@nmnmcc/ability 2.0.1 → 2.0.4

package/dist/internal/rule.js

@@ -5,6 +5,8 @@ import { builder as builder$1 } from "../Condition.js";
 import { fitsCatalog, matches, matchesBelow, parseBound } from "./patterns.js";
 import * as Data from "effect/Data";
 import * as Arr from "effect/Array";
+import * as Option from "effect/Option";
+import * as MutableHashMap from "effect/MutableHashMap";
 // src/internal/rule.ts
 /**
 * The values of rules, with no types. The types are in `Policy.ts`.
@@ -13,12 +15,23 @@ import * as Arr from "effect/Array";
 * works in a generator: it gives itself, so `yield* _.allow(...)` gives the
 * rule to `Policy.define`.
 */
-/** The class of every rule value. */
+/**
+* The class of every rule value. The types are those of `Policy.Rule`: `D` is
+* the domain, `I` is what the tests of the condition read, and `X` is the
+* mark of the condition. With no types, as in the nodes of a policy, a rule
+* fits no domain, its condition fits no other rule, and it may have a
+* predicate.
+*/
 var Rule = class extends Data.Class {
+	#rule = true;
 	*[Symbol.iterator]() {
 		yield this;
 		return this;
 	}
+	/** Tests if a value is a rule, by its private field. */
+	static is(u) {
+		return typeof u === "object" && u !== null && #rule in u;
+	}
 };
 /** Makes a rule from its data. It does not check the data against a domain. */
 const make = (data) => new Rule({
@@ -42,7 +55,7 @@ const makePlain = (data) => {
 	return make(data);
 };
 /** Tests if a value is a rule. */
-const isRule = (u) => u instanceof Rule;
+const isRule = (u) => Rule.is(u);
 const toArray = (value) => Array.isArray(value) ? value : [value];
 const kindName = (target) => isResource(target) ? descriptor(target).kind : target;
 const fromOptions = (tag, domain) => (action, resource, options) => make({
@@ -73,6 +86,21 @@ const matchesField = (pattern, field) => matches(parseBound(pattern), field.spli
 */
 const matchesInside = (pattern, field) => matchesBelow(parseBound(pattern), field.split("."));
 /**
+* Makes the test "a field pattern matches some field of the catalog" for one
+* walk, such as one decision. A policy may name one pattern very many times,
+* so the test keeps each answer by the text of the pattern, and the memo goes
+* away when the walk ends. The binding puts a limit on the work of the
+* patterns of a policy on each kind, so one walk does at most that work.
+*/
+const fitsOf = (catalog) => {
+	const memo = MutableHashMap.empty();
+	return (pattern) => Option.getOrElse(MutableHashMap.get(memo, pattern), () => {
+		const found = fitsCatalog(parseBound(pattern), catalog);
+		MutableHashMap.set(memo, pattern, found);
+		return found;
+	});
+};
+/**
 * Tests the parts of a rule that do not need the resource value: the action,
 * the kind and the field.
 *
@@ -92,12 +120,12 @@ const matchesTarget = (rule, target) => {
 	if (rule.fields.length === 0) return false;
 	if (target.field === void 0) {
 		const descriptor = target.descriptor;
-		return rule._tag === "Allow" && (descriptor === void 0 || Arr.some(rule.fields, (pattern) => fitsCatalog(parseBound(pattern), descriptor.catalog)));
+		return rule._tag === "Allow" && (descriptor === void 0 || Arr.some(rule.fields, target.fits ?? fitsOf(descriptor.catalog)));
 	}
 	const field = target.field;
 	const open = rule._tag === "Deny" && target.descriptor !== void 0 && (lookup(target.descriptor.catalog, field)?.open ?? false);
 	return rule.fields.some((pattern) => matchesField(pattern, field) || open && matchesInside(pattern, field));
 };
-export { Rule, builder, isRule, make, makePlain, matchesField, matchesInside, matchesTarget };
+export { Rule, builder, fitsOf, isRule, make, makePlain, matchesField, matchesInside, matchesTarget };
 
 //# sourceMappingURL=rule.js.map

package/dist/internal/rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule.js","names":["Nodes.isNode","ResourceData.isResource","ResourceData.descriptor","Condition.builder","Patterns.matches","Patterns.parseBound","Patterns.matchesBelow","Patterns.fitsCatalog","Catalog.lookup"],"sources":["../../src/internal/rule.ts"],"sourcesContent":["/**\n * The values of rules, with no types. The types are in `Policy.ts`.\n *\n * Rules do not change, and two rules with the same data are equal. A rule\n * works in a generator: it gives itself, so `yield* _.allow(...)` gives the\n * rule to `Policy.define`.\n */\nimport * as Arr from \"effect/Array\"\nimport * as Data from \"effect/Data\"\nimport * as Condition from \"../Condition.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport * as Catalog from \"./catalog.ts\"\nimport * as Nodes from \"./nodes.ts\"\nimport * as ResourceData from \"./resource.ts\"\nimport * as Patterns from \"./patterns.ts\"\n\n/** The data of a rule. */\nexport interface Shape {\n\treadonly _tag: \"Allow\" | \"Deny\"\n\treadonly actions: ReadonlyArray<string>\n\treadonly resources: ReadonlyArray<string>\n\treadonly when?: Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n\t/**\n\t * The domain of the builder that made the rule. Two domains may have the\n\t * same types but other paths, so the types can not tell them apart. It is\n\t * not in the JSON form of a rule.\n\t */\n\treadonly domain?: Domain.Any\n}\n\n/** The class of every rule value. */\nexport class Rule extends Data.Class<Shape> {\n\t*[Symbol.iterator](): Generator<this, this, unknown> {\n\t\tyield this\n\t\treturn this\n\t}\n}\n\n/** Makes a rule from its data. It does not check the data against a domain. */\nexport const make = (data: Shape): Rule =>\n\t// A missing option is left out, so two rules with the same data are equal.\n\tnew Rule({\n\t\t_tag: data._tag,\n\t\tactions: [...data.actions],\n\t\tresources: [...data.resources],\n\t\t...(data.when === undefined ? {} : { when: data.when }),\n\t\t...(data.fields === undefined ? {} : { fields: [...data.fields] }),\n\t\t...(data.reason === undefined ? {} : { reason: data.reason }),\n\t\t...(data.id === undefined ? {} : { id: data.id }),\n\t\t...(data.meta === undefined ? {} : { meta: data.meta }),\n\t\t...(data.domain === undefined ? {} : { domain: data.domain }),\n\t})\n\n/**\n * Makes a rule from its data, as `Policy.rule` does. A condition with a\n * predicate is a defect: the types of the predicate tie it to the kinds of\n * the rule of a builder, and the binding can not check it.\n */\nexport const makePlain = (data: Shape): Rule => {\n\tif (data.when !== undefined && Nodes.isNode(data.when) && data.when.opaque) {\n\t\tthrow new Error(\n\t\t\t\"Policy.rule takes no condition with a predicate. Make the rule with Policy.builder.\",\n\t\t)\n\t}\n\treturn make(data)\n}\n\n/** Tests if a value is a rule. */\nexport const isRule = (u: unknown): u is Rule => u instanceof Rule\n\nconst toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>\n\tArray.isArray(value) ? value : [value as A]\n\nconst kindName = (target: unknown): string =>\n\tResourceData.isResource(target)\n\t\t? ResourceData.descriptor(target).kind\n\t\t: (target as string)\n\n/** The options of a rule from a builder, with no types. */\ninterface Options {\n\treadonly when?: (builder: never) => Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n}\n\nconst fromOptions =\n\t(tag: \"Allow\" | \"Deny\", domain: Domain.Any) =>\n\t(\n\t\taction: string | ReadonlyArray<string>,\n\t\tresource: unknown,\n\t\toptions?: Options,\n\t): Rule =>\n\t\tmake({\n\t\t\t_tag: tag,\n\t\t\tactions: toArray(action),\n\t\t\tresources: Arr.map(toArray(resource), kindName),\n\t\t\t...(options?.when === undefined\n\t\t\t\t? {}\n\t\t\t\t: { when: options.when(Condition.builder() as never) }),\n\t\t\t...(options?.fields === undefined ? {} : { fields: options.fields }),\n\t\t\t...(options?.reason === undefined ? {} : { reason: options.reason }),\n\t\t\t...(options?.id === undefined ? {} : { id: options.id }),\n\t\t\t...(options?.meta === undefined ? {} : { meta: options.meta }),\n\t\t\tdomain,\n\t\t})\n\n/** Makes the rule builder of a domain. */\nexport const builder = (domain: Domain.Any) => ({\n\tallow: fromOptions(\"Allow\", domain),\n\tdeny: fromOptions(\"Deny\", domain),\n})\n\n/**\n * Tests if a field name matches a field name or a field pattern of a rule. A\n * pattern matches the fields below a field that it matches too, so `settings`\n * matches `settings.model`.\n */\nexport const matchesField = (pattern: string, field: string): boolean =>\n\tPatterns.matches(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests if a field pattern may match a field inside `field`, such as\n * `settings.secret` inside `settings`.\n */\nexport const matchesInside = (pattern: string, field: string): boolean =>\n\tPatterns.matchesBelow(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests the parts of a rule that do not need the resource value: the action,\n * the kind and the field.\n *\n * A rule with an empty list of fields covers no request. A rule with fields\n * covers a request with no field only when it is an allow rule. So \"may\n * update some fields\" is a yes. A deny rule for some fields does not stop a\n * request for the whole value. With the `descriptor` of the kind, such an\n * allow rule covers the request only when one of its patterns matches a field\n * of the kind, and a deny rule for a part of a field that holds parts covers\n * a request for the whole field. A grant of fields that the kind does not have is not a grant of\n * some fields.\n */\nexport const matchesTarget = (\n\trule: Shape,\n\ttarget: {\n\t\treadonly action: string\n\t\treadonly kind: string\n\t\treadonly field?: string | undefined\n\t\treadonly descriptor?: Resource.Descriptor | undefined\n\t},\n): boolean => {\n\tif (!rule.actions.includes(\"*\") && !rule.actions.includes(target.action)) {\n\t\treturn false\n\t}\n\tif (!rule.resources.includes(\"*\") && !rule.resources.includes(target.kind)) {\n\t\treturn false\n\t}\n\tif (rule.fields === undefined) {\n\t\treturn true\n\t}\n\t// A rule for no fields is a rule for nothing. A grant with its last field\n\t// taken away must not cover the whole value.\n\tif (rule.fields.length === 0) {\n\t\treturn false\n\t}\n\tif (target.field === undefined) {\n\t\tconst descriptor = target.descriptor\n\t\treturn (\n\t\t\trule._tag === \"Allow\" &&\n\t\t\t(descriptor === undefined ||\n\t\t\t\tArr.some(rule.fields, (pattern) =>\n\t\t\t\t\tPatterns.fitsCatalog(\n\t\t\t\t\t\tPatterns.parseBound(pattern),\n\t\t\t\t\t\tdescriptor.catalog,\n\t\t\t\t\t),\n\t\t\t\t))\n\t\t)\n\t}\n\tconst field = target.field\n\t// A field that holds parts, as a record does, shows its parts too. So a\n\t// deny rule for a part inside it, as `data.secret` inside `data`, also\n\t// covers a request for the whole field.\n\tconst open =\n\t\trule._tag === \"Deny\" &&\n\t\ttarget.descriptor !== undefined &&\n\t\t(Catalog.lookup(target.descriptor.catalog, field)?.open ?? false)\n\treturn rule.fields.some(\n\t\t(pattern) =>\n\t\t\tmatchesField(pattern, field) || (open && matchesInside(pattern, field)),\n\t)\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,IAAa,OAAb,cAA0B,KAAK,MAAa;CAC3C,EAAE,OAAO,YAA4C;EACpD,MAAM;EACN,OAAO;CACR;AACD;;AAGA,MAAa,QAAQ,SAEpB,IAAI,KAAK;CACR,MAAM,KAAK;CACX,SAAS,CAAC,GAAG,KAAK,OAAO;CACzB,WAAW,CAAC,GAAG,KAAK,SAAS;CAC7B,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE;CAChE,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;CAC3D,GAAI,KAAK,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;CAC/C,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAC5D,CAAC;;;;;;AAOF,MAAa,aAAa,SAAsB;CAC/C,IAAI,KAAK,SAAS,KAAA,KAAaA,OAAa,KAAK,IAAI,KAAK,KAAK,KAAK,QACnE,MAAM,IAAI,MACT,qFACD;CAED,OAAO,KAAK,IAAI;AACjB;;AAGA,MAAa,UAAU,MAA0B,aAAa;AAE9D,MAAM,WAAc,UACnB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAU;AAE3C,MAAM,YAAY,WACjBC,WAAwB,MAAM,IAC3BC,WAAwB,MAAM,CAAC,CAAC,OAC/B;AAWL,MAAM,eACJ,KAAuB,YAEvB,QACA,UACA,YAEA,KAAK;CACJ,MAAM;CACN,SAAS,QAAQ,MAAM;CACvB,WAAW,IAAI,IAAI,QAAQ,QAAQ,GAAG,QAAQ;CAC9C,GAAI,SAAS,SAAS,KAAA,IACnB,CAAC,IACD,EAAE,MAAM,QAAQ,KAAKC,UAAkB,CAAU,EAAE;CACtD,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;CACtD,GAAI,SAAS,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;CAC5D;AACD,CAAC;;AAGH,MAAa,WAAW,YAAwB;CAC/C,OAAO,YAAY,SAAS,MAAM;CAClC,MAAM,YAAY,QAAQ,MAAM;AACjC;;;;;;AAOA,MAAa,gBAAgB,SAAiB,UAC7CC,QAAiBC,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;AAMhE,MAAa,iBAAiB,SAAiB,UAC9CC,aAAsBD,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;;;;;;;;;;AAerE,MAAa,iBACZ,MACA,WAMa;CACb,IAAI,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,KAAK,QAAQ,SAAS,OAAO,MAAM,GACtE,OAAO;CAER,IAAI,CAAC,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,KAAK,UAAU,SAAS,OAAO,IAAI,GACxE,OAAO;CAER,IAAI,KAAK,WAAW,KAAA,GACnB,OAAO;CAIR,IAAI,KAAK,OAAO,WAAW,GAC1B,OAAO;CAER,IAAI,OAAO,UAAU,KAAA,GAAW;EAC/B,MAAM,aAAa,OAAO;EAC1B,OACC,KAAK,SAAS,YACb,eAAe,KAAA,KACf,IAAI,KAAK,KAAK,SAAS,YACtBE,YACCF,WAAoB,OAAO,GAC3B,WAAW,OACZ,CACD;CAEH;CACA,MAAM,QAAQ,OAAO;CAIrB,MAAM,OACL,KAAK,SAAS,UACd,OAAO,eAAe,KAAA,MACrBG,OAAe,OAAO,WAAW,SAAS,KAAK,CAAC,EAAE,QAAQ;CAC5D,OAAO,KAAK,OAAO,MACjB,YACA,aAAa,SAAS,KAAK,KAAM,QAAQ,cAAc,SAAS,KAAK,CACvE;AACD"}
+{"version":3,"file":"rule.js","names":["Nodes.isNode","ResourceData.isResource","ResourceData.descriptor","Condition.builder","Patterns.matches","Patterns.parseBound","Patterns.matchesBelow","Patterns.fitsCatalog","Catalog.lookup"],"sources":["../../src/internal/rule.ts"],"sourcesContent":["/**\n * The values of rules, with no types. The types are in `Policy.ts`.\n *\n * Rules do not change, and two rules with the same data are equal. A rule\n * works in a generator: it gives itself, so `yield* _.allow(...)` gives the\n * rule to `Policy.define`.\n */\nimport * as Arr from \"effect/Array\"\nimport * as Data from \"effect/Data\"\nimport * as MutableHashMap from \"effect/MutableHashMap\"\nimport * as Option from \"effect/Option\"\nimport * as Condition from \"../Condition.ts\"\nimport type * as Domain from \"../Domain.ts\"\nimport type * as Policy from \"../Policy.ts\"\nimport type * as Resource from \"../Resource.ts\"\nimport * as Catalog from \"./catalog.ts\"\nimport * as Nodes from \"./nodes.ts\"\nimport * as ResourceData from \"./resource.ts\"\nimport * as Patterns from \"./patterns.ts\"\n\n/** The data of a rule. */\nexport interface Shape {\n\treadonly _tag: \"Allow\" | \"Deny\"\n\treadonly actions: ReadonlyArray<string>\n\treadonly resources: ReadonlyArray<string>\n\treadonly when?: Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n\t/**\n\t * The domain of the builder that made the rule. Two domains may have the\n\t * same types but other paths, so the types can not tell them apart. It is\n\t * not in the JSON form of a rule.\n\t */\n\treadonly domain?: Domain.Any\n}\n\n/**\n * The class of every rule value. The types are those of `Policy.Rule`: `D` is\n * the domain, `I` is what the tests of the condition read, and `X` is the\n * mark of the condition. With no types, as in the nodes of a policy, a rule\n * fits no domain, its condition fits no other rule, and it may have a\n * predicate.\n */\nexport class Rule<D = never, I = never, X = unknown> extends Data.Class<\n\tPolicy.RuleShape<I, X>\n> {\n\t/** Only in the types. */\n\tdeclare readonly \"~Opaque\": () => X\n\t/** Only in the types. */\n\tdeclare readonly \"~Domain\": (domain: D) => D\n\t// A private field makes the type of a rule its own, as for a policy: a\n\t// spread of a rule, or an object made by hand, is not a rule. `Equal` does\n\t// not read it. It comes last, so its `;` stays: the generator method below\n\t// needs one after a field. Node.js takes the `declare` fields out of the\n\t// code, and a `;` after one of them would go with it.\n\treadonly #rule = true;\n\n\t*[Symbol.iterator](): Generator<Rule<D, I, X>, Rule<D, I, X>, unknown> {\n\t\tyield this\n\t\treturn this\n\t}\n\n\t/** Tests if a value is a rule, by its private field. */\n\tstatic is(u: unknown): u is Rule {\n\t\treturn typeof u === \"object\" && u !== null && #rule in u\n\t}\n}\n\n/** Makes a rule from its data. It does not check the data against a domain. */\nexport const make = (data: Shape): Rule =>\n\t// A missing option is left out, so two rules with the same data are equal.\n\t// The data has no types here, as the code below works with no types.\n\tnew Rule({\n\t\t_tag: data._tag,\n\t\tactions: [...data.actions],\n\t\tresources: [...data.resources],\n\t\t...(data.when === undefined ? {} : { when: data.when }),\n\t\t...(data.fields === undefined ? {} : { fields: [...data.fields] }),\n\t\t...(data.reason === undefined ? {} : { reason: data.reason }),\n\t\t...(data.id === undefined ? {} : { id: data.id }),\n\t\t...(data.meta === undefined ? {} : { meta: data.meta }),\n\t\t...(data.domain === undefined ? {} : { domain: data.domain }),\n\t} as never)\n\n/**\n * Makes a rule from its data, as `Policy.rule` does. A condition with a\n * predicate is a defect: the types of the predicate tie it to the kinds of\n * the rule of a builder, and the binding can not check it.\n */\nexport const makePlain = (data: Shape): Rule => {\n\tif (data.when !== undefined && Nodes.isNode(data.when) && data.when.opaque) {\n\t\tthrow new Error(\n\t\t\t\"Policy.rule takes no condition with a predicate. Make the rule with Policy.builder.\",\n\t\t)\n\t}\n\treturn make(data)\n}\n\n/** Tests if a value is a rule. */\nexport const isRule = (u: unknown): u is Rule => Rule.is(u)\n\nconst toArray = <A>(value: A | ReadonlyArray<A>): ReadonlyArray<A> =>\n\tArray.isArray(value) ? value : [value as A]\n\nconst kindName = (target: unknown): string =>\n\tResourceData.isResource(target)\n\t\t? ResourceData.descriptor(target).kind\n\t\t: (target as string)\n\n/** The options of a rule from a builder, with no types. */\ninterface Options {\n\treadonly when?: (builder: never) => Condition.Ast\n\treadonly fields?: ReadonlyArray<string>\n\treadonly reason?: string\n\treadonly id?: string\n\treadonly meta?: unknown\n}\n\nconst fromOptions =\n\t(tag: \"Allow\" | \"Deny\", domain: Domain.Any) =>\n\t(\n\t\taction: string | ReadonlyArray<string>,\n\t\tresource: unknown,\n\t\toptions?: Options,\n\t): Rule =>\n\t\tmake({\n\t\t\t_tag: tag,\n\t\t\tactions: toArray(action),\n\t\t\tresources: Arr.map(toArray(resource), kindName),\n\t\t\t...(options?.when === undefined\n\t\t\t\t? {}\n\t\t\t\t: { when: options.when(Condition.builder() as never) }),\n\t\t\t...(options?.fields === undefined ? {} : { fields: options.fields }),\n\t\t\t...(options?.reason === undefined ? {} : { reason: options.reason }),\n\t\t\t...(options?.id === undefined ? {} : { id: options.id }),\n\t\t\t...(options?.meta === undefined ? {} : { meta: options.meta }),\n\t\t\tdomain,\n\t\t})\n\n/** Makes the rule builder of a domain. */\nexport const builder = (domain: Domain.Any) => ({\n\tallow: fromOptions(\"Allow\", domain),\n\tdeny: fromOptions(\"Deny\", domain),\n})\n\n/**\n * Tests if a field name matches a field name or a field pattern of a rule. A\n * pattern matches the fields below a field that it matches too, so `settings`\n * matches `settings.model`.\n */\nexport const matchesField = (pattern: string, field: string): boolean =>\n\tPatterns.matches(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Tests if a field pattern may match a field inside `field`, such as\n * `settings.secret` inside `settings`.\n */\nexport const matchesInside = (pattern: string, field: string): boolean =>\n\tPatterns.matchesBelow(Patterns.parseBound(pattern), field.split(\".\"))\n\n/**\n * Makes the test \"a field pattern matches some field of the catalog\" for one\n * walk, such as one decision. A policy may name one pattern very many times,\n * so the test keeps each answer by the text of the pattern, and the memo goes\n * away when the walk ends. The binding puts a limit on the work of the\n * patterns of a policy on each kind, so one walk does at most that work.\n */\nexport const fitsOf = (\n\tcatalog: Catalog.Catalog,\n): ((pattern: string) => boolean) => {\n\tconst memo = MutableHashMap.empty<string, boolean>()\n\treturn (pattern) =>\n\t\tOption.getOrElse(MutableHashMap.get(memo, pattern), () => {\n\t\t\tconst found = Patterns.fitsCatalog(Patterns.parseBound(pattern), catalog)\n\t\t\tMutableHashMap.set(memo, pattern, found)\n\t\t\treturn found\n\t\t})\n}\n\n/**\n * Tests the parts of a rule that do not need the resource value: the action,\n * the kind and the field.\n *\n * A rule with an empty list of fields covers no request. A rule with fields\n * covers a request with no field only when it is an allow rule. So \"may\n * update some fields\" is a yes. A deny rule for some fields does not stop a\n * request for the whole value. With the `descriptor` of the kind, such an\n * allow rule covers the request only when one of its patterns matches a field\n * of the kind, and a deny rule for a part of a field that holds parts covers\n * a request for the whole field. A grant of fields that the kind does not have is not a grant of\n * some fields.\n */\nexport const matchesTarget = (\n\trule: Shape,\n\ttarget: {\n\t\treadonly action: string\n\t\treadonly kind: string\n\t\treadonly field?: string | undefined\n\t\treadonly descriptor?: Resource.Descriptor | undefined\n\t\t/** The test of {@link fitsOf} for the catalog of the descriptor. */\n\t\treadonly fits?: ((pattern: string) => boolean) | undefined\n\t},\n): boolean => {\n\tif (!rule.actions.includes(\"*\") && !rule.actions.includes(target.action)) {\n\t\treturn false\n\t}\n\tif (!rule.resources.includes(\"*\") && !rule.resources.includes(target.kind)) {\n\t\treturn false\n\t}\n\tif (rule.fields === undefined) {\n\t\treturn true\n\t}\n\t// A rule for no fields is a rule for nothing. A grant with its last field\n\t// taken away must not cover the whole value.\n\tif (rule.fields.length === 0) {\n\t\treturn false\n\t}\n\tif (target.field === undefined) {\n\t\tconst descriptor = target.descriptor\n\t\treturn (\n\t\t\trule._tag === \"Allow\" &&\n\t\t\t(descriptor === undefined ||\n\t\t\t\tArr.some(rule.fields, target.fits ?? fitsOf(descriptor.catalog)))\n\t\t)\n\t}\n\tconst field = target.field\n\t// A field that holds parts, as a record does, shows its parts too. So a\n\t// deny rule for a part inside it, as `data.secret` inside `data`, also\n\t// covers a request for the whole field.\n\tconst open =\n\t\trule._tag === \"Deny\" &&\n\t\ttarget.descriptor !== undefined &&\n\t\t(Catalog.lookup(target.descriptor.catalog, field)?.open ?? false)\n\treturn rule.fields.some(\n\t\t(pattern) =>\n\t\t\tmatchesField(pattern, field) || (open && matchesInside(pattern, field)),\n\t)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa,OAAb,cAA6D,KAAK,MAEhE;CAUD,QAAiB;CAEjB,EAAE,OAAO,YAA8D;EACtE,MAAM;EACN,OAAO;CACR;;CAGA,OAAO,GAAG,GAAuB;EAChC,OAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,SAAS;CACxD;AACD;;AAGA,MAAa,QAAQ,SAGpB,IAAI,KAAK;CACR,MAAM,KAAK;CACX,SAAS,CAAC,GAAG,KAAK,OAAO;CACzB,WAAW,CAAC,GAAG,KAAK,SAAS;CAC7B,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,MAAM,EAAE;CAChE,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;CAC3D,GAAI,KAAK,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,KAAK,GAAG;CAC/C,GAAI,KAAK,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;CACrD,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;AAC5D,CAAU;;;;;;AAOX,MAAa,aAAa,SAAsB;CAC/C,IAAI,KAAK,SAAS,KAAA,KAAaA,OAAa,KAAK,IAAI,KAAK,KAAK,KAAK,QACnE,MAAM,IAAI,MACT,qFACD;CAED,OAAO,KAAK,IAAI;AACjB;;AAGA,MAAa,UAAU,MAA0B,KAAK,GAAG,CAAC;AAE1D,MAAM,WAAc,UACnB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAU;AAE3C,MAAM,YAAY,WACjBC,WAAwB,MAAM,IAC3BC,WAAwB,MAAM,CAAC,CAAC,OAC/B;AAWL,MAAM,eACJ,KAAuB,YAEvB,QACA,UACA,YAEA,KAAK;CACJ,MAAM;CACN,SAAS,QAAQ,MAAM;CACvB,WAAW,IAAI,IAAI,QAAQ,QAAQ,GAAG,QAAQ;CAC9C,GAAI,SAAS,SAAS,KAAA,IACnB,CAAC,IACD,EAAE,MAAM,QAAQ,KAAKC,UAAkB,CAAU,EAAE;CACtD,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;CAClE,GAAI,SAAS,OAAO,KAAA,IAAY,CAAC,IAAI,EAAE,IAAI,QAAQ,GAAG;CACtD,GAAI,SAAS,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,QAAQ,KAAK;CAC5D;AACD,CAAC;;AAGH,MAAa,WAAW,YAAwB;CAC/C,OAAO,YAAY,SAAS,MAAM;CAClC,MAAM,YAAY,QAAQ,MAAM;AACjC;;;;;;AAOA,MAAa,gBAAgB,SAAiB,UAC7CC,QAAiBC,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;AAMhE,MAAa,iBAAiB,SAAiB,UAC9CC,aAAsBD,WAAoB,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC;;;;;;;;AASrE,MAAa,UACZ,YACoC;CACpC,MAAM,OAAO,eAAe,MAAuB;CACnD,QAAQ,YACP,OAAO,UAAU,eAAe,IAAI,MAAM,OAAO,SAAS;EACzD,MAAM,QAAQE,YAAqBF,WAAoB,OAAO,GAAG,OAAO;EACxE,eAAe,IAAI,MAAM,SAAS,KAAK;EACvC,OAAO;CACR,CAAC;AACH;;;;;;;;;;;;;;AAeA,MAAa,iBACZ,MACA,WAQa;CACb,IAAI,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,KAAK,QAAQ,SAAS,OAAO,MAAM,GACtE,OAAO;CAER,IAAI,CAAC,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,KAAK,UAAU,SAAS,OAAO,IAAI,GACxE,OAAO;CAER,IAAI,KAAK,WAAW,KAAA,GACnB,OAAO;CAIR,IAAI,KAAK,OAAO,WAAW,GAC1B,OAAO;CAER,IAAI,OAAO,UAAU,KAAA,GAAW;EAC/B,MAAM,aAAa,OAAO;EAC1B,OACC,KAAK,SAAS,YACb,eAAe,KAAA,KACf,IAAI,KAAK,KAAK,QAAQ,OAAO,QAAQ,OAAO,WAAW,OAAO,CAAC;CAElE;CACA,MAAM,QAAQ,OAAO;CAIrB,MAAM,OACL,KAAK,SAAS,UACd,OAAO,eAAe,KAAA,MACrBG,OAAe,OAAO,WAAW,SAAS,KAAK,CAAC,EAAE,QAAQ;CAC5D,OAAO,KAAK,OAAO,MACjB,YACA,aAAa,SAAS,KAAK,KAAM,QAAQ,cAAc,SAAS,KAAK,CACvE;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nmnmcc/ability",
-	"version": "2.0.1",
+	"version": "2.0.4",
 	"description": "Typed, composable authorization policies for Effect programs.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/Condition.ts

@@ -224,32 +224,24 @@ export interface Opaque<out E = never, out R = never> {
 }
 
 /**
- * The error type of the predicates of a mark `X`. A mark that may be
- * anything, as `unknown`, may have any error.
+ * The error type of the predicates of a mark `X`. A mark that is not an
+ * {@link Opaque}, as `unknown` or `object`, may have any error.
  *
  * @stability stable
  * @category utility types
  * @since 2.0.0
  */
-export type ErrorOf<X> = unknown extends X
-	? unknown
-	: X extends Opaque<infer E, infer _R>
-		? E
-		: never
+export type ErrorOf<X> = X extends Opaque<infer E, infer _R> ? E : unknown
 
 /**
- * The service type of the predicates of a mark `X`. A mark that may be
- * anything, as `unknown`, may need any service.
+ * The service type of the predicates of a mark `X`. A mark that is not an
+ * {@link Opaque}, as `unknown` or `object`, may need any service.
  *
  * @stability stable
  * @category utility types
  * @since 2.0.0
  */
-export type ServicesOf<X> = unknown extends X
-	? unknown
-	: X extends Opaque<infer _E, infer R>
-		? R
-		: never
+export type ServicesOf<X> = X extends Opaque<infer _E, infer R> ? R : unknown
 
 /**
  * The mark `X` with no services.
@@ -258,11 +250,8 @@ export type ServicesOf<X> = unknown extends X
  * @category utility types
  * @since 2.0.0
  */
-export type Provided<X> = unknown extends X
-	? Opaque<unknown>
-	: X extends Opaque<infer E, infer _R>
-		? Opaque<E>
-		: never
+export type Provided<X> =
+	X extends Opaque<infer E, infer _R> ? Opaque<E> : Opaque<unknown>
 
 /**
  * What the predicates of a condition read: a resource value of the type `V`
@@ -366,14 +355,15 @@ type FieldPathInternal<
 > = [Depth] extends [never]
 	? never
 	: {
-			[K in keyof T & string]-?: PathsOf<
-				K,
+			// A record with number keys has number keys, as `counts.1`.
+			[K in keyof T & (string | number)]-?: PathsOf<
+				`${K}`,
 				NonNullable<T[K]>,
 				Depth,
 				Arrays,
 				Parents
 			>
-		}[keyof T & string]
+		}[keyof T & (string | number)]
 
 /**
  * The paths of one field `K` with the values `V`. Each kind of value in `V`
@@ -387,21 +377,30 @@ type PathsOf<
 	Arrays extends boolean,
 	Parents extends boolean,
 > =
-	// A field that is only ever `null` or missing is a field too.
-	| ([V] extends [never] ? K : never)
+	// A field that is only ever `null` or missing is a field too, and so is a
+	// field that may hold any value, as one of `Schema.Unknown` may.
+	| ([V] extends [never] ? K : {} extends V ? K : never)
 	| ([Extract<V, Leaf | Whole>] extends [never] ? never : K)
 	| ([Extract<V, ReadonlyArray<unknown>>] extends [never]
 			? never
 			: Arrays extends true
 				? K
 				: never)
-	| ObjectPaths<
-			K,
-			Exclude<V, Leaf | Whole | Function | ReadonlyArray<unknown>>,
-			Depth,
-			Arrays,
-			Parents
-	  >
+	// A condition reads a field below `K` only when `K` holds plain data: a
+	// list, a whole value such as a date, or a function may have a getter or a
+	// method with the name, so the binding does not take such a read. A rule
+	// or a request names a field and does not read it, so it may.
+	| (Arrays extends true
+			? ObjectPaths<
+					K,
+					Exclude<V, Leaf | Whole | Function | ReadonlyArray<unknown>>,
+					Depth,
+					Arrays,
+					Parents
+				>
+			: [Extract<V, Whole | Function | ReadonlyArray<unknown>>] extends [never]
+				? ObjectPaths<K, Exclude<V, Leaf>, Depth, Arrays, Parents>
+				: never)
 
 /** The paths of a field `K` that holds the objects `O`, and of the fields below. */
 type ObjectPaths<
@@ -419,7 +418,9 @@ type ObjectPaths<
 				: Arrays extends true
 					? string extends keyof O
 						? K
-						: never
+						: number extends keyof O
+							? K
+							: never
 					: never)
 		| `${K}.${FieldPathInternal<O, PreviousDepth[Depth], Arrays, Parents>}`
 
@@ -427,9 +428,10 @@ type ObjectPaths<
  * The paths of the fields of `T` that hold one value, with dots for nested
  * fields. Arrays are left out. A map, a set, a date, a URL, a byte array, an
  * `Option` and the other value types of Effect, such as `BigDecimal` and
- * `Duration`, are one field, and a path does not go into them. The type goes down four levels, so type
- * checking stays fast. For a union of types, only the common fields are
- * paths.
+ * `Duration`, are one field, and a path does not go into them. A path does
+ * not go into a field that may hold one of them or a list either. The type
+ * goes down four levels, so type checking stays fast. For a union of types,
+ * only the common fields are paths.
  *
  * @stability stable
  * @category utility types
@@ -491,25 +493,36 @@ type Normalize<A> = Exclude<A, undefined> | (undefined extends A ? null : never)
 
 /**
  * The type of the field of `T` at `Path`. A field that may be missing may also
- * be `null`.
+ * be `null`. Each type of a union gives its own value: a field below a value
+ * that is not an object, as below a string, is `null`, as a read of it is.
  *
  * @stability stable
  * @category utility types
  * @since 0.3.0
  */
-export type PathValue<
-	T,
-	Path extends string,
-> = Path extends `${infer Head}.${infer Rest}`
-	? Head extends keyof T
-		? undefined extends T[Head]
-			? PathValue<NonNullable<T[Head]>, Rest> | null
-			: null extends T[Head]
-				? PathValue<NonNullable<T[Head]>, Rest> | null
-				: PathValue<T[Head], Rest>
-		: never
-	: Path extends keyof T
-		? Normalize<T[Path]>
+export type PathValue<T, Path extends string> = T extends unknown
+	? PathValueIn<T, Path>
+	: never
+
+/** The type of the field at `Path` of `T`, which is not a union. */
+type PathValueIn<T, Path extends string> = T extends object
+	? Path extends `${infer Head}.${infer Rest}`
+		? PathValue<ChildOf<T, Head>, Rest>
+		: Normalize<ChildOf<T, Path>>
+	: null
+
+/**
+ * The type of the part `Name` of `T`. A part of a path is text, so the part
+ * `"1"` names the number key `1` too, as of a record with number keys.
+ */
+type ChildOf<T, Name extends string> = Name extends keyof T
+	? T[Name]
+	: Name extends `${infer N extends number}`
+		? N extends keyof T
+			? T[N]
+			: number extends keyof T
+				? T[number]
+				: never
 		: never
 
 /**
@@ -858,7 +871,8 @@ type ReadsInput<I> =
 /**
  * Tests a condition on a value. A predicate may fail with its error. When the
  * condition has a predicate, the input must have the value and the principal
- * that the predicate reads.
+ * that the predicate reads. The test runs on the simple form of the condition
+ * with the principal in it, so it reads only the fields that a residual reads.
  *
  * @stability stable
  * @category evaluation

package/src/Limits.ts

@@ -97,7 +97,9 @@ export const catalogFields: number = Limits.catalogFields
 
 /**
  * The most steps of one search for a value, as in `Policy.coverage`. Past
- * it, the answer is `Unknown`.
+ * it, the answer is `Unknown`. It is also the most steps of the checks of
+ * the field patterns of one policy on every kind of their rules. Past it, the
+ * policy does not load.
  *
  * @stability stable
  * @category constants

package/src/Policy.ts

@@ -37,7 +37,6 @@
 import type * as Context from "effect/Context"
 import type * as Data from "effect/Data"
 import type * as Effect from "effect/Effect"
-import type * as Pipeable from "effect/Pipeable"
 import type * as Schema from "effect/Schema"
 import type * as Condition from "./Condition.ts"
 import * as Analysis from "./internal/analysis.ts"
@@ -301,12 +300,7 @@ export interface Explanation {
  * @category models
  * @since 0.3.0
  */
-export interface Rule<D = any, I = unknown, X = never>
-	extends RuleShape<I, X>, Pipeable.Pipeable {
-	readonly "~Opaque": () => X
-	readonly "~Domain": (domain: D) => D
-	[Symbol.iterator](): Generator<Rule<D, I, X>, Rule<D, I, X>, unknown>
-}
+export type Rule<D = any, I = unknown, X = never> = RuleData.Rule<D, I, X>
 
 /**
  * The data of a rule.
@@ -778,8 +772,10 @@ export type ResidualReads<D, K> = Condition.Reads<
 /**
  * Gives the condition on resource values for which the policy allows a
  * request. It has no principal fields and no `Under` nodes, so you can give it
- * to `Condition.fold`. It is `True` when the policy allows every value of the
- * kind, and `False` when it allows none.
+ * to `Condition.fold`. It is made smaller, so it is often `True` or `False`
+ * when the answer does not depend on the value, but it does no search: a
+ * condition that is true for every value may stay a test. To know if the
+ * policy allows every value, or some value, use {@link coverage}.
  *
  * With a scope (`within`), the condition is the scope and the residual
  * together, so it is false for every value outside the scope. Give the policy

package/src/internal/algebra.ts

@@ -259,8 +259,8 @@ const testUnder = (
 	})
 }
 
-/** Tests a condition with no predicate on a value. */
-export const evaluateSync = (node: Node, input: Input): boolean => {
+/** Tests a simple condition with no predicate on a value. */
+const testSync = (node: Node, input: Input): boolean => {
 	switch (node._tag) {
 		case "True":
 			return true
@@ -283,11 +283,11 @@ export const evaluateSync = (node: Node, input: Input): boolean => {
 		case "Under":
 			return testUnder(node.prefix, input)
 		case "And":
-			return Arr.every(node.conditions, (child) => evaluateSync(child, input))
+			return Arr.every(node.conditions, (child) => testSync(child, input))
 		case "Or":
-			return Arr.some(node.conditions, (child) => evaluateSync(child, input))
+			return Arr.some(node.conditions, (child) => testSync(child, input))
 		case "Not":
-			return !evaluateSync(node.condition, input)
+			return !testSync(node.condition, input)
 		case "Predicate":
 			// The types stop this. A predicate needs `evaluate`.
 			throw new Error(
@@ -297,38 +297,55 @@ export const evaluateSync = (node: Node, input: Input): boolean => {
 }
 
 /**
- * Tests a condition on a value. The children of `And` and `Or` run in order,
- * and they stop at the first child that gives the answer.
+ * Tests a simple condition on a value. The children of `And` and `Or` run in
+ * order, and they stop at the first child that gives the answer.
  */
-export const evaluate = (
+const test = (
 	node: Node,
 	input: Input,
 ): Effect.Effect<boolean, unknown, unknown> => {
 	if (!node.opaque) {
-		return Effect.sync(() => evaluateSync(node, input))
+		return Effect.sync(() => testSync(node, input))
 	}
 	switch (node._tag) {
 		case "Predicate":
 			return Nodes.runOf(node)(input.value, input.principal)
 		case "Not":
-			return Effect.map(evaluate(node.condition, input), (value) => !value)
+			return Effect.map(test(node.condition, input), (value) => !value)
 		case "And":
 			return Effect.map(
 				Effect.findFirst(node.conditions, (child) =>
-					Effect.map(evaluate(child, input), (value) => !value),
+					Effect.map(test(child, input), (value) => !value),
 				),
 				Option.isNone,
 			)
 		case "Or":
 			return Effect.map(
-				Effect.findFirst(node.conditions, (child) => evaluate(child, input)),
+				Effect.findFirst(node.conditions, (child) => test(child, input)),
 				Option.isSome,
 			)
 		default:
-			return Effect.sync(() => evaluateSync(node, input))
+			return Effect.sync(() => testSync(node, input))
 	}
 }
 
+/**
+ * Tests a condition with no predicate on a value. The test runs on the
+ * simple form of the condition with the principal in it, as a residual does.
+ * So a test reads only the fields that the residual reads: a read of a field
+ * that is not plain data is a defect, and a field that the answer does not
+ * need, as in `x AND False`, is not read.
+ */
+export const evaluateSync = (node: Node, input: Input): boolean =>
+	testSync(partial(node, input), input)
+
+/** Tests a condition on a value, as {@link evaluateSync} does. */
+export const evaluate = (
+	node: Node,
+	input: Input,
+): Effect.Effect<boolean, unknown, unknown> =>
+	Effect.suspend(() => test(partial(node, input), input))
+
 // The principal and the path
 
 /**

package/src/internal/analysis.ts

@@ -85,6 +85,8 @@ interface ResidualContext {
 	}
 	/** The resource of the kind, for the fields that a rule may grant. */
 	readonly descriptor: Resource.Descriptor
+	/** The test of `RuleData.fitsOf` for the catalog, for this request. */
+	readonly fits: (pattern: string) => boolean
 	/**
 	 * The condition of each rule, with the principal in it. They are made
 	 * first, from a flat list of the rules, so the walk does not go down the
@@ -241,6 +243,7 @@ interface PredicateContext {
 	readonly kind: string
 	readonly field: string | undefined
 	readonly descriptor: Resource.Descriptor
+	readonly fits: (pattern: string) => boolean
 }
 
 /** Tests if a rule that the request may use has a predicate. */
@@ -345,6 +348,7 @@ const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
 		field: request.field,
 		input,
 		descriptor,
+		fits: RuleData.fitsOf(descriptor.catalog),
 	}
 	const context: ResidualContext = {
 		...target,
@@ -378,6 +382,7 @@ const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
 					path: descriptor.path,
 				},
 				descriptor,
+				fits: RuleData.fitsOf(descriptor.catalog),
 				trace: undefined,
 			},
 			[],

package/src/internal/authorizer.ts

@@ -93,19 +93,29 @@ type AnyTarget = {
 
 /**
  * A cache key for a principal. Two keys are equal when they have the same
- * text, so two principals with the same key share one policy. The key also
- * keeps the principal, so the cache can load its policy. A plain `Data` value
- * can not do both, so the key gives its own equality with `Equal.Equal`.
+ * text, so two principals with the same key share one policy. A key from the
+ * JSON form also needs equal decoded principals: a Schema may make data when
+ * it decodes, as `expired` from a time, so one text may give two principals.
+ * The key also keeps the principal, so the cache can load its policy. A plain
+ * `Data` value can not do all this, so the key gives its own equality with
+ * `Equal.Equal`.
  */
 class PrincipalKey implements Equal.Equal {
 	readonly principal: object
 	readonly text: string
-	constructor(principal: object, text: string) {
+	/** The key is the JSON form, so the decoded principals must be equal too. */
+	readonly exact: boolean
+	constructor(principal: object, text: string, exact: boolean) {
 		this.principal = principal
 		this.text = text
+		this.exact = exact
 	}
 	[Equal.symbol](that: unknown): boolean {
-		return that instanceof PrincipalKey && that.text === this.text
+		return (
+			that instanceof PrincipalKey &&
+			that.text === this.text &&
+			(!this.exact || Equal.equals(that.principal, this.principal))
+		)
 	}
 	[Hash.symbol](): number {
 		return Hash.string(this.text)
@@ -160,7 +170,7 @@ const jsonKey = (
 					onFailure: () => undefined,
 					onSuccess: (decoded) =>
 						Equal.equals(decoded, principal)
-							? new PrincipalKey(decoded as object, text)
+							? new PrincipalKey(decoded as object, text, true)
 							: undefined,
 				})
 			},
@@ -226,7 +236,7 @@ export const makeLayer = (
 		const text = custom(principal)
 		return text === undefined
 			? undefined
-			: new PrincipalKey(canonical?.principal ?? principal, text)
+			: new PrincipalKey(canonical?.principal ?? principal, text, false)
 	}
 	return Layer.effect(
 		service,