@nmnmcc/ability 1.0.1 → 2.0.0

package/dist/Domain.js

@@ -1,35 +1,7 @@
 import { __exportAll } from "./_virtual/_rolldown/runtime.js";
-import { descriptor, fieldPaths } from "./Resource.js";
-import * as Arr from "effect/Array";
-import * as Option from "effect/Option";
-import * as Data from "effect/Data";
-import * as HashMap from "effect/HashMap";
+import { make as make$1 } from "./internal/domain.js";
 // src/Domain.ts
-/**
-* A domain puts together the principal and all the resources of an
-* application. All other modules get their types from the domain. A rule may
-* only use the actions of its resource. A condition may only use the fields of
-* its resource and of the principal.
-*
-* @example
-* ```ts
-* import { Domain } from "@nmnmcc/ability"
-*
-* const App = Domain.make({ principal: Member, resources: [Document, Comment] })
-* ```
-*
-* @stability stable
-* @since 0.3.0
-*/
-var Domain_exports = /* @__PURE__ */ __exportAll({
-	descriptorOf: () => descriptorOf,
-	isDomain: () => isDomain,
-	make: () => make
-});
-/**
-* The class of every domain value. {@link isDomain} uses it to know a domain.
-*/
-var DomainData = class extends Data.Class {};
+var Domain_exports = /* @__PURE__ */ __exportAll({ make: () => make });
 /**
 * Makes a domain. Each resource must have its own kind name. Give `meta` when
 * rules must keep extra data, such as the scope of a grant. The `meta` Schema
@@ -40,37 +12,7 @@ var DomainData = class extends Data.Class {};
 * @category constructors
 * @since 0.3.0
 */
-const make = (options) => {
-	const descriptors = Arr.map(options.resources, descriptor);
-	const kinds = Arr.map(descriptors, (descriptor) => descriptor.kind);
-	const twice = Arr.findFirst(kinds, (kind, index) => kinds.indexOf(kind) !== index);
-	if (Option.isSome(twice)) throw new Error(`Two resources have the kind name "${twice.value}"`);
-	if (kinds.includes("*")) throw new Error(`A resource may not have the kind name "*"`);
-	const resources = HashMap.fromIterable(Arr.map(descriptors, (descriptor) => [descriptor.kind, descriptor]));
-	fieldPaths(options.principal);
-	return new DomainData({
-		principal: options.principal,
-		resources,
-		meta: options.meta
-	});
-};
-/**
-* Gives the descriptor of the resource with a kind name, or `undefined` when
-* the domain has no such resource.
-*
-* @stability stable
-* @category getters
-* @since 1.0.0
-*/
-const descriptorOf = (domain, kind) => Option.getOrUndefined(HashMap.get(domain.resources, kind));
-/**
-* Tests if a value is a domain.
-*
-* @stability stable
-* @category guards
-* @since 0.3.0
-*/
-const isDomain = (u) => u instanceof DomainData;
-export { Domain_exports, descriptorOf, isDomain, make };
+const make = make$1;
+export { Domain_exports, make };
 
 //# sourceMappingURL=Domain.js.map

package/dist/Domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"Domain.js","names":["Resource.descriptor"],"sources":["../src/Domain.ts"],"sourcesContent":["/**\n * A domain puts together the principal and all the resources of an\n * application. All other modules get their types from the domain. A rule may\n * only use the actions of its resource. A condition may only use the fields of\n * its resource and of the principal.\n *\n * @example\n * ```ts\n * import { Domain } from \"@nmnmcc/ability\"\n *\n * const App = Domain.make({ principal: Member, resources: [Document, Comment] })\n * ```\n *\n * @stability stable\n * @since 0.3.0\n */\nimport * as Arr from \"effect/Array\"\nimport * as Data from \"effect/Data\"\nimport * as HashMap from \"effect/HashMap\"\nimport * as Option from \"effect/Option\"\nimport type * as Schema from \"effect/Schema\"\nimport type * as PrincipalSchema from \"./Principal.ts\"\nimport * as Resource from \"./Resource.ts\"\n\n/**\n * A domain. `P` is the type of the principal, `Resources` is the union of the\n * resources, and `Meta` is the type of the extra data that a rule may keep.\n *\n * @stability stable\n * @category models\n * @since 0.3.0\n */\nexport interface Domain<\n\tP extends object,\n\tResources extends Resource.Any,\n\tMeta,\n> {\n\treadonly principal: PrincipalSchema.Any\n\t/** The descriptor of each resource, by its kind name. */\n\treadonly resources: HashMap.HashMap<string, Resource.Descriptor>\n\treadonly meta: Schema.Top | undefined\n\treadonly \"~Domain\"?: {\n\t\treadonly Principal: P\n\t\treadonly Resources: Resources\n\t\treadonly Meta: Meta\n\t}\n}\n\n/**\n * Any domain.\n *\n * @stability stable\n * @category models\n * @since 0.3.0\n */\nexport type Any = Domain<any, any, any>\n\n/**\n * The type of the principal of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Principal<D> = D extends Domain<infer P, any, any> ? P : never\n\n/**\n * The union of the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Resources<D> = D extends Domain<any, infer R, any> ? R : never\n\n/**\n * The type of the extra data that a rule of the domain may keep.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Meta<D> = D extends Domain<any, any, infer M> ? M : never\n\n/**\n * The kind names of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Kind<D> = Resource.Kind<Resources<D>>\n\n/**\n * The resource of a domain with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ResourceOf<D, K extends string> =\n\tResources<D> extends infer R\n\t\t? R extends Resource.Resource<K, any, any, any>\n\t\t\t? R\n\t\t\t: never\n\t\t: never\n\n/**\n * The actions of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ActionOf<D, K extends string> = Resource.Action<ResourceOf<D, K>>\n\n/**\n * The actions that every kind in `K` has. For one kind, they are its actions.\n * For a union of kinds, an action of only some of them is left out, so a\n * value of the union type can not get an action that its kind does not have.\n *\n * @stability stable\n * @category utility types\n * @since 1.0.0\n */\nexport type CommonAction<D, K extends string> = (\n\tK extends unknown ? (action: ActionOf<D, K>) => void : never\n) extends (action: infer A) => void\n\t? A\n\t: never\n\n/**\n * All the actions of all the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type AnyAction<D> = Resource.Action<Resources<D>>\n\n/**\n * The data type of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type DataOf<D, K extends string> = Resource.Data<ResourceOf<D, K>>\n\n/**\n * The value type of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ValueOf<D, K extends string> = Resource.Value<ResourceOf<D, K>>\n\n/**\n * The union of the value types of all the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type AnyValue<D> = Resource.Value<Resources<D>>\n\n/**\n * The class of every domain value. {@link isDomain} uses it to know a domain.\n */\nclass DomainData extends Data.Class<{\n\treadonly principal: PrincipalSchema.Any\n\treadonly resources: HashMap.HashMap<string, Resource.Descriptor>\n\treadonly meta: Schema.Top | undefined\n}> {}\n\n/**\n * Makes a domain. Each resource must have its own kind name. Give `meta` when\n * rules must keep extra data, such as the scope of a grant. The `meta` Schema\n * may not need services, because `Policy.schema` gives a Schema that needs\n * none.\n *\n * @stability stable\n * @category constructors\n * @since 0.3.0\n */\nexport const make: <\n\tP extends PrincipalSchema.Any,\n\tconst Resources extends ReadonlyArray<Resource.Any>,\n\tM extends Schema.Codec<any, any, never, never> = Schema.Never,\n>(options: {\n\treadonly principal: P\n\treadonly resources: Resources\n\treadonly meta?: M\n}) => Domain<P[\"Type\"], Resources[number], M[\"Type\"]> = (options) => {\n\tconst descriptors = Arr.map(options.resources, Resource.descriptor)\n\tconst kinds = Arr.map(descriptors, (descriptor) => descriptor.kind)\n\t// Two resources with one kind name is a mistake in the code, not in the\n\t// data, so it is a defect.\n\tconst twice = Arr.findFirst(\n\t\tkinds,\n\t\t(kind, index) => kinds.indexOf(kind) !== index,\n\t)\n\tif (Option.isSome(twice)) {\n\t\tthrow new Error(`Two resources have the kind name \"${twice.value}\"`)\n\t}\n\tif (kinds.includes(\"*\")) {\n\t\tthrow new Error(`A resource may not have the kind name \"*\"`)\n\t}\n\tconst resources = HashMap.fromIterable(\n\t\tArr.map(\n\t\t\tdescriptors,\n\t\t\t(descriptor) => [descriptor.kind, descriptor] as const,\n\t\t),\n\t)\n\t// This checks the field names of the principal. See `Resource.fieldPaths`.\n\tResource.fieldPaths(options.principal)\n\treturn new DomainData({\n\t\tprincipal: options.principal,\n\t\tresources,\n\t\tmeta: options.meta,\n\t})\n}\n\n/**\n * Gives the descriptor of the resource with a kind name, or `undefined` when\n * the domain has no such resource.\n *\n * @stability stable\n * @category getters\n * @since 1.0.0\n */\nexport const descriptorOf = (\n\tdomain: Any,\n\tkind: string,\n): Resource.Descriptor | undefined =>\n\tOption.getOrUndefined(HashMap.get(domain.resources, kind))\n\n/**\n * Tests if a value is a domain.\n *\n * @stability stable\n * @category guards\n * @since 0.3.0\n */\nexport const isDomain = (u: unknown): u is Any => u instanceof DomainData\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0KA,IAAM,aAAN,cAAyB,KAAK,MAI3B,CAAC;;;;;;;;;;;AAYJ,MAAa,QAQ4C,YAAY;CACpE,MAAM,cAAc,IAAI,IAAI,QAAQ,WAAWA,UAAmB;CAClE,MAAM,QAAQ,IAAI,IAAI,cAAc,eAAe,WAAW,IAAI;CAGlE,MAAM,QAAQ,IAAI,UACjB,QACC,MAAM,UAAU,MAAM,QAAQ,IAAI,MAAM,KAC1C;CACA,IAAI,OAAO,OAAO,KAAK,GACtB,MAAM,IAAI,MAAM,qCAAqC,MAAM,MAAM,EAAE;CAEpE,IAAI,MAAM,SAAS,GAAG,GACrB,MAAM,IAAI,MAAM,2CAA2C;CAE5D,MAAM,YAAY,QAAQ,aACzB,IAAI,IACH,cACC,eAAe,CAAC,WAAW,MAAM,UAAU,CAC7C,CACD;CAEA,WAAoB,QAAQ,SAAS;CACrC,OAAO,IAAI,WAAW;EACrB,WAAW,QAAQ;EACnB;EACA,MAAM,QAAQ;CACf,CAAC;AACF;;;;;;;;;AAUA,MAAa,gBACZ,QACA,SAEA,OAAO,eAAe,QAAQ,IAAI,OAAO,WAAW,IAAI,CAAC;;;;;;;;AAS1D,MAAa,YAAY,MAAyB,aAAa"}
+{"version":3,"file":"Domain.js","names":["Internal.make"],"sources":["../src/Domain.ts"],"sourcesContent":["/**\n * A domain puts together the principal and all the resources of an\n * application. All other modules get their types from the domain. A rule may\n * only use the actions of its resource. A condition may only use the fields of\n * its resource and of the principal.\n *\n * @example\n * ```ts\n * import { Domain } from \"@nmnmcc/ability\"\n *\n * const App = Domain.make({ principal: Member, resources: [Document, Comment] })\n * ```\n *\n * @stability stable\n * @since 0.3.0\n */\nimport type * as HashMap from \"effect/HashMap\"\nimport type * as Schema from \"effect/Schema\"\nimport type * as Catalog from \"./internal/catalog.ts\"\nimport * as Internal from \"./internal/domain.ts\"\nimport type * as Resource from \"./Resource.ts\"\n\n/** The Schema of a principal: a Schema of objects, such as a `Schema.Class`. */\ntype PrincipalSchema = Schema.Top & { readonly Type: object }\n\n/**\n * A domain. `P` is the type of the principal, `Resources` is the union of the\n * resources, and `Meta` is the type of the extra data that a rule may keep.\n *\n * @stability stable\n * @category models\n * @since 0.3.0\n */\nexport interface Domain<\n\tP extends object,\n\tResources extends Resource.Any,\n\tMeta,\n> {\n\treadonly principal: PrincipalSchema\n\t/** The catalog of the data fields of the principal. */\n\treadonly principalCatalog: Catalog.Catalog\n\t/** The descriptor of each resource, by its kind name. */\n\treadonly resources: HashMap.HashMap<string, Resource.Descriptor>\n\treadonly meta: Schema.Top | undefined\n\treadonly \"~Domain\"?: {\n\t\treadonly Principal: P\n\t\treadonly Resources: Resources\n\t\treadonly Meta: Meta\n\t}\n}\n\n/**\n * Any domain.\n *\n * @stability stable\n * @category models\n * @since 0.3.0\n */\nexport type Any = Domain<any, any, any>\n\n/**\n * The type of the principal of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Principal<D> = D extends Domain<infer P, any, any> ? P : never\n\n/**\n * The union of the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Resources<D> = D extends Domain<any, infer R, any> ? R : never\n\n/**\n * The type of the extra data that a rule of the domain may keep.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Meta<D> = D extends Domain<any, any, infer M> ? M : never\n\n/**\n * The kind names of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type Kind<D> = Resource.Kind<Resources<D>>\n\n/**\n * The resource of a domain with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ResourceOf<D, K extends string> =\n\tResources<D> extends infer R\n\t\t? R extends Resource.Resource<K, any, any, any>\n\t\t\t? R\n\t\t\t: never\n\t\t: never\n\n/**\n * The actions of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ActionOf<D, K extends string> = Resource.Action<ResourceOf<D, K>>\n\n/**\n * The actions that every kind in `K` has. For one kind, they are its actions.\n * For a union of kinds, an action of only some of them is left out, so a\n * value of the union type can not get an action that its kind does not have.\n *\n * @stability stable\n * @category utility types\n * @since 1.0.0\n */\nexport type CommonAction<D, K extends string> = (\n\tK extends unknown ? (action: ActionOf<D, K>) => void : never\n) extends (action: infer A) => void\n\t? A\n\t: never\n\n/**\n * All the actions of all the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type AnyAction<D> = Resource.Action<Resources<D>>\n\n/**\n * The data type of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type DataOf<D, K extends string> = Resource.Data<ResourceOf<D, K>>\n\n/**\n * The value type of the resource with the kind `K`.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type ValueOf<D, K extends string> = Resource.Value<ResourceOf<D, K>>\n\n/**\n * The union of the value types of all the resources of a domain.\n *\n * @stability stable\n * @category utility types\n * @since 0.3.0\n */\nexport type AnyValue<D> = Resource.Value<Resources<D>>\n\n/**\n * Makes a domain. Each resource must have its own kind name. Give `meta` when\n * rules must keep extra data, such as the scope of a grant. The `meta` Schema\n * may not need services, because `Policy.schema` gives a Schema that needs\n * none.\n *\n * @stability stable\n * @category constructors\n * @since 0.3.0\n */\nexport const make: <\n\tP extends PrincipalSchema,\n\tconst Resources extends ReadonlyArray<Resource.Any>,\n\tM extends Schema.Codec<any, any, never, never> = Schema.Never,\n>(options: {\n\treadonly principal: P\n\treadonly resources: Resources\n\treadonly meta?: M\n}) => Domain<P[\"Type\"], Resources[number], M[\"Type\"]> = Internal.make as never\n"],"mappings":";;;;;;;;;;;;;;AAoLA,MAAa,OAQ2CA"}

package/dist/HttpApi.d.ts

@@ -1,10 +1,13 @@
+import { Condition, Opaque } from "./Condition.js";
 import { Any, CommonAction, Kind, ValueOf } from "./Domain.js";
-import { Scope } from "./Policy.js";
-import { AnyServiceClass, Forbidden, Pending, PolicyUnavailable } from "./Authorizer.js";
+import { ResidualReads, Scope } from "./Policy.js";
+import { Forbidden, Pending, PolicyUnavailable } from "./internal/authorizer.js";
+import { AnyServiceClass, Authorizer, PolicyUnavailable as PolicyUnavailable$1, ServiceClass } from "./Authorizer.js";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import { HttpRouter } from "effect/http";
 /**
  * The path parameters of a request.
  *
@@ -83,11 +86,34 @@ export declare const requires: <A extends {
 }, const K extends Kind<A["domain"]>>(authorizer: A, action: CommonAction<A["domain"], K>, kind: K, how?: ((params: Params) => Effect.Effect<ValueOf<A["domain"], K>, unknown, unknown>) | {
   readonly within: (params: Params) => Scope<A["domain"], K>;
 }) => Requirement;
+/**
+ * A {@link Requirement} for an endpoint that gives a list, with the list query
+ * for the handler. `filter` takes the authorizer, which the handler gets when
+ * its group is built. It reads the path parameters of the request, and it
+ * gives the condition of `Authorizer.filter` in the scope of the requirement.
+ * So the scope is written one time, for the middleware and for the handler.
+ *
+ * @stability unstable
+ * @category models
+ * @since 2.0.0
+ */
+export interface List<A, K extends string> extends Requirement {
+  readonly filter: A extends ServiceClass<any, any, infer D, infer E, infer R> ? (authorizer: Authorizer<D, E, R>) => Effect.Effect<Condition<ResidualReads<D, K>, Opaque<E>>, PolicyUnavailable$1 | E, R | HttpRouter.RouteContext> : never;
+}
 /**
  * Makes a {@link Requirement} for an endpoint that gives a list. The middleware
  * does not check that the principal may act on every value, because the list
  * shows only the values that it may act on. The handler gets the list query
- * with `Authorizer.filter`, with the same scope.
+ * from `filter` of the result, with the same scope:
+ *
+ * ```ts
+ * const byAuthor = HttpApi.lists(Auth, "read", "Note", {
+ *   within: (params) => ($) => $.eq("authorId", params.user ?? null),
+ * })
+ * // When the group is built: const auth = yield* Auth
+ * // In the handler:
+ * const where = yield* byAuthor.filter(auth)
+ * ```
  *
  * When the principal may act on no value, the list is empty: that is not an
  * error, so a client does not learn that hidden values are there. With
@@ -99,12 +125,10 @@ export declare const requires: <A extends {
  * @category constructors
  * @since 1.0.0
  */
-export declare const lists: <A extends {
-  readonly domain: Any;
-}, const K extends Kind<A["domain"]>>(authorizer: A, action: CommonAction<A["domain"], K>, kind: K, options?: {
+export declare const lists: <A extends AnyServiceClass, const K extends Kind<A["domain"]>>(authorizer: A, action: CommonAction<A["domain"], K>, kind: K, options?: {
   readonly within?: (params: Params) => Scope<A["domain"], K>;
   readonly nonEmpty?: boolean;
-}) => Requirement;
+}) => List<A, K>;
 /**
  * The errors of the middleware, with HTTP status codes: 403 for
  * `Forbidden`, 503 for `PolicyUnavailable`, and 409 for `Pending`.

package/dist/HttpApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpApi.d.ts","names":["Domain.Any","Domain.Kind","Domain.CommonAction","Domain.ValueOf","Policy.Scope","Authorizer.Forbidden","Authorizer.PolicyUnavailable","Authorizer.Pending","Authorizer.AnyServiceClass"],"sources":["../src/HttpApi.ts"],"mappings":";;;;;;;;;;;;;;YAyDY,SAAS,SAAS;;;;;;;;;;;;;;;;;iBAkBb;WACP;WACA;WACA,QAAQ,QAAQ,WAAW,OAAO;WAClC,UAAU,QAAQ;WAClB;aAAkB;;;;;;;;;;;qBAUf,iBAAiB;;WAgBb,MAAA,cAAc;WACb,OAAA,cAAc;;;;;;;;;;qBAJnB,sBAAsB;;;;;;;;;;;;;;;;;;;qBA0BtB,WACZ;WAAqB,QAAQA;SACvB,UAAUC,KAAY,cAE5B,YAAY,GACZ,QAAQC,aAAoB,aAAa,IACzC,MAAM,GACN,QAEG,QAAQ,WACH,OAAO,OAAOC,QAAe,aAAa;WACpC,SAAS,QAAQ,WAAWC,MAAa,aAAa;MAChE;;;;;;;;;;;;;;;;;qBAuBQ,QACZ;WAAqB,QAAQJ;SACvB,UAAUC,KAAY,cAE5B,YAAY,GACZ,QAAQC,aAAoB,aAAa,IACzC,MAAM,GACN;WACU,UAAU,QAAQ,WAAWE,MAAa,aAAa;WACvD;MAEN;;;;;;;;;;;;;qBAuCQ,kBAAM,OAAA,SAAA,OAAA,mBAAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyHN,QACZ,MACA,mBACA,UAAUG,iBACV,WAEA,YAAY,QAAQ,aAAa,MAAM,UACvC,YAAY,MACR,MAAM,MACV,cAEC,UAAU,QAAQ,UAAU,UAAU,aAAa"}
+{"version":3,"file":"HttpApi.d.ts","names":["Domain.Any","Domain.Kind","Domain.CommonAction","Domain.ValueOf","Policy.Scope","Authorizer.ServiceClass","Authorizer.Authorizer","Policy.ResidualReads","Condition.Opaque","Condition.Condition","Authorizer.PolicyUnavailable","Authorizer.AnyServiceClass","_$__internal_authorizer_ts0.Forbidden","_$__internal_authorizer_ts0.PolicyUnavailable","_$__internal_authorizer_ts0.Pending"],"sources":["../src/HttpApi.ts"],"mappings":";;;;;;;;;;;;;;;;;YA0DY,SAAS,SAAS;;;;;;;;;;;;;;;;;iBAkBb;WACP;WACA;WACA,QAAQ,QAAQ,WAAW,OAAO;WAClC,UAAU,QAAQ;WAClB;aAAkB;;;;;;;;;;;qBAUf,iBAAiB;;WAgBb,MAAA,cAAc;WACb,OAAA,cAAc;;;;;;;;;;qBAJnB,sBAAsB;;;;;;;;;;;;;;;;;;;qBA0BtB,WACZ;WAAqB,QAAQA;SACvB,UAAUC,KAAY,cAE5B,YAAY,GACZ,QAAQC,aAAoB,aAAa,IACzC,MAAM,GACN,QAEG,QAAQ,WACH,OAAO,OAAOC,QAAe,aAAa;WACpC,SAAS,QAAQ,WAAWC,MAAa,aAAa;MAChE;;;;;;;;;;;;iBAkBY,KAAK,GAAG,0BAA0B;WACzC,QAAQ,UAAUC,6BAGpB,SACA,SACA,MAGJ,YAAYC,WAAsB,GAAG,GAAG,OACpC,OAAO,OACXG,UAAoBF,cAAqB,GAAG,IAAIC,OAAiB,KACjEE,sBAA+B,GAC/B,IAAI,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA8BN,QACZ,UAAUC,uBACJ,UAAUV,KAAY,cAE5B,YAAY,GACZ,QAAQC,aAAoB,aAAa,IACzC,MAAM,GACN;WACU,UAAU,QAAQ,WAAWE,MAAa,aAAa;WACvD;MAEN,KAAK,GAAG;;;;;;;;;;;;;qBA8DA,kBAAM,OAAA,SAAA,OAAA,mBAANQ;;;;;;;;;;;;;;;;;;;;;;mB,+BAAMC,mB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyHN,QACZ,MACA,mBACA,UAAUF,iBACV,WAEA,YAAY,QAAQ,aAAa,MAAM,UACvC,YAAY,MACR,MAAM,MACV,cAEC,UAAU,QAAQ,UAAU,UAAU,aAAa"}

package/dist/HttpApi.js

@@ -1,11 +1,11 @@
-import { kindOf } from "./Resource.js";
+import { kindOf } from "./internal/resource.js";
 import { Forbidden, Pending, PolicyUnavailable } from "./Authorizer.js";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as SchemaTransformation from "effect/SchemaTransformation";
+import * as Option from "effect/Option";
 import { HttpRouter } from "effect/http";
 import { HttpApiSchema } from "effect/http-api";
 // src/HttpApi.ts
@@ -93,7 +93,16 @@ const requires = (_authorizer, action, kind, how) => how === void 0 ? {
 * Makes a {@link Requirement} for an endpoint that gives a list. The middleware
 * does not check that the principal may act on every value, because the list
 * shows only the values that it may act on. The handler gets the list query
-* with `Authorizer.filter`, with the same scope.
+* from `filter` of the result, with the same scope:
+*
+* ```ts
+* const byAuthor = HttpApi.lists(Auth, "read", "Note", {
+*   within: (params) => ($) => $.eq("authorId", params.user ?? null),
+* })
+* // When the group is built: const auth = yield* Auth
+* // In the handler:
+* const where = yield* byAuthor.filter(auth)
+* ```
 *
 * When the principal may act on no value, the list is empty: that is not an
 * error, so a client does not learn that hidden values are there. With
@@ -105,11 +114,19 @@ const requires = (_authorizer, action, kind, how) => how === void 0 ? {
 * @category constructors
 * @since 1.0.0
 */
-const lists = (_authorizer, action, kind, options) => ({
-	action,
-	kind,
-	list: { nonEmpty: options?.nonEmpty ?? false },
-	...options?.within === void 0 ? {} : { within: options.within }
+const lists = ((_authorizer, action, kind, options) => {
+	const within = options?.within;
+	return {
+		action,
+		kind,
+		list: { nonEmpty: options?.nonEmpty ?? false },
+		...within === void 0 ? {} : { within },
+		filter: (authorizer) => Effect.flatMap(HttpRouter.params, (params) => authorizer.filter({
+			action,
+			kind,
+			...within === void 0 ? {} : { within: within(params) }
+		}))
+	};
 });
 /**
 * The Schema of a `PolicyUnavailable` response. It encodes only the `_tag`, so

package/dist/HttpApi.js.map

@@ -1 +1 @@
-{"version":3,"file":"HttpApi.js","names":["Authorizer.PolicyUnavailable","Resource.kindOf"],"sources":["../src/HttpApi.ts"],"sourcesContent":["/**\n * Tools to check authorization in an `effect/http-api` server.\n *\n * Each endpoint says what it needs with the {@link Required} annotation. A\n * group can give a default with {@link GroupRequired}: one list for GET\n * requests and one list for all other methods. A middleware checks the\n * requirements before the handler runs, in each group that uses it. An\n * endpoint with no annotation is a defect, so a new endpoint is closed until\n * you say what it needs. An empty list means the endpoint is open. An endpoint\n * in a group without the middleware is not checked at all.\n *\n * ```ts\n * class Authorization extends HttpApiMiddleware.Service<\n *   Authorization,\n *   { requires: Identity }\n * >()(\"app/Authorization\", { error: HttpApi.errors }) {}\n *\n * const endpoint = HttpApiEndpoint.patch(\"update\", \"/notes/:id\", { ... })\n *   .annotate(HttpApi.Required, [\n *     HttpApi.requires(Auth, \"update\", \"Note\", (params) => Notes.find(params.id)),\n *   ])\n *\n * const notes = HttpApiGroup.make(\"notes\").add(endpoint).middleware(Authorization)\n *\n * const AuthorizationLive = HttpApi.layer(Authorization, Auth)\n * ```\n *\n * This module is a separate entry point, `@nmnmcc/ability/HttpApi`, because\n * `effect/http-api` is not stable yet.\n *\n * @stability unstable\n * @since 0.3.0\n */\n// A `load` function of a requirement is kept in an annotation, so its error\n// type and its service type are erased to `unknown`. The language service\n// check for `unknown` in an Effect is off here.\n// @effect-diagnostics anyUnknownInErrorContext:off\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as SchemaTransformation from \"effect/SchemaTransformation\"\nimport { HttpRouter } from \"effect/http\"\nimport { HttpApiSchema } from \"effect/http-api\"\nimport * as Authorizer from \"./Authorizer.ts\"\nimport type * as Domain from \"./Domain.ts\"\nimport type * as Policy from \"./Policy.ts\"\nimport * as Resource from \"./Resource.ts\"\n\n/**\n * The path parameters of a request.\n *\n * @stability unstable\n * @category models\n * @since 1.0.0\n */\nexport type Params = Readonly<Record<string, string | undefined>>\n\n/**\n * One check that an endpoint needs: an action on a kind of resource.\n * - With `load`, the middleware loads the resource value from the path\n *   parameters and checks the action on that value.\n * - With `within`, it makes a scope from the path parameters and checks the\n *   action on every value in the scope.\n * - With `list`, the endpoint gives a list. The handler gets the list query\n *   with `Authorizer.filter`, so the middleware checks nothing, unless\n *   `nonEmpty` is true: then it fails when the principal may act on no value\n *   in the scope.\n * - With none of them, it checks the action on every value of the kind.\n *\n * @stability unstable\n * @category models\n * @since 0.3.0\n */\nexport interface Requirement {\n\treadonly action: string\n\treadonly kind: string\n\treadonly load?: (params: Params) => Effect.Effect<object, unknown, unknown>\n\treadonly within?: (params: Params) => unknown\n\treadonly list?: { readonly nonEmpty: boolean }\n}\n\n/**\n * The checks that an endpoint needs.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class Required extends Context.Service<\n\tRequired,\n\tReadonlyArray<Requirement>\n>()(\"@nmnmcc/ability/HttpApi/Required\") {}\n\n/**\n * The checks for every endpoint of a group with no {@link Required}\n * annotation. `read` is for GET requests. `write` is for all other methods.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class GroupRequired extends Context.Service<\n\tGroupRequired,\n\t{\n\t\treadonly read: ReadonlyArray<Requirement>\n\t\treadonly write: ReadonlyArray<Requirement>\n\t}\n>()(\"@nmnmcc/ability/HttpApi/GroupRequired\") {}\n\n/**\n * Makes a {@link Requirement} with the types of an authorizer. The action must\n * be an action of the kind, also when the kind has a union type.\n *\n * The last argument is one of:\n * - a `load` function, which must give a value of the kind. It may fail. Its\n *   errors must be errors of the middleware, and the services that it needs\n *   must be given to {@link layer}.\n * - `{ within }`, a function from the path parameters to a scope. Use it for\n *   an act on a part of the kind, such as a new value with no id yet:\n *   `{ within: (params) => ($) => $.under(\"org\", params.org ?? null) }`. A path\n *   parameter may be `undefined`, and a scope with `undefined` in it is a\n *   defect, so give a value for it.\n *\n * @stability unstable\n * @category constructors\n * @since 0.3.0\n */\nexport const requires: <\n\tA extends { readonly domain: Domain.Any },\n\tconst K extends Domain.Kind<A[\"domain\"]>,\n>(\n\tauthorizer: A,\n\taction: Domain.CommonAction<A[\"domain\"], K>,\n\tkind: K,\n\thow?:\n\t\t| ((\n\t\t\t\tparams: Params,\n\t\t  ) => Effect.Effect<Domain.ValueOf<A[\"domain\"], K>, unknown, unknown>)\n\t\t| { readonly within: (params: Params) => Policy.Scope<A[\"domain\"], K> },\n) => Requirement = (_authorizer, action, kind, how) =>\n\thow === undefined\n\t\t? { action: action as string, kind }\n\t\t: typeof how === \"function\"\n\t\t\t? { action: action as string, kind, load: how }\n\t\t\t: { action: action as string, kind, within: how.within }\n\n/**\n * Makes a {@link Requirement} for an endpoint that gives a list. The middleware\n * does not check that the principal may act on every value, because the list\n * shows only the values that it may act on. The handler gets the list query\n * with `Authorizer.filter`, with the same scope.\n *\n * When the principal may act on no value, the list is empty: that is not an\n * error, so a client does not learn that hidden values are there. With\n * `nonEmpty: true`, the middleware fails with `Forbidden` in that case. It\n * also fails when the coverage is `Unknown`, because then it can not say that\n * the list has a value.\n *\n * @stability unstable\n * @category constructors\n * @since 1.0.0\n */\nexport const lists: <\n\tA extends { readonly domain: Domain.Any },\n\tconst K extends Domain.Kind<A[\"domain\"]>,\n>(\n\tauthorizer: A,\n\taction: Domain.CommonAction<A[\"domain\"], K>,\n\tkind: K,\n\toptions?: {\n\t\treadonly within?: (params: Params) => Policy.Scope<A[\"domain\"], K>\n\t\treadonly nonEmpty?: boolean\n\t},\n) => Requirement = (_authorizer, action, kind, options) => ({\n\taction: action as string,\n\tkind,\n\tlist: { nonEmpty: options?.nonEmpty ?? false },\n\t...(options?.within === undefined ? {} : { within: options.within }),\n})\n\n/**\n * The Schema of a `PolicyUnavailable` response. It encodes only the `_tag`, so\n * the cause does not go to the client.\n */\nconst PolicyUnavailableResponse = Schema.TaggedStruct(\n\t\"PolicyUnavailable\",\n\t{},\n).pipe(\n\tSchema.decodeTo(\n\t\tSchema.declare(\n\t\t\t(u): u is Authorizer.PolicyUnavailable =>\n\t\t\t\tu instanceof Authorizer.PolicyUnavailable,\n\t\t),\n\t\tSchemaTransformation.transform({\n\t\t\tdecode: () => Authorizer.PolicyUnavailable.make({ cause: undefined }),\n\t\t\tencode: () => ({ _tag: \"PolicyUnavailable\" as const }),\n\t\t}),\n\t),\n)\n\n/**\n * The errors of the middleware, with HTTP status codes: 403 for\n * `Forbidden`, 503 for `PolicyUnavailable`, and 409 for `Pending`.\n *\n * The body of a `PolicyUnavailable` response has only its `_tag`. The cause\n * may have private details, such as an error from the database, so it stays\n * on the server.\n *\n * @stability unstable\n * @category errors\n * @since 0.3.0\n */\nexport const errors = [\n\tAuthorizer.Forbidden.pipe(HttpApiSchema.status(403)),\n\tPolicyUnavailableResponse.pipe(HttpApiSchema.status(503)),\n\tAuthorizer.Pending.pipe(HttpApiSchema.status(409)),\n] as const\n\nconst makeLayer = (\n\tmiddleware: Context.ServiceClass<any, string, any>,\n\tauthorizer: Authorizer.AnyServiceClass,\n) =>\n\tLayer.effect(\n\t\tmiddleware,\n\t\tEffect.gen(function* () {\n\t\t\tconst service = yield* authorizer\n\t\t\tconst services = yield* Effect.context<never>()\n\t\t\treturn Effect.fnUntraced(function* (\n\t\t\t\thttpEffect: Effect.Effect<unknown, unknown, unknown>,\n\t\t\t\toptions: {\n\t\t\t\t\treadonly endpoint: {\n\t\t\t\t\t\treadonly name: string\n\t\t\t\t\t\treadonly method: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t\treadonly group: {\n\t\t\t\t\t\treadonly identifier: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t) {\n\t\t\t\tconst requirements = Option.orElse(\n\t\t\t\t\tContext.getOption(options.endpoint.annotations, Required),\n\t\t\t\t\t() =>\n\t\t\t\t\t\tOption.map(\n\t\t\t\t\t\t\tContext.getOption(options.group.annotations, GroupRequired),\n\t\t\t\t\t\t\t(rules) =>\n\t\t\t\t\t\t\t\toptions.endpoint.method === \"GET\" ? rules.read : rules.write,\n\t\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\tif (Option.isNone(requirements)) {\n\t\t\t\t\treturn yield* Effect.die(\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`The endpoint ${options.group.identifier}.${options.endpoint.name} does not say what it needs. Give it the HttpApi.Required annotation.`,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t\tconst endpoint = `${options.group.identifier}.${options.endpoint.name}`\n\t\t\t\t// The requirements are checked in order. The first one that fails\n\t\t\t\t// stops the request.\n\t\t\t\tyield* Effect.forEach(\n\t\t\t\t\trequirements.value,\n\t\t\t\t\t({ action, kind, load, within, list }) => {\n\t\t\t\t\t\tif (load !== undefined) {\n\t\t\t\t\t\t\treturn HttpRouter.params.pipe(\n\t\t\t\t\t\t\t\tEffect.flatMap((params) =>\n\t\t\t\t\t\t\t\t\tEffect.provideContext(load(params), services),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t// The check is for the kind of the requirement. A value of\n\t\t\t\t\t\t\t\t// another kind is a mistake in `load`, and the check must\n\t\t\t\t\t\t\t\t// not pass with the rules of that other kind.\n\t\t\t\t\t\t\t\tEffect.filterOrElse(\n\t\t\t\t\t\t\t\t\t(value) => Resource.kindOf(value) === kind,\n\t\t\t\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\t\t\t\tEffect.die(\n\t\t\t\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\t\t\t`The load function of ${endpoint} gave a value that is not a ${kind}`,\n\t\t\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\tEffect.flatMap((value) =>\n\t\t\t\t\t\t\t\t\tservice.check({ action, resource: value } as never),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst target =\n\t\t\t\t\t\t\twithin === undefined\n\t\t\t\t\t\t\t\t? Effect.succeed({ action, kind } as never)\n\t\t\t\t\t\t\t\t: Effect.map(\n\t\t\t\t\t\t\t\t\t\tHttpRouter.params,\n\t\t\t\t\t\t\t\t\t\t(params) =>\n\t\t\t\t\t\t\t\t\t\t\t({ action, kind, within: within(params) }) as never,\n\t\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\tif (list === undefined) {\n\t\t\t\t\t\t\treturn Effect.flatMap(target, (value) => service.check(value))\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// A list endpoint may give an empty list, unless it must not.\n\t\t\t\t\t\t// Only `All` and `Some` say that the list has a value. `Unknown`\n\t\t\t\t\t\t// is not a \"yes\".\n\t\t\t\t\t\treturn list.nonEmpty\n\t\t\t\t\t\t\t? target.pipe(\n\t\t\t\t\t\t\t\t\tEffect.flatMap((value) => service.coverage(value)),\n\t\t\t\t\t\t\t\t\tEffect.filterOrElse(\n\t\t\t\t\t\t\t\t\t\t(covered) =>\n\t\t\t\t\t\t\t\t\t\t\t(covered as { readonly _tag: string })._tag === \"All\" ||\n\t\t\t\t\t\t\t\t\t\t\t(covered as { readonly _tag: string })._tag === \"Some\",\n\t\t\t\t\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\t\t\t\t\tEffect.fail(Authorizer.Forbidden.make({ action, kind })),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: Effect.void\n\t\t\t\t\t},\n\t\t\t\t\t{ discard: true },\n\t\t\t\t)\n\t\t\t\treturn yield* httpEffect\n\t\t\t})\n\t\t}),\n\t)\n\n/**\n * Makes the layer of an authorization middleware. The middleware reads the\n * {@link Required} and {@link GroupRequired} annotations and checks each\n * requirement with the authorizer.\n *\n * The layer takes the authorizer when it is built. The middleware must\n * require the services of the authorizer, such as the identity of the\n * caller. `R` is the type of the services that the `load` functions need. The\n * layer takes them when it is built too.\n *\n * @stability unstable\n * @category layers\n * @since 0.3.0\n */\nexport const layer: <\n\tSelf,\n\tId extends string,\n\tA extends Authorizer.AnyServiceClass,\n\tR = never,\n>(\n\tmiddleware: Context.ServiceClass<Self, Id, any>,\n\tauthorizer: A,\n) => Layer.Layer<\n\tSelf,\n\tnever,\n\t(A extends Context.Key<infer I, any> ? I : never) | R\n> = makeLayer as never\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,IAAa,WAAb,cAA8B,QAAQ,QAGpC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC;;;;;;;;;AAUzC,IAAa,gBAAb,cAAmC,QAAQ,QAMzC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;AAoB9C,MAAa,YAYO,aAAa,QAAQ,MAAM,QAC9C,QAAQ,KAAA,IACL;CAAU;CAAkB;AAAK,IACjC,OAAO,QAAQ,aACd;CAAU;CAAkB;CAAM,MAAM;AAAI,IAC5C;CAAU;CAAkB;CAAM,QAAQ,IAAI;AAAO;;;;;;;;;;;;;;;;;AAkB1D,MAAa,SAWO,aAAa,QAAQ,MAAM,aAAa;CACnD;CACR;CACA,MAAM,EAAE,UAAU,SAAS,YAAY,MAAM;CAC7C,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AACnE;;;;;AAMA,MAAM,4BAA4B,OAAO,aACxC,qBACA,CAAC,CACF,CAAC,CAAC,KACD,OAAO,SACN,OAAO,SACL,MACA,aAAaA,iBACf,GACA,qBAAqB,UAAU;CAC9B,cAAA,kBAA2C,KAAK,EAAE,OAAO,KAAA,EAAU,CAAC;CACpE,eAAe,EAAE,MAAM,oBAA6B;AACrD,CAAC,CACF,CACD;;;;;;;;;;;;;AAcA,MAAa,SAAS;CACA,UAAA,KAAK,cAAc,OAAO,GAAG,CAAC;CACnD,0BAA0B,KAAK,cAAc,OAAO,GAAG,CAAC;CACrC,QAAA,KAAK,cAAc,OAAO,GAAG,CAAC;AAClD;AAEA,MAAM,aACL,YACA,eAEA,MAAM,OACL,YACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO;CACvB,MAAM,WAAW,OAAO,OAAO,QAAe;CAC9C,OAAO,OAAO,WAAW,WACxB,YACA,SAWC;EACD,MAAM,eAAe,OAAO,OAC3B,QAAQ,UAAU,QAAQ,SAAS,aAAa,QAAQ,SAEvD,OAAO,IACN,QAAQ,UAAU,QAAQ,MAAM,aAAa,aAAa,IACzD,UACA,QAAQ,SAAS,WAAW,QAAQ,MAAM,OAAO,MAAM,KACzD,CACF;EACA,IAAI,OAAO,OAAO,YAAY,GAC7B,OAAO,OAAO,OAAO,oBACpB,IAAI,MACH,gBAAgB,QAAQ,MAAM,WAAW,GAAG,QAAQ,SAAS,KAAK,sEACnE,CACD;EAED,MAAM,WAAW,GAAG,QAAQ,MAAM,WAAW,GAAG,QAAQ,SAAS;EAGjE,OAAO,OAAO,QACb,aAAa,QACZ,EAAE,QAAQ,MAAM,MAAM,QAAQ,WAAW;GACzC,IAAI,SAAS,KAAA,GACZ,OAAO,WAAW,OAAO,KACxB,OAAO,SAAS,WACf,OAAO,eAAe,KAAK,MAAM,GAAG,QAAQ,CAC7C,GAIA,OAAO,cACL,UAAUC,OAAgB,KAAK,MAAM,YAErC,OAAO,oBACN,IAAI,MACH,wBAAwB,SAAS,8BAA8B,MAChE,CACD,CACF,GACA,OAAO,SAAS,UACf,QAAQ,MAAM;IAAE;IAAQ,UAAU;GAAM,CAAU,CACnD,CACD;GAED,MAAM,SACL,WAAW,KAAA,IACR,OAAO,QAAQ;IAAE;IAAQ;GAAK,CAAU,IACxC,OAAO,IACP,WAAW,SACV,YACC;IAAE;IAAQ;IAAM,QAAQ,OAAO,MAAM;GAAE,EAC1C;GACH,IAAI,SAAS,KAAA,GACZ,OAAO,OAAO,QAAQ,SAAS,UAAU,QAAQ,MAAM,KAAK,CAAC;GAK9D,OAAO,KAAK,WACT,OAAO,KACP,OAAO,SAAS,UAAU,QAAQ,SAAS,KAAK,CAAC,GACjD,OAAO,cACL,YACC,QAAsC,SAAS,SAC/C,QAAsC,SAAS,cAEhD,OAAO,KAAA,UAA0B,KAAK;IAAE;IAAQ;GAAK,CAAC,CAAC,CACzD,CACD,IACC,OAAO;EACX,GACA,EAAE,SAAS,KAAK,CACjB;EACA,OAAO,OAAO;CACf,CAAC;AACF,CAAC,CACF;;;;;;;;;;;;;;;AAgBD,MAAa,QAYT"}
+{"version":3,"file":"HttpApi.js","names":["Authorizer.PolicyUnavailable","ResourceData.kindOf"],"sources":["../src/HttpApi.ts"],"sourcesContent":["/**\n * Tools to check authorization in an `effect/http-api` server.\n *\n * Each endpoint says what it needs with the {@link Required} annotation. A\n * group can give a default with {@link GroupRequired}: one list for GET\n * requests and one list for all other methods. A middleware checks the\n * requirements before the handler runs, in each group that uses it. An\n * endpoint with no annotation is a defect, so a new endpoint is closed until\n * you say what it needs. An empty list means the endpoint is open. An endpoint\n * in a group without the middleware is not checked at all.\n *\n * ```ts\n * class Authorization extends HttpApiMiddleware.Service<\n *   Authorization,\n *   { requires: Identity }\n * >()(\"app/Authorization\", { error: HttpApi.errors }) {}\n *\n * const endpoint = HttpApiEndpoint.patch(\"update\", \"/notes/:id\", { ... })\n *   .annotate(HttpApi.Required, [\n *     HttpApi.requires(Auth, \"update\", \"Note\", (params) => Notes.find(params.id)),\n *   ])\n *\n * const notes = HttpApiGroup.make(\"notes\").add(endpoint).middleware(Authorization)\n *\n * const AuthorizationLive = HttpApi.layer(Authorization, Auth)\n * ```\n *\n * This module is a separate entry point, `@nmnmcc/ability/HttpApi`, because\n * `effect/http-api` is not stable yet.\n *\n * @stability unstable\n * @since 0.3.0\n */\n// A `load` function of a requirement is kept in an annotation, so its error\n// type and its service type are erased to `unknown`. The language service\n// check for `unknown` in an Effect is off here.\n// @effect-diagnostics anyUnknownInErrorContext:off\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport * as SchemaTransformation from \"effect/SchemaTransformation\"\nimport { HttpRouter } from \"effect/http\"\nimport { HttpApiSchema } from \"effect/http-api\"\nimport * as Authorizer from \"./Authorizer.ts\"\nimport type * as Condition from \"./Condition.ts\"\nimport type * as Domain from \"./Domain.ts\"\nimport type * as Policy from \"./Policy.ts\"\nimport * as ResourceData from \"./internal/resource.ts\"\n\n/**\n * The path parameters of a request.\n *\n * @stability unstable\n * @category models\n * @since 1.0.0\n */\nexport type Params = Readonly<Record<string, string | undefined>>\n\n/**\n * One check that an endpoint needs: an action on a kind of resource.\n * - With `load`, the middleware loads the resource value from the path\n *   parameters and checks the action on that value.\n * - With `within`, it makes a scope from the path parameters and checks the\n *   action on every value in the scope.\n * - With `list`, the endpoint gives a list. The handler gets the list query\n *   with `Authorizer.filter`, so the middleware checks nothing, unless\n *   `nonEmpty` is true: then it fails when the principal may act on no value\n *   in the scope.\n * - With none of them, it checks the action on every value of the kind.\n *\n * @stability unstable\n * @category models\n * @since 0.3.0\n */\nexport interface Requirement {\n\treadonly action: string\n\treadonly kind: string\n\treadonly load?: (params: Params) => Effect.Effect<object, unknown, unknown>\n\treadonly within?: (params: Params) => unknown\n\treadonly list?: { readonly nonEmpty: boolean }\n}\n\n/**\n * The checks that an endpoint needs.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class Required extends Context.Service<\n\tRequired,\n\tReadonlyArray<Requirement>\n>()(\"@nmnmcc/ability/HttpApi/Required\") {}\n\n/**\n * The checks for every endpoint of a group with no {@link Required}\n * annotation. `read` is for GET requests. `write` is for all other methods.\n *\n * @stability unstable\n * @category annotations\n * @since 0.3.0\n */\nexport class GroupRequired extends Context.Service<\n\tGroupRequired,\n\t{\n\t\treadonly read: ReadonlyArray<Requirement>\n\t\treadonly write: ReadonlyArray<Requirement>\n\t}\n>()(\"@nmnmcc/ability/HttpApi/GroupRequired\") {}\n\n/**\n * Makes a {@link Requirement} with the types of an authorizer. The action must\n * be an action of the kind, also when the kind has a union type.\n *\n * The last argument is one of:\n * - a `load` function, which must give a value of the kind. It may fail. Its\n *   errors must be errors of the middleware, and the services that it needs\n *   must be given to {@link layer}.\n * - `{ within }`, a function from the path parameters to a scope. Use it for\n *   an act on a part of the kind, such as a new value with no id yet:\n *   `{ within: (params) => ($) => $.under(\"org\", params.org ?? null) }`. A path\n *   parameter may be `undefined`, and a scope with `undefined` in it is a\n *   defect, so give a value for it.\n *\n * @stability unstable\n * @category constructors\n * @since 0.3.0\n */\nexport const requires: <\n\tA extends { readonly domain: Domain.Any },\n\tconst K extends Domain.Kind<A[\"domain\"]>,\n>(\n\tauthorizer: A,\n\taction: Domain.CommonAction<A[\"domain\"], K>,\n\tkind: K,\n\thow?:\n\t\t| ((\n\t\t\t\tparams: Params,\n\t\t  ) => Effect.Effect<Domain.ValueOf<A[\"domain\"], K>, unknown, unknown>)\n\t\t| { readonly within: (params: Params) => Policy.Scope<A[\"domain\"], K> },\n) => Requirement = (_authorizer, action, kind, how) =>\n\thow === undefined\n\t\t? { action: action as string, kind }\n\t\t: typeof how === \"function\"\n\t\t\t? { action: action as string, kind, load: how }\n\t\t\t: { action: action as string, kind, within: how.within }\n\n/**\n * A {@link Requirement} for an endpoint that gives a list, with the list query\n * for the handler. `filter` takes the authorizer, which the handler gets when\n * its group is built. It reads the path parameters of the request, and it\n * gives the condition of `Authorizer.filter` in the scope of the requirement.\n * So the scope is written one time, for the middleware and for the handler.\n *\n * @stability unstable\n * @category models\n * @since 2.0.0\n */\nexport interface List<A, K extends string> extends Requirement {\n\treadonly filter: A extends Authorizer.ServiceClass<\n\t\tany,\n\t\tany,\n\t\tinfer D,\n\t\tinfer E,\n\t\tinfer R\n\t>\n\t\t? (\n\t\t\t\tauthorizer: Authorizer.Authorizer<D, E, R>,\n\t\t\t) => Effect.Effect<\n\t\t\t\tCondition.Condition<Policy.ResidualReads<D, K>, Condition.Opaque<E>>,\n\t\t\t\tAuthorizer.PolicyUnavailable | E,\n\t\t\t\tR | HttpRouter.RouteContext\n\t\t\t>\n\t\t: never\n}\n\n/**\n * Makes a {@link Requirement} for an endpoint that gives a list. The middleware\n * does not check that the principal may act on every value, because the list\n * shows only the values that it may act on. The handler gets the list query\n * from `filter` of the result, with the same scope:\n *\n * ```ts\n * const byAuthor = HttpApi.lists(Auth, \"read\", \"Note\", {\n *   within: (params) => ($) => $.eq(\"authorId\", params.user ?? null),\n * })\n * // When the group is built: const auth = yield* Auth\n * // In the handler:\n * const where = yield* byAuthor.filter(auth)\n * ```\n *\n * When the principal may act on no value, the list is empty: that is not an\n * error, so a client does not learn that hidden values are there. With\n * `nonEmpty: true`, the middleware fails with `Forbidden` in that case. It\n * also fails when the coverage is `Unknown`, because then it can not say that\n * the list has a value.\n *\n * @stability unstable\n * @category constructors\n * @since 1.0.0\n */\nexport const lists: <\n\tA extends Authorizer.AnyServiceClass,\n\tconst K extends Domain.Kind<A[\"domain\"]>,\n>(\n\tauthorizer: A,\n\taction: Domain.CommonAction<A[\"domain\"], K>,\n\tkind: K,\n\toptions?: {\n\t\treadonly within?: (params: Params) => Policy.Scope<A[\"domain\"], K>\n\t\treadonly nonEmpty?: boolean\n\t},\n) => List<A, K> = ((\n\t_authorizer: Authorizer.AnyServiceClass,\n\taction: string,\n\tkind: string,\n\toptions?: {\n\t\treadonly within?: (params: Params) => unknown\n\t\treadonly nonEmpty?: boolean\n\t},\n) => {\n\tconst within = options?.within\n\treturn {\n\t\taction,\n\t\tkind,\n\t\tlist: { nonEmpty: options?.nonEmpty ?? false },\n\t\t...(within === undefined ? {} : { within }),\n\t\tfilter: (authorizer: {\n\t\t\treadonly filter: (\n\t\t\t\ttarget: object,\n\t\t\t) => Effect.Effect<unknown, unknown, unknown>\n\t\t}) =>\n\t\t\tEffect.flatMap(HttpRouter.params, (params) =>\n\t\t\t\tauthorizer.filter({\n\t\t\t\t\taction,\n\t\t\t\t\tkind,\n\t\t\t\t\t...(within === undefined ? {} : { within: within(params) }),\n\t\t\t\t}),\n\t\t\t),\n\t}\n}) as never\n\n/**\n * The Schema of a `PolicyUnavailable` response. It encodes only the `_tag`, so\n * the cause does not go to the client.\n */\nconst PolicyUnavailableResponse = Schema.TaggedStruct(\n\t\"PolicyUnavailable\",\n\t{},\n).pipe(\n\tSchema.decodeTo(\n\t\tSchema.declare(\n\t\t\t(u): u is Authorizer.PolicyUnavailable =>\n\t\t\t\tu instanceof Authorizer.PolicyUnavailable,\n\t\t),\n\t\tSchemaTransformation.transform({\n\t\t\tdecode: () => Authorizer.PolicyUnavailable.make({ cause: undefined }),\n\t\t\tencode: () => ({ _tag: \"PolicyUnavailable\" as const }),\n\t\t}),\n\t),\n)\n\n/**\n * The errors of the middleware, with HTTP status codes: 403 for\n * `Forbidden`, 503 for `PolicyUnavailable`, and 409 for `Pending`.\n *\n * The body of a `PolicyUnavailable` response has only its `_tag`. The cause\n * may have private details, such as an error from the database, so it stays\n * on the server.\n *\n * @stability unstable\n * @category errors\n * @since 0.3.0\n */\nexport const errors = [\n\tAuthorizer.Forbidden.pipe(HttpApiSchema.status(403)),\n\tPolicyUnavailableResponse.pipe(HttpApiSchema.status(503)),\n\tAuthorizer.Pending.pipe(HttpApiSchema.status(409)),\n] as const\n\nconst makeLayer = (\n\tmiddleware: Context.ServiceClass<any, string, any>,\n\tauthorizer: Authorizer.AnyServiceClass,\n) =>\n\tLayer.effect(\n\t\tmiddleware,\n\t\tEffect.gen(function* () {\n\t\t\tconst service = yield* authorizer\n\t\t\tconst services = yield* Effect.context<never>()\n\t\t\treturn Effect.fnUntraced(function* (\n\t\t\t\thttpEffect: Effect.Effect<unknown, unknown, unknown>,\n\t\t\t\toptions: {\n\t\t\t\t\treadonly endpoint: {\n\t\t\t\t\t\treadonly name: string\n\t\t\t\t\t\treadonly method: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t\treadonly group: {\n\t\t\t\t\t\treadonly identifier: string\n\t\t\t\t\t\treadonly annotations: Context.Context<never>\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t) {\n\t\t\t\tconst requirements = Option.orElse(\n\t\t\t\t\tContext.getOption(options.endpoint.annotations, Required),\n\t\t\t\t\t() =>\n\t\t\t\t\t\tOption.map(\n\t\t\t\t\t\t\tContext.getOption(options.group.annotations, GroupRequired),\n\t\t\t\t\t\t\t(rules) =>\n\t\t\t\t\t\t\t\toptions.endpoint.method === \"GET\" ? rules.read : rules.write,\n\t\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t\tif (Option.isNone(requirements)) {\n\t\t\t\t\treturn yield* Effect.die(\n\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t`The endpoint ${options.group.identifier}.${options.endpoint.name} does not say what it needs. Give it the HttpApi.Required annotation.`,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t\tconst endpoint = `${options.group.identifier}.${options.endpoint.name}`\n\t\t\t\t// The requirements are checked in order. The first one that fails\n\t\t\t\t// stops the request.\n\t\t\t\tyield* Effect.forEach(\n\t\t\t\t\trequirements.value,\n\t\t\t\t\t({ action, kind, load, within, list }) => {\n\t\t\t\t\t\tif (load !== undefined) {\n\t\t\t\t\t\t\treturn HttpRouter.params.pipe(\n\t\t\t\t\t\t\t\tEffect.flatMap((params) =>\n\t\t\t\t\t\t\t\t\tEffect.provideContext(load(params), services),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t// The check is for the kind of the requirement. A value of\n\t\t\t\t\t\t\t\t// another kind is a mistake in `load`, and the check must\n\t\t\t\t\t\t\t\t// not pass with the rules of that other kind.\n\t\t\t\t\t\t\t\tEffect.filterOrElse(\n\t\t\t\t\t\t\t\t\t(value) => ResourceData.kindOf(value) === kind,\n\t\t\t\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\t\t\t\tEffect.die(\n\t\t\t\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\t\t\t`The load function of ${endpoint} gave a value that is not a ${kind}`,\n\t\t\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\tEffect.flatMap((value) =>\n\t\t\t\t\t\t\t\t\tservice.check({ action, resource: value } as never),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst target =\n\t\t\t\t\t\t\twithin === undefined\n\t\t\t\t\t\t\t\t? Effect.succeed({ action, kind } as never)\n\t\t\t\t\t\t\t\t: Effect.map(\n\t\t\t\t\t\t\t\t\t\tHttpRouter.params,\n\t\t\t\t\t\t\t\t\t\t(params) =>\n\t\t\t\t\t\t\t\t\t\t\t({ action, kind, within: within(params) }) as never,\n\t\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\tif (list === undefined) {\n\t\t\t\t\t\t\treturn Effect.flatMap(target, (value) => service.check(value))\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// A list endpoint may give an empty list, unless it must not.\n\t\t\t\t\t\t// Only `All` and `Some` say that the list has a value. `Unknown`\n\t\t\t\t\t\t// is not a \"yes\".\n\t\t\t\t\t\treturn list.nonEmpty\n\t\t\t\t\t\t\t? target.pipe(\n\t\t\t\t\t\t\t\t\tEffect.flatMap((value) => service.coverage(value)),\n\t\t\t\t\t\t\t\t\tEffect.filterOrElse(\n\t\t\t\t\t\t\t\t\t\t(covered) =>\n\t\t\t\t\t\t\t\t\t\t\t(covered as { readonly _tag: string })._tag === \"All\" ||\n\t\t\t\t\t\t\t\t\t\t\t(covered as { readonly _tag: string })._tag === \"Some\",\n\t\t\t\t\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\t\t\t\t\tEffect.fail(Authorizer.Forbidden.make({ action, kind })),\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: Effect.void\n\t\t\t\t\t},\n\t\t\t\t\t{ discard: true },\n\t\t\t\t)\n\t\t\t\treturn yield* httpEffect\n\t\t\t})\n\t\t}),\n\t)\n\n/**\n * Makes the layer of an authorization middleware. The middleware reads the\n * {@link Required} and {@link GroupRequired} annotations and checks each\n * requirement with the authorizer.\n *\n * The layer takes the authorizer when it is built. The middleware must\n * require the services of the authorizer, such as the identity of the\n * caller. `R` is the type of the services that the `load` functions need. The\n * layer takes them when it is built too.\n *\n * @stability unstable\n * @category layers\n * @since 0.3.0\n */\nexport const layer: <\n\tSelf,\n\tId extends string,\n\tA extends Authorizer.AnyServiceClass,\n\tR = never,\n>(\n\tmiddleware: Context.ServiceClass<Self, Id, any>,\n\tauthorizer: A,\n) => Layer.Layer<\n\tSelf,\n\tnever,\n\t(A extends Context.Key<infer I, any> ? I : never) | R\n> = makeLayer as never\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,IAAa,WAAb,cAA8B,QAAQ,QAGpC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC;;;;;;;;;AAUzC,IAAa,gBAAb,cAAmC,QAAQ,QAMzC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;AAoB9C,MAAa,YAYO,aAAa,QAAQ,MAAM,QAC9C,QAAQ,KAAA,IACL;CAAU;CAAkB;AAAK,IACjC,OAAO,QAAQ,aACd;CAAU;CAAkB;CAAM,MAAM;AAAI,IAC5C;CAAU;CAAkB;CAAM,QAAQ,IAAI;AAAO;;;;;;;;;;;;;;;;;;;;;;;;;;AAwD1D,MAAa,UAYZ,aACA,QACA,MACA,YAII;CACJ,MAAM,SAAS,SAAS;CACxB,OAAO;EACN;EACA;EACA,MAAM,EAAE,UAAU,SAAS,YAAY,MAAM;EAC7C,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EACzC,SAAS,eAKR,OAAO,QAAQ,WAAW,SAAS,WAClC,WAAW,OAAO;GACjB;GACA;GACA,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,EAAE;EAC1D,CAAC,CACF;CACF;AACD;;;;;AAMA,MAAM,4BAA4B,OAAO,aACxC,qBACA,CAAC,CACF,CAAC,CAAC,KACD,OAAO,SACN,OAAO,SACL,MACA,aAAaA,iBACf,GACA,qBAAqB,UAAU;CAC9B,cAAA,kBAA2C,KAAK,EAAE,OAAO,KAAA,EAAU,CAAC;CACpE,eAAe,EAAE,MAAM,oBAA6B;AACrD,CAAC,CACF,CACD;;;;;;;;;;;;;AAcA,MAAa,SAAS;CACA,UAAA,KAAK,cAAc,OAAO,GAAG,CAAC;CACnD,0BAA0B,KAAK,cAAc,OAAO,GAAG,CAAC;CACrC,QAAA,KAAK,cAAc,OAAO,GAAG,CAAC;AAClD;AAEA,MAAM,aACL,YACA,eAEA,MAAM,OACL,YACA,OAAO,IAAI,aAAa;CACvB,MAAM,UAAU,OAAO;CACvB,MAAM,WAAW,OAAO,OAAO,QAAe;CAC9C,OAAO,OAAO,WAAW,WACxB,YACA,SAWC;EACD,MAAM,eAAe,OAAO,OAC3B,QAAQ,UAAU,QAAQ,SAAS,aAAa,QAAQ,SAEvD,OAAO,IACN,QAAQ,UAAU,QAAQ,MAAM,aAAa,aAAa,IACzD,UACA,QAAQ,SAAS,WAAW,QAAQ,MAAM,OAAO,MAAM,KACzD,CACF;EACA,IAAI,OAAO,OAAO,YAAY,GAC7B,OAAO,OAAO,OAAO,oBACpB,IAAI,MACH,gBAAgB,QAAQ,MAAM,WAAW,GAAG,QAAQ,SAAS,KAAK,sEACnE,CACD;EAED,MAAM,WAAW,GAAG,QAAQ,MAAM,WAAW,GAAG,QAAQ,SAAS;EAGjE,OAAO,OAAO,QACb,aAAa,QACZ,EAAE,QAAQ,MAAM,MAAM,QAAQ,WAAW;GACzC,IAAI,SAAS,KAAA,GACZ,OAAO,WAAW,OAAO,KACxB,OAAO,SAAS,WACf,OAAO,eAAe,KAAK,MAAM,GAAG,QAAQ,CAC7C,GAIA,OAAO,cACL,UAAUC,OAAoB,KAAK,MAAM,YAEzC,OAAO,oBACN,IAAI,MACH,wBAAwB,SAAS,8BAA8B,MAChE,CACD,CACF,GACA,OAAO,SAAS,UACf,QAAQ,MAAM;IAAE;IAAQ,UAAU;GAAM,CAAU,CACnD,CACD;GAED,MAAM,SACL,WAAW,KAAA,IACR,OAAO,QAAQ;IAAE;IAAQ;GAAK,CAAU,IACxC,OAAO,IACP,WAAW,SACV,YACC;IAAE;IAAQ;IAAM,QAAQ,OAAO,MAAM;GAAE,EAC1C;GACH,IAAI,SAAS,KAAA,GACZ,OAAO,OAAO,QAAQ,SAAS,UAAU,QAAQ,MAAM,KAAK,CAAC;GAK9D,OAAO,KAAK,WACT,OAAO,KACP,OAAO,SAAS,UAAU,QAAQ,SAAS,KAAK,CAAC,GACjD,OAAO,cACL,YACC,QAAsC,SAAS,SAC/C,QAAsC,SAAS,cAEhD,OAAO,KAAA,UAA0B,KAAK;IAAE;IAAQ;GAAK,CAAC,CAAC,CACzD,CACD,IACC,OAAO;EACX,GACA,EAAE,SAAS,KAAK,CACjB;EACA,OAAO,OAAO;CACf,CAAC;AACF,CAAC,CACF;;;;;;;;;;;;;;;AAgBD,MAAa,QAYT"}

package/dist/Limits.d.ts

@@ -0,0 +1,114 @@
+import { LimitExceeded as LimitExceeded$1 } from "./internal/limits.js";
+declare namespace Limits_d_exports {
+  export { LimitExceeded, catalogFields, conditionDepth, conditionNodes, fieldPathParts, jsonNodes, patternParts, policyDepth, policyNodes, residualNodes, searchFields, searchSteps };
+}
+/**
+ * The most parts of a field path, as in `settings.model`. The types of the
+ * field paths go to the same depth.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const fieldPathParts: number;
+/**
+ * The most parts of a field pattern, as in `**.secret`.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const patternParts: number;
+/**
+ * The most nodes of one condition. A part that a condition uses in many
+ * places counts for each place.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const conditionNodes: number;
+/**
+ * The most levels of one condition.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const conditionDepth: number;
+/**
+ * The most nodes of one residual condition.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const residualNodes: number;
+/**
+ * The most levels of a policy tree.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const policyDepth: number;
+/**
+ * The most nodes of a policy tree, with its rules and the nodes of their
+ * conditions. A part that the tree uses in many places counts for each place.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const policyNodes: number;
+/**
+ * The most objects and arrays in one input to the Schema of a policy or of a
+ * condition.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const jsonNodes: number;
+/**
+ * The most fields in the catalog of one Schema.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const catalogFields: number;
+/**
+ * The most steps of one search for a value, as in `Policy.coverage`. Past
+ * it, the answer is `Unknown`.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const searchSteps: number;
+/**
+ * The most fields that one search for a value may test. Past it, the answer
+ * is `Unknown`.
+ *
+ * @stability stable
+ * @category constants
+ * @since 2.0.0
+ */
+export declare const searchFields: number;
+/**
+ * The error when an input goes past a limit.
+ *
+ * @stability stable
+ * @category errors
+ * @since 2.0.0
+ */
+export declare const LimitExceeded: typeof LimitExceeded$1;
+/**
+ * @stability stable
+ * @category errors
+ * @since 2.0.0
+ */
+export type LimitExceeded = LimitExceeded$1;
+export { Limits_d_exports };
+//# sourceMappingURL=Limits.d.ts.map

package/dist/Limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Limits.d.ts","names":["Limits.LimitExceeded"],"sources":["../src/Limits.ts"],"mappings":";;;;;;;;;;;;qBAoBa;;;;;;;;qBASA;;;;;;;;;qBAUA;;;;;;;;qBASA;;;;;;;;qBASA;;;;;;;;qBASA;;;;;;;;;qBAUA;;;;;;;;;qBAUA;;;;;;;;qBASA;;;;;;;;;qBAUA;;;;;;;;;qBAUA;;;;;;;;qBASA,sBAAsBA;;;;;;YAOvB,gBAAgBA"}

package/dist/Limits.js

@@ -0,0 +1,132 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { LimitExceeded as LimitExceeded$1, catalogFields as catalogFields$1, conditionNodes as conditionNodes$1, jsonNodes as jsonNodes$1, policyNodes as policyNodes$1, residualNodes as residualNodes$1, searchSteps as searchSteps$1 } from "./internal/limits.js";
+// src/Limits.ts
+/**
+* The limits of the library. Each one keeps a walk, a decoder or a search
+* small, so no input can fill the stack or take a very long time. An input
+* past a limit is an error, with one form of message, as in "A condition has
+* 100001 nodes. The most is 100000.". In an `Authorizer`, such an error is
+* never a "yes".
+*
+* @stability stable
+* @since 2.0.0
+*/
+var Limits_exports = /* @__PURE__ */ __exportAll({
+	LimitExceeded: () => LimitExceeded,
+	catalogFields: () => catalogFields,
+	conditionDepth: () => conditionDepth,
+	conditionNodes: () => conditionNodes,
+	fieldPathParts: () => fieldPathParts,
+	jsonNodes: () => jsonNodes,
+	patternParts: () => patternParts,
+	policyDepth: () => policyDepth,
+	policyNodes: () => policyNodes,
+	residualNodes: () => residualNodes,
+	searchFields: () => searchFields,
+	searchSteps: () => searchSteps
+});
+/**
+* The most parts of a field path, as in `settings.model`. The types of the
+* field paths go to the same depth.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const fieldPathParts = 5;
+/**
+* The most parts of a field pattern, as in `**.secret`.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const patternParts = 16;
+/**
+* The most nodes of one condition. A part that a condition uses in many
+* places counts for each place.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const conditionNodes = conditionNodes$1;
+/**
+* The most levels of one condition.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const conditionDepth = 500;
+/**
+* The most nodes of one residual condition.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const residualNodes = residualNodes$1;
+/**
+* The most levels of a policy tree.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const policyDepth = 256;
+/**
+* The most nodes of a policy tree, with its rules and the nodes of their
+* conditions. A part that the tree uses in many places counts for each place.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const policyNodes = policyNodes$1;
+/**
+* The most objects and arrays in one input to the Schema of a policy or of a
+* condition.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const jsonNodes = jsonNodes$1;
+/**
+* The most fields in the catalog of one Schema.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const catalogFields = catalogFields$1;
+/**
+* The most steps of one search for a value, as in `Policy.coverage`. Past
+* it, the answer is `Unknown`.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const searchSteps = searchSteps$1;
+/**
+* The most fields that one search for a value may test. Past it, the answer
+* is `Unknown`.
+*
+* @stability stable
+* @category constants
+* @since 2.0.0
+*/
+const searchFields = 256;
+/**
+* The error when an input goes past a limit.
+*
+* @stability stable
+* @category errors
+* @since 2.0.0
+*/
+const LimitExceeded = LimitExceeded$1;
+export { LimitExceeded, Limits_exports, catalogFields, conditionDepth, conditionNodes, fieldPathParts, jsonNodes, patternParts, policyDepth, policyNodes, residualNodes, searchFields, searchSteps };
+
+//# sourceMappingURL=Limits.js.map

package/dist/Limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Limits.js","names":["Limits.conditionNodes","Limits.residualNodes","Limits.policyNodes","Limits.jsonNodes","Limits.catalogFields","Limits.searchSteps","Limits.LimitExceeded"],"sources":["../src/Limits.ts"],"sourcesContent":["/**\n * The limits of the library. Each one keeps a walk, a decoder or a search\n * small, so no input can fill the stack or take a very long time. An input\n * past a limit is an error, with one form of message, as in \"A condition has\n * 100001 nodes. The most is 100000.\". In an `Authorizer`, such an error is\n * never a \"yes\".\n *\n * @stability stable\n * @since 2.0.0\n */\nimport * as Limits from \"./internal/limits.ts\"\n\n/**\n * The most parts of a field path, as in `settings.model`. The types of the\n * field paths go to the same depth.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const fieldPathParts: number = Limits.fieldPathParts\n\n/**\n * The most parts of a field pattern, as in `**.secret`.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const patternParts: number = Limits.patternParts\n\n/**\n * The most nodes of one condition. A part that a condition uses in many\n * places counts for each place.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const conditionNodes: number = Limits.conditionNodes\n\n/**\n * The most levels of one condition.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const conditionDepth: number = Limits.conditionDepth\n\n/**\n * The most nodes of one residual condition.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const residualNodes: number = Limits.residualNodes\n\n/**\n * The most levels of a policy tree.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const policyDepth: number = Limits.policyDepth\n\n/**\n * The most nodes of a policy tree, with its rules and the nodes of their\n * conditions. A part that the tree uses in many places counts for each place.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const policyNodes: number = Limits.policyNodes\n\n/**\n * The most objects and arrays in one input to the Schema of a policy or of a\n * condition.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const jsonNodes: number = Limits.jsonNodes\n\n/**\n * The most fields in the catalog of one Schema.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const catalogFields: number = Limits.catalogFields\n\n/**\n * The most steps of one search for a value, as in `Policy.coverage`. Past\n * it, the answer is `Unknown`.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const searchSteps: number = Limits.searchSteps\n\n/**\n * The most fields that one search for a value may test. Past it, the answer\n * is `Unknown`.\n *\n * @stability stable\n * @category constants\n * @since 2.0.0\n */\nexport const searchFields: number = Limits.searchFields\n\n/**\n * The error when an input goes past a limit.\n *\n * @stability stable\n * @category errors\n * @since 2.0.0\n */\nexport const LimitExceeded: typeof Limits.LimitExceeded = Limits.LimitExceeded\n\n/**\n * @stability stable\n * @category errors\n * @since 2.0.0\n */\nexport type LimitExceeded = Limits.LimitExceeded\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,iBAAyB;;;;;;;;AAStC,MAAa,eAAuB;;;;;;;;;AAUpC,MAAa,iBAAyBA;;;;;;;;AAStC,MAAa,iBAAyB;;;;;;;;AAStC,MAAa,gBAAwBC;;;;;;;;AASrC,MAAa,cAAsB;;;;;;;;;AAUnC,MAAa,cAAsBC;;;;;;;;;AAUnC,MAAa,YAAoBC;;;;;;;;AASjC,MAAa,gBAAwBC;;;;;;;;;AAUrC,MAAa,cAAsBC;;;;;;;;;AAUnC,MAAa,eAAuB;;;;;;;;AASpC,MAAa,gBAA6CC"}