ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/changesets.d.ts

@@ -0,0 +1,54 @@
+import { TxRejected } from "../../db/Errors.ts";
+import { Connection } from "../core/conn.ts";
+import { type Datom } from "../core/datom.ts";
+import { type AuthenticatedCaller, type AuthorizedRequestContext } from "./request.ts";
+import { type OperationInvocation, type OperationRuntime } from "./operations-runtime.ts";
+export declare const MAX_CHANGESET_OPERATIONS = 100;
+export declare const MAX_CHANGESET_DATOMS = 10000;
+export declare const MAX_CHANGESET_BYTES = 1000000;
+export type ChangesetStep = {
+    readonly invocation: Omit<OperationInvocation, "caller">;
+    readonly datoms: readonly Datom[];
+};
+export type StoredChangeset = {
+    readonly id: string;
+    readonly revision: string;
+    readonly reviewers?: readonly string[] | undefined;
+    readonly requestKey?: string;
+    readonly parentRevision?: string;
+    readonly title: string;
+    readonly subject: string;
+    readonly basis: number;
+    readonly nextEntityId: number;
+    readonly createdAt: number;
+    readonly expiresAt: number;
+    readonly steps: readonly ChangesetStep[];
+    readonly datoms: readonly Datom[];
+    readonly status: "draft" | "committed" | "discarded";
+    readonly committedAt?: number;
+    readonly committedBy?: string;
+};
+export declare const decodeStoredChangeset: (value: StoredChangeset) => StoredChangeset;
+export declare const changesetConflict: (code: string) => TxRejected;
+export declare const changesetSubject: (caller: AuthenticatedCaller, now: number) => string;
+export declare const collapseChangeset: (base: Connection, steps: readonly ChangesetStep[], now: number) => Promise<readonly Datom[]>;
+export declare const prepareChangeset: (base: Connection, runtime: OperationRuntime, input: {
+    readonly id: string;
+    readonly title: string;
+    readonly operations: readonly OperationInvocation[];
+}, caller: AuthenticatedCaller) => Promise<StoredChangeset>;
+export declare const authorizeChangeset: (base: Connection, runtime: OperationRuntime, stored: StoredChangeset, caller: AuthenticatedCaller) => Promise<Connection>;
+export declare const appendChangeset: (base: Connection, runtime: OperationRuntime, stored: StoredChangeset, operations: readonly OperationInvocation[], caller: AuthenticatedCaller) => Promise<StoredChangeset>;
+export type ChangesetFact = {
+    readonly entity: number;
+    readonly field: string;
+    readonly value: unknown;
+    readonly reference: boolean;
+    readonly added: boolean;
+};
+export declare const changesetReadContext: (base: Connection, runtime: OperationRuntime, stored: StoredChangeset, caller: AuthenticatedCaller, draft: Connection, live?: Connection) => Promise<{
+    readonly before: AuthorizedRequestContext;
+    readonly after: AuthorizedRequestContext;
+}>;
+export declare const changesetDiff: (base: Connection, runtime: OperationRuntime, stored: StoredChangeset, caller: AuthenticatedCaller, live?: Connection) => Promise<readonly ChangesetFact[]>;
+//# sourceMappingURL=changesets.d.ts.map

package/dist/internal/authorization/changesets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesets.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/changesets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,UAAU,EAAgB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAmB,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG/D,OAAO,EAAqC,KAAK,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAW,eAAe,KAAG,eAU7D,CAAC;AAEH,eAAO,MAAM,iBAAiB,SAAU,MAAM,KAAG,UACR,CAAC;AAE1C,eAAO,MAAM,gBAAgB,WAAY,mBAAmB,OAAO,MAAM,KAAG,MAO3E,CAAC;AAIF,eAAO,MAAM,iBAAiB,SACtB,UAAU,SACT,SAAS,aAAa,EAAE,OAC1B,MAAM,KACV,OAAO,CAAC,SAAS,KAAK,EAAE,CAY1B,CAAC;AAEF,eAAO,MAAM,gBAAgB,SACrB,UAAU,WACP,gBAAgB,SAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,UACnG,mBAAmB,KAC1B,OAAO,CAAC,eAAe,CAqCzB,CAAC;AAEF,eAAO,MAAM,kBAAkB,SACvB,UAAU,WACP,gBAAgB,UACjB,eAAe,UACf,mBAAmB,KAC1B,OAAO,CAAC,UAAU,CAiBpB,CAAC;AAEF,eAAO,MAAM,eAAe,SACpB,UAAU,WACP,gBAAgB,UACjB,eAAe,cACX,SAAS,mBAAmB,EAAE,UAClC,mBAAmB,KAC1B,OAAO,CAAC,eAAe,CAUzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,SACzB,UAAU,WACP,gBAAgB,UACjB,eAAe,UACf,mBAAmB,SACpB,UAAU,SACX,UAAU,KACf,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;CAAE,CAYjG,CAAC;AAEF,eAAO,MAAM,aAAa,SAClB,UAAU,WACP,gBAAgB,UACjB,eAAe,UACf,mBAAmB,SACrB,UAAU,KACf,OAAO,CAAC,SAAS,aAAa,EAAE,CAclC,CAAC"}

package/dist/internal/authorization/changesets.js

@@ -0,0 +1,156 @@
+import { proposedReadView } from "./read-filter.js";
+import * as Effect from "effect/Effect";
+import { InvalidRequest, TxRejected, Unauthorized } from "../../db/Errors.js";
+import { Connection } from "../core/conn.js";
+import { Index, ValueTag } from "../core/datom.js";
+import { DB_TX_INSTANT, isTxEid, txEid } from "../core/schema.js";
+import { fromJson, stringifyJson } from "../core/json.js";
+import { constructAuthorizedRequestContext } from "./request.js";
+import { authorizeCatalogOperation, deployedOperationVersion, executeCatalogOperation, resolveOperationCatalog, } from "./operations-runtime.js";
+export const MAX_CHANGESET_OPERATIONS = 100;
+export const MAX_CHANGESET_DATOMS = 10_000;
+export const MAX_CHANGESET_BYTES = 1_000_000;
+export const decodeStoredChangeset = (value) => ({
+    ...value,
+    datoms: fromJson(value.datoms),
+    steps: value.steps.map((step) => ({
+        ...step,
+        datoms: fromJson(step.datoms),
+        invocation: { ...step.invocation, ...(step.invocation.target === undefined ? {} : {
+                target: fromJson(step.invocation.target),
+            }) },
+    })),
+});
+export const changesetConflict = (code) => new TxRejected({ message: code, code });
+export const changesetSubject = (caller, now) => {
+    const subject = caller.claims.sub;
+    if (typeof subject !== "string" || subject.length === 0 ||
+        !Number.isSafeInteger(caller.exp) || caller.exp * 1000 <= now) {
+        throw new Unauthorized({});
+    }
+    return subject;
+};
+const factKey = (d) => stringifyJson([d.e, d.a, d.vt, d.v]);
+export const collapseChangeset = async (base, steps, now) => {
+    const last = new Map();
+    for (const step of steps) {
+        for (const d of step.datoms)
+            if (!isTxEid(d.e))
+                last.set(factKey(d), d);
+    }
+    const t = base.t + 1;
+    const result = [{ e: txEid(t), a: DB_TX_INSTANT, vt: ValueTag.Inst, v: now, t, op: true }];
+    for (const d of last.values()) {
+        const prior = await base.db().first(Index.EAVT, { e: d.e, a: d.a, vt: d.vt, v: d.v });
+        if ((prior !== undefined) !== d.op)
+            result.push({ ...d, t });
+    }
+    return result;
+};
+export const prepareChangeset = async (base, runtime, input, caller) => {
+    if (input.operations.length < 1 || input.operations.length > MAX_CHANGESET_OPERATIONS) {
+        throw new InvalidRequest({ message: "a changeset needs between 1 and 100 operations" });
+    }
+    const now = runtime.now();
+    const subject = changesetSubject(caller, now);
+    const draft = base.fork();
+    const steps = [];
+    let count = 0;
+    for (const invocation of input.operations) {
+        const resolved = await Effect.runPromise(resolveOperationCatalog(runtime, invocation));
+        const version = deployedOperationVersion(resolved, invocation.owner, invocation.localName);
+        if (version === undefined || invocation.operationVersion !== version) {
+            throw changesetConflict("operation_changed");
+        }
+        const executed = await executeCatalogOperation(draft, runtime, { ...invocation, caller });
+        executed.assertFresh();
+        count += executed.report.txData.length;
+        if (count > MAX_CHANGESET_DATOMS)
+            throw changesetConflict("changeset_too_large");
+        const { caller: _caller, ...transaction } = invocation;
+        steps.push({ invocation: transaction, datoms: executed.report.txData });
+    }
+    const result = {
+        id: input.id,
+        title: input.title,
+        revision: crypto.randomUUID(),
+        subject,
+        basis: base.t,
+        nextEntityId: draft.nextEntityId,
+        createdAt: now,
+        expiresAt: now + 24 * 60 * 60 * 1000,
+        steps,
+        datoms: await collapseChangeset(base, steps, now),
+        status: "draft",
+    };
+    if (new TextEncoder().encode(stringifyJson(result)).byteLength > MAX_CHANGESET_BYTES)
+        throw changesetConflict("changeset_too_large");
+    return result;
+};
+export const authorizeChangeset = async (base, runtime, stored, caller) => {
+    const subject = changesetSubject(caller, runtime.now());
+    if (subject !== stored.subject && !stored.reviewers?.includes(subject))
+        throw new Unauthorized({});
+    if (stored.expiresAt <= runtime.now())
+        throw changesetConflict("changeset_expired");
+    if (base.t !== stored.basis)
+        throw changesetConflict("changeset_stale");
+    const draft = base.fork();
+    for (const step of stored.steps) {
+        const invocation = { ...step.invocation, caller };
+        const resolved = await Effect.runPromise(resolveOperationCatalog(runtime, invocation));
+        if (deployedOperationVersion(resolved, invocation.owner, invocation.localName) !== invocation.operationVersion) {
+            throw changesetConflict("operation_changed");
+        }
+        await authorizeCatalogOperation(draft, runtime, invocation, resolved);
+        draft.applyDatoms(step.datoms);
+    }
+    changesetSubject(caller, runtime.now());
+    return draft;
+};
+export const appendChangeset = async (base, runtime, stored, operations, caller) => {
+    if (stored.steps.length + operations.length > MAX_CHANGESET_OPERATIONS)
+        throw changesetConflict("changeset_too_large");
+    const draft = await authorizeChangeset(base, runtime, stored, caller);
+    const appended = await prepareChangeset(draft, runtime, { id: stored.id, title: stored.title, operations }, caller);
+    const steps = [...stored.steps, ...appended.steps];
+    if (steps.reduce((count, step) => count + step.datoms.length, 0) > MAX_CHANGESET_DATOMS)
+        throw changesetConflict("changeset_too_large");
+    const result = { ...appended, subject: stored.subject, reviewers: stored.reviewers, createdAt: stored.createdAt, expiresAt: stored.expiresAt, basis: stored.basis, steps,
+        datoms: await collapseChangeset(base, steps, runtime.now()) };
+    if (new TextEncoder().encode(stringifyJson(result)).byteLength > MAX_CHANGESET_BYTES)
+        throw changesetConflict("changeset_too_large");
+    return result;
+};
+export const changesetReadContext = async (base, runtime, stored, caller, draft, live = base) => {
+    const invocation = stored.steps[0].invocation;
+    const context = (connection) => Effect.runPromise(constructAuthorizedRequestContext({
+        authenticate: Effect.succeed(caller), catalogs: runtime.catalogs.catalogs,
+        routeDatabase: invocation.database, catalogKey: invocation.catalogKey, unitHash: invocation.unitHash,
+        currentDb: () => Effect.succeed(connection.db()),
+    }, caller));
+    const historical = await context(base);
+    const current = await context(live);
+    const before = { ...historical, filteredDb: proposedReadView(historical, historical, current) };
+    const after = await context(draft);
+    return { before, after: { ...after, filteredDb: proposedReadView(before, after, current) } };
+};
+export const changesetDiff = async (base, runtime, stored, caller, live = base) => {
+    const draft = await authorizeChangeset(base, runtime, stored, caller);
+    const { before, after } = await changesetReadContext(base, runtime, stored, caller, draft, live);
+    const facts = [];
+    for (const d of stored.datoms) {
+        if (isTxEid(d.e))
+            continue;
+        const view = d.op ? after.filteredDb : before.filteredDb;
+        if (await view.first(Index.EAVT, { e: d.e, a: d.a, vt: d.vt, v: d.v }) === undefined)
+            continue;
+        const attr = view.attr(d.a);
+        if (attr === undefined)
+            continue;
+        facts.push({ entity: d.e, field: attr.ident, value: d.v, reference: d.vt === ValueTag.Ref, added: d.op });
+    }
+    changesetSubject(caller, runtime.now());
+    return facts;
+};
+//# sourceMappingURL=changesets.js.map

package/dist/internal/authorization/changesets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesets.js","sourceRoot":"","sources":["../../../src/internal/authorization/changesets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAc,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAA2D,MAAM,cAAc,CAAC;AAC1H,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AA0B7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAsB,EAAmB,EAAE,CAAC,CAAC;IACjF,GAAG,KAAK;IACR,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAqB;IAClD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,IAAI;QACP,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAqB;QACjD,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAA+C;aACvF,CAAC,EAAE;KACL,CAAC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAc,EAAE,CAC5D,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA2B,EAAE,GAAW,EAAU,EAAE;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACrD,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAgB,EAChB,KAA+B,EAC/B,GAAW,EACgB,EAAE;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAAY,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,IAAgB,EAChB,OAAyB,EACzB,KAA2G,EAC3G,MAA2B,EACD,EAAE;IAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QACtF,MAAM,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3F,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;YACrE,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,IAAI,KAAK,GAAG,oBAAoB;YAAE,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACjF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAoB;QAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;QAC7B,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,CAAC;QACb,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACpC,KAAK;QACL,MAAM,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;QACjD,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,mBAAmB;QAAE,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAgB,EAChB,OAAyB,EACzB,MAAuB,EACvB,MAA2B,EACN,EAAE;IACvB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE;QAAE,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK;QAAE,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACvF,IAAI,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC/G,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAgB,EAChB,OAAyB,EACzB,MAAuB,EACvB,UAA0C,EAC1C,MAA2B,EACD,EAAE;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,wBAAwB;QAAE,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,oBAAoB;QAAE,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACxI,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK;QACtK,MAAM,EAAE,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,mBAAmB;QAAE,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EACvC,IAAgB,EAChB,OAAyB,EACzB,MAAuB,EACvB,MAA2B,EAC3B,KAAiB,EACjB,IAAI,GAAe,IAAI,EAC2E,EAAE;IACpG,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,UAAsB,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,iCAAiC,CAAC;QAC9F,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;QACzE,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ;QACpG,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;KACjD,EAAE,MAAM,CAAC,CAAC,CAAC;IACZ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,IAAgB,EAChB,OAAyB,EACzB,MAAuB,EACvB,MAA2B,EAC3B,IAAI,GAAe,IAAI,EACY,EAAE;IACrC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjG,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/internal/authorization/composition.d.ts

@@ -0,0 +1,10 @@
+import * as Result from "effect/Result";
+import { type CompositionIndex } from "../core/composition.ts";
+import type { CatalogDescriptor } from "./catalog.ts";
+import type { InstalledCatalogUnitV2 } from "./catalog-unit.ts";
+import { type PreparedAuthorizationCatalog } from "./validation/catalog.ts";
+import type { ValidateFailure } from "./validation/common.ts";
+export declare const compositionFromPrepared: (index: PreparedAuthorizationCatalog) => CompositionIndex;
+export declare const compositionFromDescriptor: (descriptor: CatalogDescriptor) => Result.Result<CompositionIndex, ValidateFailure>;
+export declare const compositionFromUnit: (unit: InstalledCatalogUnitV2) => Result.Result<CompositionIndex, ValidateFailure>;
+//# sourceMappingURL=composition.d.ts.map

package/dist/internal/authorization/composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/composition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAA+B,KAAK,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAc9D,eAAO,MAAM,uBAAuB,UAC3B,4BAA4B,KAClC,gBAMC,CAAC;AAEL,eAAO,MAAM,yBAAyB,eACxB,iBAAiB,KAC5B,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAY9C,CAAC;AAEL,eAAO,MAAM,mBAAmB,SACxB,sBAAsB,KAC3B,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CACT,CAAC"}

package/dist/internal/authorization/composition.js

@@ -0,0 +1,28 @@
+import * as Result from "effect/Result";
+import { makeCompositionIndex, } from "../core/composition.js";
+import { prepareAuthorizationCatalog } from "./validation/catalog.js";
+const identOf = (name) => `:${name}`;
+const traitSetRows = (rows) => {
+    const out = [];
+    for (const [name, traits] of rows) {
+        out.push([identOf(name), [...traits].map(identOf)]);
+    }
+    return out;
+};
+export const compositionFromPrepared = (index) => makeCompositionIndex({
+    entities: [...index.entities.keys()].map(identOf),
+    traits: [...index.traits.keys()].map(identOf),
+    entityTraits: traitSetRows(index.entityTraits),
+    traitTraits: traitSetRows(index.traitTraits),
+});
+export const compositionFromDescriptor = (descriptor) => Result.gen(function* () {
+    const prepared = yield* prepareAuthorizationCatalog({
+        database: descriptor.database,
+        catalog: descriptor.id,
+        catalogVersion: descriptor.version,
+        schemaFingerprint: descriptor.fingerprint,
+    }, descriptor);
+    return compositionFromPrepared(prepared);
+});
+export const compositionFromUnit = (unit) => compositionFromDescriptor(unit.catalog);
+//# sourceMappingURL=composition.js.map

package/dist/internal/authorization/composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.js","sourceRoot":"","sources":["../../../src/internal/authorization/composition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,oBAAoB,GAErB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,2BAA2B,EAAqC,MAAM,yBAAyB,CAAC;AAGzG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;AAErD,MAAM,YAAY,GAAG,CACnB,IAA8C,EACD,EAAE;IAC/C,MAAM,GAAG,GAAgD,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,KAAmC,EACjB,EAAE,CACpB,oBAAoB,CAAC;IACnB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACjD,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7C,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9C,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;CAC7C,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,UAA6B,EACqB,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,2BAA2B,CACjD;QACE,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,UAAU,CAAC,EAAE;QACtB,cAAc,EAAE,UAAU,CAAC,OAAO;QAClC,iBAAiB,EAAE,UAAU,CAAC,WAAW;KAC1C,EACD,UAAU,CACX,CAAC;IACF,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,IAA4B,EACsB,EAAE,CACpD,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC"}

package/dist/internal/authorization/database-bindings.d.ts

@@ -0,0 +1,48 @@
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import { Unauthorized } from "../../db/Errors.ts";
+import type { CatalogDefinitions, DeployedCatalogDefinition, DeployedCatalogDefinitions } from "./definitions.ts";
+import { CatalogMismatch, InvalidIR } from "./failures.ts";
+import type { CatalogUnitHash, CatalogId, DatabaseId } from "./identities.ts";
+import type { DeployedCatalog } from "./deployed.ts";
+declare const ResolvedDatabaseRouteTypeId: unique symbol;
+declare const DatabaseCatalogBindingsTypeId: unique symbol;
+export interface ResolvedDatabaseRoute {
+    readonly [ResolvedDatabaseRouteTypeId]: typeof ResolvedDatabaseRouteTypeId;
+    readonly database: DatabaseId;
+    readonly deployed: DeployedCatalog;
+}
+export type DatabaseRouteDerivation = {
+    readonly rootDatabase: DatabaseId;
+};
+declare const DatabaseCatalogBindingConflict_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DatabaseCatalogBindingConflict";
+} & Readonly<A>;
+export declare class DatabaseCatalogBindingConflict extends DatabaseCatalogBindingConflict_base<{
+    readonly database: DatabaseId;
+    readonly expectedCatalogKey: CatalogId;
+    readonly expectedUnitHash: CatalogUnitHash;
+    readonly actualCatalogKey: CatalogId;
+    readonly actualUnitHash: CatalogUnitHash;
+}> {
+}
+declare const InvalidResolvedDatabaseRoute_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "InvalidResolvedDatabaseRoute";
+} & Readonly<A>;
+export declare class InvalidResolvedDatabaseRoute extends InvalidResolvedDatabaseRoute_base<{
+    readonly message: string;
+}> {
+}
+export type DatabaseBindingFailure = DatabaseCatalogBindingConflict | InvalidResolvedDatabaseRoute | InvalidIR;
+export interface DatabaseCatalogBindings {
+    readonly [DatabaseCatalogBindingsTypeId]: typeof DatabaseCatalogBindingsTypeId;
+    readonly root: (database: DatabaseId) => Result.Result<ResolvedDatabaseRoute, CatalogMismatch>;
+}
+export declare const unavailableDatabaseCatalogBindings: (fail: () => never) => DatabaseCatalogBindings;
+export declare const opaqueDatabaseBindingDenial: (_error: DatabaseBindingFailure | CatalogMismatch) => Unauthorized;
+export declare const deployDatabaseCatalogBindings: (definitions: CatalogDefinitions, roots: DeployedCatalogDefinitions) => Result.Result<DatabaseCatalogBindings, CatalogMismatch | InvalidIR>;
+export declare const resolveBoundCatalogDefinition: (bindings: DatabaseCatalogBindings, route: ResolvedDatabaseRoute) => Result.Result<DeployedCatalogDefinition, InvalidResolvedDatabaseRoute>;
+export declare const acquireResolvedDatabase: <A, E, R>(bindings: DatabaseCatalogBindings, route: ResolvedDatabaseRoute, acquire: (database: DatabaseId) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | InvalidResolvedDatabaseRoute, R>;
+export declare const deriveResolvedDatabaseRoute: (bindings: DatabaseCatalogBindings, derivation: DatabaseRouteDerivation) => Effect.Effect<ResolvedDatabaseRoute, CatalogMismatch, never>;
+export {};
+//# sourceMappingURL=database-bindings.d.ts.map

package/dist/internal/authorization/database-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-bindings.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/database-bindings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,QAAA,MAAM,2BAA2B,EAAE,OAAO,MAEzC,CAAC;AACF,QAAA,MAAM,6BAA6B,EAAE,OAAO,MAE3C,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,CAAC,2BAA2B,CAAC,EAAE,OAAO,2BAA2B,CAAC;IAC3E,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAAC;;;;AAE5E,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;CAC1C,CAAC;CAAG;;;;AAEL,qBAAa,4BAA6B,SAAQ,kCAEhD;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;CAAG;AAElC,MAAM,MAAM,sBAAsB,GAC9B,8BAA8B,GAC9B,4BAA4B,GAC5B,SAAS,CAAC;AAEd,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,CAAC,6BAA6B,CAAC,EAAE,OAAO,6BAA6B,CAAC;IAC/E,QAAQ,CAAC,IAAI,EAAE,CACb,QAAQ,EAAE,UAAU,KACjB,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,eAAe,CAAC,CAAC;CAC5D;AAED,eAAO,MAAM,kCAAkC,SACvC,MAAM,KAAK,KAChB,uBAID,CAAC;AAEH,eAAO,MAAM,2BAA2B,WAC9B,sBAAsB,GAAG,eAAe,KAC/C,YAAoC,CAAC;AA2ExC,eAAO,MAAM,6BAA6B,gBAC3B,kBAAkB,SACxB,0BAA0B,KAChC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,eAAe,GAAG,SAAS,CAkCjE,CAAC;AAEL,eAAO,MAAM,6BAA6B,aAC9B,uBAAuB,SAC1B,qBAAqB,KAC3B,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,CAInE,CAAC;AAEN,eAAO,MAAM,uBAAuB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,YACnC,uBAAuB,SAC1B,qBAAqB,WACnB,CAAC,QAAQ,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KACxD,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAInD,CAAC;AAEL,eAAO,MAAM,2BAA2B,0IAOtC,CAAC"}

package/dist/internal/authorization/database-bindings.js

@@ -0,0 +1,101 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import { Unauthorized } from "../../db/Errors.js";
+import { CatalogMismatch, InvalidIR } from "./failures.js";
+const ResolvedDatabaseRouteTypeId = Symbol("ramose/internal/ResolvedDatabaseRoute");
+const DatabaseCatalogBindingsTypeId = Symbol("ramose/internal/DatabaseCatalogBindings");
+export class DatabaseCatalogBindingConflict extends Data.TaggedError("DatabaseCatalogBindingConflict") {
+}
+export class InvalidResolvedDatabaseRoute extends Data.TaggedError("InvalidResolvedDatabaseRoute") {
+}
+export const unavailableDatabaseCatalogBindings = (fail) => Object.freeze({
+    [DatabaseCatalogBindingsTypeId]: DatabaseCatalogBindingsTypeId,
+    root: fail,
+});
+export const opaqueDatabaseBindingDenial = (_error) => new Unauthorized({});
+const bindingStates = new WeakMap();
+const routeStates = new WeakMap();
+const deployedCatalog = (database, definition) => Object.freeze({
+    database,
+    catalogKey: definition.catalogKey,
+    unitHash: definition.unitHash,
+    unit: definition.unit,
+    composition: definition.composition,
+});
+const makeRoute = (owner, database, definition) => {
+    const route = Object.freeze({
+        [ResolvedDatabaseRouteTypeId]: ResolvedDatabaseRouteTypeId,
+        database,
+        deployed: deployedCatalog(database, definition),
+    });
+    const bound = Object.freeze({ route, definition });
+    routeStates.set(route, { ...bound, owner });
+    return bound;
+};
+const stateOf = (bindings) => {
+    const state = bindingStates.get(bindings);
+    return state === undefined
+        ? Result.fail(new InvalidResolvedDatabaseRoute({
+            message: "database catalog bindings were not created by deployDatabaseCatalogBindings",
+        }))
+        : Result.succeed(state);
+};
+const boundRoute = (bindings, route) => Result.gen(function* () {
+    const state = yield* stateOf(bindings);
+    const routed = routeStates.get(route);
+    if (routed === undefined ||
+        routed.owner !== state.owner ||
+        state.byDatabase.get(route.database)?.route !== route ||
+        route.deployed.database !== route.database ||
+        route.deployed.catalogKey !== routed.definition.catalogKey ||
+        route.deployed.unitHash !== routed.definition.unitHash) {
+        return yield* Result.fail(new InvalidResolvedDatabaseRoute({
+            message: "resolved database route is forged, stale, or belongs to another deployment",
+        }));
+    }
+    return routed;
+});
+export const deployDatabaseCatalogBindings = (definitions, roots) => Result.gen(function* () {
+    const owner = Object.freeze({});
+    const byDatabase = new Map();
+    for (const database of roots.databases()) {
+        const root = yield* roots.requireDatabase(database);
+        const canonical = yield* definitions.require(root.definition.catalogKey);
+        const read = yield* roots.catalogs.requireDatabase(database);
+        if (canonical !== root.definition ||
+            read.catalogKey !== canonical.catalogKey ||
+            read.unitHash !== canonical.unitHash) {
+            return yield* Result.fail(new InvalidIR({
+                message: `configured database '${database}' does not match its immutable catalog definition`,
+            }));
+        }
+        byDatabase.set(database, makeRoute(owner, database, canonical));
+    }
+    const bindings = Object.freeze({
+        [DatabaseCatalogBindingsTypeId]: DatabaseCatalogBindingsTypeId,
+        root: (database) => {
+            const found = byDatabase.get(database);
+            return found === undefined
+                ? Result.fail(new CatalogMismatch({
+                    message: "catalog mismatch",
+                    expectedDatabase: database,
+                }))
+                : Result.succeed(found.route);
+        },
+    });
+    bindingStates.set(bindings, { owner, byDatabase });
+    return bindings;
+});
+export const resolveBoundCatalogDefinition = (bindings, route) => Result.map(boundRoute(bindings, route), (bound) => Object.freeze({
+    database: route.database,
+    definition: bound.definition,
+}));
+export const acquireResolvedDatabase = (bindings, route, acquire) => Effect.gen(function* () {
+    yield* Effect.fromResult(boundRoute(bindings, route));
+    return yield* acquire(route.database);
+});
+export const deriveResolvedDatabaseRoute = Effect.fn("Authorization.deriveResolvedDatabaseRoute")(function* (bindings, derivation) {
+    return yield* Effect.fromResult(bindings.root(derivation.rootDatabase));
+});
+//# sourceMappingURL=database-bindings.js.map

package/dist/internal/authorization/database-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-bindings.js","sourceRoot":"","sources":["../../../src/internal/authorization/database-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI3D,MAAM,2BAA2B,GAAkB,MAAM,CACvD,uCAAuC,CACxC,CAAC;AACF,MAAM,6BAA6B,GAAkB,MAAM,CACzD,yCAAyC,CAC1C,CAAC;AAUF,MAAM,OAAO,8BAA+B,SAAQ,IAAI,CAAC,WAAW,CAClE,gCAAgC,CAOhC;CAAG;AAEL,MAAM,OAAO,4BAA6B,SAAQ,IAAI,CAAC,WAAW,CAChE,8BAA8B,CACD;CAAG;AAclC,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,IAAiB,EACQ,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,CAAC,6BAA6B,CAAC,EAC7B,6BAAqE;IACvE,IAAI,EAAE,IAAI;CACX,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,MAAgD,EAClC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;AAYxC,MAAM,aAAa,GAAG,IAAI,OAAO,EAAyC,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,OAAO,EAAqC,CAAC;AAErE,MAAM,eAAe,GAAG,CACtB,QAAoB,EACpB,UAAsC,EACrB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IAClC,QAAQ;IACR,UAAU,EAAE,UAAU,CAAC,UAAU;IACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;IAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,WAAW,EAAE,UAAU,CAAC,WAAW;CACpC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAChB,KAAa,EACb,QAAoB,EACpB,UAAsC,EAC1B,EAAE;IACd,MAAM,KAAK,GAA0B,MAAM,CAAC,MAAM,CAAC;QACjD,CAAC,2BAA2B,CAAC,EAC3B,2BAAiE;QACnE,QAAQ;QACR,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CACd,QAAiC,EAC0B,EAAE;IAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC;YAC7C,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,QAAiC,EACjC,KAA4B,EAC6B,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC5B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,KAAK;QACrD,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAC1C,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC,UAAU;QAC1D,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,EACtD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC;YACzD,OAAO,EAAE,4EAA4E;SACtF,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,WAA+B,EAC/B,KAAiC,EACoC,EAAE,CACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7D,IACE,SAAS,KAAK,IAAI,CAAC,UAAU;YAC7B,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;YACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EACpC,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;gBACtC,OAAO,EAAE,wBAAwB,QAAQ,mDAAmD;aAC7F,CAAC,CAAC,CAAC;QACN,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAA4B,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC,6BAA6B,CAAC,EAC7B,6BAAqE;QACvE,IAAI,EAAE,CAAC,QAAoB,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;oBAChC,OAAO,EAAE,kBAAkB;oBAC3B,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC,CAAC;gBACH,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;KACF,CAAC,CAAC;IACH,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,QAAiC,EACjC,KAA4B,EAC4C,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAiC,EACjC,KAA4B,EAC5B,OAAyD,EACF,EAAE,CACzD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,EAAE,CAClD,2CAA2C,CAC5C,CAAC,QAAQ,CAAC,EACT,QAAiC,EACjC,UAAmC;IAEnC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC"}

package/dist/internal/authorization/database-target.d.ts

@@ -0,0 +1,75 @@
+import * as Effect from "effect/Effect";
+import { Unauthorized } from "../../db/Errors.ts";
+import type { Db } from "../core/db.ts";
+import type { InstalledCatalogDefinition } from "./definitions.ts";
+import type { DatabaseCatalogBindings, DatabaseRouteDerivation, ResolvedDatabaseRoute } from "./database-bindings.ts";
+import type { CatalogUnitHash, CatalogId, DatabaseId } from "./identities.ts";
+import { type AuthenticatedCaller, type AuthorizedRequestContext, type AuthorizedRequestView } from "./request.ts";
+declare const DatabaseAuthorizationFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DatabaseAuthorizationFailed";
+} & Readonly<A>;
+export declare class DatabaseAuthorizationFailed extends DatabaseAuthorizationFailed_base<{
+    readonly database: DatabaseId;
+}> {
+}
+declare const DatabaseUnavailable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DatabaseUnavailable";
+} & Readonly<A>;
+export declare class DatabaseUnavailable extends DatabaseUnavailable_base<{
+    readonly database: DatabaseId;
+    readonly cause: unknown;
+}> {
+}
+declare const DatabaseProvisioningFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DatabaseProvisioningFailed";
+} & Readonly<A>;
+export declare class DatabaseProvisioningFailed extends DatabaseProvisioningFailed_base<{
+    readonly database: DatabaseId;
+    readonly cause: unknown;
+}> {
+}
+export type DatabaseTargetFailure = DatabaseAuthorizationFailed | DatabaseUnavailable | DatabaseProvisioningFailed;
+export declare const opaqueDatabaseTargetDenial: (_error: DatabaseTargetFailure) => Unauthorized;
+export type AuthorizedDatabaseInput<R = never, EDb = unknown, EProvision = unknown> = {
+    readonly bindings: DatabaseCatalogBindings;
+    readonly root: ResolvedDatabaseRoute;
+    readonly currentDb: (database: DatabaseId) => Effect.Effect<Db, EDb, R>;
+    readonly provision: (route: ResolvedDatabaseRoute, derivation: DatabaseRouteDerivation) => Effect.Effect<void, EProvision, R>;
+    readonly view?: AuthorizedRequestView;
+};
+export type DatabaseLeaseRouteIdentity = {
+    readonly database: DatabaseId;
+    readonly catalogKey: CatalogId;
+    readonly unitHash: CatalogUnitHash;
+};
+export type DatabaseLeaseIdentity = {
+    readonly rootDatabase: DatabaseId;
+    readonly route: DatabaseLeaseRouteIdentity;
+};
+export type AuthorizedDatabaseTarget = {
+    readonly route: ResolvedDatabaseRoute;
+    readonly derivation: DatabaseRouteDerivation;
+    readonly context: AuthorizedRequestContext;
+};
+export declare const databaseLeaseIdentity: (target: AuthorizedDatabaseTarget) => DatabaseLeaseIdentity;
+export declare const sameDatabaseLeaseIdentity: (left: DatabaseLeaseIdentity, right: DatabaseLeaseIdentity) => boolean;
+export type CatalogProvisioningAttribute = {
+    readonly ":db/ident": string;
+    readonly ":db/valueType": string;
+    readonly ":db/cardinality": string;
+    readonly ":db/unique"?: string;
+    readonly ":db/index"?: true;
+    readonly ":db/isComponent"?: true;
+    readonly ":db/optional"?: true;
+    readonly ":db/doc"?: string;
+};
+export declare const catalogProvisioningAttributes: (definition: InstalledCatalogDefinition) => readonly CatalogProvisioningAttribute[];
+export declare const resolveAuthorizedDatabaseTarget: <R, EDb, EProvision>(input: AuthorizedDatabaseInput<R, EDb, EProvision>, caller: AuthenticatedCaller) => Effect.Effect<AuthorizedDatabaseTarget, DatabaseTargetFailure, R>;
+export type ExecuteAuthorizedDatabaseInput<R = never, EDb = unknown, EProvision = unknown> = AuthorizedDatabaseInput<R, EDb, EProvision> & {
+    readonly authenticate: Effect.Effect<AuthenticatedCaller, Unauthorized, R>;
+    readonly interruptAfter?: import("effect/Duration").Input;
+};
+export declare const executeAuthorizedDatabaseTarget: <A, E, R, EDb = unknown, EProvision = unknown>(input: ExecuteAuthorizedDatabaseInput<R, EDb, EProvision>, execute: (target: AuthorizedDatabaseTarget) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | Unauthorized, R>;
+export declare const executeAuthorizedDatabase: <A, E, R, EDb = unknown, EProvision = unknown>(input: ExecuteAuthorizedDatabaseInput<R, EDb, EProvision>, execute: (filteredDb: Db) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | Unauthorized, R>;
+export {};
+//# sourceMappingURL=database-target.d.ts.map

package/dist/internal/authorization/database-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-target.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/database-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EACV,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC3B,MAAM,cAAc,CAAC;;;;AAEtB,qBAAa,2BAA4B,SAAQ,iCAE/C;IAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;CAAE,CAAC;CAAG;;;;AAEvC,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;;;;AAEL,qBAAa,0BAA2B,SAAQ,gCAE9C;IACA,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,mBAAmB,GACnB,0BAA0B,CAAC;AAE/B,eAAO,MAAM,0BAA0B,WAC7B,qBAAqB,KAC5B,YAAiD,CAAC;AAErD,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,GAAG,OAAO,EAAE,UAAU,GAAG,OAAO,IAAI;IACpF,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,qBAAqB,EAC5B,UAAU,EAAE,uBAAuB,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,WACxB,wBAAwB,KAC/B,qBAOD,CAAC;AAEH,eAAO,MAAM,yBAAyB,SAC9B,qBAAqB,SACpB,qBAAqB,KAC3B,OAI2C,CAAC;AAE/C,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,6BAA6B,eAC5B,0BAA0B,KACrC,SAAS,4BAA4B,EAkBlC,CAAC;AAEP,eAAO,MAAM,+BAA+B,GAE/B,CAAC,EAAE,GAAG,EAAE,UAAU,uJAyB7B,CAAC;AAEH,MAAM,MAAM,8BAA8B,CACxC,CAAC,GAAG,KAAK,EACT,GAAG,GAAG,OAAO,EACb,UAAU,GAAG,OAAO,IAClB,uBAAuB,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG;IAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,iBAAiB,EAAE,KAAK,CAAC;CAC3D,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAE/B,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,UAAU,yFAE3B,wBAAwB,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,0CAQrE,CAAC;AAEH,eAAO,MAAM,yBAAyB,GAEzB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,YAAY,UAAU,6FAEvB,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,0CAMnD,CAAC"}

package/dist/internal/authorization/database-target.js

@@ -0,0 +1,65 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import { Unauthorized } from "../../db/Errors.js";
+import { constructAuthorizedResolvedRequestContext, executeWithinAuthorizedLease, } from "./request.js";
+export class DatabaseAuthorizationFailed extends Data.TaggedError("DatabaseAuthorizationFailed") {
+}
+export class DatabaseUnavailable extends Data.TaggedError("DatabaseUnavailable") {
+}
+export class DatabaseProvisioningFailed extends Data.TaggedError("DatabaseProvisioningFailed") {
+}
+export const opaqueDatabaseTargetDenial = (_error) => new Unauthorized({ status: 403 });
+export const databaseLeaseIdentity = (target) => Object.freeze({
+    rootDatabase: target.derivation.rootDatabase,
+    route: Object.freeze({
+        database: target.route.database,
+        catalogKey: target.route.deployed.catalogKey,
+        unitHash: target.route.deployed.unitHash,
+    }),
+});
+export const sameDatabaseLeaseIdentity = (left, right) => left.rootDatabase === right.rootDatabase &&
+    left.route.database === right.route.database &&
+    left.route.catalogKey === right.route.catalogKey &&
+    left.route.unitHash === right.route.unitHash;
+export const catalogProvisioningAttributes = (definition) => Object.freeze(definition.unit.catalog.fields.map((field) => Object.freeze({
+    ":db/ident": `:${field.id.owner.name}/${field.id.localName}`,
+    ":db/valueType": `:db.type/${field.valueType}`,
+    ":db/cardinality": `:db.cardinality/${field.cardinality}`,
+    ...(field.unique === undefined
+        ? {}
+        : {
+            ":db/unique": field.unique === "upsert"
+                ? ":db.unique/identity"
+                : ":db.unique/value",
+        }),
+    ...(field.index ? { ":db/index": true } : {}),
+    ...(field.owned ? { ":db/isComponent": true } : {}),
+    ...(field.optional && field.cardinality === "one"
+        ? { ":db/optional": true }
+        : {}),
+    ...(field.doc === undefined ? {} : { ":db/doc": field.doc }),
+})));
+export const resolveAuthorizedDatabaseTarget = Effect.fn("Authorization.resolveAuthorizedDatabaseTarget")(function* (input, caller) {
+    const derivation = Object.freeze({ rootDatabase: input.root.database });
+    yield* input.provision(input.root, derivation).pipe(Effect.mapError((cause) => new DatabaseProvisioningFailed({
+        database: input.root.database,
+        cause,
+    })));
+    const context = yield* constructAuthorizedResolvedRequestContext({
+        authenticate: Effect.succeed(caller),
+        bindings: input.bindings,
+        route: input.root,
+        currentDb: input.currentDb,
+        ...(input.view === undefined ? {} : { view: input.view }),
+    }, caller).pipe(Effect.mapError((error) => error instanceof Unauthorized
+        ? new DatabaseAuthorizationFailed({ database: input.root.database })
+        : new DatabaseUnavailable({ database: input.root.database, cause: error })));
+    return Object.freeze({ route: input.root, derivation, context });
+});
+export const executeAuthorizedDatabaseTarget = Effect.fn("Authorization.executeAuthorizedDatabaseTarget")(function* (input, execute) {
+    return yield* executeWithinAuthorizedLease(input, (caller) => resolveAuthorizedDatabaseTarget(input, caller).pipe(Effect.mapError(opaqueDatabaseTargetDenial), Effect.flatMap(execute)));
+});
+export const executeAuthorizedDatabase = Effect.fn("Authorization.executeAuthorizedDatabase")(function* (input, execute) {
+    return yield* executeAuthorizedDatabaseTarget(input, (target) => execute(target.context.filteredDb));
+});
+//# sourceMappingURL=database-target.js.map

package/dist/internal/authorization/database-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-target.js","sourceRoot":"","sources":["../../../src/internal/authorization/database-target.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASlD,OAAO,EACL,yCAAyC,EACzC,4BAA4B,GAI7B,MAAM,cAAc,CAAC;AAEtB,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CACK;CAAG;AAEvC,MAAM,OAAO,mBAAoB,SAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAG7E;CAAG;AAEL,MAAM,OAAO,0BAA2B,SAAQ,IAAI,CAAC,WAAW,CAC9D,4BAA4B,CAI5B;CAAG;AAOL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,MAA6B,EACf,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AA8BrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAgC,EACT,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;QAC/B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU;QAC5C,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;KACzC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,IAA2B,EAC3B,KAA4B,EACnB,EAAE,CACX,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;IACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU;IAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;AAa/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,UAAsC,EACG,EAAE,CAC3C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IACxE,WAAW,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE;IAC5D,eAAe,EAAE,YAAY,KAAK,CAAC,SAAS,EAAE;IAC9C,iBAAiB,EAAE,mBAAmB,KAAK,CAAC,WAAW,EAAE;IACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACA,YAAY,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ;gBACrC,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,kBAAkB;SACvB,CAAC;IACJ,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK;QAC/C,CAAC,CAAC,EAAE,cAAc,EAAE,IAAa,EAAE;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;CAC7D,CAAC,CAAC,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,EAAE,CACtD,+CAA+C,CAChD,CAAC,QAAQ,CAAC,EACT,KAAkD,EAClD,MAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC;QACxD,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,yCAAyC,CAAC;QAC/D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1D,EAAE,MAAM,CAAC,CAAC,IAAI,CACb,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,YAAY;QAC3B,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAC7E,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,EAAE,CACtD,+CAA+C,CAChD,CAAC,QAAQ,CAAC,EACT,KAAyD,EACzD,OAAqE;IAErE,OAAO,KAAK,CAAC,CAAC,4BAA4B,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAC3D,+BAA+B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAC3C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CACxB,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,EAAE,CAChD,yCAAyC,CAC1C,CAAC,QAAQ,CAAC,EACT,KAAyD,EACzD,OAAmD;IAEnD,OAAO,KAAK,CAAC,CAAC,+BAA+B,CAC3C,KAAK,EACL,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC,CAAC"}