@nmnmcc/ability 2.0.7 → 2.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +52 -29
- package/dist/Authorizer.d.ts +21 -12
- package/dist/Authorizer.d.ts.map +1 -1
- package/dist/Authorizer.js.map +1 -1
- package/dist/Condition.d.ts +121 -19
- package/dist/Condition.d.ts.map +1 -1
- package/dist/Condition.js +32 -21
- package/dist/Condition.js.map +1 -1
- package/dist/Domain.d.ts +9 -0
- package/dist/Domain.d.ts.map +1 -1
- package/dist/Domain.js +5 -0
- package/dist/Domain.js.map +1 -1
- package/dist/Limits.d.ts +44 -13
- package/dist/Limits.d.ts.map +1 -1
- package/dist/Limits.js +52 -22
- package/dist/Limits.js.map +1 -1
- package/dist/Policy.d.ts +102 -18
- package/dist/Policy.d.ts.map +1 -1
- package/dist/Policy.js +7 -6
- package/dist/Policy.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/internal/algebra.js +2 -2
- package/dist/internal/analysis.js +81 -75
- package/dist/internal/analysis.js.map +1 -1
- package/dist/internal/authorizer.d.ts.map +1 -1
- package/dist/internal/authorizer.js +11 -7
- package/dist/internal/authorizer.js.map +1 -1
- package/dist/internal/bind.js +86 -64
- package/dist/internal/bind.js.map +1 -1
- package/dist/internal/catalog.d.ts +33 -10
- package/dist/internal/catalog.d.ts.map +1 -1
- package/dist/internal/catalog.js +170 -77
- package/dist/internal/catalog.js.map +1 -1
- package/dist/internal/decide.js +27 -31
- package/dist/internal/decide.js.map +1 -1
- package/dist/internal/domain.js +19 -5
- package/dist/internal/domain.js.map +1 -1
- package/dist/internal/json.js +120 -76
- package/dist/internal/json.js.map +1 -1
- package/dist/internal/limits.d.ts +28 -0
- package/dist/internal/limits.d.ts.map +1 -1
- package/dist/internal/limits.js +75 -16
- package/dist/internal/limits.js.map +1 -1
- package/dist/internal/nodes.d.ts.map +1 -1
- package/dist/internal/nodes.js +53 -44
- package/dist/internal/nodes.js.map +1 -1
- package/dist/internal/patterns.js +50 -15
- package/dist/internal/patterns.js.map +1 -1
- package/dist/internal/policy-json.js +169 -127
- package/dist/internal/policy-json.js.map +1 -1
- package/dist/internal/policy-nodes.d.ts.map +1 -1
- package/dist/internal/policy-nodes.js +16 -13
- package/dist/internal/policy-nodes.js.map +1 -1
- package/dist/internal/policy.d.ts.map +1 -1
- package/dist/internal/policy.js +38 -22
- package/dist/internal/policy.js.map +1 -1
- package/dist/internal/resource.js +1 -1
- package/dist/internal/rule.d.ts.map +1 -1
- package/dist/internal/rule.js +6 -5
- package/dist/internal/rule.js.map +1 -1
- package/dist/internal/search.d.ts.map +1 -1
- package/dist/internal/search.js +106 -92
- package/dist/internal/search.js.map +1 -1
- package/dist/internal/trampoline.js +19 -5
- package/dist/internal/trampoline.js.map +1 -1
- package/package.json +1 -1
- package/src/Authorizer.ts +30 -20
- package/src/Condition.ts +317 -86
- package/src/Domain.ts +9 -0
- package/src/Limits.ts +69 -29
- package/src/Policy.ts +143 -21
- package/src/internal/analysis.ts +154 -124
- package/src/internal/authorizer.ts +29 -14
- package/src/internal/bind.ts +193 -136
- package/src/internal/catalog.ts +320 -118
- package/src/internal/decide.ts +61 -50
- package/src/internal/domain.ts +39 -3
- package/src/internal/json.ts +212 -117
- package/src/internal/limits.ts +101 -31
- package/src/internal/nodes.ts +65 -47
- package/src/internal/patterns.ts +79 -25
- package/src/internal/policy-json.ts +266 -197
- package/src/internal/policy-nodes.ts +31 -23
- package/src/internal/policy.ts +63 -23
- package/src/internal/rule.ts +16 -3
- package/src/internal/search.ts +186 -136
- package/src/internal/trampoline.ts +51 -4
package/dist/internal/catalog.js
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { ceilings, exceeded, fieldPathParts } from "./limits.js";
|
|
2
|
+
import { adaptive } from "./trampoline.js";
|
|
3
|
+
import * as Arr from "effect/Array";
|
|
2
4
|
import * as HashMap from "effect/HashMap";
|
|
3
5
|
import * as HashSet from "effect/HashSet";
|
|
4
6
|
import * as Schema from "effect/Schema";
|
|
5
|
-
import * as Arr from "effect/Array";
|
|
6
7
|
import { hasProperty } from "effect/Predicate";
|
|
7
8
|
import * as Option from "effect/Option";
|
|
8
9
|
import * as SchemaAST from "effect/SchemaAST";
|
|
@@ -111,13 +112,28 @@ const classStruct = (ast) => {
|
|
|
111
112
|
* Schema nodes by structure, and a recursive Schema has no end. A suspend
|
|
112
113
|
* node that gives itself again, with no step on the path, gives nothing.
|
|
113
114
|
*/
|
|
114
|
-
const alternatives = (ast, open) => {
|
|
115
|
+
const alternatives = (ast, open) => alternativesOf({
|
|
116
|
+
ast,
|
|
117
|
+
open
|
|
118
|
+
});
|
|
119
|
+
/**
|
|
120
|
+
* The walk of {@link alternatives}. A union may hold a union, very many
|
|
121
|
+
* levels down, so it is a walk of the trampoline for an input of an unknown
|
|
122
|
+
* depth.
|
|
123
|
+
*/
|
|
124
|
+
const alternativesOf = adaptive((R, child) => ({ ast, open }, depth) => {
|
|
115
125
|
switch (ast._tag) {
|
|
116
|
-
case "Union": return
|
|
117
|
-
|
|
118
|
-
|
|
126
|
+
case "Union": return R.map(R.forEach(ast.types, (type) => child({
|
|
127
|
+
ast: type,
|
|
128
|
+
open
|
|
129
|
+
}, depth + 1)), Arr.flatten);
|
|
130
|
+
case "Suspend": return open.has(ast) ? R.succeed([]) : child({
|
|
131
|
+
ast: ast.thunk(),
|
|
132
|
+
open: /* @__PURE__ */ new Set([...open, ast])
|
|
133
|
+
}, depth + 1);
|
|
134
|
+
default: return R.succeed([ast]);
|
|
119
135
|
}
|
|
120
|
-
};
|
|
136
|
+
});
|
|
121
137
|
/** The struct of a Schema: a struct, or the struct of a class. */
|
|
122
138
|
const structOf = (ast) => ast._tag === "Objects" ? ast : ast._tag === "Declaration" ? classStruct(ast) : void 0;
|
|
123
139
|
const hasCheck = (checks, id) => Arr.some(checks, (check) => check.annotations?.representation?.id === id || check._tag === "FilterGroup" && hasCheck(check.checks, id));
|
|
@@ -197,37 +213,13 @@ const namesOf = (structs) => Array.from(new Set(Arr.flatMap(structs, (struct) =>
|
|
|
197
213
|
if (name === "") throw new Error("A field name may not be empty");
|
|
198
214
|
return [name];
|
|
199
215
|
}))));
|
|
200
|
-
/**
|
|
201
|
-
|
|
202
|
-
* number of fields so far. It belongs to one walk, and it stops a Schema with
|
|
203
|
-
* very many fields before the walk is done.
|
|
204
|
-
*/
|
|
205
|
-
const branchOf = (place, count) => {
|
|
216
|
+
/** Works out the facts of a place, and the places below it. */
|
|
217
|
+
const placeOf = (place) => {
|
|
206
218
|
const structs = Arr.filter(Arr.map(place.schemas, structOf), isStruct);
|
|
207
219
|
const values = Arr.filter(place.schemas, (schema) => !isStruct(structOf(schema)));
|
|
208
220
|
const valueKinds = Arr.reduce(values, noKinds, (kinds, schema) => joinKinds(kinds, kindsOf(structOf(schema) ?? schema)));
|
|
209
221
|
const kinds = place.top ? anyKinds : joinKinds(joinKinds(valueKinds, structs.length > 0 ? objectKinds : noKinds), place.missing ? nullKinds : noKinds);
|
|
210
222
|
const records = Arr.filter(structs, (struct) => struct.indexSignatures.length > 0);
|
|
211
|
-
const last = place.path.length === 5;
|
|
212
|
-
const field = place.path.length === 0 ? void 0 : {
|
|
213
|
-
path: place.path,
|
|
214
|
-
text: textOf(place.path),
|
|
215
|
-
kinds,
|
|
216
|
-
listed: values.length > 0 || records.length > 0 || last && structs.length > 0,
|
|
217
|
-
open: records.length > 0 || structs.length > 0 || valueKinds.object || place.top,
|
|
218
|
-
plain: place.plain
|
|
219
|
-
};
|
|
220
|
-
if (field !== void 0) {
|
|
221
|
-
count.size += 1;
|
|
222
|
-
if (count.size > 1e4) throw exceeded("A Schema", "catalogFields", "fields", count.size, catalogFields);
|
|
223
|
-
}
|
|
224
|
-
if (last) return {
|
|
225
|
-
field,
|
|
226
|
-
children: [],
|
|
227
|
-
names: HashMap.empty(),
|
|
228
|
-
key: void 0,
|
|
229
|
-
keyBranch: void 0
|
|
230
|
-
};
|
|
231
223
|
const structProperties = Arr.map(structs, propertiesOf);
|
|
232
224
|
const children = Arr.map(namesOf(structs), (name) => {
|
|
233
225
|
const properties = Arr.flatMap(structProperties, (named) => {
|
|
@@ -235,76 +227,177 @@ const branchOf = (place, count) => {
|
|
|
235
227
|
return property === void 0 ? [] : [property];
|
|
236
228
|
});
|
|
237
229
|
const top = place.top || valueKinds.object || properties.length < structs.length;
|
|
238
|
-
|
|
239
|
-
path: [...place.path, name],
|
|
230
|
+
return [name, {
|
|
240
231
|
schemas: Arr.flatMap(properties, (property) => alternatives(property.type, /* @__PURE__ */ new Set())),
|
|
241
232
|
missing: place.missing || values.length > 0 || Arr.some(properties, (property) => SchemaAST.isOptional(property.type)),
|
|
242
233
|
top,
|
|
243
234
|
plain: place.plain && !top
|
|
244
|
-
};
|
|
245
|
-
return [name, branchOf(below, count)];
|
|
235
|
+
}];
|
|
246
236
|
});
|
|
247
|
-
const names = HashMap.fromIterable(children);
|
|
248
237
|
const signatures = Arr.flatMap(records, (struct) => struct.indexSignatures);
|
|
249
|
-
if (signatures.length === 0) return {
|
|
250
|
-
field,
|
|
251
|
-
children,
|
|
252
|
-
names,
|
|
253
|
-
key: void 0,
|
|
254
|
-
keyBranch: void 0
|
|
255
|
-
};
|
|
256
238
|
const keyTop = place.top || valueKinds.object || records.length < structs.length;
|
|
257
|
-
const key = {
|
|
258
|
-
_tag: "Key",
|
|
259
|
-
parameters: Arr.map(signatures, (signature) => signature.parameter)
|
|
260
|
-
};
|
|
261
239
|
return {
|
|
262
|
-
|
|
240
|
+
branch: {
|
|
241
|
+
kinds,
|
|
242
|
+
values: values.length > 0 || records.length > 0,
|
|
243
|
+
structs: structs.length > 0,
|
|
244
|
+
open: records.length > 0 || structs.length > 0 || valueKinds.object || place.top,
|
|
245
|
+
plain: place.plain,
|
|
246
|
+
key: signatures.length === 0 ? void 0 : {
|
|
247
|
+
_tag: "Key",
|
|
248
|
+
parameters: Arr.map(signatures, (signature) => signature.parameter)
|
|
249
|
+
}
|
|
250
|
+
},
|
|
263
251
|
children,
|
|
264
|
-
|
|
265
|
-
key,
|
|
266
|
-
keyBranch: branchOf({
|
|
267
|
-
path: [...place.path, key],
|
|
252
|
+
keyPlace: signatures.length === 0 ? void 0 : {
|
|
268
253
|
schemas: Arr.flatMap(signatures, (signature) => alternatives(signature.type, /* @__PURE__ */ new Set())),
|
|
269
254
|
missing: true,
|
|
270
255
|
top: keyTop,
|
|
271
256
|
plain: place.plain && !keyTop
|
|
272
|
-
}
|
|
257
|
+
}
|
|
273
258
|
};
|
|
274
259
|
};
|
|
275
|
-
const fieldsOf = (branch) => [
|
|
276
|
-
...branch.field === void 0 ? [] : [branch.field],
|
|
277
|
-
...Arr.flatMap(branch.children, ([, child]) => fieldsOf(child)),
|
|
278
|
-
...branch.keyBranch === void 0 ? [] : fieldsOf(branch.keyBranch)
|
|
279
|
-
];
|
|
280
260
|
/**
|
|
281
|
-
* Makes the
|
|
282
|
-
*
|
|
261
|
+
* Makes the places of a Schema. Each place comes one time: two paths with the
|
|
262
|
+
* same Schemas and the same marks lead to one place. The walk keeps a queue
|
|
263
|
+
* of the places that it has found, and it makes them in order, so a deep
|
|
264
|
+
* Schema does not fill the stack.
|
|
283
265
|
*/
|
|
284
|
-
const
|
|
285
|
-
const
|
|
266
|
+
const branchesOf = (root) => {
|
|
267
|
+
const astIds = /* @__PURE__ */ new Map();
|
|
268
|
+
const placeIds = /* @__PURE__ */ new Map();
|
|
269
|
+
const queue = [];
|
|
270
|
+
const idOf = (place) => {
|
|
271
|
+
const ids = Arr.map(place.schemas, (schema) => {
|
|
272
|
+
const known = astIds.get(schema);
|
|
273
|
+
if (known !== void 0) return known;
|
|
274
|
+
astIds.set(schema, astIds.size);
|
|
275
|
+
return astIds.size - 1;
|
|
276
|
+
});
|
|
277
|
+
const key = `${Array.from(new Set(ids)).sort((a, b) => a - b).join(",")}|${String(place.missing)}|${String(place.top)}|${String(place.plain)}`;
|
|
278
|
+
const known = placeIds.get(key);
|
|
279
|
+
if (known !== void 0) return known;
|
|
280
|
+
if (queue.length >= ceilings.catalogFields) throw exceeded("A Schema", "catalogFields", "places", queue.length + 1, ceilings.catalogFields);
|
|
281
|
+
placeIds.set(key, queue.length);
|
|
282
|
+
queue.push(place);
|
|
283
|
+
return queue.length - 1;
|
|
284
|
+
};
|
|
285
|
+
idOf(root);
|
|
286
|
+
return Arr.unfold(0, (id) => {
|
|
287
|
+
const place = queue[id];
|
|
288
|
+
if (place === void 0) return Option.none();
|
|
289
|
+
const made = placeOf(place);
|
|
290
|
+
const children = Arr.map(made.children, ([name, below]) => [name, idOf(below)]);
|
|
291
|
+
const branch = {
|
|
292
|
+
...made.branch,
|
|
293
|
+
id,
|
|
294
|
+
children,
|
|
295
|
+
names: HashMap.fromIterable(children),
|
|
296
|
+
keyBranch: made.keyPlace === void 0 ? void 0 : idOf(made.keyPlace)
|
|
297
|
+
};
|
|
298
|
+
return Option.some([branch, id + 1]);
|
|
299
|
+
});
|
|
300
|
+
};
|
|
301
|
+
/** The field at a place, for a path. */
|
|
302
|
+
const fieldAt = (branch, path, parts) => ({
|
|
303
|
+
path,
|
|
304
|
+
text: textOf(path),
|
|
305
|
+
kinds: branch.kinds,
|
|
306
|
+
listed: branch.values || path.length === parts && branch.structs,
|
|
307
|
+
open: branch.open,
|
|
308
|
+
plain: branch.plain
|
|
309
|
+
});
|
|
310
|
+
/**
|
|
311
|
+
* The fields that a list shows, a field before the fields below it, down to
|
|
312
|
+
* `parts` parts. A path goes into a place that is on it already one time
|
|
313
|
+
* only, so the list of a recursive Schema is finite. The walk keeps a stack
|
|
314
|
+
* of the places to visit, so a deep Schema does not fill the stack. The
|
|
315
|
+
* stack belongs to this walk.
|
|
316
|
+
*/
|
|
317
|
+
const listOf = (branches, parts) => {
|
|
318
|
+
const below = (visit) => {
|
|
319
|
+
const { branch, path } = visit;
|
|
320
|
+
if (path.length === parts || path.length > 0 && HashSet.has(visit.above, branch.id)) return [];
|
|
321
|
+
const above = HashSet.add(visit.above, branch.id);
|
|
322
|
+
const named = Arr.map(branch.children, ([name, id]) => ({
|
|
323
|
+
branch: branches[id],
|
|
324
|
+
path: [...path, name],
|
|
325
|
+
above
|
|
326
|
+
}));
|
|
327
|
+
return branch.key === void 0 || branch.keyBranch === void 0 ? named : [...named, {
|
|
328
|
+
branch: branches[branch.keyBranch],
|
|
329
|
+
path: [...path, branch.key],
|
|
330
|
+
above
|
|
331
|
+
}];
|
|
332
|
+
};
|
|
333
|
+
const stack = [{
|
|
334
|
+
branch: branches[0],
|
|
286
335
|
path: [],
|
|
336
|
+
above: HashSet.empty()
|
|
337
|
+
}];
|
|
338
|
+
return Arr.flatten(Arr.unfold(stack, (rest) => {
|
|
339
|
+
const visit = rest.pop();
|
|
340
|
+
if (visit === void 0) return Option.none();
|
|
341
|
+
Arr.forEach(Arr.reverse(below(visit)), (next) => {
|
|
342
|
+
rest.push(next);
|
|
343
|
+
});
|
|
344
|
+
const field = visit.path.length === 0 ? [] : [fieldAt(visit.branch, visit.path, parts)];
|
|
345
|
+
if (field.length > 0 && rest.length + 1 > ceilings.catalogFields) throw exceeded("A Schema", "catalogFields", "fields", rest.length + 1, ceilings.catalogFields);
|
|
346
|
+
return Option.some([field, rest]);
|
|
347
|
+
}));
|
|
348
|
+
};
|
|
349
|
+
/**
|
|
350
|
+
* The fields that a list shows for paths of at most `parts` parts, as for a
|
|
351
|
+
* domain with that limit. See `Catalog.fields`.
|
|
352
|
+
*/
|
|
353
|
+
const fieldsOf = (catalog, parts) => parts === fieldPathParts ? catalog.fields : listOf(catalog.branches, parts);
|
|
354
|
+
/**
|
|
355
|
+
* Makes the catalog of a Schema, with the list of its fields for the default
|
|
356
|
+
* limit of the parts of a path. It throws when a field name has a dot or is
|
|
357
|
+
* empty, and when the Schema has more places or fields than the ceiling of
|
|
358
|
+
* `catalogFields`. A domain checks the size of the list with its own limit.
|
|
359
|
+
*/
|
|
360
|
+
const catalogOf = (ast) => {
|
|
361
|
+
const branches = branchesOf({
|
|
287
362
|
schemas: alternatives(ast, /* @__PURE__ */ new Set()),
|
|
288
363
|
missing: false,
|
|
289
364
|
top: false,
|
|
290
365
|
plain: true
|
|
291
|
-
}
|
|
366
|
+
});
|
|
292
367
|
return {
|
|
293
|
-
fields:
|
|
294
|
-
|
|
368
|
+
fields: listOf(branches, fieldPathParts),
|
|
369
|
+
branches,
|
|
370
|
+
edges: Arr.reduce(branches, 0, (total, branch) => total + branch.children.length + (branch.keyBranch === void 0 ? 0 : 1)),
|
|
371
|
+
root: branches[0]
|
|
295
372
|
};
|
|
296
373
|
};
|
|
297
|
-
/**
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
301
|
-
|
|
374
|
+
/**
|
|
375
|
+
* Gives the field of a catalog at a path with dots, if the catalog has it.
|
|
376
|
+
* A path has at most `parts` parts. The lookup follows one place for each
|
|
377
|
+
* part, in a loop.
|
|
378
|
+
*/
|
|
379
|
+
const lookup = (catalog, path, parts = fieldPathParts) => {
|
|
380
|
+
const names = path.split(".", parts + 1);
|
|
381
|
+
if (names.length > parts) return;
|
|
382
|
+
const found = Arr.reduce(names, {
|
|
383
|
+
branch: catalog.root,
|
|
384
|
+
path: []
|
|
385
|
+
}, (current, name) => {
|
|
302
386
|
if (current === void 0) return;
|
|
303
|
-
const named = HashMap.get(current.names, name);
|
|
304
|
-
if (Option.isSome(named)) return
|
|
305
|
-
|
|
306
|
-
|
|
387
|
+
const named = HashMap.get(current.branch.names, name);
|
|
388
|
+
if (Option.isSome(named)) return {
|
|
389
|
+
branch: catalog.branches[named.value],
|
|
390
|
+
path: [...current.path, name]
|
|
391
|
+
};
|
|
392
|
+
const key = current.branch.key;
|
|
393
|
+
const keyBranch = current.branch.keyBranch;
|
|
394
|
+
return key !== void 0 && keyBranch !== void 0 && keyFits(key, name) ? {
|
|
395
|
+
branch: catalog.branches[keyBranch],
|
|
396
|
+
path: [...current.path, key]
|
|
397
|
+
} : void 0;
|
|
398
|
+
});
|
|
399
|
+
return found === void 0 ? void 0 : fieldAt(found.branch, found.path, parts);
|
|
307
400
|
};
|
|
308
|
-
export { accepts, anyKinds, catalogOf, fitsNumber, joinKinds, keyFits, lookup, noKinds };
|
|
401
|
+
export { accepts, anyKinds, catalogOf, fieldsOf, fitsNumber, joinKinds, keyFits, lookup, noKinds };
|
|
309
402
|
|
|
310
403
|
//# sourceMappingURL=catalog.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"catalog.js","names":["Limits.exceeded","Limits.catalogFields"],"sources":["../../src/internal/catalog.ts"],"sourcesContent":["/**\n * The catalog of the fields of a Schema. One walk over the Schema makes it,\n * and every question about the fields of a resource or of the principal reads\n * it: which names a rule may use, which values a field may hold, which fields\n * a pattern fits, and which fields a list of permitted fields shows.\n *\n * The catalog describes the shape of the values, not the checks of the\n * Schema. A check, such as a minimum length, only keeps some values out, so a\n * catalog that leaves the checks out holds every real value and more. An\n * answer that holds for all of these values, as `All` and `None` of a\n * coverage do, then holds for the real values too.\n */\nimport * as Arr from \"effect/Array\"\nimport * as HashMap from \"effect/HashMap\"\nimport * as HashSet from \"effect/HashSet\"\nimport * as Option from \"effect/Option\"\nimport { hasProperty } from \"effect/Predicate\"\nimport * as Schema from \"effect/Schema\"\nimport * as SchemaAST from \"effect/SchemaAST\"\nimport * as Limits from \"./limits.ts\"\n\n/** The kinds of values that a field may hold. */\nexport interface Kinds {\n\t/** The field may be `null`, `undefined` or missing. */\n\treadonly null: boolean\n\treadonly boolean: boolean\n\t/** The field may hold any string. */\n\treadonly string: boolean\n\t/** The numbers that the field may hold. */\n\treadonly number: \"none\" | \"integer\" | \"finite\" | \"any\"\n\t/** The field may hold an object, or a value that is not a scalar. */\n\treadonly object: boolean\n\t/** Single values that the field may hold, other than the ones above. */\n\treadonly literals: ReadonlyArray<string | number | boolean>\n}\n\n/** No value: the kinds of a field of `Schema.Never`. */\nexport const noKinds: Kinds = {\n\tnull: false,\n\tboolean: false,\n\tstring: false,\n\tnumber: \"none\",\n\tobject: false,\n\tliterals: [],\n}\n\n/** Any value. */\nexport const anyKinds: Kinds = {\n\tnull: true,\n\tboolean: true,\n\tstring: true,\n\tnumber: \"any\",\n\tobject: true,\n\tliterals: [],\n}\n\nconst nullKinds: Kinds = { ...noKinds, null: true }\nconst objectKinds: Kinds = { ...noKinds, object: true }\n\nconst numberOrder = [\"none\", \"integer\", \"finite\", \"any\"] as const\n\n/** The kinds of a field that may hold a value of `left` or of `right`. */\nexport const joinKinds = (left: Kinds, right: Kinds): Kinds => ({\n\tnull: left.null || right.null,\n\tboolean: left.boolean || right.boolean,\n\tstring: left.string || right.string,\n\tnumber:\n\t\tnumberOrder.indexOf(left.number) >= numberOrder.indexOf(right.number)\n\t\t\t? left.number\n\t\t\t: right.number,\n\tobject: left.object || right.object,\n\t// A native `Set` finds copies about ten times as fast as `Arr.dedupe`. It\n\t// takes `0` and `-0` as one, as `includes` does when a test reads them.\n\tliterals: Array.from(new Set([...left.literals, ...right.literals])),\n})\n\n/** Tests if a number fits the numbers of a field. */\nexport const fitsNumber = (number: Kinds[\"number\"], value: number): boolean => {\n\tswitch (number) {\n\t\tcase \"none\":\n\t\t\treturn false\n\t\tcase \"integer\":\n\t\t\treturn Number.isInteger(value)\n\t\tcase \"finite\":\n\t\t\treturn Number.isFinite(value)\n\t\tcase \"any\":\n\t\t\treturn true\n\t}\n}\n\n/**\n * Tests if a field with these kinds may hold a value. A missing value and\n * `undefined` are `null`.\n */\nexport const accepts = (kinds: Kinds, value: unknown): boolean => {\n\tif (value === null || value === undefined) {\n\t\treturn kinds.null\n\t}\n\tswitch (typeof value) {\n\t\tcase \"boolean\":\n\t\t\treturn kinds.boolean || kinds.literals.includes(value)\n\t\tcase \"string\":\n\t\t\treturn kinds.string || kinds.literals.includes(value)\n\t\tcase \"number\":\n\t\t\treturn fitsNumber(kinds.number, value) || kinds.literals.includes(value)\n\t\tdefault:\n\t\t\treturn kinds.object\n\t}\n}\n\n/** A part of a field path that stands for any key of a record. */\nexport interface Key {\n\treadonly _tag: \"Key\"\n\t/** The Schemas of the keys. A key must fit one of them. */\n\treadonly parameters: ReadonlyArray<SchemaAST.AST>\n}\n\n/** One part of a field path: a name, or any key of a record. */\nexport type Segment = string | Key\n\n/** One field of a catalog. */\nexport interface Field {\n\treadonly path: ReadonlyArray<Segment>\n\t/** The path with dots, and `*` for a key of a record. */\n\treadonly text: string\n\treadonly kinds: Kinds\n\t/**\n\t * The field holds a value that a list of fields shows as one field: a\n\t * scalar, a record, an array, or a struct at the last part a path may have.\n\t */\n\treadonly listed: boolean\n\t/** The field may hold parts that the Schema does not name, as a record may. */\n\treadonly open: boolean\n\t/**\n\t * A read of the field finds only plain data. It is `false` when a value\n\t * above the field may be an object that does not have it as a data field:\n\t * a class without the field, which may have a getter of that name, a\n\t * value such as a date or a list, or any object, as of `Schema.Unknown`.\n\t * A decode or a `make` copies a struct or a record into a plain object,\n\t * so a struct without the field gives `null` for it.\n\t */\n\treadonly plain: boolean\n}\n\n/** A place in the tree of a catalog, with the places below it. */\nexport interface Branch {\n\t/** The field at this place. The root has none. */\n\treadonly field: Field | undefined\n\t/** The places below, by name, in the order of the Schema. */\n\treadonly children: ReadonlyArray<readonly [string, Branch]>\n\t/**\n\t * The places below, by name. A lookup gets each name from `split`, as a\n\t * new string, and a `HashMap` finds a new string about 20% faster than a\n\t * native `Map`. The names come from the Schema, so a name from a policy\n\t * can not make a long list of names with one hash here.\n\t */\n\treadonly names: HashMap.HashMap<string, Branch>\n\t/** The place for the keys of a record, when the value may be a record. */\n\treadonly key: Key | undefined\n\treadonly keyBranch: Branch | undefined\n}\n\n/** The catalog of the fields of a Schema. */\nexport interface Catalog {\n\t/** Every field, a field before the fields below it. */\n\treadonly fields: ReadonlyArray<Field>\n\treadonly root: Branch\n}\n\n/**\n * Tests if a key of an object fits the Schemas of the keys of a record. A key\n * of an object is a string, also a key that a number Schema takes: `{ 1: \"a\" }`\n * has the key `\"1\"`. So a key that is the text of a number is tried as that\n * number too.\n */\nexport const keyFits = (key: Key, name: string): boolean =>\n\tArr.some(key.parameters, (parameter) => {\n\t\tconst is = Schema.is(Schema.make(parameter))\n\t\treturn (\n\t\t\tis(name) ||\n\t\t\t(name !== \"\" && String(Number(name)) === name && is(Number(name)))\n\t\t)\n\t})\n\n/**\n * Gives the struct of a `Schema.Class`. A class is a declaration with one\n * struct as its type parameter, and Effect marks it with a `\"~constructor\"`\n * annotation, also through more codec steps, as in\n * `Schema.fromJsonString(User)`. Other declarations, such as `Schema.Option`\n * or `Schema.ReadonlyMap`, have no such mark, and the fields of their type\n * parameter are not fields of the value.\n */\nconst classStruct = (\n\tast: SchemaAST.Declaration,\n): SchemaAST.Objects | undefined => {\n\tconst [inner] = ast.typeParameters\n\treturn ast.annotations?.[\"~constructor\"] !== undefined &&\n\t\tast.typeParameters.length === 1 &&\n\t\tinner?._tag === \"Objects\"\n\t\t? inner\n\t\t: undefined\n}\n\n/**\n * Gives the Schemas that a value at one place may fit: it opens unions and\n * `Schema.suspend`. A class stays a class: see {@link structOf}. The open suspend nodes are in a native `Set`,\n * because the walk must find a node by the node itself: `Equal` compares\n * Schema nodes by structure, and a recursive Schema has no end. A suspend\n * node that gives itself again, with no step on the path, gives nothing.\n */\nconst alternatives = (\n\tast: SchemaAST.AST,\n\topen: ReadonlySet<SchemaAST.AST>,\n): ReadonlyArray<SchemaAST.AST> => {\n\tswitch (ast._tag) {\n\t\tcase \"Union\":\n\t\t\treturn Arr.flatMap(ast.types, (type) => alternatives(type, open))\n\t\tcase \"Suspend\":\n\t\t\treturn open.has(ast)\n\t\t\t\t? []\n\t\t\t\t: alternatives(ast.thunk(), new Set([...open, ast]))\n\t\tdefault:\n\t\t\treturn [ast]\n\t}\n}\n\n/** The struct of a Schema: a struct, or the struct of a class. */\nconst structOf = (ast: SchemaAST.AST): SchemaAST.Objects | undefined =>\n\tast._tag === \"Objects\"\n\t\t? ast\n\t\t: ast._tag === \"Declaration\"\n\t\t\t? classStruct(ast)\n\t\t\t: undefined\n\nconst hasCheck = (\n\tchecks: ReadonlyArray<SchemaAST.Check<never>>,\n\tid: string,\n): boolean =>\n\tArr.some(\n\t\tchecks,\n\t\t(check) =>\n\t\t\tcheck.annotations?.representation?.id === id ||\n\t\t\t(check._tag === \"FilterGroup\" && hasCheck(check.checks, id)),\n\t)\n\n/** A struct with named fields, or with the keys of a record. */\nconst isStruct = (\n\tast: SchemaAST.Objects | undefined,\n): ast is SchemaAST.Objects =>\n\tast !== undefined &&\n\t(ast.propertySignatures.length > 0 || ast.indexSignatures.length > 0)\n\n/** The kinds of the values of a Schema that is not a struct. */\nconst kindsOf = (ast: SchemaAST.AST): Kinds => {\n\tswitch (ast._tag) {\n\t\tcase \"Null\":\n\t\tcase \"Undefined\":\n\t\t\treturn nullKinds\n\t\tcase \"Never\":\n\t\t\treturn noKinds\n\t\tcase \"String\":\n\t\tcase \"TemplateLiteral\":\n\t\t\treturn { ...noKinds, string: true }\n\t\tcase \"Boolean\":\n\t\t\treturn { ...noKinds, boolean: true }\n\t\tcase \"Number\": {\n\t\t\t// The two checks that a search uses. Effect names a number with\n\t\t\t// them, as `Schema.Int` and `Schema.Finite`; other checks are left\n\t\t\t// out, as all checks are.\n\t\t\tconst checks = ast.checks ?? []\n\t\t\treturn {\n\t\t\t\t...noKinds,\n\t\t\t\tnumber: hasCheck(checks, \"effect/schema/isInt\")\n\t\t\t\t\t? \"integer\"\n\t\t\t\t\t: hasCheck(checks, \"effect/schema/isFinite\")\n\t\t\t\t\t\t? \"finite\"\n\t\t\t\t\t\t: \"any\",\n\t\t\t}\n\t\t}\n\t\tcase \"Literal\":\n\t\t\treturn typeof ast.literal === \"bigint\"\n\t\t\t\t? objectKinds\n\t\t\t\t: { ...noKinds, literals: [ast.literal] }\n\t\tcase \"Enum\":\n\t\t\treturn { ...noKinds, literals: Arr.map(ast.enums, ([, value]) => value) }\n\t\tcase \"Arrays\":\n\t\tcase \"ObjectKeyword\":\n\t\tcase \"BigInt\":\n\t\tcase \"Symbol\":\n\t\tcase \"UniqueSymbol\":\n\t\t\treturn objectKinds\n\t\tcase \"Declaration\":\n\t\t\t// A declaration of Effect in `objectDeclarations` holds an object,\n\t\t\t// such as a `Date`. Another declaration may hold any value, as\n\t\t\t// `Schema.Json` or one from `Schema.declare` may.\n\t\t\treturn HashSet.has(objectDeclarations, declarationId(ast))\n\t\t\t\t? objectKinds\n\t\t\t\t: anyKinds\n\t\tdefault:\n\t\t\t// `Schema.Unknown`, `Schema.Void`, and `Struct({})`, which takes a\n\t\t\t// string too: these may hold any value.\n\t\t\treturn anyKinds\n\t}\n}\n\n/**\n * The ids of the declarations of Effect that hold only objects. Effect puts\n * the id in the `representation` annotation. A declaration that is not in\n * this list may hold a scalar, as `Schema.Json` may, so its kinds are any\n * value.\n */\nconst objectDeclarations = HashSet.make(\n\t\"effect/schema/Date\",\n\t\"effect/schema/URL\",\n\t\"effect/schema/Uint8Array\",\n\t\"effect/schema/Duration\",\n\t\"effect/schema/DateTimeUtc\",\n\t\"effect/schema/DateTimeZoned\",\n\t\"effect/schema/BigDecimal\",\n\t\"effect/schema/Redacted\",\n\t\"effect/schema/Cause\",\n\t\"effect/schema/Chunk\",\n\t\"effect/schema/HashMap\",\n\t\"effect/schema/HashSet\",\n\t\"effect/schema/ReadonlyMap\",\n\t\"effect/schema/ReadonlySet\",\n\t\"effect/schema/Option\",\n\t\"effect/schema/Result\",\n\t\"effect/schema/Exit\",\n\t\"effect/schema/File\",\n\t\"effect/schema/FormData\",\n\t\"effect/schema/RegExp\",\n\t\"effect/schema/URLSearchParams\",\n)\n\nconst declarationId = (ast: SchemaAST.Declaration): string | undefined => {\n\tconst representation: unknown = ast.annotations?.[\"representation\"]\n\treturn hasProperty(representation, \"id\") &&\n\t\ttypeof representation.id === \"string\"\n\t\t? representation.id\n\t\t: undefined\n}\n\n/** The things that a walk of the catalog knows at one place. */\ninterface Place {\n\treadonly path: ReadonlyArray<Segment>\n\treadonly schemas: ReadonlyArray<SchemaAST.AST>\n\t/** The value may be missing. */\n\treadonly missing: boolean\n\t/** The value may be anything, as an extra field of a struct may be. */\n\treadonly top: boolean\n\t/** A read here finds only plain data: see {@link Field.plain}. */\n\treadonly plain: boolean\n}\n\nconst textOf = (path: ReadonlyArray<Segment>): string =>\n\tArr.map(path, (segment) =>\n\t\ttypeof segment === \"string\" ? segment : \"*\",\n\t).join(\".\")\n\n/**\n * The name of a property as a part of a path. A key of an object is a string,\n * so a number key, as from `Schema.Record(Schema.Literal(1), ...)`, has the\n * name `\"1\"`. A symbol key is not a field.\n */\nconst nameOf = (signature: SchemaAST.PropertySignature): string | undefined =>\n\ttypeof signature.name === \"symbol\" ? undefined : String(signature.name)\n\n/**\n * The properties of a struct by name. A walk makes it one time for each\n * struct of a place, so a struct with very many fields does not take a\n * search for each name. It is a native `Map`, as `Branch.names` is.\n */\nconst propertiesOf = (\n\tstruct: SchemaAST.Objects,\n): ReadonlyMap<string, SchemaAST.PropertySignature> =>\n\tnew Map(\n\t\tArr.flatMap(struct.propertySignatures, (signature) => {\n\t\t\tconst name = nameOf(signature)\n\t\t\treturn name === undefined ? [] : [[name, signature] as const]\n\t\t}),\n\t)\n\n/** The names of the fields of the structs, in the order that they first come. */\nconst namesOf = (\n\tstructs: ReadonlyArray<SchemaAST.Objects>,\n): ReadonlyArray<string> =>\n\t// A native `Set` keeps the first copy of each name, in order, about ten\n\t// times as fast as `Arr.dedupe`.\n\tArray.from(\n\t\tnew Set(\n\t\t\tArr.flatMap(structs, (struct) =>\n\t\t\t\tArr.flatMap(struct.propertySignatures, (signature) => {\n\t\t\t\t\tconst name = nameOf(signature)\n\t\t\t\t\tif (name === undefined) {\n\t\t\t\t\t\treturn []\n\t\t\t\t\t}\n\t\t\t\t\t// A dot in a path is the step into a nested field. A field name with\n\t\t\t\t\t// a dot would make two fields have one path, so it is a defect.\n\t\t\t\t\tif (name.includes(\".\")) {\n\t\t\t\t\t\tthrow new Error(`A field name may not have a dot: \"${name}\"`)\n\t\t\t\t\t}\n\t\t\t\t\t// An empty name would make an empty part in a path, such as\n\t\t\t\t\t// `.secret`.\n\t\t\t\t\tif (name === \"\") {\n\t\t\t\t\t\tthrow new Error(\"A field name may not be empty\")\n\t\t\t\t\t}\n\t\t\t\t\treturn [name]\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t)\n\n/**\n * Makes the branch of a place, with the branches below it. `count` is the\n * number of fields so far. It belongs to one walk, and it stops a Schema with\n * very many fields before the walk is done.\n */\nconst branchOf = (place: Place, count: { size: number }): Branch => {\n\tconst structs = Arr.filter(Arr.map(place.schemas, structOf), isStruct)\n\tconst values = Arr.filter(\n\t\tplace.schemas,\n\t\t(schema) => !isStruct(structOf(schema)),\n\t)\n\tconst valueKinds = Arr.reduce(values, noKinds, (kinds, schema) =>\n\t\tjoinKinds(kinds, kindsOf(structOf(schema) ?? schema)),\n\t)\n\tconst kinds = place.top\n\t\t? anyKinds\n\t\t: joinKinds(\n\t\t\t\tjoinKinds(valueKinds, structs.length > 0 ? objectKinds : noKinds),\n\t\t\t\tplace.missing ? nullKinds : noKinds,\n\t\t\t)\n\tconst records = Arr.filter(\n\t\tstructs,\n\t\t(struct) => struct.indexSignatures.length > 0,\n\t)\n\t// The last part that a path may have: the walk does not go below it.\n\tconst last = place.path.length === Limits.fieldPathParts\n\tconst field: Field | undefined =\n\t\tplace.path.length === 0\n\t\t\t? undefined\n\t\t\t: {\n\t\t\t\t\tpath: place.path,\n\t\t\t\t\ttext: textOf(place.path),\n\t\t\t\t\tkinds,\n\t\t\t\t\tlisted:\n\t\t\t\t\t\tvalues.length > 0 ||\n\t\t\t\t\t\trecords.length > 0 ||\n\t\t\t\t\t\t(last && structs.length > 0),\n\t\t\t\t\t// A field that is a scalar in one branch of a union and a struct\n\t\t\t\t\t// in another holds parts too.\n\t\t\t\t\topen:\n\t\t\t\t\t\trecords.length > 0 ||\n\t\t\t\t\t\tstructs.length > 0 ||\n\t\t\t\t\t\tvalueKinds.object ||\n\t\t\t\t\t\tplace.top,\n\t\t\t\t\tplain: place.plain,\n\t\t\t\t}\n\tif (field !== undefined) {\n\t\tcount.size += 1\n\t\tif (count.size > Limits.catalogFields) {\n\t\t\tthrow Limits.exceeded(\n\t\t\t\t\"A Schema\",\n\t\t\t\t\"catalogFields\",\n\t\t\t\t\"fields\",\n\t\t\t\tcount.size,\n\t\t\t\tLimits.catalogFields,\n\t\t\t)\n\t\t}\n\t}\n\tif (last) {\n\t\treturn {\n\t\t\tfield,\n\t\t\tchildren: [],\n\t\t\tnames: HashMap.empty(),\n\t\t\tkey: undefined,\n\t\t\tkeyBranch: undefined,\n\t\t}\n\t}\n\tconst structProperties = Arr.map(structs, propertiesOf)\n\tconst children = Arr.map(namesOf(structs), (name) => {\n\t\tconst properties = Arr.flatMap(structProperties, (named) => {\n\t\t\tconst property = named.get(name)\n\t\t\treturn property === undefined ? [] : [property]\n\t\t})\n\t\t// A struct without the name may still have it as an extra field, with\n\t\t// any value: only a decode or a `make` takes extra fields away, and a\n\t\t// decision may get a value made by hand. A value that may be any\n\t\t// object, as one of `Schema.Unknown` may, may have the name with any\n\t\t// value too.\n\t\tconst top =\n\t\t\tplace.top || valueKinds.object || properties.length < structs.length\n\t\tconst below: Place = {\n\t\t\tpath: [...place.path, name],\n\t\t\tschemas: Arr.flatMap(properties, (property) =>\n\t\t\t\talternatives(property.type, new Set()),\n\t\t\t),\n\t\t\t// A field below a value that is not a struct reads `null`, and so\n\t\t\t// does a field that may be missing.\n\t\t\tmissing:\n\t\t\t\tplace.missing ||\n\t\t\t\tvalues.length > 0 ||\n\t\t\t\tArr.some(properties, (property) => SchemaAST.isOptional(property.type)),\n\t\t\ttop,\n\t\t\t// A value that may be anything may be a list, or have a getter, so\n\t\t\t// a read below it may not find plain data.\n\t\t\tplain: place.plain && !top,\n\t\t}\n\t\treturn [name, branchOf(below, count)] as const\n\t})\n\tconst names = HashMap.fromIterable(children)\n\tconst signatures = Arr.flatMap(records, (struct) => struct.indexSignatures)\n\tif (signatures.length === 0) {\n\t\treturn { field, children, names, key: undefined, keyBranch: undefined }\n\t}\n\tconst keyTop =\n\t\tplace.top || valueKinds.object || records.length < structs.length\n\tconst key: Key = {\n\t\t_tag: \"Key\",\n\t\tparameters: Arr.map(signatures, (signature) => signature.parameter),\n\t}\n\tconst keyBranch = branchOf(\n\t\t{\n\t\t\tpath: [...place.path, key],\n\t\t\tschemas: Arr.flatMap(signatures, (signature) =>\n\t\t\t\talternatives(signature.type, new Set()),\n\t\t\t),\n\t\t\t// A record may not have a given key.\n\t\t\tmissing: true,\n\t\t\ttop: keyTop,\n\t\t\tplain: place.plain && !keyTop,\n\t\t},\n\t\tcount,\n\t)\n\treturn { field, children, names, key, keyBranch }\n}\n\nconst fieldsOf = (branch: Branch): ReadonlyArray<Field> => [\n\t...(branch.field === undefined ? [] : [branch.field]),\n\t...Arr.flatMap(branch.children, ([, child]) => fieldsOf(child)),\n\t...(branch.keyBranch === undefined ? [] : fieldsOf(branch.keyBranch)),\n]\n\n/**\n * Makes the catalog of a Schema. It throws when a field name has a dot or is\n * empty, and when the Schema has more fields than `catalogFields`.\n */\nexport const catalogOf = (ast: SchemaAST.AST): Catalog => {\n\tconst root = branchOf(\n\t\t{\n\t\t\tpath: [],\n\t\t\tschemas: alternatives(ast, new Set()),\n\t\t\tmissing: false,\n\t\t\ttop: false,\n\t\t\tplain: true,\n\t\t},\n\t\t{ size: 0 },\n\t)\n\treturn { fields: fieldsOf(root), root }\n}\n\n/** Gives the field of a catalog at a path with dots, if the catalog has it. */\nexport const lookup = (catalog: Catalog, path: string): Field | undefined => {\n\tconst names = path.split(\".\", Limits.fieldPathParts + 1)\n\tif (names.length > Limits.fieldPathParts) {\n\t\treturn undefined\n\t}\n\tconst branch = Arr.reduce(\n\t\tnames,\n\t\tcatalog.root as Branch | undefined,\n\t\t(current, name) => {\n\t\t\tif (current === undefined) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\tconst named = HashMap.get(current.names, name)\n\t\t\tif (Option.isSome(named)) {\n\t\t\t\treturn named.value\n\t\t\t}\n\t\t\treturn current.key !== undefined && keyFits(current.key, name)\n\t\t\t\t? current.keyBranch\n\t\t\t\t: undefined\n\t\t},\n\t)\n\treturn branch?.field\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,UAAiB;CAC7B,MAAM;CACN,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,UAAU,CAAC;AACZ;;AAGA,MAAa,WAAkB;CAC9B,MAAM;CACN,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,UAAU,CAAC;AACZ;AAEA,MAAM,YAAmB;CAAE,GAAG;CAAS,MAAM;AAAK;AAClD,MAAM,cAAqB;CAAE,GAAG;CAAS,QAAQ;AAAK;AAEtD,MAAM,cAAc;CAAC;CAAQ;CAAW;CAAU;AAAK;;AAGvD,MAAa,aAAa,MAAa,WAAyB;CAC/D,MAAM,KAAK,QAAQ,MAAM;CACzB,SAAS,KAAK,WAAW,MAAM;CAC/B,QAAQ,KAAK,UAAU,MAAM;CAC7B,QACC,YAAY,QAAQ,KAAK,MAAM,KAAK,YAAY,QAAQ,MAAM,MAAM,IACjE,KAAK,SACL,MAAM;CACV,QAAQ,KAAK,UAAU,MAAM;CAG7B,UAAU,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU,GAAG,MAAM,QAAQ,CAAC,CAAC;AACpE;;AAGA,MAAa,cAAc,QAAyB,UAA2B;CAC9E,QAAQ,QAAR;EACC,KAAK,QACJ,OAAO;EACR,KAAK,WACJ,OAAO,OAAO,UAAU,KAAK;EAC9B,KAAK,UACJ,OAAO,OAAO,SAAS,KAAK;EAC7B,KAAK,OACJ,OAAO;CACT;AACD;;;;;AAMA,MAAa,WAAW,OAAc,UAA4B;CACjE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAC/B,OAAO,MAAM;CAEd,QAAQ,OAAO,OAAf;EACC,KAAK,WACJ,OAAO,MAAM,WAAW,MAAM,SAAS,SAAS,KAAK;EACtD,KAAK,UACJ,OAAO,MAAM,UAAU,MAAM,SAAS,SAAS,KAAK;EACrD,KAAK,UACJ,OAAO,WAAW,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS,KAAK;EACxE,SACC,OAAO,MAAM;CACf;AACD;;;;;;;AAmEA,MAAa,WAAW,KAAU,SACjC,IAAI,KAAK,IAAI,aAAa,cAAc;CACvC,MAAM,KAAK,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC;CAC3C,OACC,GAAG,IAAI,KACN,SAAS,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC;AAElE,CAAC;;;;;;;;;AAUF,MAAM,eACL,QACmC;CACnC,MAAM,CAAC,SAAS,IAAI;CACpB,OAAO,IAAI,cAAc,oBAAoB,KAAA,KAC5C,IAAI,eAAe,WAAW,KAC9B,OAAO,SAAS,YACd,QACA,KAAA;AACJ;;;;;;;;AASA,MAAM,gBACL,KACA,SACkC;CAClC,QAAQ,IAAI,MAAZ;EACC,KAAK,SACJ,OAAO,IAAI,QAAQ,IAAI,QAAQ,SAAS,aAAa,MAAM,IAAI,CAAC;EACjE,KAAK,WACJ,OAAO,KAAK,IAAI,GAAG,IAChB,CAAC,IACD,aAAa,IAAI,MAAM,mBAAG,IAAI,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;EACrD,SACC,OAAO,CAAC,GAAG;CACb;AACD;;AAGA,MAAM,YAAY,QACjB,IAAI,SAAS,YACV,MACA,IAAI,SAAS,gBACZ,YAAY,GAAG,IACf,KAAA;AAEL,MAAM,YACL,QACA,OAEA,IAAI,KACH,SACC,UACA,MAAM,aAAa,gBAAgB,OAAO,MACzC,MAAM,SAAS,iBAAiB,SAAS,MAAM,QAAQ,EAAE,CAC5D;;AAGD,MAAM,YACL,QAEA,QAAQ,KAAA,MACP,IAAI,mBAAmB,SAAS,KAAK,IAAI,gBAAgB,SAAS;;AAGpE,MAAM,WAAW,QAA8B;CAC9C,QAAQ,IAAI,MAAZ;EACC,KAAK;EACL,KAAK,aACJ,OAAO;EACR,KAAK,SACJ,OAAO;EACR,KAAK;EACL,KAAK,mBACJ,OAAO;GAAE,GAAG;GAAS,QAAQ;EAAK;EACnC,KAAK,WACJ,OAAO;GAAE,GAAG;GAAS,SAAS;EAAK;EACpC,KAAK,UAAU;GAId,MAAM,SAAS,IAAI,UAAU,CAAC;GAC9B,OAAO;IACN,GAAG;IACH,QAAQ,SAAS,QAAQ,qBAAqB,IAC3C,YACA,SAAS,QAAQ,wBAAwB,IACxC,WACA;GACL;EACD;EACA,KAAK,WACJ,OAAO,OAAO,IAAI,YAAY,WAC3B,cACA;GAAE,GAAG;GAAS,UAAU,CAAC,IAAI,OAAO;EAAE;EAC1C,KAAK,QACJ,OAAO;GAAE,GAAG;GAAS,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,WAAW,KAAK;EAAE;EACzE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,gBACJ,OAAO;EACR,KAAK,eAIJ,OAAO,QAAQ,IAAI,oBAAoB,cAAc,GAAG,CAAC,IACtD,cACA;EACJ,SAGC,OAAO;CACT;AACD;;;;;;;AAQA,MAAM,qBAAqB,QAAQ,KAClC,sBACA,qBACA,4BACA,0BACA,6BACA,+BACA,4BACA,0BACA,uBACA,uBACA,yBACA,yBACA,6BACA,6BACA,wBACA,wBACA,sBACA,sBACA,0BACA,wBACA,+BACD;AAEA,MAAM,iBAAiB,QAAmD;CACzE,MAAM,iBAA0B,IAAI,cAAc;CAClD,OAAO,YAAY,gBAAgB,IAAI,KACtC,OAAO,eAAe,OAAO,WAC3B,eAAe,KACf,KAAA;AACJ;AAcA,MAAM,UAAU,SACf,IAAI,IAAI,OAAO,YACd,OAAO,YAAY,WAAW,UAAU,GACzC,CAAC,CAAC,KAAK,GAAG;;;;;;AAOX,MAAM,UAAU,cACf,OAAO,UAAU,SAAS,WAAW,KAAA,IAAY,OAAO,UAAU,IAAI;;;;;;AAOvE,MAAM,gBACL,WAEA,IAAI,IACH,IAAI,QAAQ,OAAO,qBAAqB,cAAc;CACrD,MAAM,OAAO,OAAO,SAAS;CAC7B,OAAO,SAAS,KAAA,IAAY,CAAC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAU;AAC7D,CAAC,CACF;;AAGD,MAAM,WACL,YAIA,MAAM,KACL,IAAI,IACH,IAAI,QAAQ,UAAU,WACrB,IAAI,QAAQ,OAAO,qBAAqB,cAAc;CACrD,MAAM,OAAO,OAAO,SAAS;CAC7B,IAAI,SAAS,KAAA,GACZ,OAAO,CAAC;CAIT,IAAI,KAAK,SAAS,GAAG,GACpB,MAAM,IAAI,MAAM,qCAAqC,KAAK,EAAE;CAI7D,IAAI,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B;CAEhD,OAAO,CAAC,IAAI;AACb,CAAC,CACF,CACD,CACD;;;;;;AAOD,MAAM,YAAY,OAAc,UAAoC;CACnE,MAAM,UAAU,IAAI,OAAO,IAAI,IAAI,MAAM,SAAS,QAAQ,GAAG,QAAQ;CACrE,MAAM,SAAS,IAAI,OAClB,MAAM,UACL,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC,CACvC;CACA,MAAM,aAAa,IAAI,OAAO,QAAQ,UAAU,OAAO,WACtD,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,MAAM,CAAC,CACrD;CACA,MAAM,QAAQ,MAAM,MACjB,WACA,UACA,UAAU,YAAY,QAAQ,SAAS,IAAI,cAAc,OAAO,GAChE,MAAM,UAAU,YAAY,OAC7B;CACF,MAAM,UAAU,IAAI,OACnB,UACC,WAAW,OAAO,gBAAgB,SAAS,CAC7C;CAEA,MAAM,OAAO,MAAM,KAAK,WAAW;CACnC,MAAM,QACL,MAAM,KAAK,WAAW,IACnB,KAAA,IACA;EACA,MAAM,MAAM;EACZ,MAAM,OAAO,MAAM,IAAI;EACvB;EACA,QACC,OAAO,SAAS,KAChB,QAAQ,SAAS,KAChB,QAAQ,QAAQ,SAAS;EAG3B,MACC,QAAQ,SAAS,KACjB,QAAQ,SAAS,KACjB,WAAW,UACX,MAAM;EACP,OAAO,MAAM;CACd;CACH,IAAI,UAAU,KAAA,GAAW;EACxB,MAAM,QAAQ;EACd,IAAI,MAAM,OAAO,KAChB,MAAMA,SACL,YACA,iBACA,UACA,MAAM,MACNC,aACD;CAEF;CACA,IAAI,MACH,OAAO;EACN;EACA,UAAU,CAAC;EACX,OAAO,QAAQ,MAAM;EACrB,KAAK,KAAA;EACL,WAAW,KAAA;CACZ;CAED,MAAM,mBAAmB,IAAI,IAAI,SAAS,YAAY;CACtD,MAAM,WAAW,IAAI,IAAI,QAAQ,OAAO,IAAI,SAAS;EACpD,MAAM,aAAa,IAAI,QAAQ,mBAAmB,UAAU;GAC3D,MAAM,WAAW,MAAM,IAAI,IAAI;GAC/B,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;EAC/C,CAAC;EAMD,MAAM,MACL,MAAM,OAAO,WAAW,UAAU,WAAW,SAAS,QAAQ;EAC/D,MAAM,QAAe;GACpB,MAAM,CAAC,GAAG,MAAM,MAAM,IAAI;GAC1B,SAAS,IAAI,QAAQ,aAAa,aACjC,aAAa,SAAS,sBAAM,IAAI,IAAI,CAAC,CACtC;GAGA,SACC,MAAM,WACN,OAAO,SAAS,KAChB,IAAI,KAAK,aAAa,aAAa,UAAU,WAAW,SAAS,IAAI,CAAC;GACvE;GAGA,OAAO,MAAM,SAAS,CAAC;EACxB;EACA,OAAO,CAAC,MAAM,SAAS,OAAO,KAAK,CAAC;CACrC,CAAC;CACD,MAAM,QAAQ,QAAQ,aAAa,QAAQ;CAC3C,MAAM,aAAa,IAAI,QAAQ,UAAU,WAAW,OAAO,eAAe;CAC1E,IAAI,WAAW,WAAW,GACzB,OAAO;EAAE;EAAO;EAAU;EAAO,KAAK,KAAA;EAAW,WAAW,KAAA;CAAU;CAEvE,MAAM,SACL,MAAM,OAAO,WAAW,UAAU,QAAQ,SAAS,QAAQ;CAC5D,MAAM,MAAW;EAChB,MAAM;EACN,YAAY,IAAI,IAAI,aAAa,cAAc,UAAU,SAAS;CACnE;CAcA,OAAO;EAAE;EAAO;EAAU;EAAO;EAAK,WAbpB,SACjB;GACC,MAAM,CAAC,GAAG,MAAM,MAAM,GAAG;GACzB,SAAS,IAAI,QAAQ,aAAa,cACjC,aAAa,UAAU,sBAAM,IAAI,IAAI,CAAC,CACvC;GAEA,SAAS;GACT,KAAK;GACL,OAAO,MAAM,SAAS,CAAC;EACxB,GACA,KAE6C;CAAE;AACjD;AAEA,MAAM,YAAY,WAAyC;CAC1D,GAAI,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,OAAO,KAAK;CACnD,GAAG,IAAI,QAAQ,OAAO,WAAW,GAAG,WAAW,SAAS,KAAK,CAAC;CAC9D,GAAI,OAAO,cAAc,KAAA,IAAY,CAAC,IAAI,SAAS,OAAO,SAAS;AACpE;;;;;AAMA,MAAa,aAAa,QAAgC;CACzD,MAAM,OAAO,SACZ;EACC,MAAM,CAAC;EACP,SAAS,aAAa,qBAAK,IAAI,IAAI,CAAC;EACpC,SAAS;EACT,KAAK;EACL,OAAO;CACR,GACA,EAAE,MAAM,EAAE,CACX;CACA,OAAO;EAAE,QAAQ,SAAS,IAAI;EAAG;CAAK;AACvC;;AAGA,MAAa,UAAU,SAAkB,SAAoC;CAC5E,MAAM,QAAQ,KAAK,MAAM,KAAK,CAAyB;CACvD,IAAI,MAAM,SAAS,GAClB;CAkBD,OAhBe,IAAI,OAClB,OACA,QAAQ,OACP,SAAS,SAAS;EAClB,IAAI,YAAY,KAAA,GACf;EAED,MAAM,QAAQ,QAAQ,IAAI,QAAQ,OAAO,IAAI;EAC7C,IAAI,OAAO,OAAO,KAAK,GACtB,OAAO,MAAM;EAEd,OAAO,QAAQ,QAAQ,KAAA,KAAa,QAAQ,QAAQ,KAAK,IAAI,IAC1D,QAAQ,YACR,KAAA;CACJ,CAEW,CAAC,EAAE;AAChB"}
|
|
1
|
+
{"version":3,"file":"catalog.js","names":["Trampoline.adaptive","Limits.exceeded","Limits.fieldPathParts"],"sources":["../../src/internal/catalog.ts"],"sourcesContent":["/**\n * The catalog of the fields of a Schema. One walk over the Schema makes it,\n * and every question about the fields of a resource or of the principal reads\n * it: which names a rule may use, which values a field may hold, which fields\n * a pattern fits, and which fields a list of permitted fields shows.\n *\n * The catalog describes the shape of the values, not the checks of the\n * Schema. A check, such as a minimum length, only keeps some values out, so a\n * catalog that leaves the checks out holds every real value and more. An\n * answer that holds for all of these values, as `All` and `None` of a\n * coverage do, then holds for the real values too.\n */\nimport * as Arr from \"effect/Array\"\nimport * as HashMap from \"effect/HashMap\"\nimport * as HashSet from \"effect/HashSet\"\nimport * as Option from \"effect/Option\"\nimport { hasProperty } from \"effect/Predicate\"\nimport * as Schema from \"effect/Schema\"\nimport * as SchemaAST from \"effect/SchemaAST\"\nimport * as Limits from \"./limits.ts\"\nimport * as Trampoline from \"./trampoline.ts\"\n\n/** The kinds of values that a field may hold. */\nexport interface Kinds {\n\t/** The field may be `null`, `undefined` or missing. */\n\treadonly null: boolean\n\treadonly boolean: boolean\n\t/** The field may hold any string. */\n\treadonly string: boolean\n\t/** The numbers that the field may hold. */\n\treadonly number: \"none\" | \"integer\" | \"finite\" | \"any\"\n\t/** The field may hold an object, or a value that is not a scalar. */\n\treadonly object: boolean\n\t/** Single values that the field may hold, other than the ones above. */\n\treadonly literals: ReadonlyArray<string | number | boolean>\n}\n\n/** No value: the kinds of a field of `Schema.Never`. */\nexport const noKinds: Kinds = {\n\tnull: false,\n\tboolean: false,\n\tstring: false,\n\tnumber: \"none\",\n\tobject: false,\n\tliterals: [],\n}\n\n/** Any value. */\nexport const anyKinds: Kinds = {\n\tnull: true,\n\tboolean: true,\n\tstring: true,\n\tnumber: \"any\",\n\tobject: true,\n\tliterals: [],\n}\n\nconst nullKinds: Kinds = { ...noKinds, null: true }\nconst objectKinds: Kinds = { ...noKinds, object: true }\n\nconst numberOrder = [\"none\", \"integer\", \"finite\", \"any\"] as const\n\n/** The kinds of a field that may hold a value of `left` or of `right`. */\nexport const joinKinds = (left: Kinds, right: Kinds): Kinds => ({\n\tnull: left.null || right.null,\n\tboolean: left.boolean || right.boolean,\n\tstring: left.string || right.string,\n\tnumber:\n\t\tnumberOrder.indexOf(left.number) >= numberOrder.indexOf(right.number)\n\t\t\t? left.number\n\t\t\t: right.number,\n\tobject: left.object || right.object,\n\t// A native `Set` finds copies about ten times as fast as `Arr.dedupe`. It\n\t// takes `0` and `-0` as one, as `includes` does when a test reads them.\n\tliterals: Array.from(new Set([...left.literals, ...right.literals])),\n})\n\n/** Tests if a number fits the numbers of a field. */\nexport const fitsNumber = (number: Kinds[\"number\"], value: number): boolean => {\n\tswitch (number) {\n\t\tcase \"none\":\n\t\t\treturn false\n\t\tcase \"integer\":\n\t\t\treturn Number.isInteger(value)\n\t\tcase \"finite\":\n\t\t\treturn Number.isFinite(value)\n\t\tcase \"any\":\n\t\t\treturn true\n\t}\n}\n\n/**\n * Tests if a field with these kinds may hold a value. A missing value and\n * `undefined` are `null`.\n */\nexport const accepts = (kinds: Kinds, value: unknown): boolean => {\n\tif (value === null || value === undefined) {\n\t\treturn kinds.null\n\t}\n\tswitch (typeof value) {\n\t\tcase \"boolean\":\n\t\t\treturn kinds.boolean || kinds.literals.includes(value)\n\t\tcase \"string\":\n\t\t\treturn kinds.string || kinds.literals.includes(value)\n\t\tcase \"number\":\n\t\t\treturn fitsNumber(kinds.number, value) || kinds.literals.includes(value)\n\t\tdefault:\n\t\t\treturn kinds.object\n\t}\n}\n\n/** A part of a field path that stands for any key of a record. */\nexport interface Key {\n\treadonly _tag: \"Key\"\n\t/** The Schemas of the keys. A key must fit one of them. */\n\treadonly parameters: ReadonlyArray<SchemaAST.AST>\n}\n\n/** One part of a field path: a name, or any key of a record. */\nexport type Segment = string | Key\n\n/** One field of a catalog. */\nexport interface Field {\n\treadonly path: ReadonlyArray<Segment>\n\t/** The path with dots, and `*` for a key of a record. */\n\treadonly text: string\n\treadonly kinds: Kinds\n\t/**\n\t * The field holds a value that a list of fields shows as one field: a\n\t * scalar, a record, an array, or a struct at the last part a path may have.\n\t */\n\treadonly listed: boolean\n\t/** The field may hold parts that the Schema does not name, as a record may. */\n\treadonly open: boolean\n\t/**\n\t * A read of the field finds only plain data. It is `false` when a value\n\t * above the field may be an object that does not have it as a data field:\n\t * a class without the field, which may have a getter of that name, a\n\t * value such as a date or a list, or any object, as of `Schema.Unknown`.\n\t * A struct of a union without the field makes it not plain too, since a\n\t * value made by hand may have it with any value.\n\t */\n\treadonly plain: boolean\n}\n\n/**\n * A place in the graph of a catalog. A path of a field leads to a place, and\n * many paths may lead to one place, as in a recursive Schema: `next` and\n * `next.next` of a list of links are one place. A place keeps the ids of the\n * places below it, so the graph has no loop of objects.\n */\nexport interface Branch {\n\treadonly id: number\n\t/** The kinds of the values of the field at this place. */\n\treadonly kinds: Kinds\n\t/** The field holds a scalar, a record or a list: see `Field.listed`. */\n\treadonly values: boolean\n\t/** The field may hold a struct. */\n\treadonly structs: boolean\n\treadonly open: boolean\n\treadonly plain: boolean\n\t/** The ids of the places below, by name, in the order of the Schema. */\n\treadonly children: ReadonlyArray<readonly [string, number]>\n\t/**\n\t * The places below, by name. A lookup gets each name from `split`, as a\n\t * new string, and a `HashMap` finds a new string about 20% faster than a\n\t * native `Map`. The names come from the Schema, so a name from a policy\n\t * can not make a long list of names with one hash here.\n\t */\n\treadonly names: HashMap.HashMap<string, number>\n\t/** The place for the keys of a record, when the value may be a record. */\n\treadonly key: Key | undefined\n\treadonly keyBranch: number | undefined\n}\n\n/** The catalog of the fields of a Schema. */\nexport interface Catalog {\n\t/**\n\t * The fields that a list shows, a field before the fields below it. For a\n\t * recursive Schema, the list goes into each recursive place one time on\n\t * each path, so it is finite.\n\t */\n\treadonly fields: ReadonlyArray<Field>\n\t/** The places, by id. The root is the place with the id 0. */\n\treadonly branches: ReadonlyArray<Branch>\n\t/**\n\t * The number of steps from a place to a place below it. A search of the\n\t * catalog, as for a field pattern, reads each one, so this is its work.\n\t */\n\treadonly edges: number\n\treadonly root: Branch\n}\n\n/**\n * Tests if a key of an object fits the Schemas of the keys of a record. A key\n * of an object is a string, also a key that a number Schema takes: `{ 1: \"a\" }`\n * has the key `\"1\"`. So a key that is the text of a number is tried as that\n * number too.\n */\nexport const keyFits = (key: Key, name: string): boolean =>\n\tArr.some(key.parameters, (parameter) => {\n\t\tconst is = Schema.is(Schema.make(parameter))\n\t\treturn (\n\t\t\tis(name) ||\n\t\t\t(name !== \"\" && String(Number(name)) === name && is(Number(name)))\n\t\t)\n\t})\n\n/**\n * Gives the struct of a `Schema.Class`. A class is a declaration with one\n * struct as its type parameter, and Effect marks it with a `\"~constructor\"`\n * annotation, also through more codec steps, as in\n * `Schema.fromJsonString(User)`. Other declarations, such as `Schema.Option`\n * or `Schema.ReadonlyMap`, have no such mark, and the fields of their type\n * parameter are not fields of the value.\n */\nconst classStruct = (\n\tast: SchemaAST.Declaration,\n): SchemaAST.Objects | undefined => {\n\tconst [inner] = ast.typeParameters\n\treturn ast.annotations?.[\"~constructor\"] !== undefined &&\n\t\tast.typeParameters.length === 1 &&\n\t\tinner?._tag === \"Objects\"\n\t\t? inner\n\t\t: undefined\n}\n\n/**\n * Gives the Schemas that a value at one place may fit: it opens unions and\n * `Schema.suspend`. A class stays a class: see {@link structOf}. The open suspend nodes are in a native `Set`,\n * because the walk must find a node by the node itself: `Equal` compares\n * Schema nodes by structure, and a recursive Schema has no end. A suspend\n * node that gives itself again, with no step on the path, gives nothing.\n */\nconst alternatives = (\n\tast: SchemaAST.AST,\n\topen: ReadonlySet<SchemaAST.AST>,\n): ReadonlyArray<SchemaAST.AST> => alternativesOf({ ast, open })\n\n/**\n * The walk of {@link alternatives}. A union may hold a union, very many\n * levels down, so it is a walk of the trampoline for an input of an unknown\n * depth.\n */\nconst alternativesOf = Trampoline.adaptive<\n\t{ readonly ast: SchemaAST.AST; readonly open: ReadonlySet<SchemaAST.AST> },\n\tReadonlyArray<SchemaAST.AST>\n>((R, child) => ({ ast, open }, depth) => {\n\tswitch (ast._tag) {\n\t\tcase \"Union\":\n\t\t\treturn R.map(\n\t\t\t\tR.forEach(ast.types, (type) => child({ ast: type, open }, depth + 1)),\n\t\t\t\tArr.flatten,\n\t\t\t)\n\t\tcase \"Suspend\":\n\t\t\treturn open.has(ast)\n\t\t\t\t? R.succeed([])\n\t\t\t\t: child({ ast: ast.thunk(), open: new Set([...open, ast]) }, depth + 1)\n\t\tdefault:\n\t\t\treturn R.succeed([ast])\n\t}\n})\n\n/** The struct of a Schema: a struct, or the struct of a class. */\nconst structOf = (ast: SchemaAST.AST): SchemaAST.Objects | undefined =>\n\tast._tag === \"Objects\"\n\t\t? ast\n\t\t: ast._tag === \"Declaration\"\n\t\t\t? classStruct(ast)\n\t\t\t: undefined\n\nconst hasCheck = (\n\tchecks: ReadonlyArray<SchemaAST.Check<never>>,\n\tid: string,\n): boolean =>\n\tArr.some(\n\t\tchecks,\n\t\t(check) =>\n\t\t\tcheck.annotations?.representation?.id === id ||\n\t\t\t(check._tag === \"FilterGroup\" && hasCheck(check.checks, id)),\n\t)\n\n/** A struct with named fields, or with the keys of a record. */\nconst isStruct = (\n\tast: SchemaAST.Objects | undefined,\n): ast is SchemaAST.Objects =>\n\tast !== undefined &&\n\t(ast.propertySignatures.length > 0 || ast.indexSignatures.length > 0)\n\n/** The kinds of the values of a Schema that is not a struct. */\nconst kindsOf = (ast: SchemaAST.AST): Kinds => {\n\tswitch (ast._tag) {\n\t\tcase \"Null\":\n\t\tcase \"Undefined\":\n\t\t\treturn nullKinds\n\t\tcase \"Never\":\n\t\t\treturn noKinds\n\t\tcase \"String\":\n\t\tcase \"TemplateLiteral\":\n\t\t\treturn { ...noKinds, string: true }\n\t\tcase \"Boolean\":\n\t\t\treturn { ...noKinds, boolean: true }\n\t\tcase \"Number\": {\n\t\t\t// The two checks that a search uses. Effect names a number with\n\t\t\t// them, as `Schema.Int` and `Schema.Finite`; other checks are left\n\t\t\t// out, as all checks are.\n\t\t\tconst checks = ast.checks ?? []\n\t\t\treturn {\n\t\t\t\t...noKinds,\n\t\t\t\tnumber: hasCheck(checks, \"effect/schema/isInt\")\n\t\t\t\t\t? \"integer\"\n\t\t\t\t\t: hasCheck(checks, \"effect/schema/isFinite\")\n\t\t\t\t\t\t? \"finite\"\n\t\t\t\t\t\t: \"any\",\n\t\t\t}\n\t\t}\n\t\tcase \"Literal\":\n\t\t\treturn typeof ast.literal === \"bigint\"\n\t\t\t\t? objectKinds\n\t\t\t\t: { ...noKinds, literals: [ast.literal] }\n\t\tcase \"Enum\":\n\t\t\treturn { ...noKinds, literals: Arr.map(ast.enums, ([, value]) => value) }\n\t\tcase \"Arrays\":\n\t\tcase \"ObjectKeyword\":\n\t\tcase \"BigInt\":\n\t\tcase \"Symbol\":\n\t\tcase \"UniqueSymbol\":\n\t\t\treturn objectKinds\n\t\tcase \"Declaration\":\n\t\t\t// A declaration of Effect in `objectDeclarations` holds an object,\n\t\t\t// such as a `Date`. Another declaration may hold any value, as\n\t\t\t// `Schema.Json` or one from `Schema.declare` may.\n\t\t\treturn HashSet.has(objectDeclarations, declarationId(ast))\n\t\t\t\t? objectKinds\n\t\t\t\t: anyKinds\n\t\tdefault:\n\t\t\t// `Schema.Unknown`, `Schema.Void`, and `Struct({})`, which takes a\n\t\t\t// string too: these may hold any value.\n\t\t\treturn anyKinds\n\t}\n}\n\n/**\n * The ids of the declarations of Effect that hold only objects. Effect puts\n * the id in the `representation` annotation. A declaration that is not in\n * this list may hold a scalar, as `Schema.Json` may, so its kinds are any\n * value.\n */\nconst objectDeclarations = HashSet.make(\n\t\"effect/schema/Date\",\n\t\"effect/schema/URL\",\n\t\"effect/schema/Uint8Array\",\n\t\"effect/schema/Duration\",\n\t\"effect/schema/DateTimeUtc\",\n\t\"effect/schema/DateTimeZoned\",\n\t\"effect/schema/BigDecimal\",\n\t\"effect/schema/Redacted\",\n\t\"effect/schema/Cause\",\n\t\"effect/schema/Chunk\",\n\t\"effect/schema/HashMap\",\n\t\"effect/schema/HashSet\",\n\t\"effect/schema/ReadonlyMap\",\n\t\"effect/schema/ReadonlySet\",\n\t\"effect/schema/Option\",\n\t\"effect/schema/Result\",\n\t\"effect/schema/Exit\",\n\t\"effect/schema/File\",\n\t\"effect/schema/FormData\",\n\t\"effect/schema/RegExp\",\n\t\"effect/schema/URLSearchParams\",\n)\n\nconst declarationId = (ast: SchemaAST.Declaration): string | undefined => {\n\tconst representation: unknown = ast.annotations?.[\"representation\"]\n\treturn hasProperty(representation, \"id\") &&\n\t\ttypeof representation.id === \"string\"\n\t\t? representation.id\n\t\t: undefined\n}\n\n/** The things that the walk of a catalog knows at one place. */\ninterface Place {\n\treadonly schemas: ReadonlyArray<SchemaAST.AST>\n\t/** The value may be missing. */\n\treadonly missing: boolean\n\t/** The value may be anything, as an extra field of a struct may be. */\n\treadonly top: boolean\n\t/** A read here finds only plain data: see {@link Field.plain}. */\n\treadonly plain: boolean\n}\n\nconst textOf = (path: ReadonlyArray<Segment>): string =>\n\tArr.map(path, (segment) =>\n\t\ttypeof segment === \"string\" ? segment : \"*\",\n\t).join(\".\")\n\n/**\n * The name of a property as a part of a path. A key of an object is a string,\n * so a number key, as from `Schema.Record(Schema.Literal(1), ...)`, has the\n * name `\"1\"`. A symbol key is not a field.\n */\nconst nameOf = (signature: SchemaAST.PropertySignature): string | undefined =>\n\ttypeof signature.name === \"symbol\" ? undefined : String(signature.name)\n\n/**\n * The properties of a struct by name. A walk makes it one time for each\n * struct of a place, so a struct with very many fields does not take a\n * search for each name. It is a native `Map`, as `Branch.names` is.\n */\nconst propertiesOf = (\n\tstruct: SchemaAST.Objects,\n): ReadonlyMap<string, SchemaAST.PropertySignature> =>\n\tnew Map(\n\t\tArr.flatMap(struct.propertySignatures, (signature) => {\n\t\t\tconst name = nameOf(signature)\n\t\t\treturn name === undefined ? [] : [[name, signature] as const]\n\t\t}),\n\t)\n\n/** The names of the fields of the structs, in the order that they first come. */\nconst namesOf = (\n\tstructs: ReadonlyArray<SchemaAST.Objects>,\n): ReadonlyArray<string> =>\n\t// A native `Set` keeps the first copy of each name, in order, about ten\n\t// times as fast as `Arr.dedupe`.\n\tArray.from(\n\t\tnew Set(\n\t\t\tArr.flatMap(structs, (struct) =>\n\t\t\t\tArr.flatMap(struct.propertySignatures, (signature) => {\n\t\t\t\t\tconst name = nameOf(signature)\n\t\t\t\t\tif (name === undefined) {\n\t\t\t\t\t\treturn []\n\t\t\t\t\t}\n\t\t\t\t\t// A dot in a path is the step into a nested field. A field name with\n\t\t\t\t\t// a dot would make two fields have one path, so it is a defect.\n\t\t\t\t\tif (name.includes(\".\")) {\n\t\t\t\t\t\tthrow new Error(`A field name may not have a dot: \"${name}\"`)\n\t\t\t\t\t}\n\t\t\t\t\t// An empty name would make an empty part in a path, such as\n\t\t\t\t\t// `.secret`.\n\t\t\t\t\tif (name === \"\") {\n\t\t\t\t\t\tthrow new Error(\"A field name may not be empty\")\n\t\t\t\t\t}\n\t\t\t\t\treturn [name]\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t)\n\n/** A place of the walk, and the places below it, before they have ids. */\ninterface Made {\n\treadonly branch: Omit<Branch, \"id\" | \"children\" | \"names\" | \"keyBranch\">\n\treadonly children: ReadonlyArray<readonly [string, Place]>\n\treadonly keyPlace: Place | undefined\n}\n\n/** Works out the facts of a place, and the places below it. */\nconst placeOf = (place: Place): Made => {\n\tconst structs = Arr.filter(Arr.map(place.schemas, structOf), isStruct)\n\tconst values = Arr.filter(\n\t\tplace.schemas,\n\t\t(schema) => !isStruct(structOf(schema)),\n\t)\n\tconst valueKinds = Arr.reduce(values, noKinds, (kinds, schema) =>\n\t\tjoinKinds(kinds, kindsOf(structOf(schema) ?? schema)),\n\t)\n\tconst kinds = place.top\n\t\t? anyKinds\n\t\t: joinKinds(\n\t\t\t\tjoinKinds(valueKinds, structs.length > 0 ? objectKinds : noKinds),\n\t\t\t\tplace.missing ? nullKinds : noKinds,\n\t\t\t)\n\tconst records = Arr.filter(\n\t\tstructs,\n\t\t(struct) => struct.indexSignatures.length > 0,\n\t)\n\tconst structProperties = Arr.map(structs, propertiesOf)\n\tconst children = Arr.map(namesOf(structs), (name) => {\n\t\tconst properties = Arr.flatMap(structProperties, (named) => {\n\t\t\tconst property = named.get(name)\n\t\t\treturn property === undefined ? [] : [property]\n\t\t})\n\t\t// A struct without the name may still have it as an extra field, with\n\t\t// any value: only a decode or a `make` takes extra fields away, and a\n\t\t// decision may get a value made by hand. A value that may be any\n\t\t// object, as one of `Schema.Unknown` may, may have the name with any\n\t\t// value too.\n\t\tconst top =\n\t\t\tplace.top || valueKinds.object || properties.length < structs.length\n\t\tconst below: Place = {\n\t\t\tschemas: Arr.flatMap(properties, (property) =>\n\t\t\t\talternatives(property.type, new Set()),\n\t\t\t),\n\t\t\t// A field below a value that is not a struct reads `null`, and so\n\t\t\t// does a field that may be missing.\n\t\t\tmissing:\n\t\t\t\tplace.missing ||\n\t\t\t\tvalues.length > 0 ||\n\t\t\t\tArr.some(properties, (property) => SchemaAST.isOptional(property.type)),\n\t\t\ttop,\n\t\t\t// A value that may be anything may be a list, or have a getter, so\n\t\t\t// a read below it may not find plain data.\n\t\t\tplain: place.plain && !top,\n\t\t}\n\t\treturn [name, below] as const\n\t})\n\tconst signatures = Arr.flatMap(records, (struct) => struct.indexSignatures)\n\tconst keyTop =\n\t\tplace.top || valueKinds.object || records.length < structs.length\n\treturn {\n\t\tbranch: {\n\t\t\tkinds,\n\t\t\tvalues: values.length > 0 || records.length > 0,\n\t\t\tstructs: structs.length > 0,\n\t\t\t// A field that is a scalar in one branch of a union and a struct in\n\t\t\t// another holds parts too.\n\t\t\topen:\n\t\t\t\trecords.length > 0 ||\n\t\t\t\tstructs.length > 0 ||\n\t\t\t\tvalueKinds.object ||\n\t\t\t\tplace.top,\n\t\t\tplain: place.plain,\n\t\t\tkey:\n\t\t\t\tsignatures.length === 0\n\t\t\t\t\t? undefined\n\t\t\t\t\t: {\n\t\t\t\t\t\t\t_tag: \"Key\",\n\t\t\t\t\t\t\tparameters: Arr.map(\n\t\t\t\t\t\t\t\tsignatures,\n\t\t\t\t\t\t\t\t(signature) => signature.parameter,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t},\n\t\t},\n\t\tchildren,\n\t\tkeyPlace:\n\t\t\tsignatures.length === 0\n\t\t\t\t? undefined\n\t\t\t\t: {\n\t\t\t\t\t\tschemas: Arr.flatMap(signatures, (signature) =>\n\t\t\t\t\t\t\talternatives(signature.type, new Set()),\n\t\t\t\t\t\t),\n\t\t\t\t\t\t// A record may not have a given key.\n\t\t\t\t\t\tmissing: true,\n\t\t\t\t\t\ttop: keyTop,\n\t\t\t\t\t\tplain: place.plain && !keyTop,\n\t\t\t\t\t},\n\t}\n}\n\n/**\n * Makes the places of a Schema. Each place comes one time: two paths with the\n * same Schemas and the same marks lead to one place. The walk keeps a queue\n * of the places that it has found, and it makes them in order, so a deep\n * Schema does not fill the stack.\n */\nconst branchesOf = (root: Place): ReadonlyArray<Branch> => {\n\t// The id of each Schema node, and of each place, for this walk. The ids\n\t// are in native maps, because the walk must find a Schema node by the node\n\t// itself: `Equal` compares Schema nodes by structure, and a recursive\n\t// Schema has no end. The maps and the queue belong to this walk.\n\tconst astIds = new Map<SchemaAST.AST, number>()\n\tconst placeIds = new Map<string, number>()\n\tconst queue: Array<Place> = []\n\tconst idOf = (place: Place): number => {\n\t\tconst ids = Arr.map(place.schemas, (schema) => {\n\t\t\tconst known = astIds.get(schema)\n\t\t\tif (known !== undefined) {\n\t\t\t\treturn known\n\t\t\t}\n\t\t\tastIds.set(schema, astIds.size)\n\t\t\treturn astIds.size - 1\n\t\t})\n\t\tconst key = `${Array.from(new Set(ids))\n\t\t\t.sort((a, b) => a - b)\n\t\t\t.join(\n\t\t\t\t\",\",\n\t\t\t)}|${String(place.missing)}|${String(place.top)}|${String(place.plain)}`\n\t\tconst known = placeIds.get(key)\n\t\tif (known !== undefined) {\n\t\t\treturn known\n\t\t}\n\t\tif (queue.length >= Limits.ceilings.catalogFields) {\n\t\t\tthrow Limits.exceeded(\n\t\t\t\t\"A Schema\",\n\t\t\t\t\"catalogFields\",\n\t\t\t\t\"places\",\n\t\t\t\tqueue.length + 1,\n\t\t\t\tLimits.ceilings.catalogFields,\n\t\t\t)\n\t\t}\n\t\tplaceIds.set(key, queue.length)\n\t\tqueue.push(place)\n\t\treturn queue.length - 1\n\t}\n\tidOf(root)\n\treturn Arr.unfold(0, (id) => {\n\t\tconst place = queue[id]\n\t\tif (place === undefined) {\n\t\t\treturn Option.none()\n\t\t}\n\t\tconst made = placeOf(place)\n\t\tconst children = Arr.map(\n\t\t\tmade.children,\n\t\t\t([name, below]) => [name, idOf(below)] as const,\n\t\t)\n\t\tconst branch: Branch = {\n\t\t\t...made.branch,\n\t\t\tid,\n\t\t\tchildren,\n\t\t\tnames: HashMap.fromIterable(children),\n\t\t\tkeyBranch: made.keyPlace === undefined ? undefined : idOf(made.keyPlace),\n\t\t}\n\t\treturn Option.some([branch, id + 1] as const)\n\t})\n}\n\n/** The field at a place, for a path. */\nconst fieldAt = (\n\tbranch: Branch,\n\tpath: ReadonlyArray<Segment>,\n\tparts: number,\n): Field => ({\n\tpath,\n\ttext: textOf(path),\n\tkinds: branch.kinds,\n\t// A struct at the last part that a path may have is one field, since a\n\t// path does not go below it.\n\tlisted: branch.values || (path.length === parts && branch.structs),\n\topen: branch.open,\n\tplain: branch.plain,\n})\n\n/**\n * The fields that a list shows, a field before the fields below it, down to\n * `parts` parts. A path goes into a place that is on it already one time\n * only, so the list of a recursive Schema is finite. The walk keeps a stack\n * of the places to visit, so a deep Schema does not fill the stack. The\n * stack belongs to this walk.\n */\nconst listOf = (\n\tbranches: ReadonlyArray<Branch>,\n\tparts: number,\n): ReadonlyArray<Field> => {\n\tinterface Visit {\n\t\treadonly branch: Branch\n\t\treadonly path: ReadonlyArray<Segment>\n\t\t/** The ids of the places on the path, as a set of Effect that shares its parts. */\n\t\treadonly above: HashSet.HashSet<number>\n\t}\n\tconst below = (visit: Visit): ReadonlyArray<Visit> => {\n\t\tconst { branch, path } = visit\n\t\tif (\n\t\t\tpath.length === parts ||\n\t\t\t(path.length > 0 && HashSet.has(visit.above, branch.id))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst above = HashSet.add(visit.above, branch.id)\n\t\tconst named = Arr.map(branch.children, ([name, id]) => ({\n\t\t\tbranch: branches[id]!,\n\t\t\tpath: [...path, name],\n\t\t\tabove,\n\t\t}))\n\t\treturn branch.key === undefined || branch.keyBranch === undefined\n\t\t\t? named\n\t\t\t: [\n\t\t\t\t\t...named,\n\t\t\t\t\t{\n\t\t\t\t\t\tbranch: branches[branch.keyBranch]!,\n\t\t\t\t\t\tpath: [...path, branch.key],\n\t\t\t\t\t\tabove,\n\t\t\t\t\t},\n\t\t\t\t]\n\t}\n\tconst stack: Array<Visit> = [\n\t\t{ branch: branches[0]!, path: [], above: HashSet.empty() },\n\t]\n\treturn Arr.flatten(\n\t\tArr.unfold(stack, (rest) => {\n\t\t\tconst visit = rest.pop()\n\t\t\tif (visit === undefined) {\n\t\t\t\treturn Option.none()\n\t\t\t}\n\t\t\t// The visits go onto the stack one at a time: a spread into a call\n\t\t\t// would pass one argument for each field, past the most arguments\n\t\t\t// of a call.\n\t\t\tArr.forEach(Arr.reverse(below(visit)), (next) => {\n\t\t\t\trest.push(next)\n\t\t\t})\n\t\t\tconst field =\n\t\t\t\tvisit.path.length === 0\n\t\t\t\t\t? []\n\t\t\t\t\t: [fieldAt(visit.branch, visit.path, parts)]\n\t\t\tif (field.length > 0 && rest.length + 1 > Limits.ceilings.catalogFields) {\n\t\t\t\tthrow Limits.exceeded(\n\t\t\t\t\t\"A Schema\",\n\t\t\t\t\t\"catalogFields\",\n\t\t\t\t\t\"fields\",\n\t\t\t\t\trest.length + 1,\n\t\t\t\t\tLimits.ceilings.catalogFields,\n\t\t\t\t)\n\t\t\t}\n\t\t\treturn Option.some([field, rest] as const)\n\t\t}),\n\t)\n}\n\n/**\n * The fields that a list shows for paths of at most `parts` parts, as for a\n * domain with that limit. See `Catalog.fields`.\n */\nexport const fieldsOf = (\n\tcatalog: Catalog,\n\tparts: number,\n): ReadonlyArray<Field> =>\n\tparts === Limits.fieldPathParts\n\t\t? catalog.fields\n\t\t: listOf(catalog.branches, parts)\n\n/**\n * Makes the catalog of a Schema, with the list of its fields for the default\n * limit of the parts of a path. It throws when a field name has a dot or is\n * empty, and when the Schema has more places or fields than the ceiling of\n * `catalogFields`. A domain checks the size of the list with its own limit.\n */\nexport const catalogOf = (ast: SchemaAST.AST): Catalog => {\n\tconst branches = branchesOf({\n\t\tschemas: alternatives(ast, new Set()),\n\t\tmissing: false,\n\t\ttop: false,\n\t\tplain: true,\n\t})\n\treturn {\n\t\tfields: listOf(branches, Limits.fieldPathParts),\n\t\tbranches,\n\t\tedges: Arr.reduce(\n\t\t\tbranches,\n\t\t\t0,\n\t\t\t(total, branch) =>\n\t\t\t\ttotal +\n\t\t\t\tbranch.children.length +\n\t\t\t\t(branch.keyBranch === undefined ? 0 : 1),\n\t\t),\n\t\troot: branches[0]!,\n\t}\n}\n\n/**\n * Gives the field of a catalog at a path with dots, if the catalog has it.\n * A path has at most `parts` parts. The lookup follows one place for each\n * part, in a loop.\n */\nexport const lookup = (\n\tcatalog: Catalog,\n\tpath: string,\n\tparts: number = Limits.fieldPathParts,\n): Field | undefined => {\n\tconst names = path.split(\".\", parts + 1)\n\tif (names.length > parts) {\n\t\treturn undefined\n\t}\n\tconst found = Arr.reduce(\n\t\tnames,\n\t\t{ branch: catalog.root, path: [] } as\n\t\t\t| { readonly branch: Branch; readonly path: ReadonlyArray<Segment> }\n\t\t\t| undefined,\n\t\t(current, name) => {\n\t\t\tif (current === undefined) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\tconst named = HashMap.get(current.branch.names, name)\n\t\t\tif (Option.isSome(named)) {\n\t\t\t\treturn {\n\t\t\t\t\tbranch: catalog.branches[named.value]!,\n\t\t\t\t\tpath: [...current.path, name],\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst key = current.branch.key\n\t\t\tconst keyBranch = current.branch.keyBranch\n\t\t\treturn key !== undefined && keyBranch !== undefined && keyFits(key, name)\n\t\t\t\t? { branch: catalog.branches[keyBranch]!, path: [...current.path, key] }\n\t\t\t\t: undefined\n\t\t},\n\t)\n\treturn found === undefined\n\t\t? undefined\n\t\t: fieldAt(found.branch, found.path, parts)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAa,UAAiB;CAC7B,MAAM;CACN,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,UAAU,CAAC;AACZ;;AAGA,MAAa,WAAkB;CAC9B,MAAM;CACN,SAAS;CACT,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,UAAU,CAAC;AACZ;AAEA,MAAM,YAAmB;CAAE,GAAG;CAAS,MAAM;AAAK;AAClD,MAAM,cAAqB;CAAE,GAAG;CAAS,QAAQ;AAAK;AAEtD,MAAM,cAAc;CAAC;CAAQ;CAAW;CAAU;AAAK;;AAGvD,MAAa,aAAa,MAAa,WAAyB;CAC/D,MAAM,KAAK,QAAQ,MAAM;CACzB,SAAS,KAAK,WAAW,MAAM;CAC/B,QAAQ,KAAK,UAAU,MAAM;CAC7B,QACC,YAAY,QAAQ,KAAK,MAAM,KAAK,YAAY,QAAQ,MAAM,MAAM,IACjE,KAAK,SACL,MAAM;CACV,QAAQ,KAAK,UAAU,MAAM;CAG7B,UAAU,MAAM,qBAAK,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU,GAAG,MAAM,QAAQ,CAAC,CAAC;AACpE;;AAGA,MAAa,cAAc,QAAyB,UAA2B;CAC9E,QAAQ,QAAR;EACC,KAAK,QACJ,OAAO;EACR,KAAK,WACJ,OAAO,OAAO,UAAU,KAAK;EAC9B,KAAK,UACJ,OAAO,OAAO,SAAS,KAAK;EAC7B,KAAK,OACJ,OAAO;CACT;AACD;;;;;AAMA,MAAa,WAAW,OAAc,UAA4B;CACjE,IAAI,UAAU,QAAQ,UAAU,KAAA,GAC/B,OAAO,MAAM;CAEd,QAAQ,OAAO,OAAf;EACC,KAAK,WACJ,OAAO,MAAM,WAAW,MAAM,SAAS,SAAS,KAAK;EACtD,KAAK,UACJ,OAAO,MAAM,UAAU,MAAM,SAAS,SAAS,KAAK;EACrD,KAAK,UACJ,OAAO,WAAW,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,SAAS,KAAK;EACxE,SACC,OAAO,MAAM;CACf;AACD;;;;;;;AA0FA,MAAa,WAAW,KAAU,SACjC,IAAI,KAAK,IAAI,aAAa,cAAc;CACvC,MAAM,KAAK,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC;CAC3C,OACC,GAAG,IAAI,KACN,SAAS,MAAM,OAAO,OAAO,IAAI,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC;AAElE,CAAC;;;;;;;;;AAUF,MAAM,eACL,QACmC;CACnC,MAAM,CAAC,SAAS,IAAI;CACpB,OAAO,IAAI,cAAc,oBAAoB,KAAA,KAC5C,IAAI,eAAe,WAAW,KAC9B,OAAO,SAAS,YACd,QACA,KAAA;AACJ;;;;;;;;AASA,MAAM,gBACL,KACA,SACkC,eAAe;CAAE;CAAK;AAAK,CAAC;;;;;;AAO/D,MAAM,iBAAiBA,UAGpB,GAAG,WAAW,EAAE,KAAK,QAAQ,UAAU;CACzC,QAAQ,IAAI,MAAZ;EACC,KAAK,SACJ,OAAO,EAAE,IACR,EAAE,QAAQ,IAAI,QAAQ,SAAS,MAAM;GAAE,KAAK;GAAM;EAAK,GAAG,QAAQ,CAAC,CAAC,GACpE,IAAI,OACL;EACD,KAAK,WACJ,OAAO,KAAK,IAAI,GAAG,IAChB,EAAE,QAAQ,CAAC,CAAC,IACZ,MAAM;GAAE,KAAK,IAAI,MAAM;GAAG,sBAAM,IAAI,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC;EAAE,GAAG,QAAQ,CAAC;EACxE,SACC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC;CACxB;AACD,CAAC;;AAGD,MAAM,YAAY,QACjB,IAAI,SAAS,YACV,MACA,IAAI,SAAS,gBACZ,YAAY,GAAG,IACf,KAAA;AAEL,MAAM,YACL,QACA,OAEA,IAAI,KACH,SACC,UACA,MAAM,aAAa,gBAAgB,OAAO,MACzC,MAAM,SAAS,iBAAiB,SAAS,MAAM,QAAQ,EAAE,CAC5D;;AAGD,MAAM,YACL,QAEA,QAAQ,KAAA,MACP,IAAI,mBAAmB,SAAS,KAAK,IAAI,gBAAgB,SAAS;;AAGpE,MAAM,WAAW,QAA8B;CAC9C,QAAQ,IAAI,MAAZ;EACC,KAAK;EACL,KAAK,aACJ,OAAO;EACR,KAAK,SACJ,OAAO;EACR,KAAK;EACL,KAAK,mBACJ,OAAO;GAAE,GAAG;GAAS,QAAQ;EAAK;EACnC,KAAK,WACJ,OAAO;GAAE,GAAG;GAAS,SAAS;EAAK;EACpC,KAAK,UAAU;GAId,MAAM,SAAS,IAAI,UAAU,CAAC;GAC9B,OAAO;IACN,GAAG;IACH,QAAQ,SAAS,QAAQ,qBAAqB,IAC3C,YACA,SAAS,QAAQ,wBAAwB,IACxC,WACA;GACL;EACD;EACA,KAAK,WACJ,OAAO,OAAO,IAAI,YAAY,WAC3B,cACA;GAAE,GAAG;GAAS,UAAU,CAAC,IAAI,OAAO;EAAE;EAC1C,KAAK,QACJ,OAAO;GAAE,GAAG;GAAS,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,WAAW,KAAK;EAAE;EACzE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,gBACJ,OAAO;EACR,KAAK,eAIJ,OAAO,QAAQ,IAAI,oBAAoB,cAAc,GAAG,CAAC,IACtD,cACA;EACJ,SAGC,OAAO;CACT;AACD;;;;;;;AAQA,MAAM,qBAAqB,QAAQ,KAClC,sBACA,qBACA,4BACA,0BACA,6BACA,+BACA,4BACA,0BACA,uBACA,uBACA,yBACA,yBACA,6BACA,6BACA,wBACA,wBACA,sBACA,sBACA,0BACA,wBACA,+BACD;AAEA,MAAM,iBAAiB,QAAmD;CACzE,MAAM,iBAA0B,IAAI,cAAc;CAClD,OAAO,YAAY,gBAAgB,IAAI,KACtC,OAAO,eAAe,OAAO,WAC3B,eAAe,KACf,KAAA;AACJ;AAaA,MAAM,UAAU,SACf,IAAI,IAAI,OAAO,YACd,OAAO,YAAY,WAAW,UAAU,GACzC,CAAC,CAAC,KAAK,GAAG;;;;;;AAOX,MAAM,UAAU,cACf,OAAO,UAAU,SAAS,WAAW,KAAA,IAAY,OAAO,UAAU,IAAI;;;;;;AAOvE,MAAM,gBACL,WAEA,IAAI,IACH,IAAI,QAAQ,OAAO,qBAAqB,cAAc;CACrD,MAAM,OAAO,OAAO,SAAS;CAC7B,OAAO,SAAS,KAAA,IAAY,CAAC,IAAI,CAAC,CAAC,MAAM,SAAS,CAAU;AAC7D,CAAC,CACF;;AAGD,MAAM,WACL,YAIA,MAAM,KACL,IAAI,IACH,IAAI,QAAQ,UAAU,WACrB,IAAI,QAAQ,OAAO,qBAAqB,cAAc;CACrD,MAAM,OAAO,OAAO,SAAS;CAC7B,IAAI,SAAS,KAAA,GACZ,OAAO,CAAC;CAIT,IAAI,KAAK,SAAS,GAAG,GACpB,MAAM,IAAI,MAAM,qCAAqC,KAAK,EAAE;CAI7D,IAAI,SAAS,IACZ,MAAM,IAAI,MAAM,+BAA+B;CAEhD,OAAO,CAAC,IAAI;AACb,CAAC,CACF,CACD,CACD;;AAUD,MAAM,WAAW,UAAuB;CACvC,MAAM,UAAU,IAAI,OAAO,IAAI,IAAI,MAAM,SAAS,QAAQ,GAAG,QAAQ;CACrE,MAAM,SAAS,IAAI,OAClB,MAAM,UACL,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC,CACvC;CACA,MAAM,aAAa,IAAI,OAAO,QAAQ,UAAU,OAAO,WACtD,UAAU,OAAO,QAAQ,SAAS,MAAM,KAAK,MAAM,CAAC,CACrD;CACA,MAAM,QAAQ,MAAM,MACjB,WACA,UACA,UAAU,YAAY,QAAQ,SAAS,IAAI,cAAc,OAAO,GAChE,MAAM,UAAU,YAAY,OAC7B;CACF,MAAM,UAAU,IAAI,OACnB,UACC,WAAW,OAAO,gBAAgB,SAAS,CAC7C;CACA,MAAM,mBAAmB,IAAI,IAAI,SAAS,YAAY;CACtD,MAAM,WAAW,IAAI,IAAI,QAAQ,OAAO,IAAI,SAAS;EACpD,MAAM,aAAa,IAAI,QAAQ,mBAAmB,UAAU;GAC3D,MAAM,WAAW,MAAM,IAAI,IAAI;GAC/B,OAAO,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ;EAC/C,CAAC;EAMD,MAAM,MACL,MAAM,OAAO,WAAW,UAAU,WAAW,SAAS,QAAQ;EAgB/D,OAAO,CAAC,MAAM;GAdb,SAAS,IAAI,QAAQ,aAAa,aACjC,aAAa,SAAS,sBAAM,IAAI,IAAI,CAAC,CACtC;GAGA,SACC,MAAM,WACN,OAAO,SAAS,KAChB,IAAI,KAAK,aAAa,aAAa,UAAU,WAAW,SAAS,IAAI,CAAC;GACvE;GAGA,OAAO,MAAM,SAAS,CAAC;EAEN,CAAC;CACpB,CAAC;CACD,MAAM,aAAa,IAAI,QAAQ,UAAU,WAAW,OAAO,eAAe;CAC1E,MAAM,SACL,MAAM,OAAO,WAAW,UAAU,QAAQ,SAAS,QAAQ;CAC5D,OAAO;EACN,QAAQ;GACP;GACA,QAAQ,OAAO,SAAS,KAAK,QAAQ,SAAS;GAC9C,SAAS,QAAQ,SAAS;GAG1B,MACC,QAAQ,SAAS,KACjB,QAAQ,SAAS,KACjB,WAAW,UACX,MAAM;GACP,OAAO,MAAM;GACb,KACC,WAAW,WAAW,IACnB,KAAA,IACA;IACA,MAAM;IACN,YAAY,IAAI,IACf,aACC,cAAc,UAAU,SAC1B;GACD;EACJ;EACA;EACA,UACC,WAAW,WAAW,IACnB,KAAA,IACA;GACA,SAAS,IAAI,QAAQ,aAAa,cACjC,aAAa,UAAU,sBAAM,IAAI,IAAI,CAAC,CACvC;GAEA,SAAS;GACT,KAAK;GACL,OAAO,MAAM,SAAS,CAAC;EACxB;CACJ;AACD;;;;;;;AAQA,MAAM,cAAc,SAAuC;CAK1D,MAAM,yBAAS,IAAI,IAA2B;CAC9C,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,QAAsB,CAAC;CAC7B,MAAM,QAAQ,UAAyB;EACtC,MAAM,MAAM,IAAI,IAAI,MAAM,UAAU,WAAW;GAC9C,MAAM,QAAQ,OAAO,IAAI,MAAM;GAC/B,IAAI,UAAU,KAAA,GACb,OAAO;GAER,OAAO,IAAI,QAAQ,OAAO,IAAI;GAC9B,OAAO,OAAO,OAAO;EACtB,CAAC;EACD,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CACrC,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CACrB,KACA,GACD,EAAE,GAAG,OAAO,MAAM,OAAO,EAAE,GAAG,OAAO,MAAM,GAAG,EAAE,GAAG,OAAO,MAAM,KAAK;EACtE,MAAM,QAAQ,SAAS,IAAI,GAAG;EAC9B,IAAI,UAAU,KAAA,GACb,OAAO;EAER,IAAI,MAAM,UAAA,SAA0B,eACnC,MAAMC,SACL,YACA,iBACA,UACA,MAAM,SAAS,GAAA,SACC,aACjB;EAED,SAAS,IAAI,KAAK,MAAM,MAAM;EAC9B,MAAM,KAAK,KAAK;EAChB,OAAO,MAAM,SAAS;CACvB;CACA,KAAK,IAAI;CACT,OAAO,IAAI,OAAO,IAAI,OAAO;EAC5B,MAAM,QAAQ,MAAM;EACpB,IAAI,UAAU,KAAA,GACb,OAAO,OAAO,KAAK;EAEpB,MAAM,OAAO,QAAQ,KAAK;EAC1B,MAAM,WAAW,IAAI,IACpB,KAAK,WACJ,CAAC,MAAM,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,CACtC;EACA,MAAM,SAAiB;GACtB,GAAG,KAAK;GACR;GACA;GACA,OAAO,QAAQ,aAAa,QAAQ;GACpC,WAAW,KAAK,aAAa,KAAA,IAAY,KAAA,IAAY,KAAK,KAAK,QAAQ;EACxE;EACA,OAAO,OAAO,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAU;CAC7C,CAAC;AACF;;AAGA,MAAM,WACL,QACA,MACA,WACY;CACZ;CACA,MAAM,OAAO,IAAI;CACjB,OAAO,OAAO;CAGd,QAAQ,OAAO,UAAW,KAAK,WAAW,SAAS,OAAO;CAC1D,MAAM,OAAO;CACb,OAAO,OAAO;AACf;;;;;;;;AASA,MAAM,UACL,UACA,UAC0B;CAO1B,MAAM,SAAS,UAAuC;EACrD,MAAM,EAAE,QAAQ,SAAS;EACzB,IACC,KAAK,WAAW,SACf,KAAK,SAAS,KAAK,QAAQ,IAAI,MAAM,OAAO,OAAO,EAAE,GAEtD,OAAO,CAAC;EAET,MAAM,QAAQ,QAAQ,IAAI,MAAM,OAAO,OAAO,EAAE;EAChD,MAAM,QAAQ,IAAI,IAAI,OAAO,WAAW,CAAC,MAAM,SAAS;GACvD,QAAQ,SAAS;GACjB,MAAM,CAAC,GAAG,MAAM,IAAI;GACpB;EACD,EAAE;EACF,OAAO,OAAO,QAAQ,KAAA,KAAa,OAAO,cAAc,KAAA,IACrD,QACA,CACA,GAAG,OACH;GACC,QAAQ,SAAS,OAAO;GACxB,MAAM,CAAC,GAAG,MAAM,OAAO,GAAG;GAC1B;EACD,CACD;CACH;CACA,MAAM,QAAsB,CAC3B;EAAE,QAAQ,SAAS;EAAK,MAAM,CAAC;EAAG,OAAO,QAAQ,MAAM;CAAE,CAC1D;CACA,OAAO,IAAI,QACV,IAAI,OAAO,QAAQ,SAAS;EAC3B,MAAM,QAAQ,KAAK,IAAI;EACvB,IAAI,UAAU,KAAA,GACb,OAAO,OAAO,KAAK;EAKpB,IAAI,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC,IAAI,SAAS;GAChD,KAAK,KAAK,IAAI;EACf,CAAC;EACD,MAAM,QACL,MAAM,KAAK,WAAW,IACnB,CAAC,IACD,CAAC,QAAQ,MAAM,QAAQ,MAAM,MAAM,KAAK,CAAC;EAC7C,IAAI,MAAM,SAAS,KAAK,KAAK,SAAS,IAAA,SAAoB,eACzD,MAAMA,SACL,YACA,iBACA,UACA,KAAK,SAAS,GAAA,SACE,aACjB;EAED,OAAO,OAAO,KAAK,CAAC,OAAO,IAAI,CAAU;CAC1C,CAAC,CACF;AACD;;;;;AAMA,MAAa,YACZ,SACA,UAEA,UAAUC,iBACP,QAAQ,SACR,OAAO,QAAQ,UAAU,KAAK;;;;;;;AAQlC,MAAa,aAAa,QAAgC;CACzD,MAAM,WAAW,WAAW;EAC3B,SAAS,aAAa,qBAAK,IAAI,IAAI,CAAC;EACpC,SAAS;EACT,KAAK;EACL,OAAO;CACR,CAAC;CACD,OAAO;EACN,QAAQ,OAAO,UAAUA,cAAqB;EAC9C;EACA,OAAO,IAAI,OACV,UACA,IACC,OAAO,WACP,QACA,OAAO,SAAS,UACf,OAAO,cAAc,KAAA,IAAY,IAAI,EACxC;EACA,MAAM,SAAS;CAChB;AACD;;;;;;AAOA,MAAa,UACZ,SACA,MACA,QAAgBA,mBACO;CACvB,MAAM,QAAQ,KAAK,MAAM,KAAK,QAAQ,CAAC;CACvC,IAAI,MAAM,SAAS,OAClB;CAED,MAAM,QAAQ,IAAI,OACjB,OACA;EAAE,QAAQ,QAAQ;EAAM,MAAM,CAAC;CAAE,IAGhC,SAAS,SAAS;EAClB,IAAI,YAAY,KAAA,GACf;EAED,MAAM,QAAQ,QAAQ,IAAI,QAAQ,OAAO,OAAO,IAAI;EACpD,IAAI,OAAO,OAAO,KAAK,GACtB,OAAO;GACN,QAAQ,QAAQ,SAAS,MAAM;GAC/B,MAAM,CAAC,GAAG,QAAQ,MAAM,IAAI;EAC7B;EAED,MAAM,MAAM,QAAQ,OAAO;EAC3B,MAAM,YAAY,QAAQ,OAAO;EACjC,OAAO,QAAQ,KAAA,KAAa,cAAc,KAAA,KAAa,QAAQ,KAAK,IAAI,IACrE;GAAE,QAAQ,QAAQ,SAAS;GAAa,MAAM,CAAC,GAAG,QAAQ,MAAM,GAAG;EAAE,IACrE,KAAA;CACJ,CACD;CACA,OAAO,UAAU,KAAA,IACd,KAAA,IACA,QAAQ,MAAM,QAAQ,MAAM,MAAM,KAAK;AAC3C"}
|
package/dist/internal/decide.js
CHANGED
|
@@ -1,13 +1,15 @@
|
|
|
1
1
|
import { Allow, Deny, NotApplicable } from "../Decision.js";
|
|
2
|
-
import { lookup } from "./catalog.js";
|
|
2
|
+
import { fieldsOf, lookup } from "./catalog.js";
|
|
3
|
+
import { at, pathOf } from "./place.js";
|
|
3
4
|
import { kindOf } from "./resource.js";
|
|
4
5
|
import { evaluate } from "../Condition.js";
|
|
5
6
|
import { descriptorOf } from "./domain.js";
|
|
6
7
|
import { fitsOf, matchesInside, matchesTarget } from "./rule.js";
|
|
8
|
+
import { rulesOf } from "./policy-nodes.js";
|
|
7
9
|
import { nodeOf } from "./policy.js";
|
|
10
|
+
import * as Arr from "effect/Array";
|
|
8
11
|
import * as Chunk from "effect/Chunk";
|
|
9
12
|
import * as Effect from "effect/Effect";
|
|
10
|
-
import * as Arr from "effect/Array";
|
|
11
13
|
import * as Option from "effect/Option";
|
|
12
14
|
import * as Ref from "effect/Ref";
|
|
13
15
|
// src/internal/decide.ts
|
|
@@ -15,12 +17,12 @@ import * as Ref from "effect/Ref";
|
|
|
15
17
|
* The decision walk of a policy: `decide`, `explain` and `permittedFields`.
|
|
16
18
|
* The types are in `Policy.ts`.
|
|
17
19
|
*/
|
|
18
|
-
const ruleApplies = (value, context,
|
|
20
|
+
const ruleApplies = (value, context, at) => {
|
|
19
21
|
if (!matchesTarget(value, context)) return Effect.succeed(false);
|
|
20
22
|
const test = value.when === void 0 ? Effect.succeed(true) : evaluate(value.when, context.input);
|
|
21
23
|
const trace = context.trace;
|
|
22
24
|
return trace === void 0 ? test : Effect.tap(test, (applies) => Ref.update(trace, Chunk.append({
|
|
23
|
-
path,
|
|
25
|
+
path: pathOf(at),
|
|
24
26
|
rule: typed(value),
|
|
25
27
|
applies
|
|
26
28
|
})));
|
|
@@ -32,14 +34,14 @@ const fromRule = (value) => value._tag === "Allow" ? Allow({ rule: typed(value)
|
|
|
32
34
|
reason: value.reason
|
|
33
35
|
});
|
|
34
36
|
/** Gives the first rule that applies, in order. */
|
|
35
|
-
const firstApplying = (candidates, context,
|
|
37
|
+
const firstApplying = (candidates, context, at$3) => Effect.map(Effect.findFirst(candidates, ([value, index]) => ruleApplies(value, context, at(at$3, index))), Option.map(([value]) => value));
|
|
36
38
|
/** Gives the first result that is found, and tests `next` only when none is. */
|
|
37
39
|
const orElse = (first, next) => Effect.filterOrElse(first, Option.isSome, next);
|
|
38
|
-
const decideRules = (node, context,
|
|
40
|
+
const decideRules = (node, context, at) => {
|
|
39
41
|
const indexed = Arr.map(node.rules, (value, index) => [value, index]);
|
|
40
42
|
const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny");
|
|
41
43
|
const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow");
|
|
42
|
-
const first = (candidates) => firstApplying(candidates, context,
|
|
44
|
+
const first = (candidates) => firstApplying(candidates, context, at);
|
|
43
45
|
const found = (() => {
|
|
44
46
|
switch (node.algorithm) {
|
|
45
47
|
case "denyOverrides": return orElse(first(denies), () => first(allows));
|
|
@@ -59,8 +61,8 @@ const decideRules = (node, context, path) => {
|
|
|
59
61
|
* `end` gives the decision. A child after a stop is not decided, so its
|
|
60
62
|
* predicates do not run.
|
|
61
63
|
*/
|
|
62
|
-
const walkChildren = (children, context,
|
|
63
|
-
const go = (index, state) => index === children.length ? Effect.succeed(end(state)) : Effect.flatMap(decideNode(children[index], context,
|
|
64
|
+
const walkChildren = (children, context, at$1, start, step, end) => {
|
|
65
|
+
const go = (index, state) => index === children.length ? Effect.succeed(end(state)) : Effect.flatMap(Effect.suspend(() => decideNode(children[index], context, at(at$1, index))), (decision) => {
|
|
64
66
|
const next = step(state, decision);
|
|
65
67
|
return next._tag === "Stop" ? Effect.succeed(next.decision) : go(index + 1, next.state);
|
|
66
68
|
});
|
|
@@ -79,30 +81,30 @@ const next = (state) => ({
|
|
|
79
81
|
* predicates run each time, as the policy says. The limits of the nodes keep
|
|
80
82
|
* this work small.
|
|
81
83
|
*/
|
|
82
|
-
const decideNode = (node, context,
|
|
84
|
+
const decideNode = (node, context, at$2) => {
|
|
83
85
|
switch (node._tag) {
|
|
84
|
-
case "Rules": return decideRules(node, context,
|
|
85
|
-
case "All": return walkChildren(node.policies, context,
|
|
86
|
+
case "Rules": return decideRules(node, context, at$2);
|
|
87
|
+
case "All": return walkChildren(node.policies, context, at$2, {
|
|
86
88
|
firstAllow: Option.none(),
|
|
87
89
|
allAllow: node.policies.length > 0
|
|
88
90
|
}, (state, decision) => decision._tag === "Deny" ? stop(decision) : next({
|
|
89
91
|
firstAllow: Option.orElse(state.firstAllow, () => decision._tag === "Allow" ? Option.some(decision) : Option.none()),
|
|
90
92
|
allAllow: state.allAllow && decision._tag === "Allow"
|
|
91
93
|
}), (state) => state.allAllow ? Option.getOrElse(state.firstAllow, () => NotApplicable) : NotApplicable);
|
|
92
|
-
case "Any": return walkChildren(node.policies, context,
|
|
93
|
-
case "FirstOf": return walkChildren(node.policies, context,
|
|
94
|
-
case "Ceiling": return Effect.filterOrElse(decideNode(node.cap, context,
|
|
94
|
+
case "Any": return walkChildren(node.policies, context, at$2, Option.none(), (firstDeny, decision) => decision._tag === "Allow" ? stop(decision) : next(Option.orElse(firstDeny, () => decision._tag === "Deny" ? Option.some(decision) : Option.none())), (firstDeny) => Option.getOrElse(firstDeny, () => NotApplicable));
|
|
95
|
+
case "FirstOf": return walkChildren(node.policies, context, at$2, void 0, (_, decision) => decision._tag === "NotApplicable" ? next(void 0) : stop(decision), () => NotApplicable);
|
|
96
|
+
case "Ceiling": return Effect.filterOrElse(Effect.suspend(() => decideNode(node.cap, context, at(at$2, 0))), (capped) => capped._tag === "Deny", () => decideNode(node.policy, context, at(at$2, 1)));
|
|
95
97
|
}
|
|
96
98
|
};
|
|
97
99
|
/**
|
|
98
100
|
* Tests if a request fits its kind: the action is an action of the kind, and
|
|
99
101
|
* the field, if there is one, is a field of the kind.
|
|
100
102
|
*/
|
|
101
|
-
const fitsKind = (descriptor, request) => descriptor.actions.includes(request.action) && (request.field === void 0 || (lookup(descriptor.catalog, request.field)?.listed ?? false));
|
|
103
|
+
const fitsKind = (descriptor, request, parts) => descriptor.actions.includes(request.action) && (request.field === void 0 || (lookup(descriptor.catalog, request.field, parts)?.listed ?? false));
|
|
102
104
|
const makeContext = (domain, request, trace) => {
|
|
103
105
|
const kind = kindOf(request.resource);
|
|
104
106
|
const descriptor = kind === void 0 ? void 0 : descriptorOf(domain, kind);
|
|
105
|
-
if (kind === void 0 || descriptor === void 0 || !fitsKind(descriptor, request)) return;
|
|
107
|
+
if (kind === void 0 || descriptor === void 0 || !fitsKind(descriptor, request, domain.limits.fieldPathParts)) return;
|
|
106
108
|
return {
|
|
107
109
|
action: request.action,
|
|
108
110
|
kind,
|
|
@@ -113,13 +115,14 @@ const makeContext = (domain, request, trace) => {
|
|
|
113
115
|
path: descriptor.path
|
|
114
116
|
},
|
|
115
117
|
descriptor,
|
|
116
|
-
fits: fitsOf(descriptor.catalog),
|
|
118
|
+
fits: fitsOf(descriptor.catalog, domain.limits.fieldPathParts),
|
|
119
|
+
parts: domain.limits.fieldPathParts,
|
|
117
120
|
trace
|
|
118
121
|
};
|
|
119
122
|
};
|
|
120
123
|
const decideAny = (policy, request) => Effect.suspend(() => {
|
|
121
124
|
const context = makeContext(policy.domain, request, void 0);
|
|
122
|
-
return context === void 0 ? Effect.succeed(NotApplicable) : decideNode(nodeOf(policy), context,
|
|
125
|
+
return context === void 0 ? Effect.succeed(NotApplicable) : decideNode(nodeOf(policy), context, void 0);
|
|
123
126
|
});
|
|
124
127
|
/** Gives the decision of a policy with no predicates, at once. */
|
|
125
128
|
const decideSync = (policy, request) => Effect.runSync(decideAny(policy, request));
|
|
@@ -132,32 +135,25 @@ const explain = (policy, request) => Effect.gen(function* () {
|
|
|
132
135
|
steps: []
|
|
133
136
|
};
|
|
134
137
|
return {
|
|
135
|
-
decision: yield* decideNode(nodeOf(policy), context,
|
|
138
|
+
decision: yield* decideNode(nodeOf(policy), context, void 0),
|
|
136
139
|
steps: Chunk.toReadonlyArray(yield* Ref.get(trace))
|
|
137
140
|
};
|
|
138
141
|
});
|
|
139
142
|
/**
|
|
140
143
|
* Tests if a deny rule of the request names a part inside `field`.
|
|
141
144
|
*/
|
|
142
|
-
const deniesInside = (
|
|
143
|
-
switch (node._tag) {
|
|
144
|
-
case "Rules": return node.rules.some((value) => value._tag === "Deny" && value.fields !== void 0 && value.fields.some((pattern) => matchesInside(pattern, field)) && (value.actions.includes("*") || value.actions.includes(target.action)) && (value.resources.includes("*") || value.resources.includes(target.kind)));
|
|
145
|
-
case "All":
|
|
146
|
-
case "Any":
|
|
147
|
-
case "FirstOf": return node.policies.some((child) => deniesInside(child, target, field));
|
|
148
|
-
case "Ceiling": return deniesInside(node.cap, target, field) || deniesInside(node.policy, target, field);
|
|
149
|
-
}
|
|
150
|
-
};
|
|
145
|
+
const deniesInside = (rules, target, field) => Arr.some(rules, (value) => value._tag === "Deny" && value.fields !== void 0 && value.fields.some((pattern) => matchesInside(pattern, field)) && (value.actions.includes("*") || value.actions.includes(target.action)) && (value.resources.includes("*") || value.resources.includes(target.kind)));
|
|
151
146
|
/** Gives the fields of a resource value that the policy lets a request use. */
|
|
152
147
|
const permittedFields = (policy, request) => {
|
|
153
148
|
const kind = kindOf(request.resource);
|
|
154
149
|
const descriptor = kind === void 0 ? void 0 : descriptorOf(policy.domain, kind);
|
|
155
150
|
if (descriptor === void 0) return Effect.succeed([]);
|
|
156
|
-
const
|
|
151
|
+
const rules = policy.pipe(nodeOf, rulesOf);
|
|
152
|
+
const listed = Arr.filter(fieldsOf(descriptor.catalog, policy.domain.limits.fieldPathParts), (field) => field.listed && Arr.every(field.path, (segment) => typeof segment === "string"));
|
|
157
153
|
return Effect.map(Effect.filter(listed, (field) => Effect.map(decideAny(policy, {
|
|
158
154
|
...request,
|
|
159
155
|
field: field.text
|
|
160
|
-
}), (result) => result._tag === "Allow" && !(field.open && deniesInside(
|
|
156
|
+
}), (result) => result._tag === "Allow" && !(field.open && deniesInside(rules, {
|
|
161
157
|
...request,
|
|
162
158
|
kind: descriptor.kind
|
|
163
159
|
}, field.text)))), Arr.map((field) => field.text));
|