@nxgt/janus 0.1.0

package/dist/permissions/index.js

@@ -0,0 +1,685 @@
+import {
+  guardRelations,
+  MAX_PAGE_SIZE2,
+  pageLimit2
+} from "../chunks/index-6dytvy3h.js";
+import {
+  PermissionDepthError2,
+  formatEntity2
+} from "../chunks/index-6p56fpbe.js";
+import {
+  createMemoryRelations2
+} from "../chunks/index-fgb3t64y.js";
+
+// src/permissions/resolve.ts
+function admits(holders, subject) {
+  return holders.some((holder) => holder.kind === "type" ? !("relation" in subject) && holder.type === subject.type : ("relation" in subject) && holder.type === subject.type && holder.relation === subject.relation);
+}
+var NAME = /^[a-z][A-Za-z0-9]*$/;
+var FIELD = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function resolveModel(config, where) {
+  const refuse = (message) => new TypeError(`${where}: ${message}`);
+  if (!isRecord(config))
+    throw refuse("pass { subjects, types }");
+  if (!Array.isArray(config.subjects)) {
+    throw refuse("subjects must be an array of user types — pass auth.types from janus()");
+  }
+  for (const subject of config.subjects) {
+    if (typeof subject !== "string" || !NAME.test(subject)) {
+      throw refuse(`the subject type "${String(subject)}" must be a camelCase name`);
+    }
+  }
+  const subjects = new Set(config.subjects);
+  if (!isRecord(config.types) || Object.keys(config.types).length === 0) {
+    throw refuse("types declares no object type");
+  }
+  const typeNames = new Set(Object.keys(config.types));
+  for (const name of typeNames) {
+    if (!NAME.test(name)) {
+      throw refuse(`the object type "${name}" must be a camelCase name — letters and digits, starting with a lowercase letter`);
+    }
+    if (subjects.has(name)) {
+      throw refuse(`"${name}" names a user type and an object type; a subject of type "${name}" would be ambiguous`);
+    }
+  }
+  const relationNames = new Map;
+  const permissionNames = new Map;
+  for (const [name, def] of Object.entries(config.types)) {
+    const at = `types.${name}`;
+    if (!isRecord(def))
+      throw refuse(`${at} must be an object`);
+    for (const key of Object.keys(def)) {
+      if (key !== "relations" && key !== "permissions") {
+        throw refuse(`${at}.${key} is not a key of an object type`);
+      }
+    }
+    relationNames.set(name, namesIn(def.relations, `${at}.relations`, refuse));
+    const permissions = namesIn(def.permissions, `${at}.permissions`, refuse);
+    for (const permission of permissions) {
+      if (relationNames.get(name)?.has(permission)) {
+        throw refuse(`${at}: "${permission}" names a relation and a permission; rename one`);
+      }
+    }
+    permissionNames.set(name, permissions);
+  }
+  const isSubjectType = (type) => subjects.has(type) || typeNames.has(type);
+  const namesOf = (type) => new Set([
+    ...relationNames.get(type) ?? [],
+    ...permissionNames.get(type) ?? []
+  ]);
+  const types = new Map;
+  for (const [name, def] of Object.entries(config.types)) {
+    const at = `types.${name}`;
+    const relations = new Map;
+    for (const [relation, holders] of Object.entries(def.relations ?? {})) {
+      const here = `${at}.relations.${relation}`;
+      relations.set(relation, resolveRelation(holders, here, {
+        refuse,
+        isSubjectType,
+        relationNames
+      }));
+    }
+    const permissions = new Map;
+    for (const [permission, rules] of Object.entries(def.permissions ?? {})) {
+      const here = `${at}.permissions.${permission}`;
+      if (!Array.isArray(rules) || rules.length === 0) {
+        throw refuse(`${here} must be a non-empty array of rules`);
+      }
+      permissions.set(permission, rules.map((rule, index) => resolveRule(rule, `${here}[${index}]`, {
+        refuse,
+        own: namesOf(name),
+        relations,
+        typeNames,
+        namesOf,
+        self: name
+      })));
+    }
+    types.set(name, { name, relations, permissions });
+  }
+  refuseLoops(types, refuse);
+  refuseDataBeyondRoot(types, refuse);
+  return { subjects, types };
+}
+function namesIn(value, at, refuse) {
+  if (value === undefined)
+    return new Set;
+  if (!isRecord(value))
+    throw refuse(`${at} must be an object`);
+  for (const name of Object.keys(value)) {
+    if (!NAME.test(name)) {
+      throw refuse(`${at}: "${name}" must be a camelCase name — letters and digits, starting with a lowercase letter`);
+    }
+  }
+  return new Set(Object.keys(value));
+}
+function resolveRelation(value, here, {
+  refuse,
+  isSubjectType,
+  relationNames
+}) {
+  if (isRecord(value) && value.kind === "fromField") {
+    const { field, subject, lookup } = value;
+    if (typeof field !== "string" || !FIELD.test(field)) {
+      throw refuse(`${here}: fromField must name a top-level field`);
+    }
+    if (typeof subject !== "string" || !isSubjectType(subject)) {
+      throw refuse(`${here}: fromField names "${String(subject)}", which is not a subject type`);
+    }
+    if (lookup !== undefined && typeof lookup !== "function") {
+      throw refuse(`${here}: fromField's lookup must be a function`);
+    }
+    return lookup === undefined ? { kind: "fromField", field, subject } : {
+      kind: "fromField",
+      field,
+      subject,
+      lookup
+    };
+  }
+  if (!Array.isArray(value) || value.length === 0) {
+    throw refuse(`${here} must be a non-empty array of subject types, or fromField()`);
+  }
+  const holders = value.map((holder) => {
+    if (typeof holder !== "string") {
+      throw refuse(`${here}: a holder must be a string`);
+    }
+    const hash = holder.indexOf("#");
+    if (hash < 0) {
+      if (!isSubjectType(holder)) {
+        throw refuse(`${here}: "${holder}" is not a subject type`);
+      }
+      return { kind: "type", type: holder };
+    }
+    const type = holder.slice(0, hash);
+    const relation = holder.slice(hash + 1);
+    if (!relationNames.get(type)?.has(relation)) {
+      throw refuse(`${here}: "${holder}" is not a subject set — it must name an object type and one of its relations`);
+    }
+    return { kind: "set", type, relation };
+  });
+  return { kind: "stored", holders };
+}
+function resolveRule(value, here, context) {
+  const { refuse } = context;
+  if (isRecord(value) && value.kind === "when") {
+    if (typeof value.test !== "function") {
+      throw refuse(`${here}: when() takes a function as its test`);
+    }
+    const inner = resolveRule(value.rule, here, context);
+    return { ...inner, test: value.test };
+  }
+  if (typeof value !== "string") {
+    throw refuse(`${here}: a rule is a name, an arrow, or when()`);
+  }
+  const arrow = value.indexOf("->");
+  if (arrow < 0) {
+    if (!context.own.has(value)) {
+      throw refuse(`${here}: "${value}" is not a relation or a permission of ${context.self}`);
+    }
+    return { kind: "name", name: value };
+  }
+  const relation = value.slice(0, arrow);
+  const target = value.slice(arrow + 2);
+  const through = context.relations.get(relation);
+  if (through === undefined) {
+    throw refuse(`${here}: "${value}" goes through "${relation}", which is not a relation of ${context.self}`);
+  }
+  const targets = through.kind === "fromField" ? [through.subject] : through.holders.map((holder) => holder.kind === "type" ? holder.type : null);
+  for (const type of targets) {
+    if (type === null || !context.typeNames.has(type)) {
+      throw refuse(`${here}: "${value}" goes through "${relation}", which can hold ${type === null ? "a subject set" : `a ${type}`}; an arrow follows object types only`);
+    }
+    if (!context.namesOf(type).has(target)) {
+      throw refuse(`${here}: "${value}" names "${target}", which ${type} does not declare`);
+    }
+  }
+  return { kind: "arrow", relation, target };
+}
+function refuseLoops(types, refuse) {
+  for (const type of types.values()) {
+    const visiting = [];
+    const done = new Set;
+    const visit = (permission) => {
+      if (done.has(permission))
+        return;
+      const loop = visiting.indexOf(permission);
+      if (loop >= 0) {
+        throw refuse(`types.${type.name}.permissions: ${[...visiting.slice(loop), permission].join(" → ")} is a loop no relation ends`);
+      }
+      visiting.push(permission);
+      for (const rule of type.permissions.get(permission) ?? []) {
+        if (rule.kind === "name" && type.permissions.has(rule.name)) {
+          visit(rule.name);
+        }
+      }
+      visiting.pop();
+      done.add(permission);
+    };
+    for (const permission of type.permissions.keys())
+      visit(permission);
+  }
+}
+function refuseDataBeyondRoot(types, refuse) {
+  const fieldRead = (type, name) => {
+    const relation = type.relations.get(name);
+    if (relation !== undefined) {
+      return relation.kind === "fromField" ? relation.field : null;
+    }
+    for (const rule of type.permissions.get(name) ?? []) {
+      const field = rule.kind === "name" ? fieldRead(type, rule.name) : fieldRead(type, rule.relation);
+      if (field !== null)
+        return field;
+    }
+    return null;
+  };
+  for (const type of types.values()) {
+    for (const [relation, def] of type.relations) {
+      if (def.kind !== "stored")
+        continue;
+      for (const holder of def.holders) {
+        if (holder.kind !== "set")
+          continue;
+        const target = types.get(holder.type);
+        const field = target === undefined ? null : fieldRead(target, holder.relation);
+        if (field !== null) {
+          throw refuse(`types.${type.name}.relations.${relation}: "${holder.type}#${holder.relation}" reads ${holder.type}.${field}, and a subject set reaches ${holder.type}s nobody passed to can() — store that relation instead of reading it`);
+        }
+      }
+    }
+    for (const [permission, rules] of type.permissions) {
+      for (const rule of rules) {
+        if (rule.kind !== "arrow")
+          continue;
+        const through = type.relations.get(rule.relation);
+        const targets = through?.kind === "fromField" ? [through.subject] : (through?.holders ?? []).map((holder) => holder.type);
+        for (const name of targets) {
+          const target = types.get(name);
+          const field = target === undefined ? null : fieldRead(target, rule.target);
+          if (field !== null) {
+            throw refuse(`types.${type.name}.permissions.${permission}: "${rule.relation}->${rule.target}" reaches ${name}.${rule.target}, which reads ${name}.${field}, and only the object passed to can() carries its data — store that relation instead of reading it`);
+          }
+        }
+      }
+    }
+  }
+}
+
+// src/permissions/input.ts
+var RESERVED = /[@#()]/;
+var isRecord2 = (value) => typeof value === "object" && value !== null;
+function idOf(value, what, where) {
+  if (typeof value !== "string" || value === "" || RESERVED.test(value)) {
+    throw new TypeError(`${where}: ${what} must be a non-empty string without @, # or parentheses`);
+  }
+  return value;
+}
+function typeOf(model, name, where) {
+  const type = model.types.get(name);
+  if (type === undefined) {
+    throw new TypeError(`${where}: "${name}" is not an object type of the model`);
+  }
+  return type;
+}
+function objectOf(model, value, where) {
+  if (!isRecord2(value) || typeof value.type !== "string") {
+    throw new TypeError(`${where}: the object must be { type, id, …its fields }`);
+  }
+  typeOf(model, value.type, where);
+  return {
+    type: value.type,
+    id: idOf(value.id, "the object id", where),
+    data: value
+  };
+}
+function subjectOf(model, value, where) {
+  if (!isRecord2(value) || typeof value.type !== "string") {
+    throw new TypeError(`${where}: the subject must be a user, or { type, id }`);
+  }
+  const id = idOf(value.id, "the subject id", where);
+  if (model.subjects.has(value.type))
+    return { type: value.type, id };
+  const type = typeOf(model, value.type, where);
+  if (typeof value.relation !== "string")
+    return { type: type.name, id };
+  if (!type.relations.has(value.relation)) {
+    throw new TypeError(`${where}: "${value.relation}" is not a relation of ${type.name}, so ${type.name}:${id}#${value.relation} is no subject set`);
+  }
+  return { type: type.name, id, relation: value.relation };
+}
+function tupleOf(model, object, relation, subject, where) {
+  const target = objectOf(model, object, where);
+  const type = typeOf(model, target.type, where);
+  const def = type.relations.get(relation);
+  if (def === undefined) {
+    throw new TypeError(`${where}: "${relation}" is not a relation of ${type.name}`);
+  }
+  if (def.kind === "fromField") {
+    throw new TypeError(`${where}: ${type.name}.${relation} is read from ${def.field}; there is nothing to store — change the ${type.name} instead`);
+  }
+  const who = subjectOf(model, subject, where);
+  if (!admits(def.holders, who)) {
+    throw new TypeError(`${where}: ${type.name}.${relation} is not held by ${"relation" in who ? `${who.type}#${who.relation}` : who.type}`);
+  }
+  return {
+    object: { type: target.type, id: target.id },
+    relation,
+    subject: who
+  };
+}
+
+// src/permissions/model.ts
+function fromField(field, subject, options) {
+  return Object.freeze(options === undefined ? { kind: "fromField", field, subject } : { kind: "fromField", field, subject, lookup: options.lookup });
+}
+function when(rule, test) {
+  return Object.freeze({ kind: "when", rule, test });
+}
+var RESOLVED = new WeakMap;
+function defineModel(config) {
+  const resolved = resolveModel(config, "defineModel");
+  const model = Object.freeze({
+    subjects: [...resolved.subjects],
+    types: [...resolved.types.keys()],
+    definition: config
+  });
+  RESOLVED.set(model, resolved);
+  return model;
+}
+function resolvedOf(model) {
+  const resolved = RESOLVED.get(model);
+  if (resolved === undefined) {
+    throw new TypeError("permissions: this model was not made by defineModel() — pass what defineModel() answered");
+  }
+  return resolved;
+}
+
+// src/permissions/reverse.ts
+class Reverse {
+  constructor(model, store, maxDepth, ctx, subject, question) {
+    this.model = model;
+    this.store = store;
+    this.maxDepth = maxDepth;
+    this.ctx = ctx;
+    this.subject = subject;
+    this.question = question;
+    this.previous = new Map;
+    this.current = new Map;
+    this.path = new Set;
+    this.looped = false;
+  }
+  async objects(type, name) {
+    for (let round = 0;round <= this.maxDepth; round += 1) {
+      this.current = new Map;
+      this.looped = false;
+      const found = await this.reach(type, name);
+      if (!this.looped || this.same())
+        return found;
+      this.previous = this.current;
+    }
+    throw new PermissionDepthError2(`list: listing ${this.question} crossed more than ${this.maxDepth} relations without an answer`, { permission: this.question, maxDepth: this.maxDepth });
+  }
+  same() {
+    for (const [key, ids] of this.current) {
+      if ((this.previous.get(key)?.size ?? 0) !== ids.size)
+        return false;
+    }
+    return true;
+  }
+  async reach(typeName, name) {
+    const key = `${typeName}#${name}`;
+    const done = this.current.get(key);
+    if (done !== undefined)
+      return done;
+    if (this.path.has(key)) {
+      this.looped = true;
+      return this.previous.get(key) ?? new Set;
+    }
+    const type = this.model.types.get(typeName);
+    if (type === undefined)
+      return new Set;
+    this.path.add(key);
+    try {
+      const found = type.permissions.has(name) ? await this.permission(type, name) : await this.relation(type, name);
+      this.current.set(key, found);
+      return found;
+    } finally {
+      this.path.delete(key);
+    }
+  }
+  async relation(type, name) {
+    const relation = type.relations.get(name);
+    if (relation === undefined)
+      return new Set;
+    if (relation.kind === "fromField") {
+      const subject = this.subject;
+      return "relation" in subject || subject.type !== relation.subject ? new Set : new Set(await this.lookup(type, name, subject.id));
+    }
+    const found = new Set(admits(relation.holders, this.subject) ? await this.holding(type.name, name, this.subject) : []);
+    for (const holder of relation.holders) {
+      if (holder.kind !== "set")
+        continue;
+      for (const id of await this.reach(holder.type, holder.relation)) {
+        const set = { type: holder.type, id, relation: holder.relation };
+        for (const object of await this.holding(type.name, name, set)) {
+          found.add(object);
+        }
+      }
+    }
+    return found;
+  }
+  async permission(type, name) {
+    const found = new Set;
+    for (const rule of type.permissions.get(name) ?? []) {
+      if (rule.test !== undefined && !this.passes(rule, type, name))
+        continue;
+      if (rule.kind === "name") {
+        for (const id of await this.reach(type.name, rule.name))
+          found.add(id);
+        continue;
+      }
+      for (const id of await this.arrow(type, rule.relation, rule.target)) {
+        found.add(id);
+      }
+    }
+    return found;
+  }
+  async arrow(type, relation, target) {
+    const through = type.relations.get(relation);
+    const found = new Set;
+    if (through === undefined)
+      return found;
+    if (through.kind === "fromField") {
+      for (const id of await this.reach(through.subject, target)) {
+        for (const object of await this.lookup(type, relation, id)) {
+          found.add(object);
+        }
+      }
+      return found;
+    }
+    for (const holder of through.holders) {
+      if (holder.kind !== "type" || !this.model.types.has(holder.type)) {
+        continue;
+      }
+      for (const id of await this.reach(holder.type, target)) {
+        const entity = { type: holder.type, id };
+        for (const object of await this.holding(type.name, relation, entity)) {
+          found.add(object);
+        }
+      }
+    }
+    return found;
+  }
+  async holding(type, relation, subject) {
+    const ids = [];
+    let after = null;
+    do {
+      const page = await this.store.findObjects({
+        type,
+        relation,
+        subject,
+        after,
+        limit: MAX_PAGE_SIZE2
+      });
+      ids.push(...page.items);
+      after = page.nextCursor;
+    } while (after !== null);
+    return ids;
+  }
+  async lookup(type, relation, id) {
+    const def = type.relations.get(relation);
+    if (def?.kind !== "fromField" || def.lookup === undefined) {
+      throw new TypeError(`list: ${type.name}.${relation} is read from a field, and has no lookup to find the ${type.name}s naming ${id} — fromField('${def?.kind === "fromField" ? def.field : relation}', '${def?.kind === "fromField" ? def.subject : ""}', { lookup })`);
+    }
+    const ids = await def.lookup(id);
+    if (!Array.isArray(ids) || ids.some((each) => typeof each !== "string")) {
+      throw new TypeError(`list: the lookup of ${type.name}.${relation} must answer an array of ids`);
+    }
+    return ids;
+  }
+  passes(rule, type, name) {
+    if (this.ctx === undefined) {
+      throw new TypeError(`list: ${type.name}.${name} reaches a condition, and no ctx was passed — pass { ctx }`);
+    }
+    return rule.test(this.ctx) === true;
+  }
+}
+
+// src/permissions/walk.ts
+class Walk {
+  constructor(model, store, maxDepth, ctx, question) {
+    this.model = model;
+    this.store = store;
+    this.maxDepth = maxDepth;
+    this.ctx = ctx;
+    this.question = question;
+    this.path = new Set;
+  }
+  async holds(subject, node, name, depth) {
+    if (depth > this.maxDepth) {
+      throw new PermissionDepthError2(`can: checking ${this.question} crossed more than ${this.maxDepth} relations without an answer`, { permission: this.question, maxDepth: this.maxDepth });
+    }
+    const key = `${formatEntity2(node.entity)}#${name}`;
+    if (this.path.has(key))
+      return false;
+    const type = this.model.types.get(node.entity.type);
+    if (type === undefined)
+      return false;
+    this.path.add(key);
+    try {
+      return type.permissions.has(name) ? await this.permission(subject, type, node, name, depth) : await this.relation(subject, type, node, name, depth);
+    } finally {
+      this.path.delete(key);
+    }
+  }
+  async relation(subject, type, node, name, depth) {
+    const relation = type.relations.get(name);
+    if (relation === undefined)
+      return false;
+    if (relation.kind === "fromField") {
+      const id = fieldOf(node, relation.field, `${type.name}.${name}`);
+      return id !== null && !("relation" in subject) && subject.type === relation.subject && subject.id === id;
+    }
+    if (admits(relation.holders, subject) && await this.store.has({ object: node.entity, relation: name, subject })) {
+      return true;
+    }
+    for (const set of await this.store.findSubjectSets(node.entity, name)) {
+      if (!admits(relation.holders, set))
+        continue;
+      const through = { entity: { type: set.type, id: set.id }, data: null };
+      if (await this.holds(subject, through, set.relation, depth + 1)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  async permission(subject, type, node, name, depth) {
+    for (const rule of type.permissions.get(name) ?? []) {
+      if (rule.test !== undefined && !this.passes(rule, type, name))
+        continue;
+      if (rule.kind === "name") {
+        if (await this.holds(subject, node, rule.name, depth))
+          return true;
+        continue;
+      }
+      for (const target of await this.targets(type, node, rule.relation)) {
+        if (await this.holds(subject, target, rule.target, depth + 1)) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+  passes(rule, type, name) {
+    if (this.ctx === undefined) {
+      throw new TypeError(`can: ${type.name}.${name} reaches a condition, and no ctx was passed — pass { ctx }`);
+    }
+    return rule.test(this.ctx) === true;
+  }
+  async targets(type, node, relation) {
+    const through = type.relations.get(relation);
+    if (through === undefined)
+      return [];
+    if (through.kind === "fromField") {
+      const id = fieldOf(node, through.field, `${type.name}.${relation}`);
+      return id === null ? [] : [{ entity: { type: through.subject, id }, data: null }];
+    }
+    return (await this.store.findEntities(node.entity, relation)).filter((entity) => admits(through.holders, entity)).map((entity) => ({
+      entity: { type: entity.type, id: entity.id },
+      data: null
+    }));
+  }
+}
+function fieldOf(node, field, what) {
+  if (node.data === null) {
+    throw new TypeError(`can: ${what} reads ${field} from an object nobody passed`);
+  }
+  const value = node.data[field];
+  if (value === null)
+    return null;
+  if (typeof value !== "string") {
+    throw new TypeError(`can: ${what} reads ${field}, which the object ${value === undefined ? "does not carry — pass the loaded object, spread" : "holds as something other than a string id"}`);
+  }
+  return value;
+}
+
+// src/permissions/engine.ts
+var DEFAULT_MAX_DEPTH = 25;
+var REQUIRED = [
+  "write",
+  "has",
+  "findSubjectSets",
+  "findEntities",
+  "findObjects",
+  "deleteEntity"
+];
+function permissions(options) {
+  const where = "permissions";
+  const model = resolvedOf(options.model);
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  if (!Number.isInteger(maxDepth) || maxDepth < 1) {
+    throw new TypeError(`${where}: maxDepth must be a positive integer`);
+  }
+  const raw = options.store;
+  for (const method of REQUIRED) {
+    if (typeof raw?.[method] !== "function") {
+      throw new TypeError(`${where}: store.${method} is missing`);
+    }
+  }
+  const store = guardRelations(options.store);
+  const check = async (subject, permission, object, options) => {
+    if (subject === null || subject === undefined)
+      return false;
+    const root = objectOf(model, object, "can");
+    const type = typeOf(model, root.type, "can");
+    if (!type.relations.has(permission) && !type.permissions.has(permission)) {
+      throw new TypeError(`can: "${permission}" is not a relation or a permission of ${type.name}`);
+    }
+    return new Walk(model, store, maxDepth, options?.ctx, `${type.name}#${permission}`).holds(subjectOf(model, subject, "can"), { entity: { type: root.type, id: root.id }, data: root.data }, permission, 0);
+  };
+  const list = async (subject, permission, typeName, options) => {
+    const limit = pageLimit2(options?.limit, "list");
+    const after = options?.after ?? null;
+    if (after !== null && typeof after !== "string") {
+      throw new TypeError("list: after must be the nextCursor of a page, or null");
+    }
+    if (subject === null || subject === undefined) {
+      return { items: [], nextCursor: null };
+    }
+    if (typeof typeName !== "string") {
+      throw new TypeError("list: the type must be an object type of the model");
+    }
+    const type = typeOf(model, typeName, "list");
+    if (!type.relations.has(permission) && !type.permissions.has(permission)) {
+      throw new TypeError(`list: "${permission}" is not a relation or a permission of ${type.name}`);
+    }
+    const ids = await new Reverse(model, store, maxDepth, options?.ctx, subjectOf(model, subject, "list"), `${type.name}#${permission}`).objects(type.name, permission);
+    const rest = [...ids].sort().filter((id) => after === null || id > after);
+    const items = rest.slice(0, limit);
+    const last = items.at(-1);
+    return {
+      items,
+      nextCursor: rest.length > limit && last !== undefined ? last : null
+    };
+  };
+  const change = (operation) => async (object, relation, subject) => {
+    const tuple = tupleOf(model, object, relation, subject, operation);
+    await store.write(operation === "grant" ? { add: [tuple] } : { remove: [tuple] });
+  };
+  return Object.freeze({
+    model: options.model,
+    can: check,
+    list,
+    grant: change("grant"),
+    revoke: change("revoke")
+  });
+}
+export {
+  createMemoryRelations2 as createMemoryRelations,
+  defineModel,
+  fromField,
+  permissions,
+  when
+};
+
+//# debugId=42583EA285837CAD64756E2164756E21
+//# sourceMappingURL=index.js.map