avouch 0.1.22

package/dist/src/evaluate.js

@@ -0,0 +1,535 @@
+// Decision evaluation: evalValue / evalPredicate (two levels, Kleene logic) and decide (invocation layer, then decision table).
+// Deterministic: no wall clock, no randomness, no global mutable state; `now` comes from the caller.
+// Invalid input (ontology, snapshot, scope argument) throws; it is never a result.
+import { checkPermissionWhen, checkPredicate, fitsType, isPureLink, own, projectedFields, RESERVED_NAMES, resolvesInDomain, TIMESTAMP_MAX, TIMESTAMP_MIN } from "./expr.js";
+// The fixed invocation result set of the format (defined in ./expr). decide never returns the first two (the idempotency
+// envelope is not implemented here: it has no idempotency key).
+export { INVOCATION_RESULTS } from "./expr.js";
+// Thrown when evaluation reads a derived property that has no expression; decide turns it into INDETERMINATE.
+export class UndefinedDerived extends Error {
+    derived;
+    constructor(derived) {
+        super(`derived property ${derived} has no expression`);
+        this.derived = derived;
+        this.name = "UndefinedDerived";
+    }
+}
+// A field of a snapshot row. An absent key, or the value undefined, is an incomplete snapshot and throws; null is a value.
+function field(row, key, what) {
+    if (!Object.hasOwn(row, key) || row[key] === undefined)
+        throw new Error(`snapshot ${what} has no ${key}`);
+    return row[key];
+}
+// A field that holds an id (a foreign-key via, the scope field): a string or null; another value is a corrupt snapshot.
+function idField(row, key, what, t) {
+    const v = field(row, key, what);
+    if (v !== null && typeof v !== "string")
+        throw new Error(`snapshot ${what}: ${key} = ${JSON.stringify(v)} is not a string id`);
+    if (v !== null && t !== undefined && !fitsType(v, t))
+        throw new Error(`snapshot ${what}: ${key} = ${JSON.stringify(v)} does not fit its declared type`);
+    return v;
+}
+// One evaluation session: caches filtered rows per type and derived values per (id, row id).
+class Session {
+    ont;
+    env;
+    rows = new Map();
+    links = new Map();
+    derivedCache = new Map();
+    constructor(ont, env) {
+        this.ont = ont;
+        this.env = env;
+    }
+    mode(type) {
+        const s = this.ont.scope;
+        if (s === undefined)
+            return "none";
+        if (s.root?.type === type)
+            return "root";
+        if (s.global?.some((g) => g.type === type))
+            return "global";
+        return "tenant";
+    }
+    // A null scope field matches no scope, also when the scope is null.
+    inScope(v) {
+        return v !== null && v === this.env.scope;
+    }
+    visible(type, row) {
+        const m = this.mode(type);
+        if (m === "tenant")
+            return this.inScope(idField(row, this.ont.scope.by, `${type} row ${String(row.id)}`, own(this.ont.objectTypes[type]?.properties, this.ont.scope.by)?.type));
+        if (m === "root")
+            return row.id === this.env.scope;
+        return true;
+    }
+    allRows(type) {
+        const rows = own(this.env.snapshot.objects, type);
+        if (rows === undefined)
+            throw new Error(`snapshot lacks object type ${type}`);
+        for (const r of rows)
+            if (typeof r.id !== "string")
+                throw new Error(`a ${type} row has no string id`);
+        return rows;
+    }
+    // Rows of `type` after the scope filter, by id. Lookups by id always run on filtered rows: ids repeat across tenants.
+    byId(type) {
+        let m = this.rows.get(type);
+        if (m === undefined) {
+            m = new Map();
+            for (const r of this.allRows(type)) {
+                if (!this.visible(type, r))
+                    continue;
+                if (m.has(r.id))
+                    throw new Error(`snapshot has two ${type} rows with id ${String(r.id)} in one scope`);
+                m.set(r.id, r);
+            }
+            this.rows.set(type, m);
+        }
+        return m;
+    }
+    linkRows(link) {
+        let rows = this.links.get(link.id);
+        if (rows === undefined) {
+            const all = own(this.env.snapshot.links, link.id);
+            if (all === undefined)
+                throw new Error(`snapshot lacks link ${link.id}`);
+            for (const r of all)
+                for (const k of ["from", "to"]) {
+                    const v = field(r, k, `${link.id} link row`);
+                    if (typeof v !== "string")
+                        throw new Error(`snapshot ${link.id} link row: ${k} = ${JSON.stringify(v)} is not a string id`);
+                }
+            const by = this.ont.scope?.by;
+            const tenantEnd = this.mode(link.from) === "tenant" || this.mode(link.to) === "tenant";
+            rows = by !== undefined && tenantEnd ? all.filter((r) => this.inScope(idField(r, by, `${link.id} link row`))) : all;
+            this.links.set(link.id, rows);
+        }
+        return rows;
+    }
+    isPureLink(link) {
+        return isPureLink(this.ont, link);
+    }
+    cachedDerived(id, row, compute) {
+        const k = `${id}\u0000${String(row.id)}`;
+        if (!this.derivedCache.has(k))
+            this.derivedCache.set(k, compute());
+        return this.derivedCache.get(k);
+    }
+}
+const paramType = (ont, action, name) => action === undefined ? undefined : own(ont.actionTypes[action]?.parameters, name)?.type;
+function objVar(s, f, name) {
+    if (Object.hasOwn(f.vars, name))
+        return f.vars[name];
+    if (f.input === true)
+        return undefined; // before binding: no lookup, readRef gives the given value
+    const t = paramType(s.ont, f.action, name);
+    if (t === undefined || typeof t === "string" || !("ref" in t))
+        return undefined;
+    const v = own(s.env.bindings, name);
+    if (v === null || v === undefined)
+        return { type: t.ref, row: null };
+    const row = s.byId(t.ref).get(v);
+    if (row === undefined)
+        throw new Error(`binding ${name} = ${String(v)} is not a visible ${t.ref}`);
+    return { type: t.ref, row };
+}
+function readRef(s, f, path) {
+    const parts = path.split(".");
+    if (parts.length > 2 || parts.some((p) => p === ""))
+        throw new Error(`ref ${path}: at most one dot`);
+    const [head, prop] = parts;
+    if (head === "now") {
+        if (prop !== undefined)
+            throw new Error("now has no properties");
+        return s.env.now;
+    }
+    if (head === "actor") {
+        if (prop === "id")
+            return s.env.actor.id;
+        if (prop === "keys")
+            return s.env.actor.keys;
+        if (prop === "kind")
+            return s.env.actor.kind;
+        throw new Error(`actor.${prop ?? ""} is not readable; use actor.id, actor.keys or actor.kind`);
+    }
+    const o = objVar(s, f, head);
+    if (prop === undefined) {
+        if (o !== undefined)
+            return o.row === null ? null : o.row.id;
+        if (f.action === undefined)
+            throw new Error(`${head} is not visible in a derived property expression`);
+        return own(s.env.bindings, head) ?? null;
+    }
+    if (o === undefined)
+        throw new Error(`${head} is not an object binding`);
+    if (o.row === null)
+        return null;
+    const v = field(o.row, prop, `${o.type} row ${String(o.row.id)}`);
+    // A non-null value must fit the declared type; otherwise the snapshot is malformed.
+    const t = own(s.ont.objectTypes[o.type]?.properties, prop)?.type;
+    if (v !== null && t !== undefined && !fitsType(v, t))
+        throw new Error(`snapshot ${o.type} row ${String(o.row.id)}: ${prop} = ${JSON.stringify(v)} does not fit its declared type`);
+    return v;
+}
+// Out of range means malformed input (snapshot, duration, now): it throws, it is not U.
+function inRange(t, where) {
+    if (!(t >= TIMESTAMP_MIN && t <= TIMESTAMP_MAX))
+        throw new Error(`${where}: timestamp out of supported range (${t})`);
+    return t;
+}
+function dateIn(t, tz) {
+    const parts = new Intl.DateTimeFormat("en-US", { timeZone: tz, year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(new Date(t));
+    const get = (k) => parts.find((x) => x.type === k).value;
+    // Timestamps are bounded so the year is 1..9999; pad it to 4 digits so dates compare as strings.
+    return `${get("year").padStart(4, "0")}-${get("month")}-${get("day")}`;
+}
+function value(s, f, e) {
+    if ("ref" in e)
+        return readRef(s, f, e.ref);
+    if ("lit" in e)
+        return e.lit;
+    if ("plus" in e) {
+        const [a, b] = evalAll([() => value(s, f, e.plus[0]), () => value(s, f, e.plus[1])]);
+        if (a === null || b === null)
+            return null;
+        const r = a + 1000 * b;
+        return inRange(r, "plus");
+    }
+    if ("dateIn" in e) {
+        const [a, b] = evalAll([() => value(s, f, e.dateIn[0]), () => value(s, f, e.dateIn[1])]);
+        if (a === null || b === null)
+            return null;
+        inRange(a, "dateIn");
+        return dateIn(a, b);
+    }
+    if ("derived" in e) {
+        const o = objVar(s, f, e.derived.of.ref);
+        if (o === undefined)
+            throw new Error(`${e.derived.of.ref} is not an object binding`);
+        if (o.row === null)
+            return null;
+        const id = e.derived.id;
+        const dp = own(s.ont.derivedProperties, id);
+        if (dp === undefined)
+            throw new Error(`derived property ${id} is not declared`);
+        const expr = dp.expr;
+        if (expr === undefined)
+            throw new UndefinedDerived(id);
+        const row = o.row;
+        const frame = { action: undefined, vars: { self: { type: dp.of, row } } };
+        // A predicate root (a Boolean derived property): T / F / U give true / false / null.
+        return s.cachedDerived(id, row, () => (isValueNode(expr) ? value(s, frame, expr) : fromTV(predicate(s, frame, expr))));
+    }
+    throw new Error(`not a value expression: ${Object.keys(e)[0]}`);
+}
+const isValueNode = (e) => "ref" in e || "lit" in e || "plus" in e || "dateIn" in e || "derived" in e;
+const fromTV = (x) => (x === "T" ? true : x === "F" ? false : null);
+// A boolean value in a predicate position: true / false / null give T / F / U.
+function toTV(v) {
+    if (v === null)
+        return "U";
+    if (typeof v !== "boolean")
+        throw new Error(`a predicate position holds a non-boolean value ${JSON.stringify(v)}`);
+    return v ? "T" : "F";
+}
+const and3 = (xs) => (xs.includes("F") ? "F" : xs.includes("U") ? "U" : "T");
+const or3 = (xs) => (xs.includes("T") ? "T" : xs.includes("U") ? "U" : "F");
+const not3 = (x) => (x === "T" ? "F" : x === "F" ? "T" : "U");
+const tv = (b) => (b ? "T" : "F");
+function navigate(s, f, n) {
+    const { from, link: linkId, dir } = n.nav;
+    const o = objVar(s, f, from.ref);
+    if (o === undefined)
+        throw new Error(`${from.ref} is not an object binding`);
+    const link = s.ont.linkTypes.find((l) => l.id === linkId);
+    if (link === undefined)
+        throw new Error(`link ${linkId} is not declared`);
+    const target = dir === "forward" ? link.to : link.from;
+    if (o.row === null)
+        return [];
+    const fromRow = o.row;
+    const targets = s.byId(target);
+    const pick = (ids) => ids.flatMap((id) => (typeof id === "string" && targets.has(id) ? [{ type: target, row: targets.get(id) }] : []));
+    if (s.isPureLink(link)) {
+        const rows = s.linkRows(link);
+        const end = (r, k) => field(r, k, `${link.id} link row`);
+        return dir === "forward"
+            ? pick(rows.filter((r) => end(r, "from") === fromRow.id).map((r) => end(r, "to")))
+            : pick(rows.filter((r) => end(r, "to") === fromRow.id).map((r) => end(r, "from")));
+    }
+    if (dir === "forward") {
+        const v = idField(fromRow, link.via, `${link.from} row ${String(fromRow.id)}`, own(s.ont.objectTypes[link.from]?.properties, link.via)?.type);
+        return v === null ? [] : pick([v]);
+    }
+    return [...targets.values()]
+        .filter((r) => idField(r, link.via, `${link.from} row ${String(r.id)}`, own(s.ont.objectTypes[link.from]?.properties, link.via)?.type) === fromRow.id)
+        .map((row) => ({ type: target, row }));
+}
+const COMPARE = ["eq", "neq", "lt", "lte", "gt", "gte"];
+// Evaluates every thunk, then: the first error that is not UndefinedDerived (an invalid snapshot) is thrown; else the
+// first UndefinedDerived in order is thrown; else the values are returned. So an invalid snapshot is never masked.
+function evalAll(thunks) {
+    const out = [];
+    const errs = [];
+    for (const t of thunks)
+        try {
+            out.push(t());
+        }
+        catch (err) {
+            errs.push(err);
+        }
+    const invalid = errs.findIndex((err) => !(err instanceof UndefinedDerived));
+    if (invalid !== -1)
+        throw errs[invalid];
+    if (errs.length > 0)
+        throw errs[0];
+    return out;
+}
+// No short circuit: all operands of every multi-operand node (comparisons, in, subsetOf, plus, dateIn, and, or) and all
+// elements of a quantifier are evaluated (evalAll); an invalid-snapshot error takes precedence over an undefined derived
+// property; the reported derived property is the first in operand order.
+// An undefined derived property makes the condition undefined only when evaluation reaches it: a derived property of a
+// null optional ref is null without reading its expression, and the `where` of an empty quantifier is never evaluated.
+function predicate(s, f, e) {
+    for (const op of COMPARE)
+        if (op in e) {
+            const [x, y] = e[op];
+            const [a, b] = evalAll([() => value(s, f, x), () => value(s, f, y)]);
+            if (a === null || b === null)
+                return "U";
+            switch (op) {
+                case "eq": return tv(a === b);
+                case "neq": return tv(a !== b);
+                case "lt": return tv(a < b);
+                case "lte": return tv(a <= b);
+                case "gt": return tv(a > b);
+                case "gte": return tv(a >= b);
+            }
+        }
+    if ("and" in e)
+        return and3(evalAll(e.and.map((x) => () => predicate(s, f, x))));
+    if ("or" in e)
+        return or3(evalAll(e.or.map((x) => () => predicate(s, f, x))));
+    if ("not" in e)
+        return not3(predicate(s, f, e.not[0]));
+    if ("in" in e) {
+        const [a, set] = evalAll([() => value(s, f, e.in[0]), () => value(s, f, e.in[1])]);
+        if (a === null || set === null)
+            return "U";
+        return tv(set.includes(a));
+    }
+    if ("subsetOf" in e) {
+        const [a, b] = evalAll([() => value(s, f, e.subsetOf[0]), () => value(s, f, e.subsetOf[1])]);
+        if (a === null || b === null)
+            return "U";
+        const big = b;
+        return tv(a.every((x) => big.includes(x)));
+    }
+    if ("isNull" in e)
+        return tv(value(s, f, e.isNull[0]) === null);
+    if ("isNotNull" in e)
+        return tv(value(s, f, e.isNotNull[0]) !== null);
+    const quant = (q) => evalAll(navigate(s, f, q.in).map((el) => () => (q.where === undefined ? "T" : predicate(s, { ...f, vars: { ...f.vars, [q.as]: el } }, q.where))));
+    // Quantifiers are two-valued: an element counts only when its predicate is T.
+    if ("exists" in e)
+        return tv(quant(e.exists).includes("T"));
+    if ("none" in e)
+        return tv(!quant(e.none).includes("T"));
+    if ("all" in e)
+        return tv(quant(e.all).every((x) => x === "T"));
+    if ("ref" in e || "derived" in e)
+        return toTV(value(s, f, e));
+    throw new Error(`not a predicate expression: ${Object.keys(e)[0]}`);
+}
+const topFrame = (env) => ({ action: env.action, vars: {} });
+// Value expressions. `bindings` are taken as having passed decide's shape and binding layers: a ref with
+// `unresolved: domain` whose id does not resolve is passed as null, as decide binds it.
+export function evalValue(ont, expr, env) {
+    return value(new Session(ont, env), topFrame(env), expr);
+}
+// Predicate expressions: T, F or U.
+export function evalPredicate(ont, expr, env) {
+    return predicate(new Session(ont, env), topFrame(env), expr);
+}
+const kindAdmitted = (pr, actor) => pr === undefined || pr.kinds.includes(actor.kind);
+// Only conditional keys missing: conditional_when says whether they are needed (F: not needed, T: needed, U or absent: undecided).
+function altState(a, actor, when) {
+    if (!kindAdmitted(a.principals, actor))
+        return "deny";
+    if (!a.keys.every((k) => actor.keys.includes(k)))
+        return "deny";
+    if ((a.conditional_keys ?? []).every((k) => actor.keys.includes(k)))
+        return "pass";
+    const w = a.conditional_when === undefined ? "U" : when(a.conditional_when);
+    return w === "F" ? "pass" : w === "T" ? "deny" : "undecided";
+}
+// Shape (no snapshot reads) and permission. Returns a result to stop with, or undefined to go on.
+function admit(ont, actionId, bindings, actor, when) {
+    const action = ont.actionTypes[actionId];
+    const params = action.parameters ?? {};
+    const unknown = Object.keys(bindings)
+        .filter((k) => bindings[k] !== undefined && !Object.hasOwn(params, k))
+        .sort()[0];
+    if (unknown !== undefined)
+        return { layer: "invocation", result: "INVALID_BINDING", param: unknown, reason: "unknown_param" };
+    for (const [name, p] of Object.entries(params)) {
+        const v = own(bindings, name);
+        if (v === null || v === undefined) {
+            // A projected ref parameter is always given: null means the projection found nothing (not_found at the binding step).
+            const projected = projectedFields(p) !== null;
+            if (v === null ? p.optional === true || projected : p.optional === true && !projected)
+                continue;
+            return { layer: "invocation", result: "INVALID_BINDING", param: name, reason: "missing" };
+        }
+        if (!fitsType(v, p.type))
+            return { layer: "invocation", result: "INVALID_BINDING", param: name, reason: "type" };
+        if (Array.isArray(p.values) && !p.values.includes(v))
+            return { layer: "invocation", result: "INVALID_BINDING", param: name, reason: "type" };
+    }
+    const perm = action.permission;
+    if (perm === "unknown")
+        return { layer: "indeterminate", reason: "permission_unknown" };
+    if ("none" in perm)
+        return kindAdmitted(perm.principals, actor) ? undefined : { layer: "invocation", result: "PERMISSION_DENIED" };
+    const states = ("any_of" in perm ? perm.any_of : [perm]).map((a) => altState(a, actor, when));
+    if (states.includes("pass"))
+        return undefined;
+    if (states.every((x) => x === "deny"))
+        return { layer: "invocation", result: "PERMISSION_DENIED" };
+    return { layer: "indeterminate", reason: "permission_condition" };
+}
+const condId = (row) => ("passes" in row.when ? row.when.passes : row.when.fails);
+// Binding and scope, then the decision table.
+function resolve(s, actionId) {
+    const action = s.ont.actionTypes[actionId];
+    // A ref parameter binds one object; each element of a set-of-ref parameter is a referenced object too (array order).
+    // A scalar ref with `unresolved: domain` binds to null when its id is not visible.
+    const unresolved = []; // unresolved: domain parameters whose id did not resolve
+    for (const [name, p] of Object.entries(action.parameters ?? {})) {
+        const t = p.type;
+        const isSet = typeof t !== "string" && "set" in t;
+        const elem = isSet ? t.set : t;
+        if (typeof elem === "string" || !("ref" in elem))
+            continue;
+        const v = own(s.env.bindings, name);
+        if (v === null && p.optional !== true && projectedFields(p) !== null)
+            return { layer: "invocation", result: "INVALID_BINDING", param: name, reason: "not_found" };
+        if (v === null || v === undefined)
+            continue;
+        for (const id of isSet ? v : [v]) {
+            if (s.byId(elem.ref).has(id))
+                continue;
+            // Absent and out of scope give the same null, so existence in another tenant is not revealed.
+            if (resolvesInDomain(p)) {
+                unresolved.push(name);
+                break;
+            }
+            if (s.allRows(elem.ref).some((r) => r.id === id))
+                return { layer: "invocation", result: "SCOPE_DENIED", param: name };
+            return { layer: "invocation", result: "INVALID_BINDING", param: name, reason: "not_found" };
+        }
+    }
+    const b = s.env.bindings;
+    const d = unresolved.length === 0 ? s : new Session(s.ont, { ...s.env, bindings: Object.fromEntries(Object.keys(action.parameters ?? {}).filter((n) => Object.hasOwn(b, n)).map((n) => [n, unresolved.includes(n) ? null : b[n]])) });
+    const decision = action.decision;
+    if (decision === undefined)
+        return { layer: "indeterminate", reason: "no_decision_table" };
+    const frame = topFrame(d.env);
+    const cache = new Map();
+    const disposition = (result) => own(s.ont.dispositions, result).class; // checked by decide before evaluation
+    for (const [i, row] of decision.rows.entries()) {
+        const id = condId(row);
+        const cond = action.conditions.find((c) => c.id === id); // checked by decide before evaluation
+        let v = cache.get(id);
+        if (v === undefined) {
+            if (cond.expr === undefined)
+                v = {};
+            else
+                try {
+                    v = predicate(d, frame, cond.expr);
+                }
+                catch (err) {
+                    if (!(err instanceof UndefinedDerived))
+                        throw err;
+                    v = { undefinedDerived: err.derived };
+                }
+            cache.set(id, v);
+        }
+        if (typeof v !== "string")
+            return v.undefinedDerived === undefined
+                ? { layer: "indeterminate", reason: "unspecified", row: i, condition: id }
+                : { layer: "indeterminate", reason: "unspecified", row: i, condition: id, derived: v.undefinedDerived };
+        if ("passes" in row.when ? v === "T" : v !== "T")
+            return { layer: "domain", result: row.result, class: disposition(row.result), row: i, ...(row.next !== undefined ? { next: row.next } : {}) };
+    }
+    const o = decision.otherwise;
+    if (o === undefined)
+        return { layer: "indeterminate", reason: "no_row_matched" };
+    return { layer: "domain", result: o.result, class: disposition(o.result), row: "otherwise", ...(o.next !== undefined ? { next: o.next } : {}) };
+}
+// decide(action, snapshot, scope, bindings, actor, now) of the format, plus the ontology and the action id.
+// Order: shape -> permission -> (envelope, not here) -> binding and scope -> decision.
+export function decide(ont, actionId, snapshot, scope, bindings, actor, now) {
+    const action = own(ont.actionTypes, actionId);
+    if (action === undefined)
+        throw new Error(`unknown action ${actionId}`);
+    if (!Number.isSafeInteger(now))
+        throw new Error(`now must be a safe integer, found ${now}`);
+    if (!(typeof actor?.id === "string" && Array.isArray(actor.keys) && actor.keys.every((k) => typeof k === "string") && typeof actor.kind === "string"))
+        throw new Error("actor must be {id: string, keys: string[], kind: string}");
+    inRange(now, "now");
+    if (ont.scope !== undefined && scope === null)
+        throw new Error("the ontology declares scope, so the scope argument must not be null");
+    if (ont.scope === undefined && scope !== null)
+        throw new Error("the ontology declares no scope, so the scope argument must be null");
+    const root = ont.scope?.root?.type;
+    if (root !== undefined && ont.scope?.global?.some((g) => g.type === root))
+        throw new Error(`${root} is both global and root`);
+    for (const [name, p] of Object.entries(action.parameters ?? {})) {
+        if (p.type === undefined)
+            throw new Error(`parameter ${name} has no type`);
+        if (RESERVED_NAMES.includes(name))
+            throw new Error(`parameter ${name} uses a reserved name`);
+    }
+    const noDisposition = (result) => own(ont.dispositions, result)?.class === undefined;
+    for (const [i, row] of (action.decision?.rows ?? []).entries()) {
+        const id = condId(row);
+        if (!action.conditions.some((c) => c.id === id))
+            throw new Error(`decision row ${i} names unknown condition ${id}`);
+        if (noDisposition(row.result))
+            throw new Error(`result ${row.result} has no disposition`);
+    }
+    const o = action.decision?.otherwise;
+    if (o !== undefined && noDisposition(o.result))
+        throw new Error(`result ${o.result} has no disposition`);
+    for (const c of action.conditions)
+        if (c.expr !== undefined)
+            checkPredicate(ont, c.expr, { action: actionId, locals: {} });
+    // A conditional_when only with conditional_keys (else the alternative would pass unread), and over request inputs only.
+    const perm = action.permission;
+    if (perm !== "unknown")
+        for (const a of ("any_of" in perm ? perm.any_of : [perm]))
+            if (a.conditional_when !== undefined) {
+                const ck = a.conditional_keys;
+                if (a.none !== undefined || !Array.isArray(ck) || ck.length === 0)
+                    throw new Error("permission conditional_when needs conditional_keys");
+                checkPermissionWhen(ont, a.conditional_when, actionId);
+            }
+    // One session for both steps: the permission step reads no snapshot (the frame flag input; checkPermissionWhen above).
+    const s = new Session(ont, { action: actionId, snapshot, scope, bindings, actor, now });
+    const early = admit(ont, actionId, bindings, actor, (e) => predicate(s, { action: actionId, vars: {}, input: true }, e));
+    if (early !== undefined)
+        return early;
+    return resolve(s, actionId);
+}
+// The outward projection. SCOPE_DENIED and not_found map to one value, so a caller cannot learn that an id exists in
+// another tenant. Other reasons (such as type) are reported as they are.
+export function externalResult(r) {
+    if (r.layer === "domain")
+        return { result: r.result };
+    if (r.result === "SCOPE_DENIED")
+        return { result: "INVALID_BINDING", param: r.param, reason: "not_found" };
+    if (r.result === "INVALID_BINDING")
+        return { result: r.result, param: r.param, reason: r.reason };
+    return { result: r.result };
+}