Guard / foldkit-guard

Mental model

shared (client and server)               server only
Guards.declare  names and Exprs          G.implement  principal guards' bodies ──> Policy
Guards.attach   the rules on an Entity
        │
        └─> every seam reads the same rules, decided by the same Policy:
              reads     GuardDrizzle.visible, GuardServer.memory    which rows
                        GuardServer.filter                          members, relations, may
              writes    GuardServer.writer, GuardServer.mutation    checked before, read back after
              Sync      GuardSync.authorize, admit, opens           edits through the journal
              agents    GuardAgent                                  reads may
              startup   GuardServer.validate                        every guarded Source is guarded

A rule is decided in two steps: each principal guard by its body, once per request, then what is left, row guards, as a condition over the row that SQL or an evaluator runs. That split is why row guards are data and principal guards are names.

Install

sh
pnpm add effect foldkit-entity foldkit-guard

foldkit-guard is the shared declaration. Its subpaths bring their packages as optional peers: foldkit-guard/server needs foldkit-remote and foldkit-remote-server, /drizzle also foldkit-remote-drizzle and drizzle-orm, /sync foldkit-sync and foldkit-remote-server, and /agent foldkit-remote.