ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/ir.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AASzB,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,8BAA8B,EAAG,CAAU,CAAC;AACzD,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAC7D,eAAO,MAAM,kCAAkC,EAAG,CAAU,CAAC;AAE7D,eAAO,MAAM,uBAAuB,mBAA6C,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;AAE1E,eAAO,MAAM,2BAA2B,mBAAiD,CAAC;AAC1F,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAC;AAElF,eAAO,MAAM,+BAA+B,mBAAqD,CAAC;AAClG,MAAM,MAAM,+BAA+B,GAAG,OAAO,+BAA+B,CAAC,IAAI,CAAC;AAE1F,eAAO,MAAM,+BAA+B,mBAAqD,CAAC;AAClG,MAAM,MAAM,+BAA+B,GAAG,OAAO,+BAA+B,CAAC,IAAI,CAAC;AAE1F,eAAO,MAAM,SAAS,GACpB,MAAM,SAAS,MAAM,CAAC,GAAG,EACzB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,SAAS,SAAS,MAAM,CAAC,GAAG,OAEvB,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;;;;;;;;IAO1D,CAAC;AAEL,eAAO,MAAM,iBAAiB,GAC5B,MAAM,SAAS,MAAM,CAAC,GAAG,EACzB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,SAAS,SAAS,MAAM,CAAC,GAAG,EAC5B,IAAI,SAAS,MAAM,CAAC,GAAG,OAElB,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,QACtD,IAAI;;;;;;;;;;;;;;;;EAUR,CAAC;AAEL,eAAO,MAAM,QAAQ;;;EAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,MAAM,CAAC,GAAG,UAAU,MAAM;;;;;;EAInE,CAAC;AAEL,eAAO,MAAM,sBAAsB,GACjC,MAAM,SAAS,MAAM,CAAC,GAAG,EACzB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,KAAK,SAAS,MAAM,CAAC,GAAG,EACxB,SAAS,SAAS,MAAM,CAAC,GAAG,OAEvB,sBAAsB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO1D,CAAC;AAEL,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAC;AAE5D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;AAEpE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAC;AAEpF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAC;AAa5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe5C,CAAC;AACF,MAAM,MAAM,gCAAgC,GAC1C,OAAO,gCAAgC,CAAC,IAAI,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAC/D,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAE5C,eAAO,MAAM,oBAAoB;;;;;EAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;IAAqC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAC9D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAsC,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC;AAEhE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGrC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAC;AAC9E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAC;AAEhF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAkD,CAAC;AAC9F,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAC;AACxF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAmD,CAAC;AAChG,MAAM,MAAM,+BAA+B,GAAG,OAAO,+BAA+B,CAAC,IAAI,CAAC;AAE1F,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,aAAa,GAAG,kBAAkB,IAAI,CAAC,SAAS,mBAAmB,GAC/F,kBAAkB,GAClB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,aAAa,GAAG,kBAAkB,IAAI,CAAC,SAAS,mBAAmB,GACvG,0BAA0B,GAC1B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,aAAa,GAAG,kBAAkB,IAAI,CAAC,SAAS,mBAAmB,GAC5G,+BAA+B,GAC/B,8BAA8B,CAAC;AAEnC,MAAM,MAAM,aAAa,CAAC,MAAM,SAAS,MAAM,CAAC,GAAG,IAAI,UAAU,CAC/D,OAAO,aAAa,CAAC,MAAM,CAAC,CAC7B,CAAC,MAAM,CAAC,CAAC"}

package/dist/internal/authorization/ir.js

@@ -0,0 +1,131 @@
+import * as Schema from "effect/Schema";
+import { CatalogDescriptor, RuleAccessPlan } from "./catalog.js";
+import { CanonicalAuthorizationExpr, RelativeAuthorizationExpr } from "./expr.js";
+import { CanonicalIdentitySchemas, CatalogId, CatalogVersion, DatabaseId, PolicyHash, RelativeIdentitySchemas, RuleId, SchemaFingerprint, } from "./identities.js";
+import { ClaimVocabulary, ClassVocabulary, InstalledPrincipalResolution, PrincipalResolutionConfig, } from "./principal.js";
+import { AuthorizationLanguageVersion } from "./version.js";
+export const POLICY_TEMPLATE_IR_VERSION = 2;
+export const BOUND_AUTHORIZATION_IR_VERSION = 2;
+export const VALIDATED_AUTHORIZATION_IR_VERSION = 2;
+export const INSTALLED_AUTHORIZATION_IR_VERSION = 2;
+export const PolicyTemplateIRVersion = Schema.Literal(POLICY_TEMPLATE_IR_VERSION);
+export const BoundAuthorizationIRVersion = Schema.Literal(BOUND_AUTHORIZATION_IR_VERSION);
+export const ValidatedAuthorizationIRVersion = Schema.Literal(VALIDATED_AUTHORIZATION_IR_VERSION);
+export const InstalledAuthorizationIRVersion = Schema.Literal(INSTALLED_AUTHORIZATION_IR_VERSION);
+export const RuleFocus = (ids) => Schema.Union([
+    Schema.TaggedStruct("entity", { entity: ids.entity }),
+    Schema.TaggedStruct("trait", { trait: ids.trait }),
+    Schema.TaggedStruct("field", { field: ids.field }),
+    Schema.TaggedStruct("operation", { operation: ids.operation }),
+]);
+export const AuthorizationRule = (ids, expr) => Schema.Struct({
+    id: RuleId,
+    focus: RuleFocus(ids),
+    expr,
+    usesResource: Schema.Boolean,
+    usesMe: Schema.Boolean,
+    usesSubject: Schema.Boolean,
+    traversalDepth: Schema.Natural,
+});
+export const Decision = Schema.Struct({
+    allow: Schema.Array(RuleId),
+    deny: Schema.Array(RuleId),
+});
+export const DecisionEntry = (target) => Schema.Struct({
+    target,
+    decision: Decision,
+});
+export const AuthorizationDecisions = (ids) => Schema.Struct({
+    entities: Schema.Array(DecisionEntry(ids.entity)),
+    traits: Schema.Array(DecisionEntry(ids.trait)),
+    fields: Schema.Array(DecisionEntry(ids.field)),
+    operations: Schema.Array(DecisionEntry(ids.operation)),
+});
+export const PolicyTemplateIR = Schema.TaggedStruct("PolicyTemplateIR", {
+    version: PolicyTemplateIRVersion,
+    languageVersion: AuthorizationLanguageVersion,
+    classes: ClassVocabulary,
+    claims: ClaimVocabulary,
+    principal: PrincipalResolutionConfig,
+    rules: Schema.Array(AuthorizationRule(RelativeIdentitySchemas, RelativeAuthorizationExpr)),
+    decisions: AuthorizationDecisions(RelativeIdentitySchemas),
+});
+export const BoundAuthorizationIR = Schema.TaggedStruct("BoundAuthorizationIR", {
+    version: BoundAuthorizationIRVersion,
+    languageVersion: AuthorizationLanguageVersion,
+    database: DatabaseId,
+    catalog: CatalogId,
+    catalogVersion: CatalogVersion,
+    schemaFingerprint: SchemaFingerprint,
+    classes: ClassVocabulary,
+    claims: ClaimVocabulary,
+    principal: InstalledPrincipalResolution,
+    rules: Schema.Array(AuthorizationRule(CanonicalIdentitySchemas, CanonicalAuthorizationExpr)),
+    decisions: AuthorizationDecisions(CanonicalIdentitySchemas),
+});
+export const ValidatedAuthorizationIR = Schema.TaggedStruct("ValidatedAuthorizationIR", {
+    version: ValidatedAuthorizationIRVersion,
+    languageVersion: AuthorizationLanguageVersion,
+    database: DatabaseId,
+    catalog: CatalogId,
+    catalogVersion: CatalogVersion,
+    schemaFingerprint: SchemaFingerprint,
+    classes: ClassVocabulary,
+    claims: ClaimVocabulary,
+    principal: InstalledPrincipalResolution,
+    rules: Schema.Array(AuthorizationRule(CanonicalIdentitySchemas, CanonicalAuthorizationExpr)),
+    decisions: AuthorizationDecisions(CanonicalIdentitySchemas),
+});
+export const AuthorizationValidationInput = Schema.Struct({
+    bound: BoundAuthorizationIR,
+    descriptor: CatalogDescriptor,
+});
+export const InstalledAuthorizationIR = Schema.TaggedStruct("InstalledAuthorizationIR", {
+    version: InstalledAuthorizationIRVersion,
+    languageVersion: AuthorizationLanguageVersion,
+    policyHash: PolicyHash,
+    classes: ClassVocabulary,
+    claims: ClaimVocabulary,
+    principal: InstalledPrincipalResolution,
+    rules: Schema.Array(AuthorizationRule(CanonicalIdentitySchemas, CanonicalAuthorizationExpr)),
+    decisions: AuthorizationDecisions(CanonicalIdentitySchemas),
+    accessPlans: Schema.Array(RuleAccessPlan),
+});
+const LegacyCanonicalIdentitySchemasV1 = {
+    ...CanonicalIdentitySchemas,
+    operation: Schema.Never,
+};
+const LegacyAuthorizationDecisionsV1 = Schema.Struct({
+    entities: Schema.Array(DecisionEntry(CanonicalIdentitySchemas.entity)),
+    traits: Schema.Array(DecisionEntry(CanonicalIdentitySchemas.trait)),
+    fields: Schema.Array(DecisionEntry(CanonicalIdentitySchemas.field)),
+});
+export const LegacyInstalledAuthorizationIRV1 = Schema.TaggedStruct("InstalledAuthorizationIR", {
+    version: Schema.Literal(1),
+    languageVersion: AuthorizationLanguageVersion,
+    policyHash: PolicyHash,
+    classes: ClassVocabulary,
+    claims: ClaimVocabulary,
+    principal: InstalledPrincipalResolution,
+    rules: Schema.Array(AuthorizationRule(LegacyCanonicalIdentitySchemasV1, CanonicalAuthorizationExpr)),
+    decisions: LegacyAuthorizationDecisionsV1,
+    accessPlans: Schema.Array(RuleAccessPlan),
+});
+export const CatalogBindingTarget = Schema.Struct({
+    database: DatabaseId,
+    catalog: CatalogId,
+    catalogVersion: CatalogVersion,
+    schemaFingerprint: SchemaFingerprint,
+});
+export const CatalogBindingInput = Schema.Struct({
+    target: CatalogBindingTarget,
+    descriptor: CatalogDescriptor,
+    template: PolicyTemplateIR,
+});
+export const RelativeRuleFocus = RuleFocus(RelativeIdentitySchemas);
+export const CanonicalRuleFocus = RuleFocus(CanonicalIdentitySchemas);
+export const RelativeAuthorizationRule = AuthorizationRule(RelativeIdentitySchemas, RelativeAuthorizationExpr);
+export const CanonicalAuthorizationRule = AuthorizationRule(CanonicalIdentitySchemas, CanonicalAuthorizationExpr);
+export const RelativeAuthorizationDecisions = AuthorizationDecisions(RelativeIdentitySchemas);
+export const CanonicalAuthorizationDecisions = AuthorizationDecisions(CanonicalIdentitySchemas);
+//# sourceMappingURL=ir.js.map

package/dist/internal/authorization/ir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.js","sourceRoot":"","sources":["../../../src/internal/authorization/ir.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,uBAAuB,EACvB,MAAM,EACN,iBAAiB,GAKlB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,eAAe,EACf,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AACrD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AACzD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAU,CAAC;AAC7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAU,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAGlF,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAG1F,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,SAAS,GAAG,CAMvB,GAA4D,EAC5D,EAAE,CACF,MAAM,CAAC,KAAK,CAAC;IACX,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACrD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAClD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAClD,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;CAC/D,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAO/B,GAA4D,EAC5D,IAAU,EACV,EAAE,CACF,MAAM,CAAC,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC;IACrB,IAAI;IACJ,YAAY,EAAE,MAAM,CAAC,OAAO;IAC5B,MAAM,EAAE,MAAM,CAAC,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC,OAAO;IAC3B,cAAc,EAAE,MAAM,CAAC,OAAO;CAC/B,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAA4B,MAAc,EAAE,EAAE,CACzE,MAAM,CAAC,MAAM,CAAC;IACZ,MAAM;IACN,QAAQ,EAAE,QAAQ;CACnB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAMpC,GAA4D,EAC5D,EAAE,CACF,MAAM,CAAC,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;CACvD,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,kBAAkB,EAAE;IACtE,OAAO,EAAE,uBAAuB;IAChC,eAAe,EAAE,4BAA4B;IAC7C,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,yBAAyB;IACpC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;IAC1F,SAAS,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,sBAAsB,EAAE;IAC9E,OAAO,EAAE,2BAA2B;IACpC,eAAe,EAAE,4BAA4B;IAC7C,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,cAAc;IAC9B,iBAAiB,EAAE,iBAAiB;IACpC,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,4BAA4B;IACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IAC5F,SAAS,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;CAC5D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE;IACtF,OAAO,EAAE,+BAA+B;IACxC,eAAe,EAAE,4BAA4B;IAC7C,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,cAAc;IAC9B,iBAAiB,EAAE,iBAAiB;IACpC,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,4BAA4B;IACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IAC5F,SAAS,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;CAC5D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,KAAK,EAAE,oBAAoB;IAC3B,UAAU,EAAE,iBAAiB;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,YAAY,CAAC,0BAA0B,EAAE;IACtF,OAAO,EAAE,+BAA+B;IACxC,eAAe,EAAE,4BAA4B;IAC7C,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,4BAA4B;IACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC;IAC5F,SAAS,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;IAC3D,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CAC1C,CAAC,CAAC;AAGH,MAAM,gCAAgC,GAAG;IACvC,GAAG,wBAAwB;IAC3B,SAAS,EAAE,MAAM,CAAC,KAAK;CACxB,CAAC;AAEF,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,YAAY,CACjE,0BAA0B,EAC1B;IACE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,4BAA4B;IAC7C,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,4BAA4B;IACvC,KAAK,EAAE,MAAM,CAAC,KAAK,CACjB,iBAAiB,CAAC,gCAAgC,EAAE,0BAA0B,CAAC,CAChF;IACD,SAAS,EAAE,8BAA8B;IACzC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;CAC1C,CACF,CAAC;AAOF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,cAAc;IAC9B,iBAAiB,EAAE,iBAAiB;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,oBAAoB;IAC5B,UAAU,EAAE,iBAAiB;IAC7B,QAAQ,EAAE,gBAAgB;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC,wBAAwB,CAAC,CAAC;AAGtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CACxD,uBAAuB,EACvB,yBAAyB,CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CACzD,wBAAwB,EACxB,0BAA0B,CAC3B,CAAC;AAGF,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;AAE9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,sBAAsB,CAAC,wBAAwB,CAAC,CAAC"}

package/dist/internal/authorization/json.d.ts

@@ -0,0 +1,8 @@
+import * as Schema from "effect/Schema";
+export declare const JsonScalar: Schema.Union<readonly [Schema.String, Schema.Finite, Schema.Boolean, Schema.Null]>;
+export type JsonScalar = typeof JsonScalar.Type;
+export type JsonValue = JsonScalar | ReadonlyArray<JsonValue> | {
+    readonly [key: string]: JsonValue;
+};
+export declare const JsonValue: Schema.Codec<JsonValue>;
+//# sourceMappingURL=json.d.ts.map

package/dist/internal/authorization/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,UAAU,oFAKrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;AAEhD,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,aAAa,CAAC,SAAS,CAAC,GACxB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1C,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAM7C,CAAC"}

package/dist/internal/authorization/json.js

@@ -0,0 +1,13 @@
+import * as Schema from "effect/Schema";
+export const JsonScalar = Schema.Union([
+    Schema.String,
+    Schema.Finite,
+    Schema.Boolean,
+    Schema.Null,
+]);
+export const JsonValue = Schema.suspend(() => Schema.Union([
+    JsonScalar,
+    Schema.Array(JsonValue),
+    Schema.Record(Schema.String, JsonValue),
+]));
+//# sourceMappingURL=json.js.map

package/dist/internal/authorization/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/internal/authorization/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM;IACb,MAAM,CAAC,MAAM;IACb,MAAM,CAAC,OAAO;IACd,MAAM,CAAC,IAAI;CACZ,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,SAAS,GAA4B,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACpE,MAAM,CAAC,KAAK,CAAC;IACX,UAAU;IACV,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;CACxC,CAAC,CACH,CAAC"}

package/dist/internal/authorization/live.d.ts

@@ -0,0 +1,38 @@
+import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Queue from "effect/Queue";
+import * as Stream from "effect/Stream";
+import { Unauthorized } from "../../db/Errors.ts";
+import type { Db } from "../core/db.ts";
+import type { RuntimeBoundaries } from "../runtime-boundaries.ts";
+import { type AuthenticatedCaller, type AuthorizedRequestInput } from "./request.ts";
+import { OneShotReadError, type OneShotRead, type OneShotReadOptions } from "./reads.ts";
+export type LiveQueryDiff = {
+    readonly added: readonly unknown[];
+    readonly retracted: readonly unknown[];
+};
+export type LiveBasisEvent = "ready" | "change";
+export type AuthorizedLiveControls<R = never> = {
+    readonly previous?: unknown;
+    readonly wakes?: Queue.Dequeue<unknown>;
+    readonly revoked?: Deferred.Deferred<void>;
+    readonly renew?: Effect.Effect<void, Unauthorized, R>;
+    readonly basisChanges?: Stream.Stream<LiveBasisEvent, Unauthorized, R>;
+    readonly invalidations?: Stream.Stream<unknown, Unauthorized, R>;
+    readonly boundaries?: RuntimeBoundaries;
+};
+export type AuthorizedLiveInput<R = never, EDb = unknown> = AuthorizedRequestInput<R, EDb> & AuthorizedLiveControls<R>;
+export type AuthorizedLiveLeaseInput<R = never, EAuthorize = unknown> = AuthorizedLiveControls<R> & {
+    readonly authenticate: Effect.Effect<AuthenticatedCaller, Unauthorized, R>;
+    readonly interruptAfter?: Duration.Input;
+    readonly authorize: (caller: AuthenticatedCaller) => Effect.Effect<Db, Unauthorized | EAuthorize, R>;
+    readonly reauthorizeOnIdle?: boolean;
+};
+export declare const liveResultRows: (value: unknown) => readonly unknown[];
+export declare const isSilentLiveDiff: (diff: LiveQueryDiff) => boolean;
+export declare const diffAuthorizedResults: (previous: unknown, next: unknown) => LiveQueryDiff;
+export declare const liveDiffFromPrevious: (previous: unknown | undefined, next: unknown) => LiveQueryDiff;
+export declare const executeAuthorizedLiveLease: <R, EAuthorize = unknown>(input: AuthorizedLiveLeaseInput<R, EAuthorize>, read: OneShotRead, opts?: OneShotReadOptions) => Stream.Stream<LiveQueryDiff, Unauthorized | OneShotReadError | EAuthorize, R>;
+export declare const executeAuthorizedLive: <R, EDb = unknown>(input: AuthorizedLiveInput<R, EDb>, read: OneShotRead, opts?: OneShotReadOptions) => Stream.Stream<LiveQueryDiff, Unauthorized | OneShotReadError | EDb, R>;
+//# sourceMappingURL=live.d.ts.map

package/dist/internal/authorization/live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/live.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAEhB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAOpB,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,sBAAsB,CAAC,CAAC,GAAG,KAAK,IAAI;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACvE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,GAAG,OAAO,IACtD,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;AAE7D,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,KAAK,EAAE,UAAU,GAAG,OAAO,IAClE,sBAAsB,CAAC,CAAC,CAAC,GAAG;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,CAClB,MAAM,EAAE,mBAAmB,KACxB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC,CAAC;AA8CJ,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,SAAS,OAAO,EAG/D,CAAC;AAEF,eAAO,MAAM,gBAAgB,SAAU,aAAa,KAAG,OACC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,aAAc,OAAO,QAAQ,OAAO,KAAG,aA8CxE,CAAC;AAEF,eAAO,MAAM,oBAAoB,aACrB,OAAO,GAAG,SAAS,QACvB,OAAO,KACZ,aAC8G,CAAC;AAoDlH,eAAO,MAAM,0BAA0B,GAAI,CAAC,EAAE,UAAU,GAAG,OAAO,SACzD,wBAAwB,CAAC,CAAC,EAAE,UAAU,CAAC,QACxC,WAAW,SACX,kBAAkB,KACvB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,GAAG,gBAAgB,GAAG,UAAU,EAAE,CAAC,CA0J9B,CAAC;AAElD,eAAO,MAAM,qBAAqB,GAAI,CAAC,EAAE,GAAG,GAAG,OAAO,SAC7C,mBAAmB,CAAC,CAAC,EAAE,GAAG,CAAC,QAC5B,WAAW,SACX,kBAAkB,KACvB,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,GAAG,gBAAgB,GAAG,GAAG,EAAE,CAAC,CAMxD,CAAC"}

package/dist/internal/authorization/live.js

@@ -0,0 +1,227 @@
+import * as Clock from "effect/Clock";
+import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Queue from "effect/Queue";
+import * as Ref from "effect/Ref";
+import * as Result from "effect/Result";
+import * as Stream from "effect/Stream";
+import { Unauthorized } from "../../db/Errors.js";
+import { stringifyJson } from "../core/json.js";
+import { MAX_READ_LEASE_MS } from "./bounds.js";
+import { constructAuthorizedRequestContext, } from "./request.js";
+import { OneShotReadError, runOneShotRead, } from "./reads.js";
+const deny = () => new Unauthorized({});
+const ABSENT = Symbol("ramose/live/absent");
+const leaseLimit = (interruptAfter) => Duration.min(Duration.fromInputUnsafe(interruptAfter ?? MAX_READ_LEASE_MS), Duration.millis(MAX_READ_LEASE_MS));
+const callerLease = (caller, nowMs, limit) => {
+    if (!Number.isSafeInteger(caller.exp))
+        return Result.fail(deny());
+    const remainingMs = caller.exp * 1_000 - nowMs;
+    if (remainingMs <= 0)
+        return Result.fail(deny());
+    const duration = Duration.min(limit, Duration.millis(remainingMs));
+    return Result.succeed({ duration, expiresAtMs: nowMs + Duration.toMillis(duration) });
+};
+const principalLeaseIdentity = (caller) => stringifyJson({
+    claims: caller.claims,
+    classes: [...caller.classes].sort(),
+});
+const atBoundary = (boundaries, name) => boundaries === undefined
+    ? Effect.void
+    : Effect.tryPromise({
+        try: () => boundaries.checkpoint(name),
+        catch: () => deny(),
+    });
+export const liveResultRows = (value) => {
+    if (value === null || value === undefined)
+        return [];
+    return Array.isArray(value) ? value : [value];
+};
+export const isSilentLiveDiff = (diff) => diff.added.length === 0 && diff.retracted.length === 0;
+export const diffAuthorizedResults = (previous, next) => {
+    const prevRows = liveResultRows(previous);
+    const nextRows = liveResultRows(next);
+    const prevCounts = new Map();
+    const nextCounts = new Map();
+    for (const row of prevRows) {
+        const key = stringifyJson(row);
+        prevCounts.set(key, (prevCounts.get(key) ?? 0) + 1);
+    }
+    for (const row of nextRows) {
+        const key = stringifyJson(row);
+        nextCounts.set(key, (nextCounts.get(key) ?? 0) + 1);
+    }
+    const added = [];
+    const retracted = [];
+    const remainingPrev = new Map(prevCounts);
+    for (const row of nextRows) {
+        const key = stringifyJson(row);
+        const remaining = remainingPrev.get(key) ?? 0;
+        if (remaining === 0)
+            added.push(row);
+        else
+            remainingPrev.set(key, remaining - 1);
+    }
+    const remainingNext = new Map(nextCounts);
+    for (const row of prevRows) {
+        const key = stringifyJson(row);
+        const remaining = remainingNext.get(key) ?? 0;
+        if (remaining === 0)
+            retracted.push(row);
+        else
+            remainingNext.set(key, remaining - 1);
+    }
+    const reconstructed = [...prevRows];
+    for (const row of retracted) {
+        const key = stringifyJson(row);
+        const index = reconstructed.findIndex((candidate) => stringifyJson(candidate) === key);
+        if (index !== -1)
+            reconstructed.splice(index, 1);
+    }
+    reconstructed.push(...added);
+    const reconstructedOrder = reconstructed.map(stringifyJson);
+    const nextOrder = nextRows.map(stringifyJson);
+    if (reconstructedOrder.length !== nextOrder.length ||
+        reconstructedOrder.some((key, index) => key !== nextOrder[index])) {
+        return { added: nextRows, retracted: prevRows };
+    }
+    return { added, retracted };
+};
+export const liveDiffFromPrevious = (previous, next) => previous === undefined ? { added: liveResultRows(next), retracted: [] } : diffAuthorizedResults(previous, next);
+const remainingOf = (expiresAtMs, nowMs) => Duration.millis(Math.max(0, expiresAtMs - nowMs));
+const waitWakeOrLease = (wakes, remaining) => {
+    if (Duration.toMillis(remaining) <= 0)
+        return Effect.succeed(false);
+    return Effect.race(Queue.take(wakes).pipe(Effect.as(true)), Effect.sleep(remaining).pipe(Effect.as(false)));
+};
+const readAuthorized = (db, read, opts) => Effect.tryPromise({
+    try: () => runOneShotRead(db, read, opts),
+    catch: (cause) => new OneShotReadError({ cause }),
+});
+const deliverSnapshot = (item) => Effect.gen(function* () {
+    yield* atBoundary(item.boundaries, "live.emit");
+    const nowMs = yield* Clock.currentTimeMillis;
+    const current = yield* Ref.get(item.epoch);
+    if (item.id !== current || nowMs >= item.expiresAtMs)
+        return Result.fail(undefined);
+    const sent = yield* Ref.get(item.lastSent);
+    const initial = sent === ABSENT;
+    const diff = initial
+        ? liveDiffFromPrevious(undefined, item.value)
+        : diffAuthorizedResults(sent, item.value);
+    if (!initial && isSilentLiveDiff(diff)) {
+        yield* Ref.set(item.lastSent, item.value);
+        return Result.fail(undefined);
+    }
+    const still = yield* Ref.get(item.epoch);
+    const again = yield* Clock.currentTimeMillis;
+    if (still !== item.id || again >= item.expiresAtMs)
+        return Result.fail(undefined);
+    yield* Ref.set(item.lastSent, item.value);
+    return Result.succeed(diff);
+});
+export const executeAuthorizedLiveLease = (input, read, opts = {}) => Stream.callback((out) => Effect.gen(function* () {
+    const wakes = yield* Queue.dropping(1);
+    const basisReady = yield* Deferred.make();
+    const epoch = yield* Ref.make(0);
+    const lastSent = yield* Ref.make(input.previous === undefined ? ABSENT : input.previous);
+    const limit = leaseLimit(input.interruptAfter);
+    const invalidate = Ref.update(epoch, (id) => id + 1);
+    const signalBasisChange = invalidate.pipe(Effect.andThen(Queue.offer(wakes, undefined)), Effect.asVoid);
+    if (input.wakes !== undefined) {
+        const external = input.wakes;
+        yield* Effect.forkChild(Effect.forever(Queue.take(external).pipe(Effect.andThen(signalBasisChange))));
+    }
+    const revoked = input.revoked === undefined
+        ? Effect.never
+        : Deferred.await(input.revoked).pipe(Effect.andThen(invalidate), Effect.andThen(Effect.fail(deny())));
+    const close = Queue.end(out).pipe(Effect.asVoid);
+    const recompute = (filteredDb, id, expiresAtMs) => Effect.gen(function* () {
+        const nowMs = yield* Clock.currentTimeMillis;
+        if (nowMs >= expiresAtMs)
+            return;
+        const value = yield* readAuthorized(filteredDb, read, opts);
+        yield* atBoundary(input.boundaries, "live.recompute");
+        const current = yield* Ref.get(epoch);
+        if (current !== id)
+            return;
+        yield* atBoundary(input.boundaries, "live.enqueue");
+        const still = yield* Ref.get(epoch);
+        const enqueueNow = yield* Clock.currentTimeMillis;
+        if (still !== id || enqueueNow >= expiresAtMs)
+            return;
+        yield* Queue.offer(out, {
+            id,
+            expiresAtMs,
+            value,
+            epoch,
+            lastSent,
+            ...(input.boundaries === undefined
+                ? {}
+                : { boundaries: input.boundaries }),
+        });
+    });
+    const leaseLoop = Effect.gen(function* () {
+        let firstLease = true;
+        let basisChanged = true;
+        let principalIdentity;
+        while (true) {
+            if (!firstLease && input.renew !== undefined) {
+                const currentDeployment = yield* input.renew.pipe(Effect.mapError(() => deny()), Effect.result);
+                if (Result.isFailure(currentDeployment))
+                    return;
+            }
+            const admitted = yield* input.authenticate.pipe(Effect.mapError(() => deny()), Effect.result);
+            if (Result.isFailure(admitted))
+                return;
+            const caller = admitted.success;
+            const identity = principalLeaseIdentity(caller);
+            if (principalIdentity === undefined)
+                principalIdentity = identity;
+            else if (principalIdentity !== identity)
+                return;
+            const nowMs = yield* Clock.currentTimeMillis;
+            const lease = yield* Effect.fromResult(callerLease(caller, nowMs, limit));
+            const id = yield* Ref.updateAndGet(epoch, (n) => n + 1);
+            const tickNow = yield* Clock.currentTimeMillis;
+            if (tickNow < lease.expiresAtMs &&
+                (basisChanged || input.reauthorizeOnIdle === true)) {
+                const leaseWork = input.authorize(caller).pipe(Effect.flatMap((filteredDb) => basisChanged
+                    ? recompute(filteredDb, id, lease.expiresAtMs)
+                    : Effect.void), Effect.timeoutOrElse({
+                    duration: remainingOf(lease.expiresAtMs, tickNow),
+                    orElse: () => Effect.fail(deny()),
+                }), Effect.result);
+                if (Result.isFailure(yield* leaseWork))
+                    return;
+            }
+            const after = yield* Clock.currentTimeMillis;
+            basisChanged = after < lease.expiresAtMs
+                ? yield* waitWakeOrLease(wakes, remainingOf(lease.expiresAtMs, after))
+                : false;
+            yield* invalidate;
+            firstLease = false;
+        }
+    });
+    const basisWatch = input.basisChanges === undefined
+        ? Effect.never
+        : Stream.runForEach(input.basisChanges, (event) => event === "ready"
+            ? Deferred.succeed(basisReady, undefined).pipe(Effect.asVoid)
+            : Deferred.succeed(basisReady, undefined).pipe(Effect.andThen(signalBasisChange), Effect.asVoid)).pipe(Effect.mapError(() => deny()), Effect.andThen(Effect.fail(deny())));
+    const leaseAndBasis = input.basisChanges === undefined
+        ? Effect.raceFirst(leaseLoop, revoked)
+        : Effect.raceFirst(basisWatch, Deferred.await(basisReady).pipe(Effect.andThen(Effect.raceFirst(leaseLoop, revoked))));
+    const invalidationWatch = input.invalidations === undefined
+        ? Effect.never
+        : Stream.runForEach(input.invalidations, () => signalBasisChange).pipe(Effect.mapError(() => deny()), Effect.andThen(Effect.fail(deny())));
+    const authorizedLoop = input.invalidations === undefined
+        ? leaseAndBasis
+        : Effect.raceFirst(leaseAndBasis, invalidationWatch);
+    yield* authorizedLoop.pipe(Effect.result, Effect.andThen(invalidate), Effect.andThen(close), Effect.onInterrupt(() => invalidate.pipe(Effect.andThen(Queue.shutdown(out)), Effect.asVoid)));
+}), { bufferSize: 1, strategy: "suspend" }).pipe(Stream.filterMapEffect(deliverSnapshot));
+export const executeAuthorizedLive = (input, read, opts = {}) => executeAuthorizedLiveLease({
+    ...input,
+    authorize: (caller) => constructAuthorizedRequestContext(input, caller).pipe(Effect.map((context) => context.filteredDb)),
+}, read, opts);
+//# sourceMappingURL=live.js.map

package/dist/internal/authorization/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/internal/authorization/live.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,YAAY,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,iCAAiC,GAGlC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,gBAAgB,EAChB,cAAc,GAGf,MAAM,YAAY,CAAC;AAEpB,MAAM,IAAI,GAAG,GAAiB,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,GAAkB,MAAM,CAAC,oBAAoB,CAAC,CAAC;AA0C3D,MAAM,UAAU,GAAG,CAAC,cAA0C,EAAqB,EAAE,CACnF,QAAQ,CAAC,GAAG,CACV,QAAQ,CAAC,eAAe,CAAC,cAAc,IAAI,iBAAiB,CAAC,EAC7D,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CACnC,CAAC;AAEJ,MAAM,WAAW,GAAG,CAClB,MAA2B,EAC3B,KAAa,EACb,KAAwB,EAC6E,EAAE;IACvG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC;IAC/C,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,MAA2B,EAAU,EAAE,CACrE,aAAa,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;CACpC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,CACjB,UAAyC,EACzC,IAAY,EACuB,EAAE,CACrC,UAAU,KAAK,SAAS;IACtB,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAChB,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QACtC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;KACpB,CAAC,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAsB,EAAE;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAmB,EAAW,EAAE,CAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAiB,EAAE,IAAa,EAAiB,EAAE;IACvF,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAc,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAChC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC;QACvF,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7B,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IACE,kBAAkB,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC9C,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EACjE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAA6B,EAC7B,IAAa,EACE,EAAE,CACjB,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAElH,MAAM,WAAW,GAAG,CAAC,WAAmB,EAAE,KAAa,EAAqB,EAAE,CAC5E,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC;AAEpD,MAAM,eAAe,GAAG,CACtB,KAA6B,EAC7B,SAA4B,EACJ,EAAE;IAC1B,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,IAAI,CAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAC/C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,EAAwC,EACxC,IAAiB,EACjB,IAAwB,EACkB,EAAE,CAC5C,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;IACzC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC;CAClD,CAAC,CAAC;AAEL,MAAM,eAAe,GAAG,CACtB,IAAoB,EAC6C,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC7C,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,KAA8C,EAC9C,IAAiB,EACjB,IAAI,GAAuB,EAAE,EACkD,EAAE,CACjF,MAAM,CAAC,QAAQ,CACb,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAC9B,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CACvD,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,UAAU,CAAC,IAAI,CACvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAC7C,MAAM,CAAC,MAAM,CACd,CAAC;IAEF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1G,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,CAChB,UAAc,EACd,EAAU,EACV,WAAmB,EACsC,EAAE,CAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC7C,IAAI,KAAK,IAAI,WAAW;YAAE,OAAO;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO;QAC3B,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAClD,IAAI,KAAK,KAAK,EAAE,IAAI,UAAU,IAAI,WAAW;YAAE,OAAO;QACtD,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;YACtB,EAAE;YACF,WAAW;YACX,KAAK;YACL,KAAK;YACL,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpC,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,YAAY,GAAG,IAAI,CAAC;QACxB,IAAI,iBAAqC,CAAC;QAC1C,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAC/C,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAC7B,MAAM,CAAC,MAAM,CACd,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC;oBAAE,OAAO;YAClD,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAC7B,MAAM,CAAC,MAAM,CACd,CAAC;YACF,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO;YACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;YAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,iBAAiB,KAAK,SAAS;gBAAE,iBAAiB,GAAG,QAAQ,CAAC;iBAC7D,IAAI,iBAAiB,KAAK,QAAQ;gBAAE,OAAO;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC/C,IACE,OAAO,GAAG,KAAK,CAAC,WAAW;gBAC3B,CAAC,YAAY,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,EAClD,CAAC;gBACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,YAAY;oBACV,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,EACD,MAAM,CAAC,aAAa,CAAC;oBACnB,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;oBACjD,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAClC,CAAC,EACF,MAAM,CAAC,MAAM,CACd,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;oBAAE,OAAO;YACjD,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC7C,YAAY,GAAG,KAAK,GAAG,KAAK,CAAC,WAAW;gBACtC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CACtB,KAAK,EACL,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CACtC;gBACD,CAAC,CAAC,KAAK,CAAC;YACV,KAAK,CAAC,CAAC,UAAU,CAAC;YAClB,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS;QACjD,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAChD,KAAK,KAAK,OAAO;YACf,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7D,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EACjC,MAAM,CAAC,MAAM,CACd,CAAC,CAAC,IAAI,CACX,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;IACJ,MAAM,aAAa,GAAG,KAAK,CAAC,YAAY,KAAK,SAAS;QACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,SAAS,CAChB,UAAU,EACV,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CACrD,CACF,CAAC;IACJ,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS;QACzD,CAAC,CAAC,MAAM,CAAC,KAAK;QACd,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;IACJ,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS;QACtD,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAEvD,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CACxB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACnC,MAAM,CAAC,MAAM,CACd,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,EACJ,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CACvC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAkC,EAClC,IAAiB,EACjB,IAAI,GAAuB,EAAE,EAC2C,EAAE,CAC1E,0BAA0B,CAAC;IACzB,GAAG,KAAK;IACR,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iCAAiC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAC5C;CACF,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC"}

package/dist/internal/authorization/operation-grant.d.ts

@@ -0,0 +1,16 @@
+import type { OperationDescriptor } from "./catalog.ts";
+import type { CanonicalValueTerm } from "./expr.ts";
+import type { InstalledCatalogUnitV2 } from "./catalog-unit.ts";
+import type { AuthenticatedCaller } from "./request.ts";
+export type PrincipalProjection = {
+    readonly _tag: "present";
+    readonly value: unknown;
+} | {
+    readonly _tag: "absent";
+} | {
+    readonly _tag: "invalid";
+};
+export declare const principalValuesEqual: (left: unknown, right: unknown) => boolean;
+export declare const projectPrincipalTerm: (term: CanonicalValueTerm, caller: AuthenticatedCaller, subject: string) => PrincipalProjection;
+export declare const operationGrantAllows: (unit: InstalledCatalogUnitV2, descriptor: OperationDescriptor, caller: AuthenticatedCaller, subject: string) => boolean;
+//# sourceMappingURL=operation-grant.d.ts.map

package/dist/internal/authorization/operation-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-grant.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/operation-grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AASjC,eAAO,MAAM,oBAAoB,SAAU,OAAO,SAAS,OAAO,KAAG,OAMpE,CAAC;AAEF,eAAO,MAAM,oBAAoB,SACzB,kBAAkB,UAChB,mBAAmB,WAClB,MAAM,KACd,mBAcF,CAAC;AAuCF,eAAO,MAAM,oBAAoB,SACzB,sBAAsB,cAChB,mBAAmB,UACvB,mBAAmB,WAClB,MAAM,KACd,OAeF,CAAC"}

package/dist/internal/authorization/operation-grant.js

@@ -0,0 +1,79 @@
+import { operationKey } from "./validation/common.js";
+const absent = { _tag: "absent" };
+const invalid = { _tag: "invalid" };
+const present = (value) => ({
+    _tag: "present",
+    value,
+});
+export const principalValuesEqual = (left, right) => {
+    if (Object.is(left, right))
+        return true;
+    if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) {
+        return false;
+    }
+    return left.every((value, index) => Object.is(value, right[index]));
+};
+export const projectPrincipalTerm = (term, caller, subject) => {
+    switch (term._tag) {
+        case "lit":
+            return present(term.value);
+        case "subject":
+            return present(subject);
+        case "claim":
+            return Object.hasOwn(caller.claims, term.key)
+                ? present(caller.claims[term.key])
+                : absent;
+        case "me":
+        case "ref":
+            return invalid;
+    }
+};
+const equal = principalValuesEqual;
+const project = projectPrincipalTerm;
+const evaluate = (expr, caller, subject) => {
+    switch (expr._tag) {
+        case "const":
+            return expr.value;
+        case "hasClass":
+            return caller.classes.includes(expr.class);
+        case "and":
+            return expr.exprs.every((part) => evaluate(part, caller, subject));
+        case "or":
+            return expr.exprs.some((part) => evaluate(part, caller, subject));
+        case "not":
+            return !evaluate(expr.expr, caller, subject);
+        case "eq": {
+            const left = project(expr.left, caller, subject);
+            const right = project(expr.right, caller, subject);
+            return left._tag === "present" && right._tag === "present" &&
+                equal(left.value, right.value);
+        }
+        case "has":
+            return project(expr.term, caller, subject)._tag === "present";
+        case "in": {
+            const value = project(expr.value, caller, subject);
+            const collection = project(expr.collection, caller, subject);
+            return value._tag === "present" && collection._tag === "present" &&
+                Array.isArray(collection.value) &&
+                collection.value.some((item) => equal(value.value, item));
+        }
+    }
+};
+export const operationGrantAllows = (unit, descriptor, caller, subject) => {
+    const decision = unit.policy.decisions.operations.find((entry) => operationKey(entry.target) === operationKey(descriptor.id))?.decision;
+    if (decision === undefined)
+        return false;
+    const rules = new Map(unit.policy.rules.map((rule) => [rule.id, rule]));
+    for (const id of decision.deny) {
+        const rule = rules.get(id);
+        if (rule === undefined || evaluate(rule.expr, caller, subject))
+            return false;
+    }
+    for (const id of decision.allow) {
+        const rule = rules.get(id);
+        if (rule !== undefined && evaluate(rule.expr, caller, subject))
+            return true;
+    }
+    return false;
+};
+//# sourceMappingURL=operation-grant.js.map

package/dist/internal/authorization/operation-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-grant.js","sourceRoot":"","sources":["../../../src/internal/authorization/operation-grant.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAOtD,MAAM,MAAM,GAAwB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACvD,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAuB,EAAE,CAAC,CAAC;IACxD,IAAI,EAAE,SAAS;IACf,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAa,EAAE,KAAc,EAAW,EAAE;IAC7E,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAwB,EACxB,MAA2B,EAC3B,OAAe,EACM,EAAE;IACvB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;gBAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,MAAM,OAAO,GAAG,oBAAoB,CAAC;AAErC,MAAM,QAAQ,GAAG,CACf,IAAgC,EAChC,MAA2B,EAC3B,OAAe,EACN,EAAE;IACX,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,KAAK,KAAK;YACR,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,KAAK,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;QAChE,KAAK,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;gBAC9D,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC/B,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAA4B,EAC5B,UAA+B,EAC/B,MAA2B,EAC3B,OAAe,EACN,EAAE;IACX,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC,CACtE,EAAE,QAAQ,CAAC;IACZ,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAU,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/internal/authorization/operation-version.d.ts

@@ -0,0 +1,28 @@
+import * as Effect from "effect/Effect";
+import type { AllocationSlots } from "../../db/allocations.ts";
+import type { OperationInputShape } from "./catalog.ts";
+import { type CatalogId, type OperationTarget, type OwnerRef } from "./identities.ts";
+import type { JsonValue } from "./json.ts";
+export declare const OPERATION_VERSION_DESCRIPTOR_VERSION: 2;
+export declare const DEFAULT_OPERATION_REVISION = 1;
+export type OperationContractMaterial = {
+    readonly representation: JsonValue;
+    readonly shape: OperationInputShape;
+};
+export type OperationVersionDescriptor = {
+    readonly catalog: CatalogId;
+    readonly owner: OwnerRef;
+    readonly localName: string;
+    readonly target: OperationTarget;
+    readonly revision: number;
+    readonly input: OperationContractMaterial;
+    readonly output: OperationContractMaterial;
+    readonly composers: readonly string[];
+    readonly writes: readonly string[];
+    readonly allocations: AllocationSlots;
+};
+export declare const requireOperationRevision: (value: unknown, label: string) => number;
+export declare const normalizeContractRepresentation: (representation: JsonValue) => JsonValue;
+export declare const operationVersionMaterial: (descriptor: OperationVersionDescriptor) => JsonValue;
+export declare const hashOperationVersion: (descriptor: OperationVersionDescriptor) => Effect.Effect<string & import("effect/Brand").Brand<"OperationVersion">, import("./failures.ts").InvalidIR, never>;
+//# sourceMappingURL=operation-version.d.ts.map

package/dist/internal/authorization/operation-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-version.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/operation-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAI3C,eAAO,MAAM,oCAAoC,EAAG,CAAU,CAAC;AAE/D,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC,CAAC;AAEF,eAAO,MAAM,wBAAwB,UAC5B,OAAO,SACP,MAAM,KACZ,MAQF,CAAC;AAqJF,eAAO,MAAM,+BAA+B,mBAC1B,SAAS,KACxB,SAwBF,CAAC;AAEF,eAAO,MAAM,wBAAwB,eACvB,0BAA0B,KACrC,SAiCD,CAAC;AAEH,eAAO,MAAM,oBAAoB,gKAQhC,CAAC"}