA,eAAyB,SAAS,UAAU;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,SAAS;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,UAAU;IAEhE;;;;;;;;;YAWS,OAAO,QACjB,KAAKC,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,UAAUC,QAAe,GAAG;WAC5B,QAAQE,UAAoBD,OAAc,GAAG;KAEtDH,KAAY;;;;;;;;YASF,WAAW,QACrB,KAAKA,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,MAAM;WACN,QAAQG,UAAoBD,OAAc,GAAG;KAEtDH,KAAY;;;;;;;;YASF,QAAQ,KAAK,OAAO;WAAgB,WAAWK,UAAiB;;;;;;;;;YAShE,YAAY,KAAK,WAAW;WAC9B,WAAWA,UAAiB;;;;;;;;;iBAUrB;WACP;WACA;WACA;WACA;;;;;;;;;;iBAWO;WACP,MAAM;WACN,MAAMR;WACN;;;;;;;;;;iBAWO;WACP,UAAUS;WACV,OAAO,cAAc;;;;;;;;;iBAUd;;WAEP,YAAY;;;;;;;;;;;;;;;;;;;;qBAqBT,SAAS,UAAUR,OAC/B,QAAQ,GACR,UAAU,aACL,cAAcD,OAAU,GAC7B,OAAO,SAASU,QAAa,OAAO,UAAU,OAAO,gBACjD,OAAO,GAAGC,QAAW,QAAQC,WAAc,QAAQC,WAAc;;;;;;;;qBAUzD,QAAQ,UAAUZ,OAAY,cAAcD,OACxD,QAAQ,GACR,OAAO,SAAS,QAChB,UAAU,YACN,OAAO,GAAGW,QAAW,QAAQC,WAAc,QAAQC,WAAc;;;;;;;;qBAUzD,QAAQ,UAAUZ,OAAY,QAAQ,MAAM,OAAO;KAG3D,SAAS,UAAUA,OAAY,WAAW,cAAc,QAAQ,OACpE,GACA,MAAM,aACN,SAAS,aACT,SAAS;;;;;;;;;qBAWG,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,gBACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;;qBAUlB;GACX,UAAUA,OAAY,IAAI,IAAI,IAC9B,KAAK,OAAO,GAAG,IAAI,IAAI,OACpB,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;GACzE,UAAUA,OAAY,GAAG,GAAG,GAAG,IAAI,IAAI,IACvC,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,KAAK,OAAO,GAAG,IAAI,IAAI,MACrB,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;;;;;;;;;qBAUrB;GACX,UAAUA,OACV,SAAS,QAAQ,MACd,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAOQ,UAAmB,GAAG;GACxC,UAAUR,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAOQ,UAAmB,GAAG;;;;;;;;;qBAU3B;GACX,UAAUR,OACV,SAAS,QAAQ,MACd,QAAQ,OAAO,OAAOQ;GACzB,UAAUR,OACV,QAAQ,OAAO,IACf,SAAS,QAAQ,QAAQ,MACvBQ;;;;;;;;;qBAUS;GACX,UAAUR,OACV,SAAS,QAAQ,MACd,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,OAAO,aAAa,GAAG;GACzE,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAO,aAAa,GAAG;;;;;;;;;;;;;;qBAerB;GACX,UAAUA,OACV,SAAS,YAAY,MAClB,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAOa,UAAoB,GAAG,GAAG;GACrE,UAAUb,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,YAAY,QAAQ,MAC3Ba,UAAoB,GAAG,GAAG;;;;;;;;;;qBAWjB;GACX,UAAUb,OACV,SAAS,KAAK,QAAQ,gBACnB,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAO,uBAAuB,GAAG;GAC5C,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,KAAK,QAAQ,QAAQ,gBAC5B,OAAO,OAAO,uBAAuB,GAAG;;;;;;;;;iBAU3B;WACP;WACA,SAAS;WACT,WAAW;WACX,OAAOc;WACP,SAAS;WACT;WACA;WACA;;;;;;;;;YAUE;WAEA;WACA,WAAW;WACX,OAAO,cAAc;;WAGrB;WACA,UAAU,cAAc;;WAGxB;WACA,KAAK;WACL,QAAQ;;;;;;;;;;;qBAYP,SAAS,UAAUd,OAC/B,QAAQ,MACJ,OAAO,MAAM,OAAO,IAAI;;;;;;;;qBAShB,WAAW,eAAe,KAAK"}
+{"version":3,"file":"Policy.d.ts","names":["Rule.Any","Rule.Rule","Condition.Variance","Domain.Any","Domain.Kind","Domain.ActionOf","Domain.ValueOf","Domain.DataOf","Condition.FieldSelector","Domain.Principal","Condition.Builder","Condition.Reads","Condition.Condition","Decision.Decision","Rule.Error","Rule.Services","Rule.OpaqueOf","Rule.Builder","Resource.Descriptor","Condition.Example","Condition.Encoded"],"sources":["../src/Policy.ts"],"mappings":";;;;;;;;;;;;;;;;;;YAoEY;;;;;;iBAQK;WACP;WACA,WAAW;WACX,OAAO,cAAcA;;;;;;;iBAQd;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,UAAU,cAAc;;;;;;;iBAQjB;WACP;WACA,KAAK;WACL,QAAQ;;;;;;;;;YAUN,OAAO,YAAY,UAAU,UAAU,cAAc;;;;;;;;;;;YAYrD,UAAU,WAAW,WAAW,WAAW;WAE3C;WACA,WAAW;WAIX,OAAO,cAAcC,KAAU,GAAG,GAAG,GAAG;;WAGxC;WACA,UAAU,cAAc,UAAU,GAAG,GAAG,GAAG;;WAG3C;WACA,KAAK,UAAU,GAAG,GAAG,GAAG;WACxB,QAAQ,UAAU,GAAG,GAAG,GAAG;;WAG7B,SAASC,SAAmB,GAAG,GAAG;;;;;;;;;;iBAW3B,OAAO,UAAUC,OAAY,WAAW,WAAW,mBAC3D,SAAS;WACR,QAAQ;WACR,MAAM,UAAU,GAAG,GAAG,GAAG;WACzB,WAAWD,SAAmB,GAAG,GAAG;;;;;WAKpC,YAAY,QAAQ,MAAM;;;;;;;;;YAUxB,MAAM;;;;;;;;YASN,SAAS,KAAK,UAAU,aAAa,oBAAoB;;;;;;;;YASzD,MAAM,KAAK;WACb,YAAYA,eAAyB,SAAS,UAAU;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,SAAS;IAE/D;;;;;;;;YAUS,SAAS,KAAK;WAChB,YAAYA,eAAyB,UAAU,UAAU;IAEhE;;;;;;;;;YAWS,OAAO,QACjB,KAAKE,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,UAAUC,QAAe,GAAG;WAC5B,QAAQE,cAAwBD,OAAc,GAAG;;WAEjD;KAETH,KAAY;;;;;;;;YASF,gBAAgB,QAC1B,KAAKA,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,UAAUC,QAAe,GAAG;WAC5B;KAETF,KAAY;;;;;;;;;;YAWF,MAAM,GAAG,qBACpB,SAASM,QACRH,OAAc,GAAG,IACjBD,QAAe,GAAG,IAClBG,UAAiB,QAEdG,+BAIJD,MAAgBL,QAAe,GAAG,IAAIG,UAAiB;;;;;;;;;;YAY5C,WAAW,QACrB,KAAKL,KAAY;WACR,QAAQC,SAAgB,GAAG;WAC3B,MAAM;WACN,QAAQG,cAAwBD,OAAc,GAAG;;WAEjD,SAAS,MAAM,GAAG;;WAElB;KAETH,KAAY;;;;;;;;YASF,QAAQ,KAAK,OAAO;WAAgB,WAAWK,UAAiB;;;;;;;;;YAShE,iBAAiB,KAAK,gBAAgB;WACxC,WAAWA,UAAiB;;;;;;;;;YAU1B,YAAY,KAAK,WAAW;WAC9B,WAAWA,UAAiB;;;;;;;;;iBAUrB;WACP;WACA;WACA;WACA;;;;;;;;;;iBAWO;WACP,MAAM;WACN,MAAMT;WACN;;;;;;;;;;iBAWO;WACP,UAAUa;WACV,OAAO,cAAc;;;;;;;;;iBAUd;;WAEP,YAAY;;;;;;;;;qBAuKT,QACZ,UAAUV,OACV,cAAcF,oBAAyB,WAEvC,QAAQ,GACR,OAAO,SAAS,QAChB,UAAU,YACN,OACJ,GACAa,QAAW,QACXC,WAAc,QACdC,WAAc;;;;;;;;;;;;;;;;;;;qBAqDF,SACX,UAAUb,OAAU,QAAU,GAAC,UAAY,aAC3C,cAAcF,oBAAyB,WAAW,GAAC,OAC5C,SAASgB,UAAa,OAAO,UAAU,OAAO,gBACnD,OACF,GACAH,QAAW,QACXC,WAAc,QACdC,WAAc;;;;;;;;qBAmBH,QAAS,UAAUb,OAAU,QAAU,MAAI,OAAO;KAG1D,SAAS,UAAUA,OAAY,WAAW,cAAc,QAAQ,OACpE,GACA,MAAM,aACN,SAAS,aACT,SAAS;;;;;;;;;qBA0EG,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,YACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;qBASlB,gBACN,qBAAqB,+BAA+B,MAAM,OAEhE,UAAU,OACN,SAAS,SAAS,QAAQ;;;;;;;;;qBAUlB;GACX,UAAUA,OAAY,IAAI,IAAI,IAC9B,KAAK,OAAO,GAAG,IAAI,IAAI,OACpB,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;GACzE,UAAUA,OAAY,GAAG,GAAG,GAAG,IAAI,IAAI,IACvC,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,KAAK,OAAO,GAAG,IAAI,IAAI,MACrB,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI;;;;;;;;;;qBAyFrB;GACX,GACA,SAAS,QAAQ,QAAQ,MACtB,UAAUA,OAAY,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,GAAG,UAAU;GACxB,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,KACvB,OAAO,GAAG,UAAU;;;;;;;;;;;;;qBA4PX,WAAQ,YACRe,YAAmB;WACX;WAAyB;;;;;;;;;qBA2DjC;GACX,UAAUf,eACV,SAAS,QAAQ,MACd,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAOU,UAAmB,GAAG;GACxC,UAAUV,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAOU,UAAmB,GAAG;;;;;;;;;qBAU3B;GACX,UAAUV,eACV,SAAS,QAAQ,MACd,QAAQ,OAAO,OAAOU;GACzB,UAAUV,OACV,QAAQ,OAAO,IACf,SAAS,QAAQ,QAAQ,MACvBU;;;;;;;;;;;;;;qBAsBS;GACX,UAAUV,eACV,SAAS,QAAQ,MACd,GAAG,GAAG,GAAG,QAAQ,OAAO,GAAG,GAAG,GAAG,OAAO,OAAO,OAAO,aAAa,GAAG;GACzE,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,QAAQ,QAAQ,MACvB,OAAO,OAAO,aAAa,GAAG;;;;;;;;;;;;;;qBAyErB;GACX,UAAUA,eACV,SAAS,iBAAiB,MACvB,GAAG,GAAG,GACT,QAAQ,OAAO,GAAG,GAAG,GAAG,OACpB,OAAO,OAAO,uBAAuB,GAAG;GAC5C,UAAUA,OAAY,GAAG,GAAG,GAC5B,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,iBAAiB,QAAQ,MAChC,OAAO,OAAO,uBAAuB,GAAG;;;;;;;;;iBA0C3B,UAAU,WAAW,WAAW,WAAW;;WAElD,OAAOS,UAAoB,GAAG,GAAG,GAAG;;WAEpC,MAAMA,UAAoB,GAAG,GAAG,GAAG;;;;;;;;;iBAU5B;WACP;WACA;WACA;WACA;;;;;WAKA;;;;;;;;KASL,KAAK,KAAK,MAAM,cAAc;;;;;;;;;;;YAYvB,cAAc,GAAG,KAAKD,OAEhC,qBAAqB,OAAOL,QAAe,GAAG,wCACpC,aAAa,cACrB;;UAwYM;WACA;WACA;WACA;WACA;WACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAqIG;SACL,YAAY,gBAClB,SAAS,OACN,UAAUH,OAAY,GAAG,GAAG,GAC/B,QAAQ,OAAO,GAAG,GAAG,GAAG,KAAK,KAAK,KAAK,YAAY,QAC/CS,UAAoB,GAAG,GAAG,GAAG,cAAc,GAAG;GAClD,UAAUT,OAAY,GAAG,GAAG,SAAS,YAAY,YAAY,QAAQ,KACrE,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,MACPS,UAAoB,GAAG,GAAG,GAAG,cAAc,GAAG;;;;;;;;;;;qBAgBrC;SACL,YAAY,gBAClB,SAAS,OACN,UAAUT,OAAY,GAAG,GAAG,GAC/B,QAAQ,OAAO,GAAG,GAAG,GAAG,KAAK,KAAK,KAAK,YAAY,QAC/C,UAAU,GAAG,GAAG,GAAG,cAAc,GAAG;GACxC,UAAUA,OAAY,GAAG,GAAG,SAAS,YAAY,YAAY,QAAQ,KACrE,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,MACP,UAAU,GAAG,GAAG,GAAG,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;YAsB5B,SACX,WACA,WACA,WACA,eACG,KAAK;EACR;aAAgB,WAAWS,UAAoB,GAAG,GAAG,GAAG;;EACxD;aAAiB,WAAWA,UAAoB,GAAG,GAAG,GAAG;;EACzD;aACU,WAAWA,UAAoB,GAAG,GAAG,GAAG;aACxC,SAASO;aACT,SAASA;;EAEnB;aACU,WAAWP,UAAoB,GAAG,GAAG,GAAG;aACxC;;;;;;;;;;;;;qBAqME,gBAAa,QAAY,KAAG,SAAW;;;;;;;;;;;qBAmBvC,eAAY,QAAY,KAAG,SAAW;;;;;;;;;;;;;;;;;;;qBA2BtC;SACL,YAAY,gBAClB,SAAS,OACN,UAAUT,OAAY,GAAG,GAAG,GAC/B,QAAQ,OAAO,GAAG,GAAG,GAAG,KAAK,KAAK,KAAK,YAAY,QAC/C,SAAS,GAAG,GAAG,GAAG,cAAc,GAAG;GACvC,UAAUA,OAAY,GAAG,GAAG,SAAS,YAAY,YAAY,QAAQ,KACrE,QAAQ,OAAO,GAAG,GAAG,GAAG,IACxB,SAAS,MACP,SAAS,GAAG,GAAG,GAAG,cAAc,GAAG;;;;;;;;;iBAYtB;WACP;WACA,SAAS;WACT,WAAW;WACX,OAAOiB;WACP,SAAS;WACT;WACA;WACA;;;;;;;;;YAUE;WAEA;WACA,WAAW;WACX,OAAO,cAAc;;WAGrB;WACA,UAAU,cAAc;;WAGxB;WACA,KAAK;WACL,QAAQ;;;;;;;;;qBAm7BP,WAAQ,eAAiB,KAAK;;;;;;;;;;qBAW9B,SAAU,UAAUjB,OAAU,QAClC,MACN,OAAO,MAAM,OAAO,IAAI"}