ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/authoring/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAQpB,cAAM,QAAS,YAAW,YAAY;IACpC,QAAQ,CAAC,IAAI,aAAiB;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IAExC,YAAY,KAAK,EAAE,SAAS,YAAY,EAAE,EAEzC;IAED,EAAE,CAAC,GAAG,EAAE,gBAAgB,iCAEvB;IAED,QAAQ,CAAC,GAAG,EAAE,gBAAgB,iCAE7B;CACF;AAED,YAAY,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC;AA+DzC,eAAO,MAAM,CAAC,GAAI,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,QAC5F,CAAC,KACN,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAQK,CAAC;AAgBlC,eAAO,MAAM,IAAI,YAAa,aAAa,CAAC,YAAY,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,KAAG,QAMxF,CAAC;AAEF,eAAO,MAAM,UAAU,UAAW,WAAW,KAAG,aAK/C,CAAC"}

package/dist/internal/authorization/authoring/path.js

@@ -0,0 +1,109 @@
+import { isSelfRefSchema, refTargetOf } from "../../../db/valueTypes.js";
+import { contains, eq } from "./expr.js";
+import { isPathCarrier, parseIdent, stepFromCarrier, AUTH_PATH_TAG, } from "./types.js";
+class AuthPath {
+    _tag = AUTH_PATH_TAG;
+    steps;
+    constructor(steps) {
+        this.steps = steps;
+    }
+    eq(rhs) {
+        return eq(this, rhs);
+    }
+    contains(rhs) {
+        return contains(this, rhs);
+    }
+}
+const fieldOf = (owner, name) => {
+    if (Object.hasOwn(owner.fields, name))
+        return owner.fields[name];
+    if (name === "id" && isPathCarrier(owner.id))
+        return owner.id;
+    return undefined;
+};
+const nextOwner = (field, current) => {
+    if (typeof field !== "object" || field === null)
+        return undefined;
+    const schema = field.schema;
+    if (isSelfRefSchema(schema))
+        return current;
+    const resolve = refTargetOf(schema);
+    if (resolve === undefined)
+        return undefined;
+    const target = resolve();
+    return {
+        ns: target.ns,
+        fields: target.fields,
+    };
+};
+const missingStep = (owner, name) => ({
+    ident: owner.ns !== undefined ? `:${owner.ns}/${name}` : name,
+    localName: name,
+    reverse: false,
+});
+const navigate = (owner, steps) => {
+    const path = new AuthPath(steps);
+    const applyEq = (rhs) => path.eq(rhs);
+    const target = Object.assign(applyEq, path, {
+        eq: (rhs) => path.eq(rhs),
+        contains: (rhs) => path.contains(rhs),
+    });
+    return new Proxy(target, {
+        get(target, prop, receiver) {
+            if (typeof prop === "string") {
+                const field = fieldOf(owner, prop);
+                if (field !== undefined) {
+                    const step = isPathCarrier(field) ? stepFromCarrier(field) : missingStep(owner, prop);
+                    const next = isPathCarrier(field) ? (nextOwner(field, owner) ?? { fields: {} }) : { fields: {} };
+                    return navigate(next, [...steps, step]);
+                }
+            }
+            if (prop === "eq" || prop === "contains" || prop === "_tag" || prop === "steps") {
+                return Reflect.get(target, prop, receiver);
+            }
+            if (prop === "then" || prop === "toJSON")
+                return undefined;
+            if (typeof prop !== "string")
+                return undefined;
+            return navigate(owner.ns !== undefined ? { ns: owner.ns, fields: {} } : { fields: {} }, [...steps, missingStep(owner, prop)]);
+        },
+        apply(_t, _this, args) {
+            if (steps.length === 0) {
+                return { _tag: "eq" };
+            }
+            return path.eq(args[0]);
+        },
+    });
+};
+export const $ = (root) => navigate({
+    ns: root.ns,
+    fields: root.fields,
+    id: root.id,
+}, []);
+const hopToSteps = (hop) => {
+    if (hop instanceof AuthPath || hop._tag === AUTH_PATH_TAG) {
+        return hop.steps;
+    }
+    if (isPathCarrier(hop))
+        return [stepFromCarrier(hop)];
+    return [
+        {
+            ident: "",
+            localName: "",
+            reverse: false,
+        },
+    ];
+};
+export const path = (...hops) => {
+    const steps = [];
+    for (const hop of hops) {
+        steps.push(...hopToSteps(hop));
+    }
+    return new AuthPath(steps);
+};
+export const seededPath = (field) => {
+    const parsed = parseIdent(field.ident);
+    const ownerFromField = parsed === undefined ? { fields: {} } : { ns: parsed.ns, fields: {} };
+    return navigate(nextOwner(field, ownerFromField) ?? { fields: {} }, [stepFromCarrier(field)]);
+};
+//# sourceMappingURL=path.js.map

package/dist/internal/authorization/authoring/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/path.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACL,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,GAKd,MAAM,YAAY,CAAC;AAQpB,MAAM,QAAQ;IACH,IAAI,GAAG,aAAa,CAAC;IACrB,KAAK,CAA0B;IAExC,YAAY,KAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,EAAE,CAAC,GAAqB;QACtB,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,GAAqB;QAC5B,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AAID,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAE,IAAY,EAAW,EAAE;IAC3D,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,OAAmB,EAA0B,EAAE;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAI,KAAuC,CAAC,MAAM,CAAC;IAC/D,IAAI,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;IACzB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,MAA6C;KAC7D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAE,IAAY,EAAgB,EAAE,CAAC,CAAC;IACtE,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;IAC7D,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAE,KAA8B,EAAiB,EAAE;IACpF,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE;QAC1C,EAAE,EAAE,CAAC,GAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,CAAC,GAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACtF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;oBACjG,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAChF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC/C,OAAO,QAAQ,CACb,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EACtE,CAAC,GAAG,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI;YACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAqB,CAAC,CAAC;QAC9C,CAAC;KACF,CAA6B,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,CAAC,GAAG,CACf,IAAO,EACqB,EAAE,CAC9B,QAAQ,CACN;IACE,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,MAAM,EAAE,IAAI,CAAC,MAA6C;IAC1D,EAAE,EAAE,IAAI,CAAC,EAAE;CACZ,EACD,EAAE,CAC2B,CAAC;AAElC,MAAM,UAAU,GAAG,CAAC,GAA8C,EAA2B,EAAE;IAC7F,IAAI,GAAG,YAAY,QAAQ,IAAK,GAAoB,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC5E,OAAQ,GAAoB,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO;QACL;YACE,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,KAAK;SACf;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAA8D,EAAY,EAAE;IAClG,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAiB,EAAE;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,cAAc,GAClB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxE,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,CAAC"}

package/dist/internal/authorization/authoring/policy.d.ts

@@ -0,0 +1,120 @@
+import type { AnyEntity } from "../../../db/Entity.ts";
+import { OwnedOperations, type AnyOwnedOperation } from "../../../db/Operation.ts";
+import type { EntityMap, Schema } from "../../../db/Schema.ts";
+import type { PathCarrier } from "../../../db/shapes.ts";
+import type { AnyTrait } from "../../../db/Trait.ts";
+import type { ClaimDescriptor } from "../principal.ts";
+import type { AuthExpr, AuthPathLike, AuthPathProxy, BoxedOperand, CompileReadAuthorizationInput } from "./types.ts";
+type PrincipalField<Field, Namespace extends string> = Field extends PathCarrier & {
+    readonly ident: `:${Namespace}/${string}`;
+    readonly cardinality: "one";
+    readonly unique: "strict" | "upsert";
+    readonly valueType: "string" | "uuid";
+} ? Field : never;
+type EntityPrincipalFields<Es extends EntityMap> = {
+    readonly [K in keyof Es]: Es[K] extends {
+        readonly ns: infer Namespace extends string;
+        readonly fields: infer Fields;
+    } ? PrincipalField<Fields[keyof Fields], Namespace> : never;
+}[keyof Es];
+export type SchemaPrincipalField<Es extends EntityMap> = EntityPrincipalFields<Es>;
+type DirectTraits<Owner> = Owner extends {
+    readonly traits: readonly (infer Trait)[];
+} ? Trait extends AnyTrait ? Trait : never : never;
+type TraitClosure<Trait, SeenNames extends string = never> = Trait extends AnyTrait ? Trait["ns"] extends SeenNames ? never : Trait | TraitClosure<DirectTraits<Trait>, SeenNames | Trait["ns"]> : never;
+type ReachableTrait<Es extends EntityMap> = string extends keyof Es ? never : TraitClosure<DirectTraits<Es[keyof Es]>>;
+type ScalarClaimValue<ValueType> = ValueType extends "string" ? string : ValueType extends "long" | "double" ? number : ValueType extends "boolean" ? boolean : never;
+type ClaimValue<Descriptor> = Descriptor extends {
+    readonly shape: infer Shape;
+} ? Shape extends {
+    readonly _tag: "scalar";
+    readonly valueType: infer ValueType;
+} ? ScalarClaimValue<ValueType> : Shape extends {
+    readonly _tag: "array";
+    readonly items: {
+        readonly valueType: infer ValueType;
+    };
+} ? readonly ScalarClaimValue<ValueType>[] : never : never;
+type OperandOf<Tag extends BoxedOperand["_tag"]> = Extract<BoxedOperand, {
+    readonly _tag: Tag;
+}>;
+type ContainedValue<Value> = Value extends readonly (infer Element)[] ? Element : Value;
+type LiteralValue<Value> = Value extends readonly unknown[] ? never : Value;
+declare const PolicyOperandValue: unique symbol;
+type SymbolicOperand<Value> = AuthPathLike | PathCarrier | PolicyOperand<"claim", Value> | ([Value] extends [string] ? PolicyOperand<"subject", string> : never);
+export type PolicyOperand<Tag extends BoxedOperand["_tag"], Value = unknown> = OperandOf<Tag> & {
+    readonly [PolicyOperandValue]?: Value;
+    readonly eq: (rhs: SymbolicOperand<Value> | LiteralValue<Value>) => AuthExpr;
+} & (Value extends readonly unknown[] ? {
+    readonly contains: (rhs: SymbolicOperand<ContainedValue<Value>> | ContainedValue<Value>) => AuthExpr;
+} : {});
+type ClaimOperands<Claims extends readonly ClaimDescriptor[]> = {
+    readonly [Descriptor in Claims[number] as Descriptor["key"]]: PolicyOperand<"claim", ClaimValue<Descriptor>>;
+};
+type RolePredicates<Roles extends readonly string[]> = {
+    readonly [Role in Roles[number]]: AuthExpr;
+};
+export type PolicySession<Roles extends readonly string[], Claims extends readonly ClaimDescriptor[]> = {
+    readonly subject: PolicyOperand<"subject", string>;
+    readonly claims: ClaimOperands<Claims>;
+    readonly roles: RolePredicates<Roles>;
+    readonly hasRole: (role: Roles[number]) => AuthExpr;
+};
+export type PolicyReadMethods<Proxy> = {
+    readonly where: (expr: AuthExpr | ((row: Proxy) => AuthExpr)) => void;
+    readonly denyWhere: (expr: AuthExpr | ((row: Proxy) => AuthExpr)) => void;
+    readonly always: () => void;
+    readonly never: () => void;
+};
+export type PolicyOperationMethods = {
+    readonly where: (expr: AuthExpr) => void;
+    readonly denyWhere: (expr: AuthExpr) => void;
+    readonly always: () => void;
+    readonly never: () => void;
+};
+type OperationsOf<Owner> = Owner extends {
+    readonly [OwnedOperations]: infer Operations extends Readonly<Record<string, AnyOwnedOperation>>;
+} ? Operations : {};
+type FieldsOf<Owner> = Owner extends {
+    readonly fields: infer Fields extends Readonly<Record<string, unknown>>;
+} ? Fields : {};
+type OwnerPolicy<Owner extends AnyEntity | AnyTrait> = {
+    readonly read: PolicyReadMethods<AuthPathProxy<FieldsOf<Owner>>>;
+    readonly fields: {
+        readonly [K in keyof FieldsOf<Owner>]: {
+            readonly read: PolicyReadMethods<AuthPathProxy<FieldsOf<Owner>>>;
+        };
+    };
+    readonly operations: {
+        readonly [K in keyof OperationsOf<Owner>]: PolicyOperationMethods;
+    };
+};
+type TraitPolicyEntry<Trait> = Trait extends AnyTrait ? {
+    readonly [Name in Trait["ns"]]: OwnerPolicy<Trait>;
+} : unknown;
+type UnionToIntersection<Union> = (Union extends unknown ? (value: Union) => void : never) extends (value: infer Intersection) => void ? Intersection : never;
+type TraitPolicy<Es extends EntityMap> = UnionToIntersection<TraitPolicyEntry<ReachableTrait<Es>>>;
+export type SchemaPolicy<Es extends EntityMap> = {
+    readonly [K in keyof Es]: OwnerPolicy<Es[K]>;
+} & TraitPolicy<Es>;
+export type SchemaPolicyConfig<Es extends EntityMap, Roles extends readonly string[] = readonly [], Claims extends readonly ClaimDescriptor[] = readonly []> = {
+    readonly principal?: SchemaPrincipalField<Es>;
+    readonly roles?: Roles;
+    readonly claims?: Claims;
+};
+export type PolicyContext<Es extends EntityMap, Roles extends readonly string[], Claims extends readonly ClaimDescriptor[]> = {
+    readonly policy: SchemaPolicy<Es>;
+    readonly actor: PolicyOperand<"me">;
+    readonly session: PolicySession<Roles, Claims>;
+    readonly allOf: (first: AuthExpr, ...rest: readonly AuthExpr[]) => AuthExpr;
+    readonly anyOf: (first: AuthExpr, ...rest: readonly AuthExpr[]) => AuthExpr;
+};
+export type PolicyDefinition<Es extends EntityMap, Roles extends readonly string[], Claims extends readonly ClaimDescriptor[]> = (context: PolicyContext<Es, Roles, Claims>) => void;
+export interface ApplyPolicy<Es extends EntityMap> {
+    (define: PolicyDefinition<Es, readonly [], readonly []>): void;
+    <const Roles extends readonly string[] = readonly [], const Claims extends readonly ClaimDescriptor[] = readonly []>(config: SchemaPolicyConfig<Es, Roles, Claims>, define: PolicyDefinition<Es, Roles, Claims>): void;
+}
+export declare function collectSchemaPolicy<Es extends EntityMap>(schema: Schema<string, Es>, define: PolicyDefinition<Es, readonly [], readonly []>): CompileReadAuthorizationInput;
+export declare function collectSchemaPolicy<Es extends EntityMap, const Roles extends readonly string[] = readonly [], const Claims extends readonly ClaimDescriptor[] = readonly []>(schema: Schema<string, Es>, config: SchemaPolicyConfig<Es, Roles, Claims>, define: PolicyDefinition<Es, Roles, Claims>): CompileReadAuthorizationInput;
+export {};
+//# sourceMappingURL=policy.d.ts.map

package/dist/internal/authorization/authoring/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/policy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEL,eAAe,EACf,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMvD,OAAO,KAAK,EACV,QAAQ,EAER,YAAY,EACZ,aAAa,EAEb,YAAY,EACZ,6BAA6B,EAE9B,MAAM,YAAY,CAAC;AAEpB,KAAK,cAAc,CAAC,KAAK,EAAE,SAAS,SAAS,MAAM,IAAI,KAAK,SACxD,WAAW,GACX;IACA,QAAQ,CAAC,KAAK,EAAE,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;CACvC,GACC,KAAK,GACL,KAAK,CAAC;AAEV,KAAK,qBAAqB,CAAC,EAAE,SAAS,SAAS,IAAI;IACjD,QAAQ,EAAE,CAAC,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;QACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,SAAS,SAAS,MAAM,CAAC;QAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;KAC/B,GACG,cAAc,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,SAAS,CAAC,GAC/C,KAAK;CACV,CAAC,MAAM,EAAE,CAAC,CAAC;AAEZ,MAAM,MAAM,oBAAoB,CAAC,EAAE,SAAS,SAAS,IAAI,qBAAqB,CAAC,EAAE,CAAC,CAAC;AAEnF,KAAK,YAAY,CAAC,KAAK,IAAI,KAAK,SAAS;IACvC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;CAC3C,GACG,KAAK,SAAS,QAAQ,GACpB,KAAK,GACL,KAAK,GACP,KAAK,CAAC;AAEV,KAAK,YAAY,CACf,KAAK,EACL,SAAS,SAAS,MAAM,GAAG,KAAK,IAC9B,KAAK,SAAS,QAAQ,GACtB,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,GAC3B,KAAK,GACL,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GACpE,KAAK,CAAC;AAEV,KAAK,cAAc,CAAC,EAAE,SAAS,SAAS,IAAI,MAAM,SAAS,MAAM,EAAE,GAC/D,KAAK,GACL,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7C,KAAK,gBAAgB,CAAC,SAAS,IAAI,SAAS,SAAS,QAAQ,GACzD,MAAM,GACN,SAAS,SAAS,MAAM,GAAG,QAAQ,GACjC,MAAM,GACN,SAAS,SAAS,SAAS,GACzB,OAAO,GACP,KAAK,CAAC;AAEd,KAAK,UAAU,CAAC,UAAU,IAAI,UAAU,SAAS;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC;CAC7B,GACG,KAAK,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,SAAS,CAAA;CAAE,GAC5E,gBAAgB,CAAC,SAAS,CAAC,GAC3B,KAAK,SAAS;IACV,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,SAAS,CAAA;KAAE,CAAC;CACzD,GACD,SAAS,gBAAgB,CAAC,SAAS,CAAC,EAAE,GACtC,KAAK,GACT,KAAK,CAAC;AAEV,KAAK,SAAS,CAAC,GAAG,SAAS,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,CACxD,YAAY,EACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CACvB,CAAC;AAEF,KAAK,cAAc,CAAC,KAAK,IAAI,KAAK,SAAS,SAAS,CAAC,MAAM,OAAO,CAAC,EAAE,GACjE,OAAO,GACP,KAAK,CAAC;AAEV,KAAK,YAAY,CAAC,KAAK,IAAI,KAAK,SAAS,SAAS,OAAO,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC;AAE5E,OAAO,CAAC,MAAM,kBAAkB,EAAE,OAAO,MAAM,CAAC;AAEhD,KAAK,eAAe,CAAC,KAAK,IACtB,YAAY,GACZ,WAAW,GACX,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAC7B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;AAE1E,MAAM,MAAM,aAAa,CACvB,GAAG,SAAS,YAAY,CAAC,MAAM,CAAC,EAChC,KAAK,GAAG,OAAO,IACb,SAAS,CAAC,GAAG,CAAC,GAAG;IACnB,QAAQ,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;CAC9E,GAAG,CAAC,KAAK,SAAS,SAAS,OAAO,EAAE,GACjC;IACE,QAAQ,CAAC,QAAQ,EAAE,CACjB,GAAG,EAAE,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,KAChE,QAAQ,CAAC;CACf,GACD,EAAE,CAAC,CAAC;AAER,KAAK,aAAa,CAAC,MAAM,SAAS,SAAS,eAAe,EAAE,IAAI;IAC9D,QAAQ,EAAE,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,aAAa,CACzE,OAAO,EACP,UAAU,CAAC,UAAU,CAAC,CACvB;CACF,CAAC;AAEF,KAAK,cAAc,CAAC,KAAK,SAAS,SAAS,MAAM,EAAE,IAAI;IACrD,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,QAAQ;CAC3C,CAAC;AAEF,MAAM,MAAM,aAAa,CACvB,KAAK,SAAS,SAAS,MAAM,EAAE,EAC/B,MAAM,SAAS,SAAS,eAAe,EAAE,IACvC;IACF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,KAAK,IAAI;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC;IACtE,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B,CAAC;AAEF,KAAK,YAAY,CAAC,KAAK,IAAI,KAAK,SAAS;IACvC,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,MAAM,UAAU,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAClG,GACG,UAAU,GACV,EAAE,CAAC;AAEP,KAAK,QAAQ,CAAC,KAAK,IAAI,KAAK,SAAS;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,GACG,MAAM,GACN,EAAE,CAAC;AAEP,KAAK,WAAW,CAAC,KAAK,SAAS,SAAS,GAAG,QAAQ,IAAI;IACrD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,EAAE,CAAC,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG;YACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClE;KACF,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,EAAE,CAAC,IAAI,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,sBAAsB;KAClE,CAAC;CACH,CAAC;AAEF,KAAK,gBAAgB,CAAC,KAAK,IAAI,KAAK,SAAS,QAAQ,GACjD;IAAE,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;CAAE,GACtD,OAAO,CAAC;AAEZ,KAAK,mBAAmB,CAAC,KAAK,IAAI,CAChC,KAAK,SAAS,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,KAAK,CACvD,SAAS,CAAC,KAAK,EAAE,MAAM,YAAY,KAAK,IAAI,GACzC,YAAY,GACZ,KAAK,CAAC;AAEV,KAAK,WAAW,CAAC,EAAE,SAAS,SAAS,IAAI,mBAAmB,CAC1D,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CACrC,CAAC;AAEF,MAAM,MAAM,YAAY,CAAC,EAAE,SAAS,SAAS,IAAI;IAC/C,QAAQ,EAAE,CAAC,IAAI,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;CAC7C,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAEpB,MAAM,MAAM,kBAAkB,CAC5B,EAAE,SAAS,SAAS,EACpB,KAAK,SAAS,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,EAC7C,MAAM,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE,IACrD;IACF,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,CACvB,EAAE,SAAS,SAAS,EACpB,KAAK,SAAS,SAAS,MAAM,EAAE,EAC/B,MAAM,SAAS,SAAS,eAAe,EAAE,IACvC;IACF,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,SAAS,QAAQ,EAAE,KAAK,QAAQ,CAAC;IAC5E,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,SAAS,QAAQ,EAAE,KAAK,QAAQ,CAAC;CAC7E,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAC1B,EAAE,SAAS,SAAS,EACpB,KAAK,SAAS,SAAS,MAAM,EAAE,EAC/B,MAAM,SAAS,SAAS,eAAe,EAAE,IACvC,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;AAExD,MAAM,WAAW,WAAW,CAAC,EAAE,SAAS,SAAS;IAC/C,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC;IAC/D,CACE,KAAK,CAAC,KAAK,SAAS,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,CAAC,MAAM,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE,EAE7D,MAAM,EAAE,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAC7C,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAC1C,IAAI,CAAC;CACT;AA6ND,wBAAgB,mBAAmB,CAAC,EAAE,SAAS,SAAS,EACtD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAC1B,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,GACrD,6BAA6B,CAAC;AACjC,wBAAgB,mBAAmB,CACjC,EAAE,SAAS,SAAS,EACpB,KAAK,CAAC,KAAK,SAAS,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,EACnD,KAAK,CAAC,MAAM,SAAS,SAAS,eAAe,EAAE,GAAG,SAAS,EAAE,EAE7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAC1B,MAAM,EAAE,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAC7C,MAAM,EAAE,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAC1C,6BAA6B,CAAC"}

package/dist/internal/authorization/authoring/policy.js

@@ -0,0 +1,218 @@
+import { reachableTraits, } from "../../../db/compose.js";
+import { isOwnedOperation, OwnedOperations, } from "../../../db/Operation.js";
+import { compileReadAuthorizationResult } from "./compile.js";
+import { all, allow, any, contains, eq, hasClass } from "./expr.js";
+import { invoke } from "./invoke.js";
+import { $ } from "./path.js";
+import { read } from "./read.js";
+const policyOperand = (operand) => Object.freeze({
+    ...operand,
+    eq: (rhs) => eq(operand, rhs),
+    contains: (rhs) => contains(operand, rhs),
+});
+const readMethods = (target, rules, callbackOwner) => {
+    const builder = read(target);
+    const resolve = (expr) => callbackOwner !== undefined && typeof expr === "function"
+        ? expr($(callbackOwner))
+        : expr;
+    const allowExprs = [];
+    const denyExprs = [];
+    let allowIndex;
+    let denyIndex;
+    const append = (kind, expr) => {
+        const resolved = resolve(expr);
+        const exprs = kind === "allow" ? allowExprs : denyExprs;
+        exprs.push(resolved);
+        const combined = exprs.length === 1 ? resolved : any(...exprs);
+        const rule = kind === "allow"
+            ? builder.when(combined)
+            : builder.deny(combined);
+        const index = kind === "allow" ? allowIndex : denyIndex;
+        if (index === undefined) {
+            const nextIndex = rules.push(rule) - 1;
+            if (kind === "allow")
+                allowIndex = nextIndex;
+            else
+                denyIndex = nextIndex;
+        }
+        else {
+            rules[index] = rule;
+        }
+    };
+    return Object.freeze({
+        where(expr) {
+            append("allow", expr);
+        },
+        denyWhere(expr) {
+            append("deny", expr);
+        },
+        always() {
+            append("allow", allow);
+        },
+        never() {
+            append("deny", allow);
+        },
+    });
+};
+const operationMethods = (target, rules) => {
+    const builder = invoke(target);
+    const allowExprs = [];
+    const denyExprs = [];
+    let allowIndex;
+    let denyIndex;
+    const append = (kind, expr) => {
+        const exprs = kind === "allow" ? allowExprs : denyExprs;
+        exprs.push(expr);
+        const combined = exprs.length === 1 ? expr : any(...exprs);
+        const rule = kind === "allow"
+            ? builder.when(combined)
+            : builder.deny(combined);
+        const index = kind === "allow" ? allowIndex : denyIndex;
+        if (index === undefined) {
+            const nextIndex = rules.push(rule) - 1;
+            if (kind === "allow")
+                allowIndex = nextIndex;
+            else
+                denyIndex = nextIndex;
+        }
+        else {
+            rules[index] = rule;
+        }
+    };
+    return Object.freeze({
+        where(expr) {
+            append("allow", expr);
+        },
+        denyWhere(expr) {
+            append("deny", expr);
+        },
+        always() {
+            append("allow", allow);
+        },
+        never() {
+            append("deny", allow);
+        },
+    });
+};
+const ownerPolicy = (owner, rules) => {
+    const fields = {};
+    for (const [name, field] of Object.entries(owner.fields)) {
+        fields[name] = Object.freeze({ read: readMethods(field, rules, owner) });
+    }
+    const operations = {};
+    for (const [name, operation] of Object.entries(owner[OwnedOperations] ?? {})) {
+        if (isOwnedOperation(operation)) {
+            operations[name] = operationMethods(operation, rules);
+        }
+    }
+    return Object.freeze({
+        read: readMethods(owner, rules, owner),
+        fields: Object.freeze(fields),
+        operations: Object.freeze(operations),
+    });
+};
+const policyFor = (schema, rules) => {
+    const policy = {};
+    for (const [name, entity] of Object.entries(schema.entities)) {
+        policy[name] = ownerPolicy(entity, rules);
+    }
+    const traits = reachableTraits(Object.values(schema.entities));
+    for (const [name, trait] of traits) {
+        policy[name] = ownerPolicy(trait, rules);
+    }
+    return Object.freeze(policy);
+};
+const sessionFor = (roles, claims) => {
+    const rolePredicates = {};
+    for (const role of roles)
+        rolePredicates[role] = hasClass(role);
+    const declaredRoles = new Set(roles);
+    const claimOperands = {};
+    for (const descriptor of claims) {
+        claimOperands[descriptor.key] = policyOperand({
+            _tag: "claim",
+            key: descriptor.key,
+        });
+    }
+    return Object.freeze({
+        subject: policyOperand({ _tag: "subject" }),
+        claims: Object.freeze(claimOperands),
+        roles: Object.freeze(rolePredicates),
+        hasRole(role) {
+            if (!declaredRoles.has(role)) {
+                throw new Error(`ramose/policy: undeclared role ${JSON.stringify(role)}`);
+            }
+            return hasClass(role);
+        },
+    });
+};
+const snapshotClaim = (descriptor) => {
+    const shape = descriptor.shape._tag === "scalar"
+        ? Object.freeze({ ...descriptor.shape })
+        : Object.freeze({
+            ...descriptor.shape,
+            items: Object.freeze({ ...descriptor.shape.items }),
+        });
+    return Object.freeze({ ...descriptor, shape });
+};
+const assertPrincipalField = (schema, principal) => {
+    if (principal === undefined)
+        return;
+    const entity = Object.values(schema.entities).find((candidate) => Object.values(candidate.fields).some((field) => field === principal));
+    if (entity === undefined) {
+        throw new Error("ramose/policy: principal field is not in this schema");
+    }
+    if (!principal.ident.startsWith(`:${entity.ns}/`)) {
+        throw new Error("ramose/policy: principal field must be entity-owned");
+    }
+    const field = principal;
+    if (field.cardinality !== "one") {
+        throw new Error("ramose/policy: principal field must have cardinality one");
+    }
+    if (field.unique !== "strict" && field.unique !== "upsert") {
+        throw new Error("ramose/policy: principal field is not unique");
+    }
+    if (field.valueType !== "string" && field.valueType !== "uuid") {
+        throw new Error("ramose/policy: principal field must be string-compatible");
+    }
+};
+export function collectSchemaPolicy(schema, configOrDefine, maybeDefine) {
+    const config = typeof configOrDefine === "function" ? {} : configOrDefine;
+    const define = typeof configOrDefine === "function" ? configOrDefine : maybeDefine;
+    if (define === undefined) {
+        throw new Error("ramose/policy: applyPolicy requires a policy callback");
+    }
+    const roles = Object.freeze([...(config.roles ?? [])]);
+    const claims = Object.freeze((config.claims ?? []).map(snapshotClaim));
+    assertPrincipalField(schema, config.principal);
+    const rules = [];
+    const callbackResult = define({
+        policy: policyFor(schema, rules),
+        actor: policyOperand({ _tag: "me" }),
+        session: sessionFor(roles, claims),
+        allOf: (first, ...rest) => all(first, ...rest),
+        anyOf: (first, ...rest) => any(first, ...rest),
+    });
+    if ((typeof callbackResult === "object" || typeof callbackResult === "function") &&
+        callbackResult !== null &&
+        typeof callbackResult.then === "function") {
+        Object.freeze(rules);
+        void Promise.resolve(callbackResult).catch(() => undefined);
+        throw new Error("ramose/policy: policy callback must be synchronous");
+    }
+    Object.freeze(rules);
+    const input = Object.freeze({
+        schema,
+        rules,
+        classes: roles,
+        claims,
+        ...(config.principal === undefined
+            ? {}
+            : { principal: Object.freeze({ entity: config.principal }) }),
+    });
+    const validation = compileReadAuthorizationResult(input);
+    if (validation._tag === "Failure")
+        throw validation.failure;
+    return input;
+}
+//# sourceMappingURL=policy.js.map

package/dist/internal/authorization/authoring/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,gBAAgB,EAChB,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,WAAW,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAoB,MAAM,WAAW,CAAC;AAiOnD,MAAM,aAAa,GAAG,CACpB,OAAuB,EACI,EAAE,CAC7B,MAAM,CAAC,MAAM,CAAC;IACZ,GAAG,OAAO;IACV,EAAE,EAAE,CAAC,GAAiD,EAAE,EAAE,CACxD,EAAE,CAAC,OAAO,EAAE,GAAuB,CAAC;IACtC,QAAQ,EAAE,CACR,GAAmE,EACnE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAuB,CAAC;CAChD,CAA8B,CAAC;AAElC,MAAM,WAAW,GAAG,CAClB,MAAkB,EAClB,KAA0B,EAC1B,aAAoC,EACF,EAAE;IACpC,MAAM,OAAO,GAAI,IAEe,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,CACd,IAAmD,EACJ,EAAE,CACjD,aAAa,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU;QACvD,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,MAAM,MAAM,GAAG,CACb,IAAsB,EACtB,IAAmD,EAC7C,EAAE;QACR,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAa,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO;YAC3B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,OAAO;gBAAE,UAAU,GAAG,SAAS,CAAC;;gBACxC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK;YACH,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAyB,EACzB,KAA0B,EACF,EAAE;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,SAA6B,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,IAAsB,EAAE,IAAc,EAAQ,EAAE;QAC9D,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO;YAC3B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,OAAO;gBAAE,UAAU,GAAG,SAAS,CAAC;;gBACxC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK;YACH,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAA2B,EAC3B,KAA0B,EACS,EAAE;IACrC,MAAM,MAAM,GAAwE,EAAE,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;KACtC,CAAsC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,MAA0B,EAC1B,KAA0B,EACR,EAAE;IACpB,MAAM,MAAM,GAAsD,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAmB,CACjD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAA4B,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAqB,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAIjB,KAAY,EACZ,MAAc,EACgB,EAAE;IAChC,MAAM,cAAc,GAA6B,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,cAAc,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAErC,MAAM,aAAa,GAA2C,EAAE,CAAC;IACjE,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,aAAa,CAAmB;YAC9D,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,UAAU,CAAC,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,aAAa,CAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC9D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QACpC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QACpC,OAAO,CAAC,IAAmB;YACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;KACF,CAAiC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,UAA2B,EAAmB,EAAE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACZ,GAAG,UAAU,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;SACpD,CAAC,CAAC;IACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,MAA0B,EAC1B,SAAkC,EAC5B,EAAE;IACR,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC/D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CACrE,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,KAAK,GAAG,SAIb,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CAAC;AAeF,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,cAEkD,EAClD,WAIC;IAED,MAAM,MAAM,GAAG,OAAO,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IACnF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACvE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,cAAc,GAAI,MAMX,CAAC;QACZ,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC;QAChC,KAAK,EAAE,aAAa,CAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC;QAClC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC;QAC9C,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC;KAC/C,CAAC,CAAC;IACH,IACE,CAAC,OAAO,cAAc,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,UAAU,CAAC;QAC5E,cAAc,KAAK,IAAI;QACvB,OAAQ,cAA8C,CAAC,IAAI,KAAK,UAAU,EAC1E,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAErB,MAAM,KAAK,GAAkC,MAAM,CAAC,MAAM,CAAC;QACzD,MAAM;QACN,KAAK;QACL,OAAO,EAAE,KAAK;QACd,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC,OAAO,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/internal/authorization/authoring/read.d.ts

@@ -0,0 +1,13 @@
+import { type AuthExpr, type AuthPathProxy, type FieldTargetFields, type ReadRule } from "./types.ts";
+export type ReadBuilder<Proxy> = {
+    readonly when: (expr: AuthExpr | ((proxy: Proxy) => AuthExpr)) => ReadRule;
+    readonly deny: (expr: AuthExpr | ((proxy: Proxy) => AuthExpr)) => ReadRule;
+};
+export declare function read<N extends {
+    readonly _tag: "Entity" | "Trait";
+    readonly fields: object;
+}>(target: N): ReadBuilder<AuthPathProxy<N["fields"]>>;
+export declare function read<F extends {
+    readonly ident: string;
+}>(target: F): ReadBuilder<AuthPathProxy<FieldTargetFields<F>>>;
+//# sourceMappingURL=read.d.ts.map

package/dist/internal/authorization/authoring/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/read.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAEd,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,WAAW,CAAC,KAAK,IAAI;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,QAAQ,CAAC;CAC5E,CAAC;AA8BF,wBAAgB,IAAI,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC3F,MAAM,EAAE,CAAC,GACR,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3C,wBAAgB,IAAI,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,EAAE,CAAC,GACR,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/internal/authorization/authoring/read.js

@@ -0,0 +1,27 @@
+import { $, seededPath } from "./path.js";
+import { isAuthPath, isEntityTarget, isPathCarrier, isTraitTarget, READ_RULE_TAG, } from "./types.js";
+const resolveExpr = (target, expr) => {
+    if (typeof expr !== "function" || isAuthPath(expr))
+        return expr;
+    if (isEntityTarget(target) || isTraitTarget(target)) {
+        return expr($(target));
+    }
+    if (isPathCarrier(target)) {
+        return expr(seededPath(target));
+    }
+    return expr($({ fields: {} }));
+};
+const ruleOf = (target, kind, expr) => ({
+    _tag: READ_RULE_TAG,
+    target,
+    kind,
+    expr,
+});
+const builder = (target) => ({
+    when: (expr) => ruleOf(target, "allow", resolveExpr(target, expr)),
+    deny: (expr) => ruleOf(target, "deny", resolveExpr(target, expr)),
+});
+export function read(target) {
+    return builder(target);
+}
+//# sourceMappingURL=read.js.map

package/dist/internal/authorization/authoring/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../../src/internal/authorization/authoring/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,aAAa,GAMd,MAAM,YAAY,CAAC;AAOpB,MAAM,WAAW,GAAG,CAClB,MAAkB,EAClB,IAAqD,EAC3C,EAAE;IACZ,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAgB,CAAC;IAC5E,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAkB,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,IAAsB,EAAE,IAAc,EAAY,EAAE,CAAC,CAAC;IACxF,IAAI,EAAE,aAAa;IACnB,MAAM;IACN,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAQ,MAAkB,EAAsB,EAAE,CAAC,CAAC;IAClE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,IAAuD,CAAC,CAAC;IACvG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CACb,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,IAAuD,CAAC,CAAC;CACvG,CAAC,CAAC;AAQH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACrC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC"}