@nmnmcc/ability 1.0.1 → 2.0.1

package/dist/internal/analysis.js

@@ -0,0 +1,245 @@
+import { Allow, Deny, NotApplicable } from "../Decision.js";
+import { exceeded, residualNodes } from "./limits.js";
+import { toNode } from "./nodes.js";
+import { and, not, or } from "./algebra.js";
+import { kindsIn, satisfiable } from "./search.js";
+import { kindOf } from "./resource.js";
+import { always as always$1, builder, never as never$1, partial } from "../Condition.js";
+import { ruleIssues } from "./bind.js";
+import { descriptorOf } from "./domain.js";
+import { matchesTarget } from "./rule.js";
+import { rulesOf } from "./policy-nodes.js";
+import { nodeOf } from "./policy.js";
+import { decideNode, fitsKind } from "./decide.js";
+import * as Effect from "effect/Effect";
+import * as Data from "effect/Data";
+import * as Arr from "effect/Array";
+// src/internal/analysis.ts
+/**
+* The residual conditions and the coverage of a policy. The types are in
+* `Policy.ts`.
+*/
+const always = always$1;
+const never = never$1;
+const limit = (node) => {
+	if (node.size > 1e4) throw exceeded("A residual condition", "residualNodes", "nodes", node.size, residualNodes);
+	return node;
+};
+const build = {
+	and: (values) => limit(and(values)),
+	or: (values) => limit(or(values)),
+	not: (value) => value.pipe(not, limit)
+};
+const makeCondition = (value, context) => !matchesTarget(value, context) ? never : value.when === void 0 ? always : partial(value.when, context.input);
+const ruleCondition = (value, context) => context.conditions.get(value) ?? makeCondition(value, context);
+/**
+* Gives the conditions for "the first rule that applies is an allow rule" and
+* "the first rule that applies is a deny rule".
+*/
+const firstApplicableResidual = (values, context) => {
+	const { and, not, or } = build;
+	const runs = Arr.isReadonlyArrayNonEmpty(values) ? Arr.groupWith(values, (a, b) => a._tag === b._tag) : [];
+	return Arr.reduceRight(runs, {
+		allow: never,
+		deny: never
+	}, (rest, run) => {
+		const applies = or(Arr.map(run, (value) => ruleCondition(value, context)));
+		return run[0]._tag === "Allow" ? {
+			allow: or([applies, rest.allow]),
+			deny: and([not(applies), rest.deny])
+		} : {
+			allow: and([not(applies), rest.allow]),
+			deny: or([applies, rest.deny])
+		};
+	});
+};
+/**
+* Gives the residual pair of a node. A shared child is worked again for each
+* place. The limits of the nodes and of a residual keep this work small.
+*/
+const residualNode = (node, context) => {
+	const { and, not, or } = build;
+	switch (node._tag) {
+		case "Rules": switch (node.algorithm) {
+			case "denyOverrides": {
+				const deny = or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)));
+				return {
+					allow: and([not(deny), or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)))]),
+					deny
+				};
+			}
+			case "permitOverrides": {
+				const allow = or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)));
+				return {
+					allow,
+					deny: and([not(allow), or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)))])
+				};
+			}
+			case "firstApplicable": return firstApplicableResidual(node.rules, context);
+			case "lastApplicable": return firstApplicableResidual(node.rules.slice().reverse(), context);
+		}
+		case "All": {
+			if (node.policies.length === 0) return {
+				allow: never,
+				deny: never
+			};
+			const pairs = node.policies.map((child) => residualNode(child, context));
+			const deny = or(pairs.map((pair) => pair.deny));
+			return {
+				allow: and([...pairs.map((pair) => pair.allow), not(deny)]),
+				deny
+			};
+		}
+		case "Any": {
+			const pairs = node.policies.map((child) => residualNode(child, context));
+			const allow = or(pairs.map((pair) => pair.allow));
+			return {
+				allow,
+				deny: and([not(allow), or(pairs.map((pair) => pair.deny))])
+			};
+		}
+		case "FirstOf": return Arr.reduceRight(node.policies, {
+			allow: never,
+			deny: never
+		}, (rest, child) => {
+			const pair = residualNode(child, context);
+			return {
+				allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
+				deny: or([pair.deny, and([not(pair.allow), rest.deny])])
+			};
+		});
+		case "Ceiling": {
+			const cap = residualNode(node.cap, context);
+			const inner = residualNode(node.policy, context);
+			return {
+				allow: and([not(cap.deny), inner.allow]),
+				deny: or([cap.deny, inner.deny])
+			};
+		}
+	}
+};
+/** The name of the predicate of a residual condition that runs `decide`. */
+const policyPredicate = "policy";
+/** Tests if a rule that the request may use has a predicate. */
+const usesPredicate = (node, context) => {
+	if (!node.opaque) return false;
+	switch (node._tag) {
+		case "Rules": return node.rules.some((value) => value.when !== void 0 && toNode(value.when).opaque && matchesTarget(value, context));
+		case "All":
+		case "Any":
+		case "FirstOf": return node.policies.some((child) => usesPredicate(child, context));
+		case "Ceiling": return usesPredicate(node.cap, context) || usesPredicate(node.policy, context);
+	}
+};
+/**
+* Makes the scope of a request, with the principal in it. A scope comes from
+* code, so a scope that does not fit the domain is a defect. It is bound as a
+* rule for the kind and the action of the request is.
+*/
+const scopeOf = (request, domain, input) => {
+	if (request.within === void 0) return always;
+	const ast = request.within(builder());
+	if (toNode(ast).opaque) throw new globalThis.Error("A scope can not have a predicate");
+	const issues = ruleIssues(domain, {
+		actions: [request.action],
+		resources: [request.kind],
+		when: ast
+	}, ["within"]);
+	if (issues.length > 0) throw new globalThis.Error(`A scope does not fit the domain: ${issues.map((issue) => issue.issue).join("; ")}`);
+	return partial(ast, input);
+};
+const residualsAny = (policy, request) => scopedResiduals(policy, request);
+const scopedResiduals = (policy, request) => {
+	const descriptor = descriptorOf(policy.domain, request.kind);
+	if (descriptor === void 0 || !fitsKind(descriptor, request)) return {
+		scope: never,
+		allow: never,
+		deny: never,
+		catalog: void 0
+	};
+	const input = {
+		principal: request.principal,
+		path: descriptor.path
+	};
+	const scope = scopeOf(request, policy.domain, input);
+	const and = build.and;
+	const inScope = (pair) => ({
+		scope,
+		allow: and([scope, pair.allow]),
+		deny: and([scope, pair.deny]),
+		catalog: descriptor.catalog
+	});
+	if (scope._tag === "False") return inScope({
+		allow: never,
+		deny: never
+	});
+	const target = {
+		action: request.action,
+		kind: request.kind,
+		field: request.field,
+		input,
+		descriptor
+	};
+	const context = {
+		...target,
+		conditions: new Map(Arr.map(policy.pipe(nodeOf, rulesOf), (value) => [value, makeCondition(value, target)]))
+	};
+	if (!usesPredicate(nodeOf(policy), context)) return inScope(residualNode(nodeOf(policy), context));
+	const decision = (value) => decideNode(nodeOf(policy), {
+		action: request.action,
+		kind: request.kind,
+		field: request.field,
+		input: {
+			value,
+			principal: request.principal,
+			path: descriptor.path
+		},
+		descriptor,
+		trace: void 0
+	}, []);
+	const test = (tag) => builder().predicate(policyPredicate, (value) => kindOf(value) === request.kind ? Effect.map(decision(value), (result) => result._tag === tag) : Effect.succeed(false));
+	return inScope({
+		allow: test("Allow"),
+		deny: test("Deny")
+	});
+};
+/** Gives the condition on resource values for which the policy allows. */
+const residual = (policy, request) => residualsAny(policy, request).allow;
+const coverages = Data.taggedEnum();
+/** Searches for a value of the kind of a scope that makes a condition true. */
+const search = (scoped, ast) => satisfiable(ast, kindsIn(scoped.catalog));
+/** The values in the scope that the policy does not allow. */
+const refusedOf = (scoped) => and([scoped.scope, not(scoped.allow)]);
+const coverageAny = (policy, request) => {
+	const scoped = scopedResiduals(policy, request);
+	const allowed = scoped.allow;
+	const some = search(scoped, allowed);
+	if (some._tag === "Unsatisfiable") return coverages.None({ condition: never });
+	if (some._tag === "Unknown") return coverages.Unknown({
+		condition: allowed,
+		reason: some.reason
+	});
+	const missing = search(scoped, refusedOf(scoped));
+	if (missing._tag === "Unsatisfiable") return coverages.All({ condition: scoped.scope });
+	if (missing._tag === "Unknown") return coverages.Unknown({
+		condition: allowed,
+		reason: missing.reason
+	});
+	return coverages.Some({
+		condition: allowed,
+		allowed: some.example,
+		refused: missing.example
+	});
+};
+/** Decides a request about every value in a scope. */
+const decideKind = (policy, request) => {
+	const scoped = scopedResiduals(policy, request);
+	switch (search(scoped, refusedOf(scoped))._tag) {
+		case "Unknown": return Deny({});
+		case "Unsatisfiable": return search(scoped, scoped.scope)._tag === "Satisfiable" ? Allow({}) : Deny({});
+		case "Satisfiable": return search(scoped, scoped.deny)._tag === "Unsatisfiable" ? NotApplicable : Deny({});
+	}
+};
+export { coverageAny, decideKind, residual, residualsAny };
+
+//# sourceMappingURL=analysis.js.map

package/dist/internal/analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.js","names":["Condition.always","Condition.never","Limits.exceeded","Limits.residualNodes","Algebra.and","Algebra.or","Algebra.not","RuleData.matchesTarget","Condition.partial","Nodes.toNode","Condition.builder","Bind.ruleIssues","DomainData.descriptorOf","PolicyNodes.rulesOf","ResourceData.kindOf","Search.satisfiable","Search.kindsIn","Decision.Deny","Decision.Allow","Decision.NotApplicable"],"sources":["../../src/internal/analysis.ts"],"sourcesContent":["/**\n * The residual conditions and the coverage of a policy. The types are in\n * `Policy.ts`.\n */\n// A policy keeps the error type and the service type of its predicates in the\n// public types. The code below works on the nodes with no types, where they\n// are `unknown`, so the language service check for `unknown` in an Effect is\n// off here.\n// @effect-diagnostics anyUnknownInErrorContext:off\nimport * as Data from \"effect/Data\"\nimport * as Arr from \"effect/Array\"\nimport * as Effect from \"effect/Effect\"\nimport * as Condition from \"../Condition.ts\"\nimport * as Decision from \"../Decision.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Policy from \"../Policy.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport * as Algebra from \"./algebra.ts\"\nimport * as Bind from \"./bind.ts\"\nimport type * as Catalog from \"./catalog.ts\"\nimport { decideNode, fitsKind } from \"./decide.ts\"\nimport * as DomainData from \"./domain.ts\"\nimport * as Limits from \"./limits.ts\"\nimport * as Nodes from \"./nodes.ts\"\nimport * as PolicyNodes from \"./policy-nodes.ts\"\nimport { nodeOf } from \"./policy.ts\"\nimport * as ResourceData from \"./resource.ts\"\nimport * as RuleData from \"./rule.ts\"\nimport * as Search from \"./search.ts\"\n\ntype Any = Policy.Any\n\ntype Ast = Condition.Ast\n\nconst always: Ast = Condition.always\nconst never: Ast = Condition.never\n\n/**\n * Makes conditions for one residual, with no types. Each step makes the\n * condition simple, and it stops the work when the condition has more nodes\n * than `residualNodes`. A policy tree may use a condition of a child two\n * times, in its allow condition and in its deny condition, so a small policy\n * may give a very large condition.\n */\ninterface Build {\n\t// A list goes in as an array, not as arguments: a call may take only so\n\t// many arguments, and a policy may have more rules.\n\treadonly and: (values: ReadonlyArray<Ast>) => Ast\n\treadonly or: (values: ReadonlyArray<Ast>) => Ast\n\treadonly not: (value: Ast) => Ast\n}\n\nconst limit = (node: Nodes.Node): Ast => {\n\tif (node.size > Limits.residualNodes) {\n\t\tthrow Limits.exceeded(\n\t\t\t\"A residual condition\",\n\t\t\t\"residualNodes\",\n\t\t\t\"nodes\",\n\t\t\tnode.size,\n\t\t\tLimits.residualNodes,\n\t\t)\n\t}\n\treturn node\n}\n\nconst build: Build = {\n\tand: (values) => limit(Algebra.and(values as ReadonlyArray<Nodes.Node>)),\n\tor: (values) => limit(Algebra.or(values as ReadonlyArray<Nodes.Node>)),\n\tnot: (value) => (value as Nodes.Node).pipe(Algebra.not, limit),\n}\n\n/** The two residual conditions of a node, with no types. */\ninterface Pair {\n\treadonly allow: Ast\n\treadonly deny: Ast\n}\n\ninterface ResidualContext {\n\treadonly action: string\n\treadonly kind: string\n\treadonly field: string | undefined\n\treadonly input: {\n\t\treadonly principal: object\n\t\treadonly path: Condition.Input[\"path\"]\n\t}\n\t/** The resource of the kind, for the fields that a rule may grant. */\n\treadonly descriptor: Resource.Descriptor\n\t/**\n\t * The condition of each rule, with the principal in it. They are made\n\t * first, from a flat list of the rules, so the walk does not go down the\n\t * levels of the tree and of a condition at once. It is a native map,\n\t * because it must find a rule by the rule itself: two rules with the same\n\t * data are `Equal`.\n\t */\n\treadonly conditions: Map<RuleData.Rule, Ast>\n}\n\nconst makeCondition = (\n\tvalue: RuleData.Rule,\n\tcontext: Omit<ResidualContext, \"conditions\">,\n): Ast =>\n\t!RuleData.matchesTarget(value, context)\n\t\t? never\n\t\t: value.when === undefined\n\t\t\t? always\n\t\t\t: Condition.partial(value.when as Condition.Any, context.input)\n\nconst ruleCondition = (value: RuleData.Rule, context: ResidualContext): Ast =>\n\tcontext.conditions.get(value) ?? makeCondition(value, context)\n\n/**\n * Gives the conditions for \"the first rule that applies is an allow rule\" and\n * \"the first rule that applies is a deny rule\".\n */\nconst firstApplicableResidual = (\n\tvalues: ReadonlyArray<RuleData.Rule>,\n\tcontext: ResidualContext,\n): Pair => {\n\tconst { and, not, or } = build\n\t// The rules go in runs of one tag, from the last run to the first. The\n\t// conditions of a run go into one node at once. With one node for each\n\t// rule, each step would flatten the whole condition again.\n\tconst runs = Arr.isReadonlyArrayNonEmpty(values)\n\t\t? Arr.groupWith(values, (a, b) => a._tag === b._tag)\n\t\t: []\n\treturn Arr.reduceRight(\n\t\truns,\n\t\t{ allow: never, deny: never },\n\t\t(rest: Pair, run): Pair => {\n\t\t\tconst applies = or(Arr.map(run, (value) => ruleCondition(value, context)))\n\t\t\treturn run[0]._tag === \"Allow\"\n\t\t\t\t? {\n\t\t\t\t\t\tallow: or([applies, rest.allow]),\n\t\t\t\t\t\tdeny: and([not(applies), rest.deny]),\n\t\t\t\t\t}\n\t\t\t\t: {\n\t\t\t\t\t\tallow: and([not(applies), rest.allow]),\n\t\t\t\t\t\tdeny: or([applies, rest.deny]),\n\t\t\t\t\t}\n\t\t},\n\t)\n}\n\n/**\n * Gives the residual pair of a node. A shared child is worked again for each\n * place. The limits of the nodes and of a residual keep this work small.\n */\nconst residualNode = (\n\tnode: PolicyNodes.Node,\n\tcontext: ResidualContext,\n): Pair => {\n\tconst { and, not, or } = build\n\tswitch (node._tag) {\n\t\tcase \"Rules\": {\n\t\t\tswitch (node.algorithm) {\n\t\t\t\tcase \"denyOverrides\": {\n\t\t\t\t\tconst deny = or(\n\t\t\t\t\t\tnode.rules\n\t\t\t\t\t\t\t.filter((value) => value._tag === \"Deny\")\n\t\t\t\t\t\t\t.map((value) => ruleCondition(value, context)),\n\t\t\t\t\t)\n\t\t\t\t\tconst allow = and([\n\t\t\t\t\t\tnot(deny),\n\t\t\t\t\t\tor(\n\t\t\t\t\t\t\tnode.rules\n\t\t\t\t\t\t\t\t.filter((value) => value._tag === \"Allow\")\n\t\t\t\t\t\t\t\t.map((value) => ruleCondition(value, context)),\n\t\t\t\t\t\t),\n\t\t\t\t\t])\n\t\t\t\t\treturn { allow, deny }\n\t\t\t\t}\n\t\t\t\tcase \"permitOverrides\": {\n\t\t\t\t\tconst allow = or(\n\t\t\t\t\t\tnode.rules\n\t\t\t\t\t\t\t.filter((value) => value._tag === \"Allow\")\n\t\t\t\t\t\t\t.map((value) => ruleCondition(value, context)),\n\t\t\t\t\t)\n\t\t\t\t\tconst deny = and([\n\t\t\t\t\t\tnot(allow),\n\t\t\t\t\t\tor(\n\t\t\t\t\t\t\tnode.rules\n\t\t\t\t\t\t\t\t.filter((value) => value._tag === \"Deny\")\n\t\t\t\t\t\t\t\t.map((value) => ruleCondition(value, context)),\n\t\t\t\t\t\t),\n\t\t\t\t\t])\n\t\t\t\t\treturn { allow, deny }\n\t\t\t\t}\n\t\t\t\tcase \"firstApplicable\":\n\t\t\t\t\treturn firstApplicableResidual(node.rules, context)\n\t\t\t\tcase \"lastApplicable\":\n\t\t\t\t\treturn firstApplicableResidual(node.rules.slice().reverse(), context)\n\t\t\t}\n\t\t}\n\t\t// falls through: every algorithm returns above\n\t\tcase \"All\": {\n\t\t\tif (node.policies.length === 0) {\n\t\t\t\treturn { allow: never, deny: never }\n\t\t\t}\n\t\t\tconst pairs = node.policies.map((child) => residualNode(child, context))\n\t\t\tconst deny = or(pairs.map((pair) => pair.deny))\n\t\t\tconst allow = and([...pairs.map((pair) => pair.allow), not(deny)])\n\t\t\treturn { allow, deny }\n\t\t}\n\t\tcase \"Any\": {\n\t\t\tconst pairs = node.policies.map((child) => residualNode(child, context))\n\t\t\tconst allow = or(pairs.map((pair) => pair.allow))\n\t\t\tconst deny = and([not(allow), or(pairs.map((pair) => pair.deny))])\n\t\t\treturn { allow, deny }\n\t\t}\n\t\tcase \"FirstOf\": {\n\t\t\t// The first child that gives an answer wins.\n\t\t\treturn Arr.reduceRight(\n\t\t\t\tnode.policies,\n\t\t\t\t{ allow: never, deny: never },\n\t\t\t\t(rest: Pair, child): Pair => {\n\t\t\t\t\tconst pair = residualNode(child, context)\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallow: or([pair.allow, and([not(pair.deny), rest.allow])]),\n\t\t\t\t\t\tdeny: or([pair.deny, and([not(pair.allow), rest.deny])]),\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t)\n\t\t}\n\t\tcase \"Ceiling\": {\n\t\t\tconst cap = residualNode(node.cap, context)\n\t\t\tconst inner = residualNode(node.policy, context)\n\t\t\treturn {\n\t\t\t\tallow: and([not(cap.deny), inner.allow]),\n\t\t\t\tdeny: or([cap.deny, inner.deny]),\n\t\t\t}\n\t\t}\n\t}\n}\n\n/** The name of the predicate of a residual condition that runs `decide`. */\nconst policyPredicate = \"policy\"\n\n/** What {@link usesPredicate} needs: the request. */\ninterface PredicateContext {\n\treadonly action: string\n\treadonly kind: string\n\treadonly field: string | undefined\n\treadonly descriptor: Resource.Descriptor\n}\n\n/** Tests if a rule that the request may use has a predicate. */\nconst usesPredicate = (\n\tnode: PolicyNodes.Node,\n\tcontext: PredicateContext,\n): boolean => {\n\tif (!node.opaque) {\n\t\treturn false\n\t}\n\tswitch (node._tag) {\n\t\tcase \"Rules\":\n\t\t\treturn node.rules.some(\n\t\t\t\t(value) =>\n\t\t\t\t\tvalue.when !== undefined &&\n\t\t\t\t\tNodes.toNode(value.when).opaque &&\n\t\t\t\t\tRuleData.matchesTarget(value, context),\n\t\t\t)\n\t\tcase \"All\":\n\t\tcase \"Any\":\n\t\tcase \"FirstOf\":\n\t\t\treturn node.policies.some((child) => usesPredicate(child, context))\n\t\tcase \"Ceiling\":\n\t\t\treturn (\n\t\t\t\tusesPredicate(node.cap, context) || usesPredicate(node.policy, context)\n\t\t\t)\n\t}\n}\n\n/**\n * Makes the scope of a request, with the principal in it. A scope comes from\n * code, so a scope that does not fit the domain is a defect. It is bound as a\n * rule for the kind and the action of the request is.\n */\nconst scopeOf = (\n\trequest: ScopedRequest,\n\tdomain: Domain.Any,\n\tinput: ResidualContext[\"input\"],\n): Ast => {\n\tif (request.within === undefined) {\n\t\treturn always\n\t}\n\t// The builder stops a value that a condition can not hold, such as\n\t// `undefined` from a route parameter. A predicate could make a check pass\n\t// on the wrong values, so a scope with one is a defect too.\n\tconst ast = (request.within as (builder: unknown) => Ast)(Condition.builder())\n\tif (Nodes.toNode(ast).opaque) {\n\t\tthrow new globalThis.Error(\"A scope can not have a predicate\")\n\t}\n\tconst issues = Bind.ruleIssues(\n\t\tdomain,\n\t\t{ actions: [request.action], resources: [request.kind], when: ast },\n\t\t[\"within\"],\n\t)\n\tif (issues.length > 0) {\n\t\tthrow new globalThis.Error(\n\t\t\t`A scope does not fit the domain: ${issues.map((issue) => issue.issue).join(\"; \")}`,\n\t\t)\n\t}\n\treturn Condition.partial(ast as Condition.Condition, input)\n}\n\n/** A request about a kind with no types, with the scope of a target. */\nexport interface ScopedRequest {\n\treadonly principal: object\n\treadonly action: string\n\treadonly kind: string\n\treadonly field?: string | undefined\n\treadonly within?: unknown\n}\n\n/** The scope of a request, and the residual conditions inside it. */\ninterface Scoped extends Pair {\n\treadonly scope: Ast\n\t/** The catalog of the kind, when the request fits the kind. */\n\treadonly catalog: Catalog.Catalog | undefined\n}\n\nexport const residualsAny = (policy: Any, request: ScopedRequest): Pair =>\n\tscopedResiduals(policy, request)\n\nconst scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {\n\tconst descriptor = DomainData.descriptorOf(policy.domain, request.kind)\n\tif (descriptor === undefined || !fitsKind(descriptor, request)) {\n\t\treturn { scope: never, allow: never, deny: never, catalog: undefined }\n\t}\n\tconst input = { principal: request.principal, path: descriptor.path }\n\tconst scope = scopeOf(request, policy.domain, input)\n\tconst and = build.and\n\tconst inScope = (pair: Pair): Scoped => ({\n\t\tscope,\n\t\tallow: and([scope, pair.allow]),\n\t\tdeny: and([scope, pair.deny]),\n\t\tcatalog: descriptor.catalog,\n\t})\n\tif (scope._tag === \"False\") {\n\t\treturn inScope({ allow: never, deny: never })\n\t}\n\tconst target = {\n\t\taction: request.action,\n\t\tkind: request.kind,\n\t\tfield: request.field,\n\t\tinput,\n\t\tdescriptor,\n\t}\n\tconst context: ResidualContext = {\n\t\t...target,\n\t\tconditions: new Map(\n\t\t\tArr.map(policy.pipe(nodeOf, PolicyNodes.rulesOf), (value) => [\n\t\t\t\tvalue,\n\t\t\t\tmakeCondition(value, target),\n\t\t\t]),\n\t\t),\n\t}\n\t// The type of the residual of a plain policy says that it has no\n\t// predicate, so it can not be the predicate below. A residual past the\n\t// limit is a defect.\n\tif (!usesPredicate(nodeOf(policy), context)) {\n\t\treturn inScope(residualNode(nodeOf(policy), context))\n\t}\n\t// A predicate may fail, and it may give another answer each time it runs.\n\t// A tree of `And` and `Or` nodes can not run the predicates in the same\n\t// order and the same number of times as `decide`. So the residual is one\n\t// predicate that runs `decide` for each value.\n\tconst decision = (value: object) =>\n\t\tdecideNode(\n\t\t\tnodeOf(policy),\n\t\t\t{\n\t\t\t\taction: request.action,\n\t\t\t\tkind: request.kind,\n\t\t\t\tfield: request.field,\n\t\t\t\tinput: {\n\t\t\t\t\tvalue,\n\t\t\t\t\tprincipal: request.principal,\n\t\t\t\t\tpath: descriptor.path,\n\t\t\t\t},\n\t\t\t\tdescriptor,\n\t\t\t\ttrace: undefined,\n\t\t\t},\n\t\t\t[],\n\t\t)\n\t// A value of another kind is not a value that the residual is about, so\n\t// the rules of this kind must not run on it.\n\tconst test = (tag: Decision.Decision[\"_tag\"]): Ast =>\n\t\tCondition.builder<any, any, any>().predicate(policyPredicate, (value) =>\n\t\t\tResourceData.kindOf(value) === request.kind\n\t\t\t\t? Effect.map(decision(value), (result) => result._tag === tag)\n\t\t\t\t: Effect.succeed(false),\n\t\t)\n\t// The scope comes first in each `And`, so the policy runs only on values\n\t// in the scope.\n\treturn inScope({ allow: test(\"Allow\"), deny: test(\"Deny\") })\n}\n\n/** Gives the condition on resource values for which the policy allows. */\nexport const residual = (policy: Any, request: ScopedRequest): Ast =>\n\tresidualsAny(policy, request).allow\n\n/** A {@link Policy.Coverage} with no types. */\nexport type AnyCoverage = Data.TaggedEnum<{\n\tAll: { readonly condition: Ast }\n\tNone: { readonly condition: Ast }\n\tSome: {\n\t\treadonly condition: Ast\n\t\treadonly allowed: Condition.Example\n\t\treadonly refused: Condition.Example\n\t}\n\tUnknown: {\n\t\treadonly condition: Ast\n\t\treadonly reason: \"predicate\" | \"budget\"\n\t}\n}>\n\nconst coverages = Data.taggedEnum<AnyCoverage>()\n\n/** Searches for a value of the kind of a scope that makes a condition true. */\nconst search = (scoped: Scoped, ast: Ast): Condition.Satisfiability =>\n\tSearch.satisfiable(ast as Nodes.Node, Search.kindsIn(scoped.catalog))\n\n/** The values in the scope that the policy does not allow. */\nconst refusedOf = (scoped: Scoped): Ast =>\n\t// Only two nodes more than the residual, so it needs no size limit.\n\tAlgebra.and([\n\t\tscoped.scope as Nodes.Node,\n\t\tAlgebra.not(scoped.allow as Nodes.Node),\n\t])\n\nexport const coverageAny = (\n\tpolicy: Any,\n\trequest: ScopedRequest,\n): AnyCoverage => {\n\tconst scoped = scopedResiduals(policy, request)\n\tconst allowed = scoped.allow\n\tconst some = search(scoped, allowed)\n\tif (some._tag === \"Unsatisfiable\") {\n\t\treturn coverages.None({ condition: never })\n\t}\n\tif (some._tag === \"Unknown\") {\n\t\treturn coverages.Unknown({ condition: allowed, reason: some.reason })\n\t}\n\tconst missing = search(scoped, refusedOf(scoped))\n\tif (missing._tag === \"Unsatisfiable\") {\n\t\treturn coverages.All({ condition: scoped.scope })\n\t}\n\tif (missing._tag === \"Unknown\") {\n\t\treturn coverages.Unknown({ condition: allowed, reason: missing.reason })\n\t}\n\treturn coverages.Some({\n\t\tcondition: allowed,\n\t\tallowed: some.example,\n\t\trefused: missing.example,\n\t})\n}\n\n/** Decides a request about every value in a scope. */\nexport const decideKind = (\n\tpolicy: Any,\n\trequest: ScopedRequest,\n): Decision.Decision => {\n\tconst scoped = scopedResiduals(policy, request)\n\tconst missing = search(scoped, refusedOf(scoped))\n\tswitch (missing._tag) {\n\t\tcase \"Unknown\":\n\t\t\treturn Decision.Deny({})\n\t\tcase \"Unsatisfiable\":\n\t\t\treturn search(scoped, scoped.scope)._tag === \"Satisfiable\"\n\t\t\t\t? Decision.Allow({})\n\t\t\t\t: Decision.Deny({})\n\t\tcase \"Satisfiable\":\n\t\t\t// A refused value is in the scope, so the scope has a value.\n\t\t\treturn search(scoped, scoped.deny)._tag === \"Unsatisfiable\"\n\t\t\t\t? Decision.NotApplicable\n\t\t\t\t: Decision.Deny({})\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,SAAcA;AACpB,MAAM,QAAaC;AAiBnB,MAAM,SAAS,SAA0B;CACxC,IAAI,KAAK,OAAO,KACf,MAAMC,SACL,wBACA,iBACA,SACA,KAAK,MACLC,aACD;CAED,OAAO;AACR;AAEA,MAAM,QAAe;CACpB,MAAM,WAAW,MAAMC,IAAY,MAAmC,CAAC;CACvE,KAAK,WAAW,MAAMC,GAAW,MAAmC,CAAC;CACrE,MAAM,UAAW,MAAqB,KAAKC,KAAa,KAAK;AAC9D;AA4BA,MAAM,iBACL,OACA,YAEA,CAACC,cAAuB,OAAO,OAAO,IACnC,QACA,MAAM,SAAS,KAAA,IACd,SACAC,QAAkB,MAAM,MAAuB,QAAQ,KAAK;AAEjE,MAAM,iBAAiB,OAAsB,YAC5C,QAAQ,WAAW,IAAI,KAAK,KAAK,cAAc,OAAO,OAAO;;;;;AAM9D,MAAM,2BACL,QACA,YACU;CACV,MAAM,EAAE,KAAK,KAAK,OAAO;CAIzB,MAAM,OAAO,IAAI,wBAAwB,MAAM,IAC5C,IAAI,UAAU,SAAS,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IACjD,CAAC;CACJ,OAAO,IAAI,YACV,MACA;EAAE,OAAO;EAAO,MAAM;CAAM,IAC3B,MAAY,QAAc;EAC1B,MAAM,UAAU,GAAG,IAAI,IAAI,MAAM,UAAU,cAAc,OAAO,OAAO,CAAC,CAAC;EACzE,OAAO,IAAI,EAAE,CAAC,SAAS,UACpB;GACA,OAAO,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC;GAC/B,MAAM,IAAI,CAAC,IAAI,OAAO,GAAG,KAAK,IAAI,CAAC;EACpC,IACC;GACA,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,KAAK,KAAK,CAAC;GACrC,MAAM,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC;EAC9B;CACH,CACD;AACD;;;;;AAMA,MAAM,gBACL,MACA,YACU;CACV,MAAM,EAAE,KAAK,KAAK,OAAO;CACzB,QAAQ,KAAK,MAAb;EACC,KAAK,SACJ,QAAQ,KAAK,WAAb;GACC,KAAK,iBAAiB;IACrB,MAAM,OAAO,GACZ,KAAK,MACH,QAAQ,UAAU,MAAM,SAAS,MAAM,CAAC,CACxC,KAAK,UAAU,cAAc,OAAO,OAAO,CAAC,CAC/C;IASA,OAAO;KAAE,OARK,IAAI,CACjB,IAAI,IAAI,GACR,GACC,KAAK,MACH,QAAQ,UAAU,MAAM,SAAS,OAAO,CAAC,CACzC,KAAK,UAAU,cAAc,OAAO,OAAO,CAAC,CAC/C,CACD,CACa;KAAG;IAAK;GACtB;GACA,KAAK,mBAAmB;IACvB,MAAM,QAAQ,GACb,KAAK,MACH,QAAQ,UAAU,MAAM,SAAS,OAAO,CAAC,CACzC,KAAK,UAAU,cAAc,OAAO,OAAO,CAAC,CAC/C;IASA,OAAO;KAAE;KAAO,MARH,IAAI,CAChB,IAAI,KAAK,GACT,GACC,KAAK,MACH,QAAQ,UAAU,MAAM,SAAS,MAAM,CAAC,CACxC,KAAK,UAAU,cAAc,OAAO,OAAO,CAAC,CAC/C,CACD,CACmB;IAAE;GACtB;GACA,KAAK,mBACJ,OAAO,wBAAwB,KAAK,OAAO,OAAO;GACnD,KAAK,kBACJ,OAAO,wBAAwB,KAAK,MAAM,MAAM,CAAC,CAAC,QAAQ,GAAG,OAAO;EACtE;EAGD,KAAK,OAAO;GACX,IAAI,KAAK,SAAS,WAAW,GAC5B,OAAO;IAAE,OAAO;IAAO,MAAM;GAAM;GAEpC,MAAM,QAAQ,KAAK,SAAS,KAAK,UAAU,aAAa,OAAO,OAAO,CAAC;GACvE,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;GAE9C,OAAO;IAAE,OADK,IAAI,CAAC,GAAG,MAAM,KAAK,SAAS,KAAK,KAAK,GAAG,IAAI,IAAI,CAAC,CACnD;IAAG;GAAK;EACtB;EACA,KAAK,OAAO;GACX,MAAM,QAAQ,KAAK,SAAS,KAAK,UAAU,aAAa,OAAO,OAAO,CAAC;GACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC;GAEhD,OAAO;IAAE;IAAO,MADH,IAAI,CAAC,IAAI,KAAK,GAAG,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,CAAC,CAC7C;GAAE;EACtB;EACA,KAAK,WAEJ,OAAO,IAAI,YACV,KAAK,UACL;GAAE,OAAO;GAAO,MAAM;EAAM,IAC3B,MAAY,UAAgB;GAC5B,MAAM,OAAO,aAAa,OAAO,OAAO;GACxC,OAAO;IACN,OAAO,GAAG,CAAC,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC;GACxD;EACD,CACD;EAED,KAAK,WAAW;GACf,MAAM,MAAM,aAAa,KAAK,KAAK,OAAO;GAC1C,MAAM,QAAQ,aAAa,KAAK,QAAQ,OAAO;GAC/C,OAAO;IACN,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,KAAK,CAAC;IACvC,MAAM,GAAG,CAAC,IAAI,MAAM,MAAM,IAAI,CAAC;GAChC;EACD;CACD;AACD;;AAGA,MAAM,kBAAkB;;AAWxB,MAAM,iBACL,MACA,YACa;CACb,IAAI,CAAC,KAAK,QACT,OAAO;CAER,QAAQ,KAAK,MAAb;EACC,KAAK,SACJ,OAAO,KAAK,MAAM,MAChB,UACA,MAAM,SAAS,KAAA,KACfC,OAAa,MAAM,IAAI,CAAC,CAAC,UACzBF,cAAuB,OAAO,OAAO,CACvC;EACD,KAAK;EACL,KAAK;EACL,KAAK,WACJ,OAAO,KAAK,SAAS,MAAM,UAAU,cAAc,OAAO,OAAO,CAAC;EACnE,KAAK,WACJ,OACC,cAAc,KAAK,KAAK,OAAO,KAAK,cAAc,KAAK,QAAQ,OAAO;CAEzE;AACD;;;;;;AAOA,MAAM,WACL,SACA,QACA,UACS;CACT,IAAI,QAAQ,WAAW,KAAA,GACtB,OAAO;CAKR,MAAM,MAAO,QAAQ,OAAqCG,QAAkB,CAAC;CAC7E,IAAID,OAAa,GAAG,CAAC,CAAC,QACrB,MAAM,IAAI,WAAW,MAAM,kCAAkC;CAE9D,MAAM,SAASE,WACd,QACA;EAAE,SAAS,CAAC,QAAQ,MAAM;EAAG,WAAW,CAAC,QAAQ,IAAI;EAAG,MAAM;CAAI,GAClE,CAAC,QAAQ,CACV;CACA,IAAI,OAAO,SAAS,GACnB,MAAM,IAAI,WAAW,MACpB,oCAAoC,OAAO,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,KAAK,IAAI,GACjF;CAED,OAAOH,QAAkB,KAA4B,KAAK;AAC3D;AAkBA,MAAa,gBAAgB,QAAa,YACzC,gBAAgB,QAAQ,OAAO;AAEhC,MAAM,mBAAmB,QAAa,YAAmC;CACxE,MAAM,aAAaI,aAAwB,OAAO,QAAQ,QAAQ,IAAI;CACtE,IAAI,eAAe,KAAA,KAAa,CAAC,SAAS,YAAY,OAAO,GAC5D,OAAO;EAAE,OAAO;EAAO,OAAO;EAAO,MAAM;EAAO,SAAS,KAAA;CAAU;CAEtE,MAAM,QAAQ;EAAE,WAAW,QAAQ;EAAW,MAAM,WAAW;CAAK;CACpE,MAAM,QAAQ,QAAQ,SAAS,OAAO,QAAQ,KAAK;CACnD,MAAM,MAAM,MAAM;CAClB,MAAM,WAAW,UAAwB;EACxC;EACA,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;EAC9B,MAAM,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;EAC5B,SAAS,WAAW;CACrB;CACA,IAAI,MAAM,SAAS,SAClB,OAAO,QAAQ;EAAE,OAAO;EAAO,MAAM;CAAM,CAAC;CAE7C,MAAM,SAAS;EACd,QAAQ,QAAQ;EAChB,MAAM,QAAQ;EACd,OAAO,QAAQ;EACf;EACA;CACD;CACA,MAAM,UAA2B;EAChC,GAAG;EACH,YAAY,IAAI,IACf,IAAI,IAAI,OAAO,KAAK,QAAQC,OAAmB,IAAI,UAAU,CAC5D,OACA,cAAc,OAAO,MAAM,CAC5B,CAAC,CACF;CACD;CAIA,IAAI,CAAC,cAAc,OAAO,MAAM,GAAG,OAAO,GACzC,OAAO,QAAQ,aAAa,OAAO,MAAM,GAAG,OAAO,CAAC;CAMrD,MAAM,YAAY,UACjB,WACC,OAAO,MAAM,GACb;EACC,QAAQ,QAAQ;EAChB,MAAM,QAAQ;EACd,OAAO,QAAQ;EACf,OAAO;GACN;GACA,WAAW,QAAQ;GACnB,MAAM,WAAW;EAClB;EACA;EACA,OAAO,KAAA;CACR,GACA,CAAC,CACF;CAGD,MAAM,QAAQ,QACbH,QAAiC,CAAC,CAAC,UAAU,kBAAkB,UAC9DI,OAAoB,KAAK,MAAM,QAAQ,OACpC,OAAO,IAAI,SAAS,KAAK,IAAI,WAAW,OAAO,SAAS,GAAG,IAC3D,OAAO,QAAQ,KAAK,CACxB;CAGD,OAAO,QAAQ;EAAE,OAAO,KAAK,OAAO;EAAG,MAAM,KAAK,MAAM;CAAE,CAAC;AAC5D;;AAGA,MAAa,YAAY,QAAa,YACrC,aAAa,QAAQ,OAAO,CAAC,CAAC;AAiB/B,MAAM,YAAY,KAAK,WAAwB;;AAG/C,MAAM,UAAU,QAAgB,QAC/BC,YAAmB,KAAmBC,QAAe,OAAO,OAAO,CAAC;;AAGrE,MAAM,aAAa,WAElBZ,IAAY,CACX,OAAO,OACPE,IAAY,OAAO,KAAmB,CACvC,CAAC;AAEF,MAAa,eACZ,QACA,YACiB;CACjB,MAAM,SAAS,gBAAgB,QAAQ,OAAO;CAC9C,MAAM,UAAU,OAAO;CACvB,MAAM,OAAO,OAAO,QAAQ,OAAO;CACnC,IAAI,KAAK,SAAS,iBACjB,OAAO,UAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CAE3C,IAAI,KAAK,SAAS,WACjB,OAAO,UAAU,QAAQ;EAAE,WAAW;EAAS,QAAQ,KAAK;CAAO,CAAC;CAErE,MAAM,UAAU,OAAO,QAAQ,UAAU,MAAM,CAAC;CAChD,IAAI,QAAQ,SAAS,iBACpB,OAAO,UAAU,IAAI,EAAE,WAAW,OAAO,MAAM,CAAC;CAEjD,IAAI,QAAQ,SAAS,WACpB,OAAO,UAAU,QAAQ;EAAE,WAAW;EAAS,QAAQ,QAAQ;CAAO,CAAC;CAExE,OAAO,UAAU,KAAK;EACrB,WAAW;EACX,SAAS,KAAK;EACd,SAAS,QAAQ;CAClB,CAAC;AACF;;AAGA,MAAa,cACZ,QACA,YACuB;CACvB,MAAM,SAAS,gBAAgB,QAAQ,OAAO;CAE9C,QADgB,OAAO,QAAQ,UAAU,MAAM,CACjC,CAAC,CAAC,MAAhB;EACC,KAAK,WACJ,OAAOW,KAAc,CAAC,CAAC;EACxB,KAAK,iBACJ,OAAO,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,SAAS,gBAC1CC,MAAe,CAAC,CAAC,IACjBD,KAAc,CAAC,CAAC;EACpB,KAAK,eAEJ,OAAO,OAAO,QAAQ,OAAO,IAAI,CAAC,CAAC,SAAS,kBACzCE,gBACAF,KAAc,CAAC,CAAC;CACrB;AACD"}

package/dist/internal/authorizer.d.ts

@@ -0,0 +1,30 @@
+import "../Domain.js";
+import "../Policy.js";
+import "../Decision.js";
+import "../Authorizer.js";
+import "effect/Context";
+import "effect/Effect";
+import "effect/Layer";
+import * as Schema from "effect/Schema";
+import "effect/Duration";
+declare const Forbidden_base: Schema.Class<Forbidden, Schema.TaggedStruct<"Forbidden", {
+  readonly action: Schema.String;
+  readonly kind: Schema.String;
+  readonly field: Schema.optionalKey<Schema.String>;
+  readonly reason: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/** The error when a policy says no. */
+export declare class Forbidden extends Forbidden_base {}
+declare const PolicyUnavailable_base: Schema.Class<PolicyUnavailable, Schema.TaggedStruct<"PolicyUnavailable", {
+  readonly cause: Schema.Defect;
+}>, import("effect/Cause").YieldableError>;
+/** The error when the policy of the principal can not be loaded. */
+export declare class PolicyUnavailable extends PolicyUnavailable_base {}
+declare const Pending_base: Schema.Class<Pending, Schema.TaggedStruct<"Pending", {
+  readonly ticket: Schema.String;
+  readonly reason: Schema.optionalKey<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/** The error when a decider must wait for an answer. */
+export declare class Pending extends Pending_base {}
+export {};
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/internal/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","names":[],"sources":["../../src/internal/authorizer.ts"],"mappings":";;;;;;;;;;;;;;;;qBA+Ba,kBAAkB;;;;;qBAUlB,0BAA0B;;;;;;qBAK1B,gBAAgB"}

package/dist/internal/authorizer.js

@@ -0,0 +1,221 @@
+import { reason } from "../Decision.js";
+import { kindOf } from "./resource.js";
+import { descriptorOf } from "./domain.js";
+import { provideContext } from "./policy.js";
+import { decideAny, fitsKind, permittedFields } from "./decide.js";
+import { coverageAny, decideKind } from "./analysis.js";
+import * as Cache from "effect/Cache";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Equal from "effect/Equal";
+import * as Hash from "effect/Hash";
+import * as Layer from "effect/Layer";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+// src/internal/authorizer.ts
+/**
+* The values of authorizers: the errors, the service class and the layer.
+* The types are in `Authorizer.ts`.
+*/
+/** The error when a policy says no. */
+var Forbidden = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/Forbidden")("Forbidden", {
+	action: Schema.String,
+	kind: Schema.String,
+	field: Schema.optionalKey(Schema.String),
+	reason: Schema.optionalKey(Schema.String)
+}) {};
+/** The error when the policy of the principal can not be loaded. */
+var PolicyUnavailable = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/PolicyUnavailable")("PolicyUnavailable", { cause: Schema.Defect() }) {};
+/** The error when a decider must wait for an answer. */
+var Pending = class extends Schema.TaggedError("@nmnmcc/ability/Authorizer/Pending")("Pending", {
+	ticket: Schema.String,
+	reason: Schema.optionalKey(Schema.String)
+}) {};
+/** Makes an authorizer service class for a domain. */
+const Service = () => (id, options) => {
+	const Base = Context.Service()(id);
+	return class extends Base {
+		static domain = options.domain;
+		static principal = options.principal;
+		static decide = (target) => this.use((service) => service.decide(target));
+		static check = (target) => this.use((service) => service.check(target));
+		static guard = (target, options) => this.use((service) => service.guard(target, options));
+		static filter = (target) => this.use((service) => service.filter(target));
+		static coverage = (target) => this.use((service) => service.coverage(target));
+		static permittedFields = (target) => this.use((service) => service.permittedFields(target));
+	};
+};
+/**
+* A cache key for a principal. Two keys are equal when they have the same
+* text, so two principals with the same key share one policy. The key also
+* keeps the principal, so the cache can load its policy. A plain `Data` value
+* can not do both, so the key gives its own equality with `Equal.Equal`.
+*/
+var PrincipalKey = class PrincipalKey {
+	principal;
+	text;
+	constructor(principal, text) {
+		this.principal = principal;
+		this.text = text;
+	}
+	[Equal.symbol](that) {
+		return that instanceof PrincipalKey && that.text === this.text;
+	}
+	[Hash.symbol]() {
+		return Hash.string(this.text);
+	}
+};
+/**
+* Makes the cache key of a principal from its JSON form. The key keeps the
+* principal that the Schema decodes from that form, so the loader sees only
+* the data that the key shows. A principal gets no key when it does not
+* encode, or when the decoded value is not `Equal` to it. Two classes, or a
+* string and a number, may have one JSON form, as in a union, and `Equal`
+* tells them apart. So two principals with one key are equal, and the cache
+* can not give one the policy of the other.
+*/
+/**
+* Gives the JSON codec of a Schema, or `undefined` when the Schema has no JSON
+* form, as a struct with a symbol key has none.
+*/
+const jsonCodecOf = (schema) => {
+	try {
+		return Schema.toCodecJson(schema);
+	} catch {
+		return;
+	}
+};
+const jsonKey = (schema) => {
+	const codec = jsonCodecOf(schema);
+	if (codec === void 0) return () => void 0;
+	const encode = Schema.encodeUnknownResult(codec);
+	const decode = Schema.decodeUnknownResult(codec);
+	const keyOf = (principal) => Result.match(encode(principal), {
+		onFailure: () => void 0,
+		onSuccess: (json) => {
+			const text = JSON.stringify(json);
+			return Result.match(decode(JSON.parse(text)), {
+				onFailure: () => void 0,
+				onSuccess: (decoded) => Equal.equals(decoded, principal) ? new PrincipalKey(decoded, text) : void 0
+			});
+		}
+	});
+	return (principal) => {
+		try {
+			return keyOf(principal);
+		} catch {
+			return;
+		}
+	};
+};
+const forbidden = (target, kind, reason) => Forbidden.make({
+	action: target.action,
+	kind,
+	...target.field === void 0 ? {} : { field: target.field },
+	...reason === void 0 ? {} : { reason }
+});
+/** Makes the layer of an authorizer. */
+const makeLayer = (service, options) => {
+	const domain = service.domain;
+	const canonicalOf = jsonKey(domain.principal);
+	const custom = options.cache === false ? void 0 : options.cache?.key;
+	const keyOf = (principal, canonical) => {
+		if (custom === void 0) return canonical;
+		const text = custom(principal);
+		return text === void 0 ? void 0 : new PrincipalKey(canonical?.principal ?? principal, text);
+	};
+	return Layer.effect(service, Effect.gen(function* () {
+		const services = yield* Effect.context();
+		const load = (principal) => options.policy(principal).pipe(Effect.provideContext(services), Effect.filterOrFail((value) => value.domain === domain, () => new globalThis.Error("The loaded policy is not a policy of this domain")), Effect.mapError((cause) => PolicyUnavailable.make({ cause })), Effect.map((value) => provideContext(value, services)));
+		const cache = options.cache === false ? void 0 : yield* Cache.make({
+			capacity: options.cache?.capacity ?? 1e3,
+			timeToLive: options.cache?.timeToLive ?? "30 seconds",
+			lookup: (key) => load(key.principal)
+		});
+		const policyFor = (principal) => {
+			const canonical = canonicalOf(principal);
+			const key = cache === void 0 ? void 0 : keyOf(principal, canonical);
+			if (cache === void 0 || key === void 0) return load(canonical?.principal ?? principal);
+			return Cache.get(cache, key).pipe(Effect.tapError(() => Cache.invalidate(cache, key)));
+		};
+		const withServices = (effect) => Effect.provideContext(effect, services);
+		const current = Effect.gen(function* () {
+			const principal = yield* service.principal;
+			return {
+				principal,
+				policy: yield* policyFor(principal)
+			};
+		});
+		const decideWith = Effect.fnUntraced(function* ({ principal, policy: value }, target) {
+			return yield* withServices(decideAny(value, {
+				...target,
+				principal
+			}));
+		});
+		const decide = (target) => Effect.flatMap(current, (snapshot) => decideWith(snapshot, target));
+		const checkWith = Effect.fnUntraced(function* ({ principal, policy: value }, target) {
+			const kind = target.resource === void 0 ? target.kind ?? "" : kindOf(target.resource) ?? "";
+			const descriptor = descriptorOf(domain, kind);
+			if (descriptor === void 0 || !fitsKind(descriptor, target)) return yield* forbidden(target, kind, void 0);
+			const fromPolicy = target.resource === void 0 ? decideKind(value, {
+				...target,
+				principal
+			}) : yield* withServices(decideAny(value, {
+				...target,
+				principal
+			}));
+			const decision = fromPolicy._tag === "NotApplicable" && options.decider !== void 0 ? yield* options.decider({
+				...target,
+				principal
+			}) : fromPolicy;
+			if (decision._tag !== "Allow") return yield* forbidden(target, kind, reason(decision));
+		});
+		const check = (target) => Effect.flatMap(current, (snapshot) => checkWith(snapshot, target));
+		const guard = Effect.fnUntraced(function* (target, guardOptions) {
+			const snapshot = yield* current;
+			const read = guardOptions.read ?? "read";
+			const { field: _field, ...rest } = target;
+			if ((yield* decideWith(snapshot, {
+				...rest,
+				action: read
+			}))._tag !== "Allow") return yield* Effect.fail(guardOptions.hide());
+			if (target.action !== read || target.field !== void 0) yield* checkWith(snapshot, target);
+		});
+		const filter = (target) => Effect.map(current, ({ principal, policy: value }) => coverageAny(value, {
+			...target,
+			principal
+		}).condition);
+		const coverage = (target) => Effect.map(current, ({ principal, policy: value }) => coverageAny(value, {
+			...target,
+			principal
+		}));
+		const permittedFields$1 = Effect.fnUntraced(function* (target) {
+			const { principal, policy: value } = yield* current;
+			return yield* withServices(permittedFields(value, {
+				...target,
+				principal
+			}));
+		});
+		const invalidate = (principal) => {
+			if (cache === void 0) return Effect.void;
+			if (principal === void 0) return Cache.invalidateAll(cache);
+			const key = keyOf(principal, canonicalOf(principal));
+			return key === void 0 ? Effect.void : Cache.invalidate(cache, key);
+		};
+		return {
+			domain,
+			principal: service.principal,
+			policy: Effect.map(current, ({ policy: value }) => value),
+			decide,
+			check,
+			guard,
+			filter,
+			coverage,
+			permittedFields: permittedFields$1,
+			invalidate
+		};
+	}));
+};
+export { Forbidden, Pending, PolicyUnavailable, Service, makeLayer };
+
+//# sourceMappingURL=authorizer.js.map

package/dist/internal/authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.js","names":["Policies.provideContext","Decide.decideAny","ResourceData.kindOf","DomainData.descriptorOf","Decide.fitsKind","Analysis.decideKind","Decision.reason","Analysis.coverageAny","permittedFields","Decide.permittedFields"],"sources":["../../src/internal/authorizer.ts"],"sourcesContent":["/**\n * The values of authorizers: the errors, the service class and the layer.\n * The types are in `Authorizer.ts`.\n */\n// The service erases the error type and the service type of predicates,\n// principals and deciders to `unknown`. The public types keep them, so the\n// language service check for `unknown` in an Effect is off here.\n// @effect-diagnostics anyUnknownInErrorContext:off\nimport * as Cache from \"effect/Cache\"\nimport * as Context from \"effect/Context\"\nimport type * as Duration from \"effect/Duration\"\nimport * as Effect from \"effect/Effect\"\nimport * as Equal from \"effect/Equal\"\nimport * as Hash from \"effect/Hash\"\nimport * as Layer from \"effect/Layer\"\nimport * as Result from \"effect/Result\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Authorizer from \"../Authorizer.ts\"\nimport type * as Condition from \"../Condition.ts\"\nimport * as Decision from \"../Decision.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Policy from \"../Policy.ts\"\nimport * as Analysis from \"./analysis.ts\"\nimport * as Decide from \"./decide.ts\"\nimport * as DomainData from \"./domain.ts\"\nimport * as Policies from \"./policy.ts\"\nimport * as ResourceData from \"./resource.ts\"\n\ntype AnyServiceClass = Authorizer.AnyServiceClass\n\n/** The error when a policy says no. */\nexport class Forbidden extends Schema.TaggedError<Forbidden>(\n\t\"@nmnmcc/ability/Authorizer/Forbidden\",\n)(\"Forbidden\", {\n\taction: Schema.String,\n\tkind: Schema.String,\n\tfield: Schema.optionalKey(Schema.String),\n\treason: Schema.optionalKey(Schema.String),\n}) {}\n\n/** The error when the policy of the principal can not be loaded. */\nexport class PolicyUnavailable extends Schema.TaggedError<PolicyUnavailable>(\n\t\"@nmnmcc/ability/Authorizer/PolicyUnavailable\",\n)(\"PolicyUnavailable\", { cause: Schema.Defect() }) {}\n\n/** The error when a decider must wait for an answer. */\nexport class Pending extends Schema.TaggedError<Pending>(\n\t\"@nmnmcc/ability/Authorizer/Pending\",\n)(\"Pending\", {\n\tticket: Schema.String,\n\treason: Schema.optionalKey(Schema.String),\n}) {}\n\n/** Makes an authorizer service class for a domain. */\nexport const Service =\n\t() =>\n\t(\n\t\tid: string,\n\t\toptions: {\n\t\t\treadonly domain: Domain.Any\n\t\t\treadonly principal: Effect.Effect<any, any, any>\n\t\t},\n\t\t// The class has no name, and its type uses types of Effect that a\n\t\t// declaration file can not name. So this function gives a `Context.Key`.\n\t\t// The public module gives the full type.\n\t): Context.Key<any, any> => {\n\t\tconst Base = Context.Service<any, any>()(id)\n\t\treturn class extends Base {\n\t\t\tstatic readonly domain = options.domain\n\t\t\tstatic readonly principal = options.principal\n\t\t\tstatic readonly decide = (target: AnyTarget) =>\n\t\t\t\tthis.use((service: any) => service.decide(target))\n\t\t\tstatic readonly check = (target: AnyTarget) =>\n\t\t\t\tthis.use((service: any) => service.check(target))\n\t\t\tstatic readonly guard = (target: AnyTarget, options: unknown) =>\n\t\t\t\tthis.use((service: any) => service.guard(target, options))\n\t\t\tstatic readonly filter = (target: AnyTarget) =>\n\t\t\t\tthis.use((service: any) => service.filter(target))\n\t\t\tstatic readonly coverage = (target: AnyTarget) =>\n\t\t\t\tthis.use((service: any) => service.coverage(target))\n\t\t\tstatic readonly permittedFields = (target: AnyTarget) =>\n\t\t\t\tthis.use((service: any) => service.permittedFields(target))\n\t\t}\n\t}\n\ntype AnyTarget = {\n\treadonly action: string\n\treadonly resource?: object\n\treadonly kind?: string\n\treadonly field?: string\n\treadonly within?: unknown\n}\n\n/**\n * A cache key for a principal. Two keys are equal when they have the same\n * text, so two principals with the same key share one policy. The key also\n * keeps the principal, so the cache can load its policy. A plain `Data` value\n * can not do both, so the key gives its own equality with `Equal.Equal`.\n */\nclass PrincipalKey implements Equal.Equal {\n\treadonly principal: object\n\treadonly text: string\n\tconstructor(principal: object, text: string) {\n\t\tthis.principal = principal\n\t\tthis.text = text\n\t}\n\t[Equal.symbol](that: unknown): boolean {\n\t\treturn that instanceof PrincipalKey && that.text === this.text\n\t}\n\t[Hash.symbol](): number {\n\t\treturn Hash.string(this.text)\n\t}\n}\n\n/**\n * Makes the cache key of a principal from its JSON form. The key keeps the\n * principal that the Schema decodes from that form, so the loader sees only\n * the data that the key shows. A principal gets no key when it does not\n * encode, or when the decoded value is not `Equal` to it. Two classes, or a\n * string and a number, may have one JSON form, as in a union, and `Equal`\n * tells them apart. So two principals with one key are equal, and the cache\n * can not give one the policy of the other.\n */\n/**\n * Gives the JSON codec of a Schema, or `undefined` when the Schema has no JSON\n * form, as a struct with a symbol key has none.\n */\nconst jsonCodecOf = (\n\tschema: Schema.Top,\n): Schema.Codec<unknown, unknown> | undefined => {\n\ttry {\n\t\treturn Schema.toCodecJson(schema) as unknown as Schema.Codec<\n\t\t\tunknown,\n\t\t\tunknown\n\t\t>\n\t} catch {\n\t\treturn undefined\n\t}\n}\n\nconst jsonKey = (\n\tschema: Schema.Top,\n): ((principal: object) => PrincipalKey | undefined) => {\n\tconst codec = jsonCodecOf(schema)\n\t// A principal with no JSON form is never kept.\n\tif (codec === undefined) {\n\t\treturn () => undefined\n\t}\n\tconst encode = Schema.encodeUnknownResult(codec)\n\tconst decode = Schema.decodeUnknownResult(codec)\n\tconst keyOf = (principal: object): PrincipalKey | undefined =>\n\t\tResult.match(encode(principal), {\n\t\t\tonFailure: () => undefined,\n\t\t\tonSuccess: (json) => {\n\t\t\t\t// The key is the text, so the check decodes the text. The encoded\n\t\t\t\t// value may hold more than its text shows, as an object of a\n\t\t\t\t// `Schema.Any` field does: `JSON.stringify` leaves out a map.\n\t\t\t\tconst text = JSON.stringify(json)\n\t\t\t\treturn Result.match(decode(JSON.parse(text)), {\n\t\t\t\t\tonFailure: () => undefined,\n\t\t\t\t\tonSuccess: (decoded) =>\n\t\t\t\t\t\tEqual.equals(decoded, principal)\n\t\t\t\t\t\t\t? new PrincipalKey(decoded as object, text)\n\t\t\t\t\t\t\t: undefined,\n\t\t\t\t})\n\t\t\t},\n\t\t})\n\treturn (principal) => {\n\t\t// A very deep principal may fill the stack of the encoder or of\n\t\t// `Equal`. Such a principal is not kept.\n\t\ttry {\n\t\t\treturn keyOf(principal)\n\t\t} catch {\n\t\t\treturn undefined\n\t\t}\n\t}\n}\n\nconst forbidden = (\n\ttarget: AnyTarget,\n\tkind: string,\n\treason: string | undefined,\n): Forbidden =>\n\tForbidden.make({\n\t\taction: target.action,\n\t\tkind,\n\t\t...(target.field === undefined ? {} : { field: target.field }),\n\t\t...(reason === undefined ? {} : { reason }),\n\t})\n\n/** Makes the layer of an authorizer. */\nexport const makeLayer = (\n\tservice: AnyServiceClass,\n\toptions: {\n\t\treadonly policy: (\n\t\t\tprincipal: object,\n\t\t) => Effect.Effect<Policy.Any, unknown, unknown>\n\t\treadonly decider?: (\n\t\t\trequest: object,\n\t\t) => Effect.Effect<Decision.Decision, unknown, unknown>\n\t\treadonly cache?:\n\t\t\t| {\n\t\t\t\t\treadonly capacity?: number\n\t\t\t\t\treadonly timeToLive?: Duration.Input\n\t\t\t\t\treadonly key?: (principal: object) => string | undefined\n\t\t\t  }\n\t\t\t| false\n\t},\n) => {\n\tconst domain: Domain.Any = service.domain\n\t// The JSON form of a principal, and the copy that the Schema decodes from\n\t// it. The loader always gets the copy, with a cache or not, so a cache can\n\t// not change an answer: a form may lose data that `Equal` does not see,\n\t// as `-0` becomes `0`. A principal with no such form gives `undefined`.\n\tconst canonicalOf = jsonKey(domain.principal)\n\tconst custom = options.cache === false ? undefined : options.cache?.key\n\t// It gives `undefined` when the principal has no key. Such a principal does\n\t// not use the cache.\n\tconst keyOf = (\n\t\tprincipal: object,\n\t\tcanonical: PrincipalKey | undefined,\n\t): PrincipalKey | undefined => {\n\t\tif (custom === undefined) {\n\t\t\treturn canonical\n\t\t}\n\t\tconst text = custom(principal)\n\t\treturn text === undefined\n\t\t\t? undefined\n\t\t\t: new PrincipalKey(canonical?.principal ?? principal, text)\n\t}\n\treturn Layer.effect(\n\t\tservice,\n\t\tEffect.gen(function* () {\n\t\t\t// The services of the policy loader and of the predicates come from the\n\t\t\t// layer, so a check does not need them.\n\t\t\tconst services = yield* Effect.context<never>()\n\n\t\t\t// The predicates of the policy get the services of the layer, so the\n\t\t\t// policy and its residual conditions need no services.\n\t\t\t// A policy of another domain may have the same types, but its resources\n\t\t\t// may have other paths. So it fails closed, as a policy that can not be\n\t\t\t// loaded.\n\t\t\tconst load = (principal: object) =>\n\t\t\t\toptions.policy(principal).pipe(\n\t\t\t\t\tEffect.provideContext(services),\n\t\t\t\t\tEffect.filterOrFail(\n\t\t\t\t\t\t(value) => value.domain === domain,\n\t\t\t\t\t\t() =>\n\t\t\t\t\t\t\tnew globalThis.Error(\n\t\t\t\t\t\t\t\t\"The loaded policy is not a policy of this domain\",\n\t\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t\tEffect.mapError((cause) => PolicyUnavailable.make({ cause })),\n\t\t\t\t\tEffect.map((value) =>\n\t\t\t\t\t\tPolicies.provideContext(value, services as never),\n\t\t\t\t\t),\n\t\t\t\t)\n\n\t\t\tconst cache =\n\t\t\t\toptions.cache === false\n\t\t\t\t\t? undefined\n\t\t\t\t\t: yield* Cache.make({\n\t\t\t\t\t\t\tcapacity: options.cache?.capacity ?? 1000,\n\t\t\t\t\t\t\ttimeToLive: options.cache?.timeToLive ?? \"30 seconds\",\n\t\t\t\t\t\t\tlookup: (key: PrincipalKey) => load(key.principal),\n\t\t\t\t\t\t})\n\n\t\t\tconst policyFor = (principal: object) => {\n\t\t\t\tconst canonical = canonicalOf(principal)\n\t\t\t\tconst key =\n\t\t\t\t\tcache === undefined ? undefined : keyOf(principal, canonical)\n\t\t\t\tif (cache === undefined || key === undefined) {\n\t\t\t\t\treturn load(canonical?.principal ?? principal)\n\t\t\t\t}\n\t\t\t\t// A failed lookup is kept in the cache. Remove it, so the next check\n\t\t\t\t// tries again.\n\t\t\t\treturn Cache.get(cache, key).pipe(\n\t\t\t\t\tEffect.tapError(() => Cache.invalidate(cache, key)),\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tconst withServices = <A, E>(\n\t\t\t\teffect: Effect.Effect<A, E, unknown>,\n\t\t\t): Effect.Effect<A, E, unknown> => Effect.provideContext(effect, services)\n\n\t\t\tconst current = Effect.gen(function* () {\n\t\t\t\tconst principal = yield* service.principal\n\t\t\t\tconst value = yield* policyFor(principal)\n\t\t\t\treturn { principal, policy: value }\n\t\t\t})\n\n\t\t\t// The principal and its policy, loaded one time. A check that asks\n\t\t\t// the policy two times, such as `guard`, uses one snapshot for both,\n\t\t\t// so the two answers come from one principal.\n\t\t\ttype Snapshot = Effect.Success<typeof current>\n\n\t\t\tconst decideWith = Effect.fnUntraced(function* (\n\t\t\t\t{ principal, policy: value }: Snapshot,\n\t\t\t\ttarget: AnyTarget,\n\t\t\t) {\n\t\t\t\tconst decision: Decision.Decision = yield* withServices(\n\t\t\t\t\tDecide.decideAny(value, { ...target, principal } as never),\n\t\t\t\t)\n\t\t\t\treturn decision\n\t\t\t})\n\n\t\t\tconst decide = (target: AnyTarget) =>\n\t\t\t\tEffect.flatMap(current, (snapshot) => decideWith(snapshot, target))\n\n\t\t\tconst checkWith = Effect.fnUntraced(function* (\n\t\t\t\t{ principal, policy: value }: Snapshot,\n\t\t\t\ttarget: AnyTarget,\n\t\t\t) {\n\t\t\t\tconst kind =\n\t\t\t\t\ttarget.resource === undefined\n\t\t\t\t\t\t? (target.kind ?? \"\")\n\t\t\t\t\t\t: (ResourceData.kindOf(target.resource) ?? \"\")\n\t\t\t\t// A request that does not fit its kind gets a \"no\" at once. The\n\t\t\t\t// decider must not say yes to an action that the kind does not have.\n\t\t\t\tconst descriptor = DomainData.descriptorOf(domain, kind)\n\t\t\t\tif (descriptor === undefined || !Decide.fitsKind(descriptor, target)) {\n\t\t\t\t\treturn yield* forbidden(target, kind, undefined)\n\t\t\t\t}\n\t\t\t\tconst fromPolicy: Decision.Decision =\n\t\t\t\t\ttarget.resource === undefined\n\t\t\t\t\t\t? Analysis.decideKind(value, { ...target, principal } as never)\n\t\t\t\t\t\t: yield* withServices(\n\t\t\t\t\t\t\t\tDecide.decideAny(value, { ...target, principal } as never),\n\t\t\t\t\t\t\t)\n\t\t\t\t// When no rule gives an answer, the decider gives it.\n\t\t\t\tconst decision: Decision.Decision =\n\t\t\t\t\tfromPolicy._tag === \"NotApplicable\" && options.decider !== undefined\n\t\t\t\t\t\t? yield* options.decider({ ...target, principal })\n\t\t\t\t\t\t: fromPolicy\n\t\t\t\tif (decision._tag !== \"Allow\") {\n\t\t\t\t\treturn yield* forbidden(target, kind, Decision.reason(decision))\n\t\t\t\t}\n\t\t\t})\n\n\t\t\tconst check = (target: AnyTarget) =>\n\t\t\t\tEffect.flatMap(current, (snapshot) => checkWith(snapshot, target))\n\n\t\t\tconst guard = Effect.fnUntraced(function* (\n\t\t\t\ttarget: AnyTarget,\n\t\t\t\tguardOptions: {\n\t\t\t\t\treadonly read?: string\n\t\t\t\t\treadonly hide: () => unknown\n\t\t\t\t},\n\t\t\t) {\n\t\t\t\tconst snapshot = yield* current\n\t\t\t\tconst read = guardOptions.read ?? \"read\"\n\t\t\t\tconst { field: _field, ...rest } = target\n\t\t\t\tconst visible: Decision.Decision = yield* decideWith(snapshot, {\n\t\t\t\t\t...rest,\n\t\t\t\t\taction: read,\n\t\t\t\t})\n\t\t\t\tif (visible._tag !== \"Allow\") {\n\t\t\t\t\treturn yield* Effect.fail(guardOptions.hide())\n\t\t\t\t}\n\t\t\t\tif (target.action !== read || target.field !== undefined) {\n\t\t\t\t\tyield* checkWith(snapshot, target)\n\t\t\t\t}\n\t\t\t})\n\n\t\t\t// The filter is the condition of the coverage: the scope for `All`,\n\t\t\t// `False` for `None`, and else the residual condition in the scope.\n\t\t\t// The residual throws an error when it is too large, so the filter\n\t\t\t// fails.\n\t\t\tconst filter = (\n\t\t\t\ttarget: AnyTarget,\n\t\t\t): Effect.Effect<Condition.Ast, unknown, unknown> =>\n\t\t\t\tEffect.map(\n\t\t\t\t\tcurrent,\n\t\t\t\t\t({ principal, policy: value }): Condition.Ast =>\n\t\t\t\t\t\tAnalysis.coverageAny(value, { ...target, principal } as never)\n\t\t\t\t\t\t\t.condition as Condition.Ast,\n\t\t\t\t)\n\n\t\t\tconst coverage = (\n\t\t\t\ttarget: AnyTarget,\n\t\t\t): Effect.Effect<Analysis.AnyCoverage, unknown, unknown> =>\n\t\t\t\tEffect.map(current, ({ principal, policy: value }) =>\n\t\t\t\t\tAnalysis.coverageAny(value, { ...target, principal } as never),\n\t\t\t\t)\n\n\t\t\tconst permittedFields = Effect.fnUntraced(function* (target: AnyTarget) {\n\t\t\t\tconst { principal, policy: value } = yield* current\n\t\t\t\treturn yield* withServices(\n\t\t\t\t\tDecide.permittedFields(value, { ...target, principal } as never),\n\t\t\t\t)\n\t\t\t})\n\n\t\t\tconst invalidate = (principal?: object) => {\n\t\t\t\tif (cache === undefined) {\n\t\t\t\t\treturn Effect.void\n\t\t\t\t}\n\t\t\t\tif (principal === undefined) {\n\t\t\t\t\treturn Cache.invalidateAll(cache)\n\t\t\t\t}\n\t\t\t\tconst key = keyOf(principal, canonicalOf(principal))\n\t\t\t\treturn key === undefined ? Effect.void : Cache.invalidate(cache, key)\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tdomain,\n\t\t\t\tprincipal: service.principal,\n\t\t\t\tpolicy: Effect.map(current, ({ policy: value }) => value),\n\t\t\t\tdecide,\n\t\t\t\tcheck,\n\t\t\t\tguard,\n\t\t\t\tfilter,\n\t\t\t\tcoverage,\n\t\t\t\tpermittedFields,\n\t\t\t\tinvalidate,\n\t\t\t} as never\n\t\t}),\n\t)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA+BA,IAAa,YAAb,cAA+B,OAAO,YACrC,sCACD,CAAC,CAAC,aAAa;CACd,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,OAAO,OAAO,YAAY,OAAO,MAAM;CACvC,QAAQ,OAAO,YAAY,OAAO,MAAM;AACzC,CAAC,CAAC,CAAC,CAAC;;AAGJ,IAAa,oBAAb,cAAuC,OAAO,YAC7C,8CACD,CAAC,CAAC,qBAAqB,EAAE,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;;AAGpD,IAAa,UAAb,cAA6B,OAAO,YACnC,oCACD,CAAC,CAAC,WAAW;CACZ,QAAQ,OAAO;CACf,QAAQ,OAAO,YAAY,OAAO,MAAM;AACzC,CAAC,CAAC,CAAC,CAAC;;AAGJ,MAAa,iBAGX,IACA,YAO2B;CAC3B,MAAM,OAAO,QAAQ,QAAkB,CAAC,CAAC,EAAE;CAC3C,OAAO,cAAc,KAAK;EACzB,OAAgB,SAAS,QAAQ;EACjC,OAAgB,YAAY,QAAQ;EACpC,OAAgB,UAAU,WACzB,KAAK,KAAK,YAAiB,QAAQ,OAAO,MAAM,CAAC;EAClD,OAAgB,SAAS,WACxB,KAAK,KAAK,YAAiB,QAAQ,MAAM,MAAM,CAAC;EACjD,OAAgB,SAAS,QAAmB,YAC3C,KAAK,KAAK,YAAiB,QAAQ,MAAM,QAAQ,OAAO,CAAC;EAC1D,OAAgB,UAAU,WACzB,KAAK,KAAK,YAAiB,QAAQ,OAAO,MAAM,CAAC;EAClD,OAAgB,YAAY,WAC3B,KAAK,KAAK,YAAiB,QAAQ,SAAS,MAAM,CAAC;EACpD,OAAgB,mBAAmB,WAClC,KAAK,KAAK,YAAiB,QAAQ,gBAAgB,MAAM,CAAC;CAC5D;AACD;;;;;;;AAgBD,IAAM,eAAN,MAAM,aAAoC;CACzC;CACA;CACA,YAAY,WAAmB,MAAc;EAC5C,KAAK,YAAY;EACjB,KAAK,OAAO;CACb;CACA,CAAC,MAAM,QAAQ,MAAwB;EACtC,OAAO,gBAAgB,gBAAgB,KAAK,SAAS,KAAK;CAC3D;CACA,CAAC,KAAK,UAAkB;EACvB,OAAO,KAAK,OAAO,KAAK,IAAI;CAC7B;AACD;;;;;;;;;;;;;;AAeA,MAAM,eACL,WACgD;CAChD,IAAI;EACH,OAAO,OAAO,YAAY,MAAM;CAIjC,QAAQ;EACP;CACD;AACD;AAEA,MAAM,WACL,WACuD;CACvD,MAAM,QAAQ,YAAY,MAAM;CAEhC,IAAI,UAAU,KAAA,GACb,aAAa,KAAA;CAEd,MAAM,SAAS,OAAO,oBAAoB,KAAK;CAC/C,MAAM,SAAS,OAAO,oBAAoB,KAAK;CAC/C,MAAM,SAAS,cACd,OAAO,MAAM,OAAO,SAAS,GAAG;EAC/B,iBAAiB,KAAA;EACjB,YAAY,SAAS;GAIpB,MAAM,OAAO,KAAK,UAAU,IAAI;GAChC,OAAO,OAAO,MAAM,OAAO,KAAK,MAAM,IAAI,CAAC,GAAG;IAC7C,iBAAiB,KAAA;IACjB,YAAY,YACX,MAAM,OAAO,SAAS,SAAS,IAC5B,IAAI,aAAa,SAAmB,IAAI,IACxC,KAAA;GACL,CAAC;EACF;CACD,CAAC;CACF,QAAQ,cAAc;EAGrB,IAAI;GACH,OAAO,MAAM,SAAS;EACvB,QAAQ;GACP;EACD;CACD;AACD;AAEA,MAAM,aACL,QACA,MACA,WAEA,UAAU,KAAK;CACd,QAAQ,OAAO;CACf;CACA,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;CAC5D,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;AAC1C,CAAC;;AAGF,MAAa,aACZ,SACA,YAeI;CACJ,MAAM,SAAqB,QAAQ;CAKnC,MAAM,cAAc,QAAQ,OAAO,SAAS;CAC5C,MAAM,SAAS,QAAQ,UAAU,QAAQ,KAAA,IAAY,QAAQ,OAAO;CAGpE,MAAM,SACL,WACA,cAC8B;EAC9B,IAAI,WAAW,KAAA,GACd,OAAO;EAER,MAAM,OAAO,OAAO,SAAS;EAC7B,OAAO,SAAS,KAAA,IACb,KAAA,IACA,IAAI,aAAa,WAAW,aAAa,WAAW,IAAI;CAC5D;CACA,OAAO,MAAM,OACZ,SACA,OAAO,IAAI,aAAa;EAGvB,MAAM,WAAW,OAAO,OAAO,QAAe;EAO9C,MAAM,QAAQ,cACb,QAAQ,OAAO,SAAS,CAAC,CAAC,KACzB,OAAO,eAAe,QAAQ,GAC9B,OAAO,cACL,UAAU,MAAM,WAAW,cAE3B,IAAI,WAAW,MACd,kDACD,CACF,GACA,OAAO,UAAU,UAAU,kBAAkB,KAAK,EAAE,MAAM,CAAC,CAAC,GAC5D,OAAO,KAAK,UACXA,eAAwB,OAAO,QAAiB,CACjD,CACD;EAED,MAAM,QACL,QAAQ,UAAU,QACf,KAAA,IACA,OAAO,MAAM,KAAK;GAClB,UAAU,QAAQ,OAAO,YAAY;GACrC,YAAY,QAAQ,OAAO,cAAc;GACzC,SAAS,QAAsB,KAAK,IAAI,SAAS;EAClD,CAAC;EAEJ,MAAM,aAAa,cAAsB;GACxC,MAAM,YAAY,YAAY,SAAS;GACvC,MAAM,MACL,UAAU,KAAA,IAAY,KAAA,IAAY,MAAM,WAAW,SAAS;GAC7D,IAAI,UAAU,KAAA,KAAa,QAAQ,KAAA,GAClC,OAAO,KAAK,WAAW,aAAa,SAAS;GAI9C,OAAO,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC,KAC5B,OAAO,eAAe,MAAM,WAAW,OAAO,GAAG,CAAC,CACnD;EACD;EAEA,MAAM,gBACL,WACkC,OAAO,eAAe,QAAQ,QAAQ;EAEzE,MAAM,UAAU,OAAO,IAAI,aAAa;GACvC,MAAM,YAAY,OAAO,QAAQ;GAEjC,OAAO;IAAE;IAAW,QAAQ,OADP,UAAU,SAAS;GACN;EACnC,CAAC;EAOD,MAAM,aAAa,OAAO,WAAW,WACpC,EAAE,WAAW,QAAQ,SACrB,QACC;GAID,OAAO,OAHoC,aAC1CC,UAAiB,OAAO;IAAE,GAAG;IAAQ;GAAU,CAAU,CAC1D;EAED,CAAC;EAED,MAAM,UAAU,WACf,OAAO,QAAQ,UAAU,aAAa,WAAW,UAAU,MAAM,CAAC;EAEnE,MAAM,YAAY,OAAO,WAAW,WACnC,EAAE,WAAW,QAAQ,SACrB,QACC;GACD,MAAM,OACL,OAAO,aAAa,KAAA,IAChB,OAAO,QAAQ,KACfC,OAAoB,OAAO,QAAQ,KAAK;GAG7C,MAAM,aAAaC,aAAwB,QAAQ,IAAI;GACvD,IAAI,eAAe,KAAA,KAAa,CAACC,SAAgB,YAAY,MAAM,GAClE,OAAO,OAAO,UAAU,QAAQ,MAAM,KAAA,CAAS;GAEhD,MAAM,aACL,OAAO,aAAa,KAAA,IACjBC,WAAoB,OAAO;IAAE,GAAG;IAAQ;GAAU,CAAU,IAC5D,OAAO,aACPJ,UAAiB,OAAO;IAAE,GAAG;IAAQ;GAAU,CAAU,CAC1D;GAEH,MAAM,WACL,WAAW,SAAS,mBAAmB,QAAQ,YAAY,KAAA,IACxD,OAAO,QAAQ,QAAQ;IAAE,GAAG;IAAQ;GAAU,CAAC,IAC/C;GACJ,IAAI,SAAS,SAAS,SACrB,OAAO,OAAO,UAAU,QAAQ,MAAMK,OAAgB,QAAQ,CAAC;EAEjE,CAAC;EAED,MAAM,SAAS,WACd,OAAO,QAAQ,UAAU,aAAa,UAAU,UAAU,MAAM,CAAC;EAElE,MAAM,QAAQ,OAAO,WAAW,WAC/B,QACA,cAIC;GACD,MAAM,WAAW,OAAO;GACxB,MAAM,OAAO,aAAa,QAAQ;GAClC,MAAM,EAAE,OAAO,QAAQ,GAAG,SAAS;GAKnC,KAAI,OAJsC,WAAW,UAAU;IAC9D,GAAG;IACH,QAAQ;GACT,CAAC,EAAA,CACW,SAAS,SACpB,OAAO,OAAO,OAAO,KAAK,aAAa,KAAK,CAAC;GAE9C,IAAI,OAAO,WAAW,QAAQ,OAAO,UAAU,KAAA,GAC9C,OAAO,UAAU,UAAU,MAAM;EAEnC,CAAC;EAMD,MAAM,UACL,WAEA,OAAO,IACN,UACC,EAAE,WAAW,QAAQ,YACrBC,YAAqB,OAAO;GAAE,GAAG;GAAQ;EAAU,CAAU,CAAC,CAC5D,SACJ;EAED,MAAM,YACL,WAEA,OAAO,IAAI,UAAU,EAAE,WAAW,QAAQ,YACzCA,YAAqB,OAAO;GAAE,GAAG;GAAQ;EAAU,CAAU,CAC9D;EAED,MAAMC,oBAAkB,OAAO,WAAW,WAAW,QAAmB;GACvE,MAAM,EAAE,WAAW,QAAQ,UAAU,OAAO;GAC5C,OAAO,OAAO,aACbC,gBAAuB,OAAO;IAAE,GAAG;IAAQ;GAAU,CAAU,CAChE;EACD,CAAC;EAED,MAAM,cAAc,cAAuB;GAC1C,IAAI,UAAU,KAAA,GACb,OAAO,OAAO;GAEf,IAAI,cAAc,KAAA,GACjB,OAAO,MAAM,cAAc,KAAK;GAEjC,MAAM,MAAM,MAAM,WAAW,YAAY,SAAS,CAAC;GACnD,OAAO,QAAQ,KAAA,IAAY,OAAO,OAAO,MAAM,WAAW,OAAO,GAAG;EACrE;EAEA,OAAO;GACN;GACA,WAAW,QAAQ;GACnB,QAAQ,OAAO,IAAI,UAAU,EAAE,QAAQ,YAAY,KAAK;GACxD;GACA;GACA;GACA;GACA;GACA,iBAAA;GACA;EACD;CACD,CAAC,CACF;AACD"}