ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/install/normalize.d.ts

@@ -0,0 +1,196 @@
+import * as Result from "effect/Result";
+import { EntityDescriptor, FieldDescriptor, TraitComposition, TraitDescriptor, type CatalogDescriptor, type RuleAccessPlan } from "../catalog.ts";
+import type { CanonicalAuthorizationDecisions, CanonicalAuthorizationRule, ValidatedAuthorizationIR } from "../ir.ts";
+import type { ClaimDescriptor } from "../principal.ts";
+import { type ValidateFailure } from "../validation/common.ts";
+export declare const normalizeClasses: (classes: ReadonlyArray<string>) => Result.Result<ReadonlyArray<string>, ValidateFailure>;
+export declare const normalizeClaims: (claims: ReadonlyArray<ClaimDescriptor>) => Result.Result<ReadonlyArray<ClaimDescriptor>, ValidateFailure>;
+export declare const normalizeEntities: (entities: ReadonlyArray<EntityDescriptor>) => Result.Result<ReadonlyArray<EntityDescriptor>, ValidateFailure>;
+export declare const normalizeTraits: (traits: ReadonlyArray<TraitDescriptor>) => Result.Result<ReadonlyArray<TraitDescriptor>, ValidateFailure>;
+export declare const normalizeFields: (fields: ReadonlyArray<FieldDescriptor>) => Result.Result<ReadonlyArray<FieldDescriptor>, ValidateFailure>;
+export declare const normalizeTraitComposition: (rows: ReadonlyArray<TraitComposition>) => Result.Result<ReadonlyArray<TraitComposition>, ValidateFailure>;
+export declare const normalizeOperations: (operations: CatalogDescriptor["operations"]) => Result.Result<ReadonlyArray<CatalogDescriptor["operations"][number]>, ValidateFailure>;
+export declare const normalizeRules: (rules: ReadonlyArray<CanonicalAuthorizationRule>) => Result.Result<ReadonlyArray<CanonicalAuthorizationRule>, ValidateFailure>;
+export declare const normalizeDecisions: (decisions: CanonicalAuthorizationDecisions) => Result.Result<CanonicalAuthorizationDecisions, ValidateFailure>;
+export declare const normalizeAccessPlans: (plans: ReadonlyArray<RuleAccessPlan>, rules: ReadonlyArray<CanonicalAuthorizationRule>) => Result.Result<ReadonlyArray<RuleAccessPlan>, ValidateFailure>;
+export declare const normalizeValidatedTables: (validated: ValidatedAuthorizationIR, plans: ReadonlyArray<RuleAccessPlan>) => Result.Result<{
+    classes: readonly string[];
+    claims: readonly {
+        readonly key: string;
+        readonly optional: boolean;
+        readonly shape: {
+            readonly _tag: "scalar";
+            readonly valueType: "boolean" | "double" | "long" | "string";
+        } | {
+            readonly _tag: "array";
+            readonly items: {
+                readonly _tag: "scalar";
+                readonly valueType: "boolean" | "double" | "long" | "string";
+            };
+        };
+    }[];
+    rules: readonly {
+        readonly id: string & import("effect/Brand").Brand<"RuleId">;
+        readonly focus: {
+            readonly _tag: "entity";
+            readonly entity: {
+                readonly _tag: "EntityId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+        } | {
+            readonly _tag: "trait";
+            readonly trait: {
+                readonly _tag: "TraitId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+        } | {
+            readonly _tag: "field";
+            readonly field: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+        } | {
+            readonly _tag: "operation";
+            readonly operation: {
+                readonly _tag: "OperationId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+                readonly target: "none" | "required";
+            };
+        };
+        readonly expr: import("../expr.ts").CanonicalAuthorizationExpr;
+        readonly usesResource: boolean;
+        readonly usesMe: boolean;
+        readonly usesSubject: boolean;
+        readonly traversalDepth: number;
+    }[];
+    decisions: {
+        readonly entities: readonly {
+            readonly target: {
+                readonly _tag: "EntityId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+            readonly decision: {
+                readonly allow: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+                readonly deny: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+            };
+        }[];
+        readonly traits: readonly {
+            readonly target: {
+                readonly _tag: "TraitId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+            readonly decision: {
+                readonly allow: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+                readonly deny: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+            };
+        }[];
+        readonly fields: readonly {
+            readonly target: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+            readonly decision: {
+                readonly allow: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+                readonly deny: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+            };
+        }[];
+        readonly operations: readonly {
+            readonly target: {
+                readonly _tag: "OperationId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+                readonly target: "none" | "required";
+            };
+            readonly decision: {
+                readonly allow: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+                readonly deny: readonly (string & import("effect/Brand").Brand<"RuleId">)[];
+            };
+        }[];
+    };
+    accessPlans: readonly {
+        readonly rule: string & import("effect/Brand").Brand<"RuleId">;
+        readonly lookups: readonly ({
+            readonly _tag: "field";
+            readonly field: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+        } | {
+            readonly _tag: "entity";
+            readonly entity: {
+                readonly _tag: "EntityId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+        } | {
+            readonly _tag: "trait";
+            readonly trait: {
+                readonly _tag: "TraitId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly name: string;
+            };
+        } | {
+            readonly _tag: "index";
+            readonly field: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+        } | {
+            readonly _tag: "refIndex";
+            readonly field: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+        } | {
+            readonly _tag: "principal";
+            readonly field: {
+                readonly _tag: "FieldId";
+                readonly catalog: string & import("effect/Brand").Brand<"CatalogId">;
+                readonly owner: {
+                    readonly kind: "entity" | "trait";
+                    readonly name: string;
+                };
+                readonly localName: string;
+            };
+        })[];
+    }[];
+}, ValidateFailure>;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/internal/authorization/install/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/install/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,KAAK,iBAAiB,EAEtB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAE1B,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAgFxE,eAAO,MAAM,gBAAgB,YAClB,aAAa,CAAC,MAAM,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,eAAe,CACP,CAAC;AAEjD,eAAO,MAAM,eAAe,WAClB,aAAa,CAAC,eAAe,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,eAAe,CACX,CAAC;AAEtD,eAAO,MAAM,iBAAiB,aAClB,aAAa,CAAC,gBAAgB,CAAC,KACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAY7D,CAAC;AAEL,eAAO,MAAM,eAAe,WAClB,aAAa,CAAC,eAAe,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,eAAe,CAY5D,CAAC;AAEL,eAAO,MAAM,eAAe,WAClB,aAAa,CAAC,eAAe,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,eAAe,CACU,CAAC;AAE3E,eAAO,MAAM,yBAAyB,SAC9B,aAAa,CAAC,gBAAgB,CAAC,KACpC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAiB7D,CAAC;AAwBL,eAAO,MAAM,mBAAmB,eAClB,iBAAiB,CAAC,YAAY,CAAC,KAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,CA4BpF,CAAC;AAEL,eAAO,MAAM,cAAc,UAClB,aAAa,CAAC,0BAA0B,CAAC,KAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,0BAA0B,CAAC,EAAE,eAAe,CAClB,CAAC;AAE1D,eAAO,MAAM,kBAAkB,cAClB,+BAA+B,KACzC,MAAM,CAAC,MAAM,CAAC,+BAA+B,EAAE,eAAe,CAuB7D,CAAC;AAEL,eAAO,MAAM,oBAAoB,UACxB,aAAa,CAAC,cAAc,CAAC,SAC7B,aAAa,CAAC,0BAA0B,CAAC,KAC/C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,eAAe,CAe3D,CAAC;AAEL,eAAO,MAAM,wBAAwB,cACxB,wBAAwB,SAC5B,aAAa,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAelC,CAAC"}

package/dist/internal/authorization/install/normalize.js

@@ -0,0 +1,168 @@
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { compareCanonicalKeys, canonicalizeJson } from "../canonical-json.js";
+import { EntityDescriptor, FieldDescriptor, TraitComposition, TraitDescriptor, } from "../catalog.js";
+import { CanonicalIdentitySchemas } from "../identities.js";
+import { invalid } from "../validation/common.js";
+const encodedJson = (encoded) => encoded;
+const canonicalKey = (value) => {
+    try {
+        return Result.succeed(canonicalizeJson(encodedJson(value)));
+    }
+    catch (cause) {
+        return invalid(`ambiguous installed identity: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+};
+const compareCanonical = (left, right) => compareCanonicalKeys(left, right);
+const sortByCanonical = (items, encode) => Result.gen(function* () {
+    const keyed = [];
+    for (const item of items) {
+        const key = yield* canonicalKey(encode(item));
+        keyed.push({ key, item });
+    }
+    keyed.sort((left, right) => compareCanonical(left.key, right.key));
+    return keyed.map((entry) => entry.item);
+});
+const uniqueSorted = (items, encode, label) => Result.gen(function* () {
+    const sorted = yield* sortByCanonical(items, encode);
+    const seen = new Set();
+    for (const item of sorted) {
+        const key = yield* canonicalKey(encode(item));
+        if (seen.has(key))
+            return yield* invalid(`duplicate ${label}`);
+        seen.add(key);
+    }
+    return sorted;
+});
+const encodeEntity = (id) => Schema.encodeUnknownSync(CanonicalIdentitySchemas.entity)(id);
+const encodeTrait = (id) => Schema.encodeUnknownSync(CanonicalIdentitySchemas.trait)(id);
+const encodeField = (id) => Schema.encodeUnknownSync(CanonicalIdentitySchemas.field)(id);
+const encodeComposition = (row) => Schema.encodeUnknownSync(TraitComposition)(row);
+const canonicalizeComposedTraits = (traits) => uniqueSorted(traits, encodeTrait, "composed trait");
+const sortRuleIds = (ids) => [...ids].sort((left, right) => compareCanonical(left, right));
+const normalizeDecision = (decision) => ({
+    allow: sortRuleIds(decision.allow),
+    deny: sortRuleIds(decision.deny),
+});
+const normalizeDecisionEntries = (entries, encodeTarget, label) => {
+    const normalized = entries.map((entry) => ({
+        target: entry.target,
+        decision: normalizeDecision(entry.decision),
+    }));
+    return uniqueSorted(normalized, (entry) => encodeTarget(entry.target), label);
+};
+export const normalizeClasses = (classes) => uniqueSorted(classes, (name) => name, "class");
+export const normalizeClaims = (claims) => uniqueSorted(claims, (claim) => claim.key, "claim");
+export const normalizeEntities = (entities) => Result.gen(function* () {
+    const closed = [];
+    for (const entity of entities) {
+        const traits = yield* canonicalizeComposedTraits(entity.traits);
+        closed.push({
+            id: entity.id,
+            traits,
+            ...(entity.doc === undefined ? {} : { doc: entity.doc }),
+        });
+    }
+    return yield* uniqueSorted(closed, (entity) => encodeEntity(entity.id), "entity identity");
+});
+export const normalizeTraits = (traits) => Result.gen(function* () {
+    const closed = [];
+    for (const trait of traits) {
+        const nested = yield* canonicalizeComposedTraits(trait.traits);
+        closed.push({
+            id: trait.id,
+            traits: nested,
+            ...(trait.doc === undefined ? {} : { doc: trait.doc }),
+        });
+    }
+    return yield* uniqueSorted(closed, (trait) => encodeTrait(trait.id), "trait identity");
+});
+export const normalizeFields = (fields) => uniqueSorted(fields, (field) => encodeField(field.id), "field identity");
+export const normalizeTraitComposition = (rows) => Result.gen(function* () {
+    const closed = [];
+    for (const row of rows) {
+        const transitive = yield* uniqueSorted(row.transitive, encodeTrait, "transitive trait");
+        closed.push({
+            composer: row.composer,
+            trait: row.trait,
+            transitive,
+        });
+    }
+    const sorted = yield* uniqueSorted(closed, (row) => ({ composer: encodeEntity(row.composer), trait: encodeTrait(row.trait) }), "trait-composition identity");
+    return yield* uniqueSorted(sorted, encodeComposition, "trait-composition row");
+});
+const canonicalizeInputShape = (shape) => {
+    switch (shape._tag) {
+        case "scalar":
+        case "ref":
+        case "opaque":
+            return shape;
+        case "array":
+            return { _tag: "array", items: canonicalizeInputShape(shape.items) };
+        case "struct":
+            return {
+                _tag: "struct",
+                fields: [...shape.fields]
+                    .sort((left, right) => compareCanonicalKeys(left.key, right.key))
+                    .map((field) => ({
+                    key: field.key,
+                    optional: field.optional,
+                    shape: canonicalizeInputShape(field.shape),
+                })),
+            };
+    }
+};
+export const normalizeOperations = (operations) => Result.gen(function* () {
+    const normalized = [];
+    for (const operation of operations) {
+        const composers = yield* uniqueSorted(operation.composers, encodeEntity, "operation composer");
+        const writes = yield* uniqueSorted(operation.writes, encodeEntity, "operation write entity");
+        normalized.push({
+            ...operation,
+            input: canonicalizeInputShape(operation.input),
+            output: canonicalizeInputShape(operation.output),
+            composers,
+            writes,
+        });
+    }
+    return yield* uniqueSorted(normalized, (operation) => Schema.encodeUnknownSync(CanonicalIdentitySchemas.operation)(operation.id), "operation identity");
+});
+export const normalizeRules = (rules) => uniqueSorted(rules, (rule) => rule.id, "rule identity");
+export const normalizeDecisions = (decisions) => Result.gen(function* () {
+    const entities = yield* normalizeDecisionEntries(decisions.entities, encodeEntity, "entity decision target");
+    const traits = yield* normalizeDecisionEntries(decisions.traits, encodeTrait, "trait decision target");
+    const fields = yield* normalizeDecisionEntries(decisions.fields, encodeField, "field decision target");
+    const operations = yield* normalizeDecisionEntries(decisions.operations, (operation) => Schema.encodeUnknownSync(CanonicalIdentitySchemas.operation)(operation), "operation decision target");
+    return { entities, traits, fields, operations };
+});
+export const normalizeAccessPlans = (plans, rules) => Result.gen(function* () {
+    const sorted = yield* uniqueSorted(plans, (plan) => plan.rule, "access-plan identity");
+    if (sorted.length !== rules.length) {
+        return yield* invalid("missing access plan");
+    }
+    const expected = new Set(rules.map((rule) => rule.id));
+    for (const plan of sorted) {
+        if (!expected.has(plan.rule)) {
+            return yield* invalid(`conflicting access plan for '${plan.rule}'`);
+        }
+        expected.delete(plan.rule);
+    }
+    if (expected.size !== 0)
+        return yield* invalid("missing access plan");
+    return sorted;
+});
+export const normalizeValidatedTables = (validated, plans) => Result.gen(function* () {
+    const classes = yield* normalizeClasses(validated.classes);
+    const claims = yield* normalizeClaims(validated.claims);
+    const rules = yield* normalizeRules(validated.rules);
+    const decisions = yield* normalizeDecisions(validated.decisions);
+    const accessPlans = yield* normalizeAccessPlans(plans, rules);
+    return {
+        classes,
+        claims,
+        rules,
+        decisions,
+        accessPlans,
+    };
+});
+//# sourceMappingURL=normalize.js.map

package/dist/internal/authorization/install/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../../src/internal/authorization/install/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,eAAe,GAIhB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAS5D,OAAO,EAAE,OAAO,EAAwB,MAAM,yBAAyB,CAAC;AAExE,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAa,EAAE,CAAC,OAAoB,CAAC;AAE1E,MAAM,YAAY,GAAG,CAAC,KAAc,EAA0C,EAAE;IAC9E,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CACZ,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEpG,MAAM,eAAe,GAAG,CACtB,KAAuB,EACvB,MAA4B,EACsB,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAsD,EAAE,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CACnB,KAAuB,EACvB,MAA4B,EAC5B,KAAa,EACqC,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC,EAAY,EAAW,EAAE,CAC7C,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,CAAC,EAAW,EAAW,EAAE,CAC3C,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,CAAC,EAAW,EAAW,EAAE,CAC3C,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,CAAC,GAAqB,EAAW,EAAE,CAC3D,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC;AAElD,MAAM,0BAA0B,GAAG,CACjC,MAA8B,EAC0B,EAAE,CAC1D,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAEtD,MAAM,WAAW,GAAG,CAAC,GAA0B,EAAyB,EAAE,CACxE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhE,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAY,EAAE,CAAC,CAAC;IAC3D,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,CAC/B,OAAgF,EAChF,YAAyC,EACzC,KAAa,EAC4F,EAAE;IAC3G,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC5C,CAAC,CAAC,CAAC;IACJ,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAA8B,EACyB,EAAE,CACzD,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAsC,EAC0B,EAAE,CAClE,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,QAAyC,EACwB,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAsC,EAC0B,EAAE,CAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAsC,EAC0B,EAAE,CAClE,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,IAAqC,EAC4B,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAChC,MAAM,EACN,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAClF,4BAA4B,CAC7B,CAAC;IACF,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAAC,KAA0B,EAAuB,EAAE;IACjF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;qBACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;qBAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;iBAC3C,CAAC,CAAC;aACN,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,UAA2C,EAC6C,EAAE,CAC1F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAA8C,EAAE,CAAC;IACjE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CACnC,SAAS,CAAC,SAAS,EACnB,YAAY,EACZ,oBAAoB,CACrB,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAChC,SAAS,CAAC,MAAM,EAChB,YAAY,EACZ,wBAAwB,CACzB,CAAC;QACF,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,SAAS;YACZ,KAAK,EAAE,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC;YAC9C,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC;YAChD,SAAS;YACT,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,UAAU,EACV,CAAC,SAAS,EAAE,EAAE,CACZ,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAC5E,oBAAoB,CACrB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAgD,EAC2B,EAAE,CAC7E,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,SAA0C,EACuB,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAC9C,SAAS,CAAC,QAAQ,EAClB,YAAY,EACZ,wBAAwB,CACzB,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAC5C,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,uBAAuB,CACxB,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAC5C,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,uBAAuB,CACxB,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,wBAAwB,CAChD,SAAS,CAAC,UAAU,EACpB,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,EACtF,2BAA2B,CAC5B,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAoC,EACpC,KAAgD,EACe,EAAE,CACjE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,gCAAgC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,SAAmC,EACnC,KAAoC,EACpC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,OAAO;QACP,MAAM;QACN,KAAK;QACL,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/internal/authorization/install/plan.d.ts

@@ -0,0 +1,8 @@
+import * as Result from "effect/Result";
+import { type RuleAccessPlan } from "../catalog.ts";
+import type { CanonicalAuthorizationRule } from "../ir.ts";
+import type { InstalledPrincipalResolution } from "../principal.ts";
+import { type PreparedAuthorizationCatalog } from "../validation/catalog.ts";
+import { type ValidateFailure } from "../validation/common.ts";
+export declare const deriveRuleAccessPlan: (index: PreparedAuthorizationCatalog, rule: CanonicalAuthorizationRule, principal: InstalledPrincipalResolution) => Result.Result<RuleAccessPlan, ValidateFailure>;
+//# sourceMappingURL=plan.d.ts.map

package/dist/internal/authorization/install/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/install/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAIL,KAAK,4BAA4B,EAElC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AA6NxE,eAAO,MAAM,oBAAoB,UACxB,4BAA4B,QAC7B,0BAA0B,aACrB,4BAA4B,KACtC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,CA2B5C,CAAC"}

package/dist/internal/authorization/install/plan.js

@@ -0,0 +1,177 @@
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { canonicalizeJson } from "../canonical-json.js";
+import { RuleAccessLookup, } from "../catalog.js";
+import { fieldAccessibleFrom, ownerFocus, requireField, } from "../validation/catalog.js";
+import { invalid } from "../validation/common.js";
+import { rowFromRefTarget } from "../validation/types.js";
+import { meEntity, resourceFocus } from "../validation/traversal.js";
+const encodedJson = (encoded) => encoded;
+const encodeLookup = (lookup) => canonicalizeJson(encodedJson(Schema.encodeUnknownSync(RuleAccessLookup)(lookup)));
+const addLookup = (builder, lookup) => {
+    let key;
+    try {
+        key = encodeLookup(lookup);
+    }
+    catch (cause) {
+        return invalid(`ambiguous access-plan lookup: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    builder.seen.set(key, lookup);
+    return Result.succeed(undefined);
+};
+const addEntity = (builder, entity) => addLookup(builder, { _tag: "entity", entity });
+const addTrait = (builder, trait) => addLookup(builder, { _tag: "trait", trait });
+const addField = (builder, field) => addLookup(builder, { _tag: "field", field });
+const addIndex = (builder, field) => addLookup(builder, { _tag: "index", field });
+const addRefIndex = (builder, field) => addLookup(builder, { _tag: "refIndex", field });
+const addPrincipal = (builder, field) => addLookup(builder, { _tag: "principal", field });
+const addMembership = (builder, focus) => focus._tag === "entity" ? addEntity(builder, focus.entity) : addTrait(builder, focus.trait);
+const fieldLabel = (field) => `${field.owner.kind}:${field.owner.name}.${field.localName}`;
+const requireIndexed = (field) => {
+    if (field.index)
+        return Result.succeed(undefined);
+    return invalid(`unrepresentable index for field '${fieldLabel(field.id)}'`);
+};
+const addTerminalMembership = (builder, field) => {
+    if (field.valueType === "ref") {
+        return addRefIndex(builder, field.id);
+    }
+    return Result.gen(function* () {
+        yield* requireIndexed(field);
+        return yield* addIndex(builder, field.id);
+    });
+};
+const walkRef = (index, term, resource, me, use, builder) => {
+    let current;
+    switch (term.root._tag) {
+        case "resource":
+            current = resource;
+            break;
+        case "me":
+            if (me === undefined) {
+                return invalid("omitted principal-row fact for me traversal");
+            }
+            current = { _tag: "entity", entity: me };
+            break;
+    }
+    return Result.gen(function* () {
+        yield* addMembership(builder, current);
+        if (term.steps.length === 0)
+            return;
+        for (let i = 0; i < term.steps.length; i++) {
+            const step = term.steps[i];
+            const field = yield* requireField(index, step.field, "access-plan field");
+            if (!fieldAccessibleFrom(index, current, field)) {
+                return yield* invalid(`omitted field fact '${fieldLabel(step.field)}'`);
+            }
+            yield* addField(builder, field.id);
+            const isLast = i === term.steps.length - 1;
+            if (!isLast) {
+                if (field.cardinality === "many") {
+                    return yield* invalid("unrepresentable intermediate many-valued hop");
+                }
+                if (field.valueType !== "ref") {
+                    return yield* invalid(`unrepresentable non-ref hop through '${fieldLabel(step.field)}'`);
+                }
+                const next = yield* rowFromRefTarget(index, field.refTarget, field.id.owner);
+                if (next === undefined) {
+                    return yield* invalid(`omitted hop target for '${fieldLabel(step.field)}'`);
+                }
+                current = next;
+                yield* addMembership(builder, current);
+                continue;
+            }
+            if (field.cardinality === "many" && (use === "collection" || use === "presence")) {
+                yield* addTerminalMembership(builder, field);
+            }
+        }
+    });
+};
+const walkValue = (index, term, resource, me, use, builder) => {
+    switch (term._tag) {
+        case "ref":
+            return walkRef(index, term, resource, me, use, builder);
+        case "me":
+        case "lit":
+        case "subject":
+        case "claim":
+            return Result.succeed(undefined);
+    }
+};
+const walkExpr = (index, expr, resource, me, builder) => {
+    switch (expr._tag) {
+        case "const":
+        case "hasClass":
+            return Result.succeed(undefined);
+        case "and":
+        case "or":
+            return Result.gen(function* () {
+                for (const child of expr.exprs) {
+                    yield* walkExpr(index, child, resource, me, builder);
+                }
+            });
+        case "not":
+            return walkExpr(index, expr.expr, resource, me, builder);
+        case "eq":
+            return Result.gen(function* () {
+                yield* walkValue(index, expr.left, resource, me, "value", builder);
+                yield* walkValue(index, expr.right, resource, me, "value", builder);
+            });
+        case "has":
+            return walkValue(index, expr.term, resource, me, "presence", builder);
+        case "in":
+            return Result.gen(function* () {
+                yield* walkValue(index, expr.value, resource, me, "value", builder);
+                yield* walkValue(index, expr.collection, resource, me, "collection", builder);
+            });
+    }
+};
+const addPrincipalResolution = (index, principal, builder) => Result.gen(function* () {
+    if (principal.entity === undefined) {
+        return yield* invalid("omitted principal-row fact");
+    }
+    const field = yield* requireField(index, principal.entity, "principal field");
+    if (field.unique === undefined) {
+        return yield* invalid("unrepresentable principal-row resolution: field is not unique");
+    }
+    yield* requireIndexed(field);
+    const owner = yield* ownerFocus(index, field.id.owner);
+    yield* addMembership(builder, owner);
+    yield* addField(builder, field.id);
+    yield* addIndex(builder, field.id);
+    return yield* addPrincipal(builder, field.id);
+});
+const addFocusMembership = (index, rule, builder) => Result.gen(function* () {
+    const resource = yield* resourceFocus(index, rule.focus);
+    yield* addMembership(builder, resource);
+    if (rule.focus._tag === "field") {
+        yield* addField(builder, rule.focus.field);
+    }
+});
+export const deriveRuleAccessPlan = (index, rule, principal) => Result.gen(function* () {
+    const builder = { seen: new Map() };
+    const resource = yield* resourceFocus(index, rule.focus);
+    const me = yield* meEntity(index, principal);
+    if (rule.focus._tag === "operation") {
+    }
+    else if (rule.usesResource) {
+        yield* addFocusMembership(index, rule, builder);
+    }
+    else if (rule.focus._tag === "field") {
+        yield* addField(builder, rule.focus.field);
+        const owner = yield* ownerFocus(index, rule.focus.field.owner);
+        yield* addMembership(builder, owner);
+    }
+    else {
+        yield* addMembership(builder, resource);
+    }
+    yield* walkExpr(index, rule.expr, resource, me, builder);
+    if (rule.usesMe) {
+        yield* addPrincipalResolution(index, principal, builder);
+    }
+    const lookups = [...builder.seen.entries()]
+        .sort((left, right) => (left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0))
+        .map(([, lookup]) => lookup);
+    return { rule: rule.id, lookups };
+});
+//# sourceMappingURL=plan.js.map

package/dist/internal/authorization/install/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../../src/internal/authorization/install/plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,gBAAgB,GAGjB,MAAM,eAAe,CAAC;AAMvB,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,YAAY,GAGb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAwB,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAa,EAAE,CAAC,OAAoB,CAAC;AAE1E,MAAM,YAAY,GAAG,CAAC,MAAwB,EAAU,EAAE,CACxD,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAQpF,MAAM,SAAS,GAAG,CAChB,OAAoB,EACpB,MAAwB,EACc,EAAE;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CACZ,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,OAAoB,EAAE,MAAgB,EAAwC,EAAE,CACjG,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAEjD,MAAM,QAAQ,GAAG,CAAC,OAAoB,EAAE,KAAc,EAAwC,EAAE,CAC9F,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/C,MAAM,QAAQ,GAAG,CAAC,OAAoB,EAAE,KAAc,EAAwC,EAAE,CAC9F,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/C,MAAM,QAAQ,GAAG,CAAC,OAAoB,EAAE,KAAc,EAAwC,EAAE,CAC9F,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/C,MAAM,WAAW,GAAG,CAAC,OAAoB,EAAE,KAAc,EAAwC,EAAE,CACjG,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAElD,MAAM,YAAY,GAAG,CAAC,OAAoB,EAAE,KAAc,EAAwC,EAAE,CAClG,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAEnD,MAAM,aAAa,GAAG,CACpB,OAAoB,EACpB,KAAe,EACuB,EAAE,CACxC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAE9F,MAAM,UAAU,GAAG,CAAC,KAAc,EAAU,EAAE,CAC5C,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AAE/D,MAAM,cAAc,GAAG,CAAC,KAAsB,EAAwC,EAAE;IACtF,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,oCAAoC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,OAAoB,EACpB,KAAsB,EACgB,EAAE;IACxC,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CACd,KAAmC,EACnC,IAAsB,EACtB,QAAkB,EAClB,EAAwB,EACxB,GAAY,EACZ,OAAoB,EACkB,EAAE;IACxC,IAAI,OAAiB,CAAC;IACtB,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,GAAG,QAAQ,CAAC;YACnB,MAAM;QACR,KAAK,IAAI;YACP,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC,6CAA6C,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzC,MAAM;IACV,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YAC1E,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,uBAAuB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAEnC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;oBACjC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,wCAAwC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;gBACjF,KAAK,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,KAAmC,EACnC,IAAwB,EACxB,QAAkB,EAClB,EAAwB,EACxB,GAAY,EACZ,OAAoB,EACkB,EAAE;IACxC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CACf,KAAmC,EACnC,IAAgC,EAChC,QAAkB,EAClB,EAAwB,EACxB,OAAoB,EACkB,EAAE;IACxC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,KAAK,CAAC;QACX,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC/B,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3D,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACnE,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;QACL,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACxE,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpE,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAChF,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,KAAmC,EACnC,SAAuC,EACvC,OAAoB,EACkB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACvD,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,MAAM,kBAAkB,GAAG,CACzB,KAAmC,EACnC,IAAgC,EAChC,OAAoB,EACkB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,KAAmC,EACnC,IAAgC,EAChC,SAAuC,EACS,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;IACtC,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/D,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;SACxC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC,CAAC,CAAC"}