@orthacms/segments-domain 0.4.3 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@orthacms/segments-domain",
-    "version": "0.4.3",
+    "version": "0.5.0",
     "description": "@orthacms/segments-domain — part of Ortha CMS.",
     "license": "MIT",
     "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/segments/domain",

package/dist/lib/access-rule.d.ts

@@ -1,120 +0,0 @@
-/**
- * The **access rule** — what an entry, a type or a workspace declares about who
- * may read it.
- *
- * The shape is deliberately fixed rather than an expression language, and the
- * three constraints below are what buy the whole design its legibility:
- *
- * 1. **Groups are OR-ed, types inside a group are AND-ed.** Disjunctive normal
- *    form, and nothing else. `(Acme) OR (EU AND Pro)` is expressible;
- *    arbitrary nesting is not.
- * 2. **No nesting.** A group holds conditions, never other groups.
- * 3. **One negation.** Rule-level {@link AccessRule.exclusions} are absolute and
- *    sit above every group; a group's own `all-except` narrows only that group.
- *
- * Lift any of them and "why can this reader see this?" stops being a flat list
- * and becomes a proof tree — which is exactly the failure mode this kernel
- * exists to avoid.
- */
-import type { SegmentTypeKey } from './segment-type';
-/** How one segment type constrains one group. */
-export declare const CONDITION_MODE: {
-    /** Does not constrain — the type is open in this group. */
-    readonly All: "all";
-    /** Everyone in the type except the named segments. */
-    readonly AllExcept: "all-except";
-    /** Only the named segments. */
-    readonly Only: "only";
-};
-/** @see CONDITION_MODE */
-export type ConditionMode = (typeof CONDITION_MODE)[keyof typeof CONDITION_MODE];
-/** The authored-only mode: take this level's value from the level above. */
-export declare const INHERIT: "inherit";
-/** A condition as **authored**, which may still defer to the level above. */
-export interface AuthoredCondition {
-    readonly mode: ConditionMode | typeof INHERIT;
-    /** Segment ids the mode refers to. Empty for `all` and `inherit`. */
-    readonly segmentIds: readonly string[];
-}
-/**
- * A condition after inheritance has run: every `inherit` is gone.
- *
- * The two types are kept apart on purpose. {@link evaluate} takes only resolved
- * conditions, so "did anyone forget to run inheritance?" is a compile error
- * rather than a silently permissive decision at runtime.
- */
-export interface ResolvedCondition {
-    readonly mode: ConditionMode;
-    readonly segmentIds: readonly string[];
-}
-/** One AND-group, as authored: segment type key → condition. */
-export type AuthoredConditionGroup = Readonly<Record<SegmentTypeKey, AuthoredCondition>>;
-/** One AND-group, after inheritance. */
-export interface ResolvedConditionGroup {
-    /** Segment type key → condition. A type absent here does not constrain. */
-    readonly conditions: Readonly<Record<SegmentTypeKey, ResolvedCondition>>;
-    /**
-     * Which level contributed this group — what the editor is shown as
-     * "inherited from type article". Absent for a group authored on the entry
-     * itself.
-     */
-    readonly source?: AccessLevelName;
-}
-/** What a reader who matched no group is served. */
-export declare const ACCESS_FALLBACK: {
-    /** Absent from listings, 404 on a direct read — existence stays secret. */
-    readonly Hidden: "hidden";
-    /** Returned with a teaser and `requires`, so the client can upsell. */
-    readonly Teaser: "teaser";
-    /** As `teaser`, plus whatever paywall treatment the client renders. */
-    readonly Paywall: "paywall";
-};
-/** @see ACCESS_FALLBACK */
-export type AccessFallback = (typeof ACCESS_FALLBACK)[keyof typeof ACCESS_FALLBACK];
-/** The levels a rule can be attached to, outermost first. */
-export declare const ACCESS_LEVEL: {
-    readonly Installation: "installation";
-    readonly Workspace: "workspace";
-    readonly Type: "type";
-    readonly Slice: "slice";
-    readonly Entry: "entry";
-};
-/** @see ACCESS_LEVEL */
-export type AccessLevelName = (typeof ACCESS_LEVEL)[keyof typeof ACCESS_LEVEL];
-/** Exclusions, by segment type key. Absolute: they outrank every group. */
-export type Exclusions = Readonly<Record<SegmentTypeKey, readonly string[]>>;
-/** A rule as authored at one level. */
-export interface AuthoredAccessRule {
-    /** Segments that never see the content, whatever any group says. */
-    readonly exclusions?: Exclusions;
-    /** Condition groups, OR-ed. Empty means this level adds no condition. */
-    readonly groups?: readonly AuthoredConditionGroup[];
-    /**
-     * Drop everything inherited from the levels above instead of adding to it.
-     *
-     * Merging is the default because replacing silently loses a type's own
-     * restriction the moment someone edits one entry — but "this one article is
-     * genuinely public" has to remain expressible, and this is how.
-     */
-    readonly detachInherited?: boolean;
-    /** Start of the visibility window. `null`/absent = no lower bound. */
-    readonly startsAt?: Date | null;
-    /** End of the visibility window. `null`/absent = no upper bound. */
-    readonly endsAt?: Date | null;
-    /** What a reader who matched no group gets. */
-    readonly fallback?: AccessFallback;
-}
-/** A rule after inheritance: what {@link evaluate} actually reads. */
-export interface ResolvedAccessRule {
-    readonly exclusions: Exclusions;
-    /** OR-ed groups. **Empty means unrestricted** — see {@link evaluate}. */
-    readonly groups: readonly ResolvedConditionGroup[];
-    readonly startsAt: Date | null;
-    readonly endsAt: Date | null;
-    readonly fallback: AccessFallback;
-}
-/** A rule that restricts nothing — the installation default. */
-export declare const OPEN_ACCESS: ResolvedAccessRule;
-/** Whether a resolved rule constrains anything at all. */
-export declare function isUnrestricted(rule: ResolvedAccessRule): boolean;
-//# sourceMappingURL=access-rule.d.ts.map

package/dist/lib/access-rule.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-rule.d.ts","sourceRoot":"","sources":["../../src/lib/access-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,iDAAiD;AACjD,eAAO,MAAM,cAAc;IACvB,2DAA2D;;IAE3D,sDAAsD;;IAEtD,+BAA+B;;CAEzB,CAAC;AAEX,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GACrB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEzD,4EAA4E;AAC5E,eAAO,MAAM,OAAO,EAAG,SAAkB,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,OAAO,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CACzC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAC5C,CAAC;AAEF,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe;IACxB,2EAA2E;;IAE3E,uEAAuE;;IAEvE,uEAAuE;;CAEjE,CAAC;AAEX,2BAA2B;AAC3B,MAAM,MAAM,cAAc,GACtB,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAE3D,6DAA6D;AAC7D,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX,wBAAwB;AACxB,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE/E,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE7E,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACrC;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,EAAE,kBAMzB,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAOhE"}

package/dist/lib/adopt-relation-sets.d.ts

@@ -1,103 +0,0 @@
-import { type AuthoredAccessRule } from './access-rule';
-import type { SegmentTypeKey } from './segment-type';
-/**
- * How an entry's access is expressed **before** segmentation, in the scheme
- * almost every CMS reaches for first: two relation fields on the entry, one
- * listing who may read it and one listing who may not.
- *
- * The names are the shape's, not this CMS's — an adopter's fields are called
- * `subscriptions` and `excludedSubscriptions`, or `plans` and `blockedPlans`.
- * What matters is that both sides name the *same kind of thing*, which is what
- * makes them one axis.
- */
-export interface RelationSets {
-    /**
-     * Segment ids that may read the entry. **Empty means everyone**, which is
-     * the convention every instance of this scheme uses — an entry nobody
-     * bothered to restrict is an open entry, not a closed one.
-     */
-    readonly included: readonly string[];
-    /** Segment ids that may not read it, whatever `included` says. */
-    readonly excluded: readonly string[];
-}
-/**
- * Translates one entry's relation sets into the rule that means the same thing.
- *
- * ## Why this is a function and not a migration script
- *
- * There is no old scheme *in this repository* to migrate from — the scheme
- * lives in the app adopting segmentation, in fields this CMS has never seen,
- * under names only that app knows. A script here would have to invent the input
- * format it claims to read. What is genuinely shared is the **mapping**, and
- * getting it wrong is what produces content that silently opens: so the mapping
- * is the part that ships, with a test, and the adopter's script is a loop that
- * reads their fields, calls this, and posts the result to `/api/access`.
- * `docs/segments-adoption.md` is that loop, written out.
- *
- * ## The three rules of the translation
- *
- * **An empty `included` is not an empty `only`.** This is the whole trap. In
- * the relation scheme an empty include list means *everyone*; in this model an
- * `only` naming nobody admits *nobody*. Translating one to the other literally
- * turns every unrestricted entry in a library dark on the day of the migration
- * — so an empty `included` produces the `all` mode, and the entry stays open.
- *
- * **`excluded` becomes an exclusion, never the complement.** Listing the other
- * three hundred and ninety-seven segments would be storing the complement,
- * which is the one thing the projection invariant forbids: onboarding a new
- * organisation would then have to rewrite every entry in the library.
- *
- * **The result is one group.** The old scheme has no disjunction to preserve —
- * it is a single include list AND-ed with a single exclude list — so a
- * translation that produced several groups would be inventing structure the
- * source never carried.
- */
-export declare function ruleFromRelationSets(typeKey: SegmentTypeKey, sets: RelationSets): AuthoredAccessRule;
-/**
- * Groups entries by the rule they translate to, so an adopter creates a handful
- * of rules rather than one per entry.
- *
- * This is the difference between a usable migration and an unusable one. A
- * library of forty thousand articles carrying the same two subscription tiers
- * has, in practice, a few dozen distinct combinations — and one rule per entry
- * would produce forty thousand rows nobody can read, edit, or reason about,
- * defeating the reuse that made a rule worth having. Entries sharing a
- * combination share a rule and get an assignment each.
- *
- * The signature key is the two **sorted** id lists, because the relation scheme
- * has no order and two entries listing the same segments differently are the
- * same rule. Entries whose sets restrict nobody are returned under
- * {@link RelationSetGrouping.unrestricted} rather than given an empty rule:
- * they need no assignment at all, and the count of them is the first number an
- * adopter should sanity-check against their own.
- */
-export declare function groupByRelationSets<T>(entries: readonly {
-    entry: T;
-    sets: RelationSets;
-}[]): RelationSetGrouping<T>;
-/** One distinct combination, and the entries carrying it. */
-export interface RelationSetGroup<T> {
-    /** The sorted-id signature the grouping keyed on. */
-    signature: string;
-    /** The normalised sets — deduplicated and sorted. */
-    sets: RelationSets;
-    /** Every entry with this combination. */
-    entries: readonly T[];
-}
-/** What {@link groupByRelationSets} returns. */
-export interface RelationSetGrouping<T> {
-    /** One entry per distinct combination — the rules to create. */
-    groups: readonly RelationSetGroup<T>[];
-    /** Entries whose sets restrict nobody. They need no rule and no assignment. */
-    unrestricted: readonly T[];
-}
-/**
- * Whether a translation would fit the model, and what to do when it does not.
- *
- * Called before writing anything. The one bound worth checking up front is the
- * group ceiling — an adopter whose scheme carries a genuine disjunction (two
- * independent axes OR-ed) will hit it, and finding out entry by entry through
- * failed writes is a migration that stops half done.
- */
-export declare function relationSetsFit(count: number): boolean;
-//# sourceMappingURL=adopt-relation-sets.d.ts.map

package/dist/lib/adopt-relation-sets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adopt-relation-sets.d.ts","sourceRoot":"","sources":["../../src/lib/adopt-relation-sets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACnB,kBAAkB,CA8BpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACjC,OAAO,EAAE,SAAS;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAAE,GACrD,mBAAmB,CAAC,CAAC,CAAC,CA+BxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAC/B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,YAAY,CAAC;IACnB,yCAAyC;IACzC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB,CAAC,CAAC;IAClC,gEAAgE;IAChE,MAAM,EAAE,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,+EAA+E;IAC/E,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/lib/evaluate.d.ts

@@ -1,78 +0,0 @@
-/**
- * The access decision — the single place that answers "may this reader see
- * this?".
- *
- * A domain service in the strict sense: no database, no framework, no clock of
- * its own. That is what lets the same function run in the SQL compiler's tests,
- * in the admin's "who sees this" panel, and on a client rendering a paywall,
- * and give all three the same answer.
- *
- * The order of the checks is not interchangeable:
- *
- * 1. **Exclusions**, absolutely and first. "Everyone except Globex" must not be
- *    reopened by a group that happens to match — a denied reader is denied
- *    however good their plan is.
- * 2. **The window**, before any group. An embargoed entry is invisible to
- *    everyone, so evaluating groups first would only produce a match nobody is
- *    allowed to act on.
- * 3. **The groups**, OR-ed. One match is enough, and the rest are not even
- *    reported as failures — which is what keeps the explanation short.
- */
-import { type ResolvedAccessRule } from './access-rule';
-import type { SegmentTypeKey } from './segment-type';
-/** Why a reader was refused. */
-export declare const DENIAL_REASON: {
-    /** Matched a rule-level exclusion. */
-    readonly Excluded: "excluded";
-    /** The visibility window is not open. */
-    readonly Window: "window";
-    /** No condition group matched. */
-    readonly NoGroup: "no-group";
-};
-/** @see DENIAL_REASON */
-export type DenialReason = (typeof DENIAL_REASON)[keyof typeof DENIAL_REASON];
-/** The group a refused reader came closest to, and what stopped them. */
-export interface ClosestGroup {
-    /** Index into {@link ResolvedAccessRule.groups}. */
-    readonly index: number;
-    /** Segment type keys whose condition failed, in declaration order. */
-    readonly failed: readonly SegmentTypeKey[];
-    /** Segment ids that would have satisfied those failing conditions. */
-    readonly requires: Readonly<Record<SegmentTypeKey, readonly string[]>>;
-}
-/** The verdict for one reader on one entry. */
-export type AccessDecision = {
-    readonly visible: true;
-    /**
-     * Which group let them through — `-1` when the rule restricts
-     * nothing, so "unrestricted" and "matched group 0" stay
-     * distinguishable in an explanation.
-     */
-    readonly matchedGroup: number;
-} | {
-    readonly visible: false;
-    readonly reason: DenialReason;
-    readonly fallback: ResolvedAccessRule['fallback'];
-    /** Absent when the refusal was an exclusion or the window. */
-    readonly closest?: ClosestGroup;
-};
-/** What {@link evaluate} is asked about. */
-export interface EvaluationInput {
-    /** The entry's rule, after inheritance. */
-    readonly rule: ResolvedAccessRule;
-    /** The reader's segment ids, already resolved from their tags. */
-    readonly callerSegmentIds: ReadonlySet<string>;
-    /** The instant the decision is made at — passed in, never read here. */
-    readonly now: Date;
-}
-/**
- * Decide whether one reader may see one entry.
- *
- * **An empty `groups` means unrestricted**, not "matches nothing". A rule with
- * no conditions is what every entry starts life with, and reading it as a
- * closed door would black out an installation the moment the plugin is
- * enabled. Exclusions and the window still apply on their own, so
- * "everyone except Globex" needs no group at all.
- */
-export declare function evaluate(input: EvaluationInput): AccessDecision;
-//# sourceMappingURL=evaluate.d.ts.map

package/dist/lib/evaluate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/lib/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAGH,KAAK,kBAAkB,EAG1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,gCAAgC;AAChC,eAAO,MAAM,aAAa;IACtB,sCAAsC;;IAEtC,yCAAyC;;IAEzC,kCAAkC;;CAE5B,CAAC;AAEX,yBAAyB;AACzB,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE9E,yEAAyE;AACzE,MAAM,WAAW,YAAY;IACzB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC1E;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACpB;IACI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CACjC,GACD;IACI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACnC,CAAC;AAER,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACtB;AAgGD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAsC/D"}

package/dist/lib/inheritance.d.ts

@@ -1,43 +0,0 @@
-/**
- * Inheritance — turning the chain of levels an entry sits under into the one
- * rule {@link evaluate} reads.
- *
- * The chain runs installation → workspace → type → slice → entry, and the rule
- * for merging it is the answer to a question the plan leaves open on purpose:
- * a lower level **adds** its groups to what it inherited rather than replacing
- * them. Replacement as the default loses a type's restriction the moment
- * somebody edits one entry — the failure is silent and the content is already
- * public by the time anyone notices. Detaching stays possible, but it has to be
- * asked for ({@link AuthoredAccessRule.detachInherited}).
- *
- * Exclusions never merge downward the other way: they are unioned across the
- * whole chain and a lower level cannot lift one. That is the same "deny wins"
- * rule {@link evaluate} enforces within a single rule, applied across levels.
- */
-import { type AccessLevelName, type AuthoredAccessRule, type ResolvedAccessRule } from './access-rule';
-/** One link in the chain: where the rule was authored, and what it says. */
-export interface AccessLevel {
-    /** Which level this is. Used to label an inherited group in the editor. */
-    readonly name: AccessLevelName;
-    /** The rule authored there, or `null`/absent when the level says nothing. */
-    readonly rule?: AuthoredAccessRule | null;
-}
-/** A resolved rule plus what it was assembled from. */
-export interface ResolvedAccess {
-    /** What {@link evaluate} takes. */
-    readonly rule: ResolvedAccessRule;
-    /** Levels that contributed anything, outermost first. */
-    readonly contributors: readonly AccessLevelName[];
-    /** The level whose `detachInherited` dropped the chain above it, if any. */
-    readonly detachedAt?: AccessLevelName;
-}
-/**
- * Collapse the chain into a single rule.
- *
- * Levels are read outermost-first and each may add groups, add exclusions, set
- * the window, set the fallback, or detach. The **nearest** level that states a
- * window or a fallback wins, because those are single-valued — unlike groups,
- * which accumulate.
- */
-export declare function resolveAccess(levels: readonly AccessLevel[]): ResolvedAccess;
-//# sourceMappingURL=inheritance.d.ts.map

package/dist/lib/inheritance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inheritance.d.ts","sourceRoot":"","sources":["../../src/lib/inheritance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAKH,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EAG1B,MAAM,eAAe,CAAC;AAGvB,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC7C;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC3B,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACzC;AA6CD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,cAAc,CA0D5E"}

package/dist/lib/limits.d.ts

@@ -1,27 +0,0 @@
-/**
- * The ceilings segmentation runs under.
- *
- * Both are cost limits with a visible failure mode, not arbitrary round
- * numbers, and both are stated here so the server's validation and the admin's
- * "2 of 8" counter read the same constant.
- */
-/**
- * Condition groups per rule.
- *
- * Each group is one row of the entry's projection, so a group added at type
- * level multiplies the projection for every entry of that type. Eight is the
- * point past which "add another OR" stops being a cheap edit; the number is a
- * starting position to be revisited against a real write benchmark, not a
- * measured optimum.
- */
-export declare const MAX_CONDITION_GROUPS = 8;
-/**
- * Segment types active at once.
- *
- * Bounded by the projection's slot columns — a type claims one `allow`/`deny`
- * pair, and the pairs are created by migration rather than by runtime DDL, so
- * the schema stays reproducible from a checkout. Raising it is one migration
- * that adds the next batch.
- */
-export declare const MAX_SEGMENT_TYPES = 8;
-//# sourceMappingURL=limits.d.ts.map

package/dist/lib/limits.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/lib/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC"}

package/dist/lib/segment-type.d.ts

@@ -1,87 +0,0 @@
-/**
- * A **segment type** — one axis of the access decision, and the unit of AND
- * logic. "Organisation", "Plan", "Region" and "Role" are all segment types; the
- * kernel knows none of them by name, only that each owns a tag namespace and
- * that types are AND-ed with one another.
- */
-/** A reader's raw entitlement tag, namespaced by its type key: `org:acme`. */
-export type SegmentTag = string;
-/** The namespace half of a tag — and the key of the type that owns it. */
-export type SegmentTypeKey = string;
-/**
- * How many segments a type is expected to hold, and therefore how the admin
- * renders it: `low` earns matrix columns, `high` gets a searchable picker. A
- * hint for the UI, never consulted by {@link evaluate}.
- */
-export declare const SEGMENT_CARDINALITY: {
-    readonly Low: "low";
-    readonly High: "high";
-};
-/** @see SEGMENT_CARDINALITY */
-export type SegmentCardinality = (typeof SEGMENT_CARDINALITY)[keyof typeof SEGMENT_CARDINALITY];
-/**
- * Where a type's segments come from. The kernel does not read any of these —
- * it is the server package that populates segments from the named source — but
- * the vocabulary lives here so both runtimes name the four the same way.
- */
-export declare const SEGMENT_SOURCE_KIND: {
-    /** Maintained by hand in the admin (plans, tiers). */
-    readonly Manual: "manual";
-    /** A fixed list declared in configuration (regions). */
-    readonly Static: "static";
-    /** Mirrors a content collection — one segment per record (organisations). */
-    readonly ContentType: "contentType";
-    /** Mirrors an external directory, read through the resolver's adapter. */
-    readonly External: "external";
-};
-/** @see SEGMENT_SOURCE_KIND */
-export type SegmentSourceKind = (typeof SEGMENT_SOURCE_KIND)[keyof typeof SEGMENT_SOURCE_KIND];
-/**
- * A type's lifecycle. `draining` is the state that makes slot reuse safe: the
- * type has left the predicate and the UI, but its slot columns still hold the
- * old ids and must be zeroed before another type may claim it. Skipping it is
- * how a new type would silently inherit a stranger's segments.
- */
-export declare const SEGMENT_TYPE_STATE: {
-    readonly Active: "active";
-    readonly Draining: "draining";
-    readonly Free: "free";
-};
-/** @see SEGMENT_TYPE_STATE */
-export type SegmentTypeState = (typeof SEGMENT_TYPE_STATE)[keyof typeof SEGMENT_TYPE_STATE];
-/** Who owns a type's definition — and therefore whether the admin may edit it. */
-export declare const SEGMENT_TYPE_MANAGED_BY: {
-    /** Declared in `ortha.config.ts`; read-only in the admin. */
-    readonly Config: "config";
-    /** Created in the admin; editable there. */
-    readonly Ui: "ui";
-};
-/** @see SEGMENT_TYPE_MANAGED_BY */
-export type SegmentTypeManagedBy = (typeof SEGMENT_TYPE_MANAGED_BY)[keyof typeof SEGMENT_TYPE_MANAGED_BY];
-/** One declared axis of the access decision. */
-export interface SegmentType {
-    /** Stable id. */
-    readonly id: string;
-    /** Tag namespace this type owns, e.g. `org` for `org:acme`. */
-    readonly key: SegmentTypeKey;
-    /** Human-readable name, shown in the editor. */
-    readonly label: string;
-    /** Rendering hint. @see SEGMENT_CARDINALITY */
-    readonly cardinality: SegmentCardinality;
-    /** Which projection slot pair this type reads and writes. */
-    readonly slot: number;
-    /** @see SEGMENT_TYPE_STATE */
-    readonly state: SegmentTypeState;
-    /** @see SEGMENT_TYPE_MANAGED_BY */
-    readonly managedBy: SegmentTypeManagedBy;
-}
-/**
- * The namespace a tag belongs to — everything before the first `:`.
- *
- * A tag with no separator has **no** namespace rather than being its own: a
- * bare `pro` must not be swept up by a mask over some type that happens to be
- * called `pro`, and returning `undefined` is what keeps
- * {@link segmentMatchesTag} from guessing.
- */
-export declare function tagNamespace(tag: SegmentTag): SegmentTypeKey | undefined;
-//# sourceMappingURL=segment-type.d.ts.map

package/dist/lib/segment-type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"segment-type.d.ts","sourceRoot":"","sources":["../../src/lib/segment-type.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,+BAA+B;AAC/B,MAAM,MAAM,kBAAkB,GAC1B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC5B,sDAAsD;;IAEtD,wDAAwD;;IAExD,6EAA6E;;IAE7E,0EAA0E;;CAEpE,CAAC;AAEX,+BAA+B;AAC/B,MAAM,MAAM,iBAAiB,GACzB,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,8BAA8B;AAC9B,MAAM,MAAM,gBAAgB,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAEjE,kFAAkF;AAClF,eAAO,MAAM,uBAAuB;IAChC,6DAA6D;;IAE7D,4CAA4C;;CAEtC,CAAC;AAEX,mCAAmC;AACnC,MAAM,MAAM,oBAAoB,GAC5B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAE3E,gDAAgD;AAChD,MAAM,WAAW,WAAW;IACxB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAGxE"}