eyeling 1.10.20 → 1.10.21

package/HANDBOOK.md

@@ -702,7 +702,7 @@ With that, we can tour the builtin families as Eyeling actually implements them.
 
 These builtins hash a string and return a lowercase hex digest as a plain string literal.
 
-### `crypto:sha`, `crypto:md5`, `crypto:sha256`, `crypto:sha512`
+### `crypto:sha`, `crypto:md5`, `crypto:sha256`, `crypto:sha384`, `crypto:sha512`
 
 **Shape:**
 `$literal crypto:sha256 $digest`
@@ -1224,6 +1224,22 @@ Returns one of four IRIs:
 * `rdf:List` (closed or open list terms)
 * `log:Other` (IRIs, blank nodes, etc.)
 
+
+
+#### `log:isIRI` / `log:isLiteral` / `log:isBlank` / `log:isNumeric` / `log:isTriple` (extensions)
+
+Convenience *test* builtins (useful for SHACL/Sparql-style mappings). They **succeed** when the test holds and typically use `true` as the object.
+
+- **Shapes:**
+  - `$t+ log:isIRI true .`
+  - `$t+ log:isLiteral true .`
+  - `$t+ log:isBlank true .`
+  - `$t+ log:isNumeric true .`
+  - `$t+ log:isTriple true .` (formula with exactly one triple)
+
+These are treated as **constraints** for rule-body ordering.
+
+
 ### Literal constructors
 
 These two are classic N3 “bridge” operators between structured data and concrete RDF literal forms.
@@ -1321,6 +1337,19 @@ This is treated as a constraint builtin.
 
 Deterministically maps a *ground* term to a Skolem IRI in Eyeling’s well-known namespace. This is extremely useful when you want a repeatable identifier derived from structured content.
 
+
+
+#### `log:uuid` / `log:struuid` (extensions)
+
+Generate fresh UUID values.
+
+- **Shapes:**
+  - `"" log:uuid ?u .` binds `?u` to an IRI like `<urn:uuid:...>`.
+  - `"" log:struuid ?s .` binds `?s` to a UUID string literal.
+
+**Warning:** These are non-deterministic and can affect termination; prefer `log:skolem` for deterministic identifiers.
+
+
 #### `log:uri`
 
 Bidirectional conversion between IRIs and their string form:
@@ -1354,7 +1383,7 @@ This is treated as a constraint builtin (it shouldn’t drive search; it should
 
 ---
 
-## 11.3.6 `string:` — string casting, tests, and regexes
+## 11.3.6 `string:` — string casting, tests, regexes, and JSON pointers
 
 Eyeling implements string builtins with a deliberate interpretation of “domain is `xsd:string`”:
 
@@ -1385,6 +1414,35 @@ A tiny `sprintf` subset:
 * Any other specifier (`%d`, `%f`, …) causes the builtin to fail.
 * Missing arguments are treated as empty strings.
 
+
+
+#### `string:length` (extension)
+
+Length of the subject string, like SPARQL `STRLEN`.
+
+- **Shape:** `$s+ string:length $o-`
+- **Output:** `$o` is unified/bound to an integer token.
+
+#### `string:substring` (extension)
+
+Substring, like SPARQL `SUBSTR`.
+
+- **Shape:** `( $s+ $start+ [$len+] ) string:substring $o-`
+- **Notes:** `start` is **1-based**. `len` is optional; if omitted, the substring runs to the end.
+
+#### `string:upperCase` / `string:lowerCase` (extension)
+
+Case conversion, like SPARQL `UCASE` / `LCASE`.
+
+- **Shape:** `$s+ string:upperCase $o-` and `$s+ string:lowerCase $o-`
+
+#### `string:encodeForURI` (extension)
+
+Percent-encode a string, like SPARQL `ENCODE_FOR_URI`.
+
+- **Shape:** `$s+ string:encodeForURI $o-`
+
+
 ### Containment and prefix/suffix tests (constraints)
 
 * `string:contains`
@@ -1438,6 +1496,34 @@ Tests whether `pattern` matches `data`.
 
 Matches the regex once and returns the **first capturing group** (group 1). If there is no match or no group, it fails.
 
+### JSON pointer lookup
+
+#### `string:jsonPointer`
+
+**Shape:**
+`( jsonText pointer ) string:jsonPointer value`
+
+This builtin is intentionally “bridgey”: it lets you reach into JSON and get back an RDF/N3 term.
+
+Rules:
+
+* `jsonText` must be an `rdf:JSON` literal (Eyeling is permissive and may accept a couple of equivalent datatype spellings).
+* `pointer` is a string; Eyeling supports:
+
+  * standard RFC 6901 pointers like `/a/b/0`
+  * URI fragment form like `#/a/b` (it is decoded first)
+* The JSON is parsed and cached; pointer results are cached per `(jsonText, pointer)`.
+
+Returned terms follow Eyeling’s `jsonToTerm` mapping:
+
+* JSON `null` → `"null"` (a plain string literal)
+* JSON string → plain string literal
+* JSON number → numeric token literal (untyped)
+* JSON boolean → `true` / `false` token literal (untyped boolean token)
+* JSON array → an N3 list term whose elements are recursively converted
+* JSON object → an `rdf:JSON` literal containing the object’s JSON text
+
+This design keeps the builtin total and predictable even for nested structures.
 
 ## 11.4 `log:outputString` as a controlled side effect
 

package/examples/bind-builtins.n3

@@ -0,0 +1,11 @@
+@prefix : <http://example/#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+@prefix time: <http://www.w3.org/2000/10/swap/time#> .
+@prefix log: <http://www.w3.org/2000/10/swap/log#> .
+@prefix math: <http://www.w3.org/2000/10/swap/math#> .
+@prefix crypto: <http://www.w3.org/2000/10/swap/crypto#> .
+
+:p1 :givenName "Ada" ; :familyName "Lovelace" ; :born "1815-12-10T00:00:00Z"^^xsd:dateTime .
+
+{ ?p :givenName ?g . ?p :familyName ?f . ?p :born ?d . (?g " " ?f) string:concatenation ?full . (?full " " "_") string:replace ?lbl . (?lbl "en") log:langlit ?lblEn . ?lbl crypto:sha ?h . ?d time:year ?y . (?y 1) math:sum ?__e1 . (?__e1 2) math:product ?z . ("42" xsd:integer) log:dtlit ?i . } => { ?p :label ?lbl ; :labelEn ?lblEn ; :hash ?h ; :birthYear ?y ; :calc ?z ; :intLit ?i . } .

package/examples/bind.n3

@@ -0,0 +1,7 @@
+@prefix : <http://example/#> .
+@prefix log: <http://www.w3.org/2000/10/swap/log#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+
+:phayes a :Person ; :givenName "Pat"; :familyName "Hayes" .
+
+{ ?x a :Person . ?SCOPE log:notIncludes { ?x :name ?someName . } . ?x :givenName ?name1 . ?x :familyName ?name2 . (?name1 " " ?name2) string:concatenation ?FN . } => { ?x :name ?FN } .

package/examples/brussels-brew-club.n3

@@ -0,0 +1,119 @@
+# ==================
+# Brussels Brew Club
+# ==================
+#
+# A tiny loyalty + compliance reasoner with:
+# - JSON profile parsing (rdf:JSON + string:jsonPointer)
+# - backward rules (<=) used during forward chaining
+# - stable IDs with log:skolem
+# - timestamps with time:localTime
+
+@prefix :      <http://example.org/brewclub#> .
+@prefix rdf:   <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+@prefix log:   <http://www.w3.org/2000/10/swap/log#> .
+@prefix math:  <http://www.w3.org/2000/10/swap/math#> .
+@prefix string:<http://www.w3.org/2000/10/swap/string#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+
+# ---------------------------
+# Deterministic "run context"
+# ---------------------------
+
+:run :now "2000-01-01T00:00:00+00:00"^^xsd:dateTime .
+
+# -----
+# Facts
+# -----
+
+:alice :profileJson """{ "name": "Alice", "age": 23, "city": "Brussels" }"""^^rdf:JSON .
+:bob   :profileJson """{ "name": "Bob",   "age": 16, "city": "Brussels" }"""^^rdf:JSON .
+
+:order1 a :Order ;
+  :id "ORD-2025-001" ;
+  :by :alice ;
+  :total "31.50"^^xsd:decimal ;
+  :contains :Espresso, :Croissant .
+
+:order2 a :Order ;
+  :id "ORD-2025-002" ;
+  :by :bob ;
+  :total "12.00"^^xsd:decimal ;
+  :contains :HotChocolate .
+
+:Beer a :AlcoholicDrink .
+:Espresso a :Drink .
+:HotChocolate a :Drink .
+:Croissant a :Food .
+
+# -----
+# Rules
+# -----
+
+# 1) Extract fields from JSON profile into normal triples
+{
+  ?p :profileJson ?j .
+  (?j "/age")  string:jsonPointer ?age .
+  (?j "/name") string:jsonPointer ?name .
+  (?j "/city") string:jsonPointer ?city .
+}
+=>
+{
+  ?p :age ?age ;
+     :name ?name ;
+     :city ?city .
+}.
+
+# 2) Backward rule: Adult is defined by age > 17
+{ ?p a :Adult }
+<=
+{ ?p :age ?a . ?a math:greaterThan 17 }.
+
+# 3) Backward rule: BigOrder is defined by total > 25.00
+{ ?o a :BigOrder }
+<=
+{ ?o :total ?t . ?t math:greaterThan "25.00"^^xsd:decimal }.
+
+# 4) Deterministic membership card rule:
+#    Uses :run :now ?now instead of time:localTime ?now
+{
+  ?p a :Adult .
+  ?p :name ?name .
+  :run :now ?now .
+
+  (?p) log:skolem ?card .
+  ("Brew Club card for " ?name) string:concatenation ?label .
+}
+=>
+{
+  ?card a :MembershipCard ;
+        :holder ?p ;
+        :issuedAt ?now ;
+        rdfs:label ?label .
+}.
+
+# 5) Discounts: BigOrder + Adult -> discount eligibility
+{
+  ?o a :Order .
+  ?o a :BigOrder .
+  ?o :by ?p .
+  ?p a :Adult .
+}
+=>
+{
+  ?o :eligibleDiscount "true"^^xsd:boolean .
+}.
+
+# 6) Stable receipt IRI from the order id
+{
+  ?o a :Order .
+  ?o :id ?id .
+  (?id) log:skolem ?receipt .
+}
+=>
+{
+  ?receipt a :Receipt ;
+           :forOrder ?o ;
+           :receiptId ?id .
+}.
+

package/examples/builtins-string-math.n3

@@ -0,0 +1,11 @@
+@prefix : <http://example/#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+@prefix time: <http://www.w3.org/2000/10/swap/time#> .
+@prefix math: <http://www.w3.org/2000/10/swap/math#> .
+
+:x :num 1.2 ;
+     :txt "Hello World" ;
+     :dt "2020-01-01T13:14:15Z"^^xsd:dateTime .
+
+{ :x :num ?v . :x :txt ?s . :x :dt ?dt . ?v math:ceiling ?c . ?v math:floor ?f . (?s 1 5) string:substring ?sub . ?s string:length ?len . ?s string:upperCase ?up . ?s string:lowerCase ?lo . ?s string:encodeForURI ?enc . ?dt time:hour ?h . } => { :x :ceil ?c ; :floor ?f ; :substr ?sub ; :strlen ?len ; :ucase ?up ; :lcase ?lo ; :encoded ?enc ; :hours ?h . } .

package/examples/builtins-triple-termtests.n3

@@ -0,0 +1,7 @@
+@prefix : <http://example/#> .
+@prefix log: <http://www.w3.org/2000/10/swap/log#> .
+
+:alice :knows :bob .
+  :bob   :age   42 .
+
+{ :alice :knows :bob . ?t log:isTriple true . ?s log:isIRI true . ?t log:equalTo { :alice :knows :bob . } . ?t log:includes { ?s ?__e2 ?__e3 . } . ?t log:includes { ?__e4 ?p ?__e6 . } . ?t log:includes { ?__e7 ?__e8 ?o . } . } => { :test :triple ?t ; :subject ?s ; :predicate ?p ; :object ?o ; :subjectIsIRI true ; :tripleOk true . } .

package/examples/family.n3

@@ -0,0 +1,10 @@
+@prefix : <http://example.org/#> .
+
+:A :fatherOf :X . :B :motherOf :X . :C :motherOf :A .
+
+{ ?y :fatherOf ?x . } => { ?x :childOf ?y } .
+{ ?y :motherOf ?x . } => { ?x :childOf ?y } .
+{ ?x :childOf ?y . } => { ?x :descendedFrom ?y } .
+{ ?x :childOf ?z . ?z :childOf ?y . } => { ?x :descendedFrom ?y } .
+{ ?y :descendedFrom ?x . } => { ?x :ancestorOf ?y } .
+{ ?a :ancestorOf ?c . ?c :ancestorOf ?b . } => { ?a :ancestorOf ?b } .

package/examples/filter-demorgan.n3

@@ -0,0 +1,9 @@
+@prefix : <http://example/#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+@prefix log: <http://www.w3.org/2000/10/swap/log#> .
+
+:alice :name "Alice" .
+  :bob   :name "Bob" .
+  :eve   :name "Eve" .
+
+{ ?p :name ?n . ?SCOPE log:notIncludes { ?n string:contains "o" . } . ?SCOPE log:notIncludes { ?n string:startsWith "E" . } . } => { ?p :passesNameFilter true . } .

package/examples/filter-in-notin.n3

@@ -0,0 +1,10 @@
+@prefix : <http://example/#> .
+@prefix log: <http://www.w3.org/2000/10/swap/log#> .
+@prefix list: <http://www.w3.org/2000/10/swap/list#> .
+
+:a :score 1 .
+  :b :score 2 .
+  :c :score 3 .
+  :d :score 4 .
+
+{ ?x :score ?s . ?s list:in (1 3 5) . ?SCOPE log:notIncludes { ?s list:in (2 4) . } . } => { ?x :isSpecial true . } .

package/examples/filter-nested-or.n3

@@ -0,0 +1,10 @@
+@prefix : <http://example/#> .
+@prefix math: <http://www.w3.org/2000/10/swap/math#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+
+:bob   :age 20 ; :name "Bob" .
+  :alice :age 15 ; :name "Alice" .
+  :bea   :age 22 ; :name "Bea" .
+
+{ ?p :age ?age . ?p :name ?name . ?age math:notLessThan 18 . ?name string:startsWith "A" . } => { ?p :adultNamedByRule true . } .
+{ ?p :age ?age . ?p :name ?name . ?age math:notLessThan 18 . ?name string:matches "^B" . } => { ?p :adultNamedByRule true . } .

package/examples/filter.n3

@@ -0,0 +1,8 @@
+@prefix : <http://example/#> .
+@prefix math: <http://www.w3.org/2000/10/swap/math#> .
+
+:x :p 1 ; :q 2 .
+
+{ ?x :p ?v1 . ?x :q ?v2 . ?v1 math:greaterThan 0 . ?v2 math:greaterThan 0 . } => { ?x :bothPositive true . } .
+{ ?x :p ?v1 . ?x :q ?v2 . ?v1 math:equalTo 0 . } => { ?x :oneIsZero true . } .
+{ ?x :p ?v1 . ?x :q ?v2 . ?v2 math:equalTo 0 . } => { ?x :oneIsZero true . } .

package/examples/input/bind-builtins.srl

@@ -0,0 +1,30 @@
+PREFIX : <http://example/#>
+PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
+
+DATA {
+  # NOTE: Eyeling's time:* extractors currently operate on xsd:dateTime (not xsd:date).
+  :p1 :givenName "Ada" ; :familyName "Lovelace" ; :born "1815-12-10T00:00:00Z"^^xsd:dateTime .
+}
+
+# Demonstrates BIND compilation to N3 builtins:
+# - concat/replace (string:)
+# - sha1 (crypto:)
+# - year (time:)
+# - arithmetic (+,*) (math:)
+# - strlang/strdt (log:)
+RULE {
+  ?p :label ?lbl ; :labelEn ?lblEn ; :hash ?h ; :birthYear ?y ; :calc ?z ; :intLit ?i .
+}
+WHERE {
+  ?p :givenName ?g ; :familyName ?f ; :born ?d .
+
+  BIND(concat(?g, " ", ?f) AS ?full)
+  BIND(replace(?full, " ", "_") AS ?lbl)
+  BIND(strlang(?lbl, "en") AS ?lblEn)
+  BIND(sha1(?lbl) AS ?h)
+
+  BIND(year(?d) AS ?y)
+  BIND((?y + 1) * 2 AS ?z)
+
+  BIND(strdt("42", xsd:integer) AS ?i)
+}

package/examples/input/bind.srl

@@ -0,0 +1,12 @@
+PREFIX : <http://example/#>
+
+DATA { :phayes a :Person ; :givenName "Pat"; :familyName "Hayes" . }
+
+# Default value - calculate a name
+RULE { ?x :name ?FN } WHERE { 
+    ?x a :Person 
+    NOT { ?x :name ?someName }
+    ?x :givenName ?name1 ;
+       :familyName ?name2 .
+    BIND(concat(?name1, " ", ?name2) AS ?FN)
+}

package/examples/input/builtins-string-math.srl

@@ -0,0 +1,38 @@
+PREFIX : <http://example/#>
+PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
+
+DATA {
+  :x :num 1.2 ;
+     :txt "Hello World" ;
+     :dt "2020-01-01T13:14:15Z"^^xsd:dateTime .
+}
+
+RULE {
+  :x :ceil ?c ;
+     :floor ?f ;
+     :substr ?sub ;
+     :strlen ?len ;
+     :ucase ?up ;
+     :lcase ?lo ;
+     :encoded ?enc ;
+     :hours ?h .
+}
+WHERE {
+  :x :num ?v ;
+     :txt ?s ;
+     :dt ?dt .
+
+  BIND(CEIL(?v) AS ?c)
+  BIND(FLOOR(?v) AS ?f)
+
+  # SPARQL SUBSTR is 1-based; this should produce "Hello"
+  BIND(SUBSTR(?s, 1, 5) AS ?sub)
+
+  BIND(STRLEN(?s) AS ?len)
+  BIND(UCASE(?s) AS ?up)
+  BIND(LCASE(?s) AS ?lo)
+  BIND(ENCODE_FOR_URI(?s) AS ?enc)
+
+  BIND(HOURS(?dt) AS ?h)
+}
+

package/examples/input/builtins-triple-termtests.srl

@@ -0,0 +1,27 @@
+PREFIX : <http://example/#>
+
+DATA {
+  :alice :knows :bob .
+  :bob   :age   42 .
+}
+
+RULE {
+  :test :triple ?t ;
+        :subject ?s ;
+        :predicate ?p ;
+        :object ?o ;
+        :subjectIsIRI true ;
+        :tripleOk true .
+}
+WHERE {
+  :alice :knows :bob .
+
+  BIND(TRIPLE(:alice, :knows, :bob) AS ?t)
+  BIND(SUBJECT(?t) AS ?s)
+  BIND(PREDICATE(?t) AS ?p)
+  BIND(OBJECT(?t) AS ?o)
+
+  # Term-test builtins (as in SPARQL)
+  FILTER ( isTRIPLE(?t) && isIRI(?s) )
+}
+

package/examples/input/family.srl

@@ -0,0 +1,12 @@
+PREFIX : <http://example.org/#>
+
+DATA { :A :fatherOf :X . :B :motherOf :X . :C :motherOf :A . }
+
+RULE { ?x :childOf ?y } WHERE { ?y :fatherOf ?x }
+RULE { ?x :childOf ?y } WHERE { ?y :motherOf ?x }
+
+RULE { ?x :descendedFrom ?y } WHERE { ?x :childOf ?y }
+RULE { ?x :descendedFrom ?y } WHERE { ?x :childOf ?z . ?z :childOf ?y }
+
+RULE { ?x :ancestorOf ?y } WHERE { ?y :descendedFrom ?x }
+RULE { ?a :ancestorOf ?b } WHERE { ?a :ancestorOf ?c . ?c :ancestorOf ?b }

package/examples/input/filter-demorgan.srl

@@ -0,0 +1,15 @@
+PREFIX : <http://example/#>
+
+DATA {
+  :alice :name "Alice" .
+  :bob   :name "Bob" .
+  :eve   :name "Eve" .
+}
+
+# Demonstrates De Morgan push-down:
+#   !(A || B)  ==>  (!A && !B)
+RULE { ?p :passesNameFilter true . }
+WHERE {
+  ?p :name ?n .
+  FILTER ( !( CONTAINS(?n, "o") || STRSTARTS(?n, "E") ) )
+}

package/examples/input/filter-in-notin.srl

@@ -0,0 +1,15 @@
+PREFIX : <http://example/#>
+
+DATA {
+  :a :score 1 .
+  :b :score 2 .
+  :c :score 3 .
+  :d :score 4 .
+}
+
+# Demonstrates IN/NOT IN (mapped to list:in + log:notIncludes)
+RULE { ?x :isSpecial true . }
+WHERE {
+  ?x :score ?s .
+  FILTER ( (?s IN (1, 3, 5)) && (?s NOT IN (2, 4)) )
+}

package/examples/input/filter-nested-or.srl

@@ -0,0 +1,15 @@
+PREFIX : <http://example/#>
+
+DATA {
+  :bob   :age 20 ; :name "Bob" .
+  :alice :age 15 ; :name "Alice" .
+  :bea   :age 22 ; :name "Bea" .
+}
+
+# Demonstrates nested OR distribution:
+#   ?age >= 18 && ( STRSTARTS(?name,"A") || REGEX(?name,"^B") )
+RULE { ?p :adultNamedByRule true . }
+WHERE {
+  ?p :age ?age ; :name ?name .
+  FILTER ( ?age >= 18 && ( STRSTARTS(?name, "A") || REGEX(?name, "^B") ) )
+}

package/examples/input/filter.srl

@@ -0,0 +1,9 @@
+PREFIX : <http://example/#>
+
+DATA { :x :p 1 ; :q 2 . }
+
+RULE { ?x :bothPositive true . }
+WHERE { ?x :p ?v1  FILTER ( ?v1 > 0 )  ?x :q ?v2  FILTER ( ?v2 > 0 )  }
+
+RULE { ?x :oneIsZero true . }
+WHERE { ?x :p ?v1 ;  :q ?v2  FILTER ( ( ?v1 = 0 ) || ( ?v2 = 0 ) )  }

package/examples/input/snaf.srl

@@ -0,0 +1,6 @@
+PREFIX log: <http://www.w3.org/2000/10/swap/log#>
+PREFIX : <http://example.org/#>
+
+DATA { :Alice :loves :Bob. :Bob a :Person. }
+
+RULE { :Alice :hates :Nobody. } WHERE { NOT { :Alice :hates ?X } ?X a :Person. }

package/examples/json-pointer.n3

@@ -0,0 +1,75 @@
+# =================================================
+# JSON Pointer example
+# See https://datatracker.ietf.org/doc/html/rfc6901
+# =================================================
+
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix string: <http://www.w3.org/2000/10/swap/string#> .
+@prefix list:   <http://www.w3.org/2000/10/swap/list#> .
+@prefix log:    <http://www.w3.org/2000/10/swap/log#> .
+@prefix ex:     <http://example.org/#> .
+
+ex:doc ex:json """{
+  "users": [
+    { "id": "u1", "email": "ada@example.org",     "profile/name": "Ada Lovelace" },
+    { "id": "u2", "email": "bob@evil.invalid",    "profile/name": "Bob Mallory" }
+  ],
+  "policy": { "allowedDomains": ["example.org", "example.com"] }
+}"""^^rdf:JSON .
+
+# Sanity check: key contains "/" so JSON Pointer must use "~1"
+{
+  ex:doc ex:json ?J .
+  (?J "/users/0/profile~1name") string:jsonPointer "Ada Lovelace" .
+} => {
+  ex:checks ex:firstUserNameOk true .
+} .
+
+# Allowed users: email domain is in policy.allowedDomains
+{
+  ex:doc ex:json ?J .
+  (?J "/policy/allowedDomains") string:jsonPointer ?Allowed .
+  (?J "/users")                string:jsonPointer ?Users .
+
+  ?Users list:iterate (?Idx ?UserJson) .
+  (?UserJson "/id")            string:jsonPointer ?Id .
+  (?UserJson "/email")         string:jsonPointer ?Email .
+  (?UserJson "/profile~1name") string:jsonPointer ?Name .
+
+  (?Email "@([^@]+)$") string:scrape ?EmailDomain .
+  ?Allowed list:member ?EmailDomain .
+
+  ("urn:example:user:%s" ?Id) string:format ?UriStr .
+  ?User log:uri ?UriStr .
+} => {
+  ?User a ex:AllowedUser ;
+        ex:name ?Name ;
+        ex:email ?Email ;
+        ex:emailDomain ?EmailDomain ;
+        ex:userIndex ?Idx .
+} .
+
+# Blocked users: email domain is NOT in the allowlist
+{
+  ex:doc ex:json ?J .
+  (?J "/policy/allowedDomains") string:jsonPointer ?Allowed .
+  (?J "/users")                string:jsonPointer ?Users .
+
+  ?Users list:iterate (?Idx ?UserJson) .
+  (?UserJson "/id")            string:jsonPointer ?Id .
+  (?UserJson "/email")         string:jsonPointer ?Email .
+  (?UserJson "/profile~1name") string:jsonPointer ?Name .
+
+  (?Email "@([^@]+)$") string:scrape ?EmailDomain .
+  ?Allowed list:notMember ?EmailDomain .
+
+  ("urn:example:user:%s" ?Id) string:format ?UriStr .
+  ?User log:uri ?UriStr .
+} => {
+  ?User a ex:BlockedUser ;
+        ex:name ?Name ;
+        ex:email ?Email ;
+        ex:emailDomain ?EmailDomain ;
+        ex:userIndex ?Idx .
+} .
+