• Tracks user-defined items within user-defined hierarchical storage locations.
• Strongly-typed metadata with user-defined types.
• Rich search functionality; perform complex searches over item metadata with automatic pagination and sorting.
• Full API access for all operations.
• Full Java API for performing operations.
• Fine-grained capability based security model for operations; Safely write external services that can perform operations while maintaining the principle of least privilege.
• Command-line shell.
• Complete audit log; every operation that changes the state of the system is logged in an append-only log.
• Fully instrumented with OpenTelemetry.
• A small, easily auditable codebase with a heavy use of modularity for correctness.
• An extensive automated test suite with high coverage.
• Platform independence. No platform-dependent code is included in any form, and installations can largely be carried between platforms without changes.
• OSGi-ready
• JPMS-ready
• Support for Canonmill keystores.
• ISC license.

• Maven Central
• Quay.io

$ gpg --verify com.io7m.cardant.main-1.0.0-beta0001-distribution.zip.asc
gpg: assuming signed data in 'com.io7m.cardant.main-1.0.0-beta0001-distribution.zip.asc'
gpg: Signature made Tue 28 Jun 2022 15:01:56 GMT
gpg:                using RSA key 3CCE59428B30462D10459909C5607DA146E128B8
gpg:                issuer "contact@io7m.com"
gpg: using pgp trust model
gpg: Good signature from "io7m.com (2022 maven-rsa-key) <contact@io7m.com>" [unknown]

$ unzip com.io7m.cardant.main-1.0.0-beta0001-distribution.zip
$ export CARDANT_HOME=$(realpath cardant)
$ ./cardant/bin/cardant
cardant: usage: cardant [command] [arguments ...]
...

$ podman pull quay.io/io7mcom/cardant:1.0.0-beta0001
$ podman run quay.io/io7mcom/cardant:1.0.0-beta0001
cardant: usage: cardant [command] [arguments ...]
...

$ curl http://localhost:30000/health
OK

$ cardant initialize \
  --admin-id '92f83bce-3973-4db8-8aaf-d401443a9772' \
  --admin-name 'someone' \
  --configuration server.conf

$ cardant server --configuration server.conf
info: [localhost/<unresolved>:30000] Inventory API server started

$ cardant shell
[cardant]# version
com.io7m.cardant 0.0.1-SNAPSHOT 20af71248a7784b0e5247eab4b1ebd28de284739

$ podman run \
  --name some-postgres \
  -e POSTGRES_USER=cardant_install \
  -e POSTGRES_PASSWORD=mysecretpassword \
  -d postgres

<?xml version="1.0" encoding="UTF-8" ?>

<Configuration xmlns="com.io7m.cardant:configuration:1"
               xmlns:ct="com.io7m.cardant:tls:1">

  <InventoryService ListenAddress="[::]"
                    ListenPort="30000"
                    SessionExpiration="PT30M"
                    ExternalAddress="http://cardant.example.com:30000">
    <ct:TLSDisabled/>
  </InventoryService>

  <Database Kind="POSTGRESQL"
            OwnerRoleName="cardant_install"
            OwnerRolePassword="892a2b68-2ddf-478a-a8ab-37172f6ac2fe"
            WorkerRolePassword="e61135dc-1d3f-4ab2-85ef-95ef49d66285"
            ReaderRolePassword="c2026069-97e7-45b1-85c4-a2349bbb847b"
            Address="db.example.com"
            Port="5432"
            Name="cardant"
            Create="true"
            Upgrade="true"
            Language="english"/>

  <Idstore BaseURI="https://idstore.example.com:50000"
           PasswordResetURI="https://idstore.example.com:50001/reset"/>

  <Limits MaximumFileUploadSizeOctets="10000000"
          MaximumCommandSizeOctets="10000000"/>

  <Maintenance TLSReloadInterval="PT24H"/>

  <OpenTelemetry LogicalServiceName="cardant01">
    <Logs Endpoint="http://logs.example.com:4317"
          Protocol="GRPC"/>
    <Metrics Endpoint="http://metrics.example.com:4317"
             Protocol="GRPC"/>
    <Traces Endpoint="http://traces.example.com:4317"
            Protocol="GRPC"/>
  </OpenTelemetry>

</Configuration>

<?xml version="1.0" encoding="UTF-8" ?>

<InventoryService xmlns="com.io7m.cardant:configuration:1"
                  xmlns:tls="com.io7m.cardant:tls:1"
                  ListenAddress="[::]"
                  ListenPort="30000"
                  SessionExpiration="PT30M"
                  ExternalAddress="http://cardant.example.com:30000">
  <tls:TLSEnabled>
    <tls:KeyStore Type="CANONMILL"
                  Provider="CANONMILL"
                  Password="ignored"
                  File="/cardant/keystore.xml"/>
    <tls:TrustStore Type="JKS"
                    Provider="SUN"
                    Password="changeit"
                    File="/usr/lib/jvm/java-21-openjdk/lib/security/cacerts"/>
  </tls:TLSEnabled>
</InventoryService>

<?xml version="1.0" encoding="UTF-8" ?>

<Idstore xmlns="com.io7m.cardant:configuration:1"
         BaseURI="https://idstore.example.com:50000"
         PasswordResetURI="https://idstore.example.com:50001/reset"/>

<Maintenance TLSReloadInterval="PT30M"/>

<Limits MaximumFileUploadSizeOctets="10000000"
        MaximumCommandSizeOctets="10000000"/>

<Database Kind="POSTGRESQL"
          OwnerRoleName="cardant_install"
          OwnerRolePassword="mydatabase"
          WorkerRolePassword="willquickly"
          ReaderRolePassword="becompromised"
          Address="db.example.com"
          Port="5432"
          Name="cardant"
          Create="true"
          Upgrade="true"
          Language="english"
          MinimumPoolConnections="1"
          MaximumPoolConnections="5"/>

<OpenTelemetry LogicalServiceName="idstore">
  <Logs Endpoint="http://logs.example.com:4317"
        Protocol="GRPC"/>
  <Metrics Endpoint="http://metrics.example.com:4317"
           Protocol="GRPC"/>
  <Traces Endpoint="http://traces.example.com:4317"
          Protocol="GRPC"/>
</OpenTelemetry>

<?xml version="1.0" encoding="UTF-8" ?>

<!--
  Copyright © 2023 Mark Raynsford <code@io7m.com> https://www.io7m.com

  Permission to use, copy, modify, and/or distribute this software for any
  purpose with or without fee is hereby granted, provided that the above
  copyright notice and this permission notice appear in all copies.

  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
  IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-->

<schema xmlns="http://www.w3.org/2001/XMLSchema"
        targetNamespace="com.io7m.cardant:configuration:1"
        xmlns:ct="com.io7m.cardant:tls:1"
        xmlns:c="com.io7m.cardant:configuration:1">

  <import namespace="com.io7m.cardant:tls:1"/>

  <annotation>
    <documentation>
      The schema for server configuration files.
    </documentation>
  </annotation>

  <simpleType name="DatabaseKind">
    <annotation>
      <documentation>
        The kind of the target database. Currently, only PostgreSQL is supported.
      </documentation>
    </annotation>

    <restriction base="string">
      <enumeration value="POSTGRESQL">
        <annotation>
          <documentation>
            The database is PostgreSQL.
          </documentation>
        </annotation>
      </enumeration>
    </restriction>
  </simpleType>

  <element name="Idstore">
    <annotation>
      <documentation>
        Configuration for the idstore server that will be used for user identity information.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="BaseURI"
                 type="anyURI"
                 use="required">
        <annotation>
          <documentation>
            The base URI of the idstore user API.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="PasswordResetURI"
                 type="anyURI"
                 use="required">
        <annotation>
          <documentation>
            The password reset URI to which to redirect users who want to reset their password.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <simpleType name="OpenTelemetryProtocol">
    <annotation>
      <documentation>
        The protocol used to deliver OpenTelemetry data.
      </documentation>
    </annotation>

    <restriction base="string">
      <enumeration value="GRPC">
        <annotation>
          <documentation>
            The data will be sent using gRPC.
          </documentation>
        </annotation>
      </enumeration>
      <enumeration value="HTTP">
        <annotation>
          <documentation>
            The data will be sent using HTTP(s).
          </documentation>
        </annotation>
      </enumeration>
    </restriction>
  </simpleType>

  <element name="Logs">
    <annotation>
      <documentation>
        Configuration information for OpenTelemetry logs.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="Endpoint"
                 use="required"
                 type="anyURI">
        <annotation>
          <documentation>
            The endpoint to which OTLP log data will be sent.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Protocol"
                 use="required"
                 type="c:OpenTelemetryProtocol">
        <annotation>
          <documentation>
            The protocol used to send log data.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="Metrics">
    <annotation>
      <documentation>
        Configuration information for OpenTelemetry metrics.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="Endpoint"
                 use="required"
                 type="anyURI">
        <annotation>
          <documentation>
            The endpoint to which OTLP metrics data will be sent.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Protocol"
                 use="required"
                 type="c:OpenTelemetryProtocol">
        <annotation>
          <documentation>
            The protocol used to send metrics data.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="Traces">
    <annotation>
      <documentation>
        Configuration information for OpenTelemetry traces.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="Endpoint"
                 use="required"
                 type="anyURI">
        <annotation>
          <documentation>
            The endpoint to which OTLP trace data will be sent.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Protocol"
                 use="required"
                 type="c:OpenTelemetryProtocol">
        <annotation>
          <documentation>
            The protocol used to send trace data.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="OpenTelemetry">
    <annotation>
      <documentation>
        Configuration information for OpenTelemetry.
      </documentation>
    </annotation>

    <complexType>
      <sequence>
        <element ref="c:Logs"
                 minOccurs="0"
                 maxOccurs="1"/>
        <element ref="c:Metrics"
                 minOccurs="0"
                 maxOccurs="1"/>
        <element ref="c:Traces"
                 minOccurs="0"
                 maxOccurs="1"/>
      </sequence>

      <attribute name="LogicalServiceName"
                 use="required"
                 type="string">
        <annotation>
          <documentation>
            The logical name of the service as it will appear in OpenTelemetry.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="Database">
    <annotation>
      <documentation>
        Configuration information for the database.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="Kind"
                 type="c:DatabaseKind"
                 use="required"/>

      <attribute name="OwnerRoleName"
                 use="required"
                 type="string">
        <annotation>
          <documentation>
            The name of the role that owns the database. This is used for the initial database setup, and for upgrades.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="OwnerRolePassword"
                 use="required"
                 type="string">
        <annotation>
          <documentation>
            The password of the role that owns the database.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="WorkerRolePassword"
                 use="required"
                 type="string">
        <annotation>
          <documentation>
            The password of the role used for normal database operation. This is an unprivileged role that does not have
            the ability to perform DDL or other database-changing operations.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="ReaderRolePassword"
                 use="optional"
                 type="string">
        <annotation>
          <documentation>
            The password of the role used for read-only database operation. If this attribute is not specified, the
            read-only role is not allowed to log in.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Address"
                 type="string"
                 use="required">
        <annotation>
          <documentation>
            The address of the database.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Port"
                 type="integer"
                 use="required">
        <annotation>
          <documentation>
            The port used to connect to the database.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Name"
                 type="string"
                 use="required">
        <annotation>
          <documentation>
            The name of the database.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Create"
                 type="boolean"
                 use="required">
        <annotation>
          <documentation>
            If set to true, the database and tables will be created if they do not already exist.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Upgrade"
                 type="boolean"
                 use="required">
        <annotation>
          <documentation>
            If set to true, the database and tables will be upgraded to the latest supported schema version.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="Language"
                 type="string"
                 use="required">
        <annotation>
          <documentation>
            The language used for database search indexes (such as 'english'). See
            https://www.postgresql.org/docs/current/locale.html.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="MinimumPoolConnections"
                 use="optional"
                 default="1"
                 type="unsignedInt">
        <annotation>
          <documentation>
            The minimum number of connections to keep idle in the database connection pool.
          </documentation>
        </annotation>
      </attribute>

      <attribute name="MaximumPoolConnections"
                 use="optional"
                 default="10"
                 type="unsignedInt">
        <annotation>
          <documentation>
            The maximum number of connections to allow in the database connection pool. When this number of
            connections is active in the pool, the application will be forced to wait until a connection
            becomes idle upon requesting another connection.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <complexType name="HTTPService">
    <sequence minOccurs="1"
              maxOccurs="1">
      <group ref="ct:TLSGroup"/>
    </sequence>

    <attribute name="ListenAddress"
               type="string"
               use="required">
      <annotation>
        <documentation>
          The address upon which this HTTP service will listen.
        </documentation>
      </annotation>
    </attribute>

    <attribute name="ListenPort"
               type="integer"
               use="required">
      <annotation>
        <documentation>
          The port upon which this HTTP service will listen.
        </documentation>
      </annotation>
    </attribute>

    <attribute name="ExternalAddress"
               type="anyURI"
               use="required">
      <annotation>
        <documentation>
          The address by which this service is accessible to the outside world. The service will typically be configured
          behind a reverse proxy to provide TLS.
        </documentation>
      </annotation>
    </attribute>

    <attribute name="SessionExpiration"
               type="duration"
               use="optional">
      <annotation>
        <documentation>
          The expiration time for sessions.
        </documentation>
      </annotation>
    </attribute>
  </complexType>

  <element name="InventoryService"
           type="c:HTTPService">
    <annotation>
      <documentation>
        Configuration for the Inventory API service.
      </documentation>
    </annotation>
  </element>

  <element name="Limits">
    <annotation>
      <documentation>
        Configuration for various limits.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="MaximumFileUploadSizeOctets"
                 type="unsignedLong"
                 use="required">
        <annotation>
          <documentation>
            The maximum permitted size of uploaded files (in octets).
          </documentation>
        </annotation>
      </attribute>

      <attribute name="MaximumCommandSizeOctets"
                 type="unsignedLong"
                 use="required">
        <annotation>
          <documentation>
            The maximum permitted size of ordinary commands (in octets).
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="Maintenance">
    <annotation>
      <documentation>
        Configuration for the server's periodic maintenance tasks.
      </documentation>
    </annotation>

    <complexType>
      <attribute name="TLSReloadInterval"
                     type="duration"
                     use="optional">
        <annotation>
          <documentation>
            The interval at which TLS contexts will be reloaded. If not
            specified, TLS contexts will not be reloaded.
          </documentation>
        </annotation>
      </attribute>
    </complexType>
  </element>

  <element name="Configuration">
    <annotation>
      <documentation>
        The top-level configuration element.
      </documentation>
    </annotation>

    <complexType>
      <sequence>
        <element ref="c:InventoryService"/>
        <element ref="c:Database"/>
        <element ref="c:Idstore"/>
        <element ref="c:Limits"/>
        <element ref="c:Maintenance"/>
        <element ref="c:OpenTelemetry"
                 minOccurs="0"
                 maxOccurs="1"/>
      </sequence>
    </complexType>
  </element>

</schema>

<?xml version="1.0" encoding="UTF-8" ?>

<!--
  Copyright © 2023 Mark Raynsford <code@io7m.com> https://www.io7m.com

  Permission to use, copy, modify, and/or distribute this software for any
  purpose with or without fee is hereby granted, provided that the above
  copyright notice and this permission notice appear in all copies.

  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
  IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-->

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
            targetNamespace="com.io7m.cardant:tls:1"
            xmlns:nt="com.io7m.cardant:tls:1">

  <xsd:complexType name="StoreType"
                   abstract="true">
    <xsd:attribute name="Type"
                   type="xsd:string"
                   use="required"/>
    <xsd:attribute name="Provider"
                   type="xsd:string"
                   use="required"/>
    <xsd:attribute name="Password"
                   type="xsd:string"
                   use="required"/>
    <xsd:attribute name="File"
                   type="xsd:string"
                   use="required"/>
  </xsd:complexType>

  <xsd:complexType name="KeyStoreType">
    <xsd:complexContent>
      <xsd:extension base="nt:StoreType"/>
    </xsd:complexContent>
  </xsd:complexType>

  <xsd:complexType name="TrustStoreType">
    <xsd:complexContent>
      <xsd:extension base="nt:StoreType"/>
    </xsd:complexContent>
  </xsd:complexType>

  <xsd:element name="KeyStore"
               type="nt:KeyStoreType"/>

  <xsd:element name="TrustStore"
               type="nt:TrustStoreType"/>

  <xsd:complexType name="TLSType"
                   abstract="true"/>

  <xsd:complexType name="TLSDisabledType">
    <xsd:complexContent>
      <xsd:extension base="nt:TLSType"/>
    </xsd:complexContent>
  </xsd:complexType>

  <xsd:element name="TLSDisabled"
               type="nt:TLSDisabledType"/>

  <xsd:complexType name="TLSEnabledType">
    <xsd:complexContent>
      <xsd:extension base="nt:TLSType">
        <xsd:sequence>
          <xsd:element ref="nt:KeyStore"/>
          <xsd:element ref="nt:TrustStore"/>
        </xsd:sequence>
      </xsd:extension>
    </xsd:complexContent>
  </xsd:complexType>

  <xsd:element name="TLSEnabled"
               type="nt:TLSEnabledType"/>

  <xsd:group name="TLSGroup">
    <xsd:choice>
      <xsd:element ref="nt:TLSDisabled"/>
      <xsd:element ref="nt:TLSEnabled"/>
    </xsd:choice>
  </xsd:group>

</xsd:schema>

type StockReposit =
  | CAStockRepositRemove CAStockInstanceID
  | CAStockRepositSerialIntroduce CAStockInstanceID CAItemID CALocationID CAItemSerial
  | CAStockRepositSerialMove CAStockInstanceID CALocationID
  | CAStockRepositSerialNumberAdd CAStockInstanceID CAItemSerial
  | CAStockRepositSerialNumberRemove CAStockInstanceID CAItemSerial
  | CAStockRepositSetAdd CAStockInstanceID Long
  | CAStockRepositSetIntroduce CAStockInstanceID CAItemID CALocationID Long
  | CAStockRepositSetMove CAStockInstanceID CAStockInstanceID CALocationID Long
  | CAStockRepositSetRemove CAStockInstanceID Long

cardant: usage: cardant [command] [arguments ...]

  The cardant server command-line application.

  Use the "help" command to examine specific commands:

    $ cardant help help.

  Command-line arguments can be placed one per line into a file, and
  the file can be referenced using the @ symbol:

    $ echo help > file.txt
    $ echo help >> file.txt
    $ cardant @file.txt

  Commands:
    help          Show usage information for a command.
    initialize    Initialize the server and database.
    server        Start the server.
    shell         Start the shell.
    version       Show the application version.

  Documentation:
    https://www.io7m.com/software/cardant/

$ cardant server --configuration server.conf

$ (cat <<EOF
--configuration
server.conf
EOF
) > args.txt

$ cardant @args.txt

[cardant]$ set --formatter PRETTY
[cardant]$ audit-search-begin
Search results: Page 1 of 1
┌────┬──────────────────────────────────────┬────────────────┬─────────────────────────────┬─────────────────────────────────────────────────────────────────────────┐
│ ID │ Owner                                │ Type           │ Time                        │ Data                                                                    │
├────┼──────────────────────────────────────┼────────────────┼─────────────────────────────┼─────────────────────────────────────────────────────────────────────────┤
│ 1  │ c5574d46-7413-43c8-b6db-31001c382ca3 │ USER_LOGGED_IN │ 2023-12-21T11:30:11.171839Z │ {UserAgent=com.io7m.cardant.client/0.0.1-SNAPSHOT, Host=10.1.6.1:53236} │
└────┴──────────────────────────────────────┴────────────────┴─────────────────────────────┴─────────────────────────────────────────────────────────────────────────┘

[cardant]$ set --formatter RAW
[cardant]$ audit-search-begin
# Search results: Page 1 of 1
#--------------------------------
1 c5574d46-7413-43c8-b6db-31001c382ca3 USER_LOGGED_IN 2023-12-21T11:30:11.171839Z {UserAgent=com.io7m.cardant.client/0.0.1-SNAPSHOT, Host=10.1.6.1:53236}

[cardant]$ bookmark-put --user example --password F7B7D37C620C70BF03353148582AC97D --hostname 10.1.6.1 --name local0

[cardant]$ bookmark-list
┌─────────────────┬─────────────────────────┬───────┬───────┬──────────────────┐
│ Name            │ Host                    │ Port  │ TLS   │ User             │
├─────────────────┼─────────────────────────┼───────┼───────┼──────────────────┤
│ local0          │ 10.1.6.1                │ 30000 │ false │ example          │
└─────────────────┴─────────────────────────┴───────┴───────┴──────────────────┘
[cardant]$ bookmark-login --name local0

[cardant]$ self
User ID: c5574d46-7413-43c8-b6db-31001c382ca3
┌────────────────────────────────────────────────────────────────────────────────┐
│ Role                                                                           │
├────────────────────────────────────────────────────────────────────────────────┤
│ audit.reader                                                                   │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.admin                                                                │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.files.reader                                                         │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.files.writer                                                         │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.items.reader                                                         │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.items.writer                                                         │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.locations.reader                                                     │
├────────────────────────────────────────────────────────────────────────────────┤
│ inventory.locations.writer                                                     │
└────────────────────────────────────────────────────────────────────────────────┘

• with-any-name
• (with-name-equal-to n)
• (with-name-not-equal-to n)
• (with-name-similar-to n)
• (with-name-not-similar-to n)

match_name_evaluate with-any-name n                 ⇒ true
match_name_evaluate (with-name-equal-to m) n        ⇒ n = m
match_name_evaluate (with-name-not-equal-to m) n    ⇒ n ≠ m
match_name_evaluate (with-name-similar-to m) n      ⇒ n ≃ m
match_name_evaluate (with-name-not-similar-to m) n  ⇒ not (n ≃ m)

• An expression with-any-name always evaluates to true.
• For all names m, (with-name-equal-to n) m evaluates to true iff m = n.
• For all names m, (with-name-not-equal-to n) m evaluates to true iff m ≠ n.
• For all names m, (with-name-similar-to n) m evaluates to true iff m is sufficiently similar to n according to an implementation-defined, language-specific similarity function.
• For all names m, (with-name-not-similar-to n) m evaluates to true iff m is not sufficiently similar to n according to an implementation-defined, language-specific similarity function.

match_name ::=
    "with-any-name"
  | "(" "with-name-equal-to" <name> ")"
  | "(" "with-name-not-equal-to" <name> ")"
  | "(" "with-name-similar-to" <string> ")"
  | "(" "with-name-not-similar-to" <string> ")"
  ;

• with-any-types
• (with-types-equal-to n)
• (with-types-not-equal-to n)
• (with-types-superset-of n)
• (with-types-subset-of n)
• (with-types-overlapping n)

match_name_evaluate with-any-type s                 ⇒ true
match_name_evaluate (with-types-to t) s             ⇒ s = t
match_name_evaluate (with-types-not-equal-to t) s   ⇒ s ≠ t
match_name_evaluate (with-types-superset-of t) s    ⇒ s ⊆ t
match_name_evaluate (with-types-subset-of t) s      ⇒ s ⊇ t
match_name_evaluate (with-types-overlapping t) s    ⇒ ∃ e. e ∈ t ∧ e ∈ s

• An expression with-any-types always evaluates to true.
• For all descriptions s, (with-types-equal-to t) s evaluates to true iff t = s. Note that sets are not ordered.
• For all descriptions s, (with-types-not-equal-to t) s evaluates to true iff s ≠ t. Note that sets are not ordered.
• For all descriptions s, (with-types-subset-of t) s evaluates to true iff s is a subset of t.
• For all descriptions s, (with-types-superset-of t) s evaluates to true iff s is a superset of t.
• For all descriptions s, (with-types-overlapping t) s evaluates to true iff there exists some element e that is present in both s and t.

match_type ::=
    "with-any-type"
  | "(" "with-types-equal-to" <type-record-identifier> [<type-record-identifier>, ...] ")"
  | "(" "with-types-not-equal-to" <type-record-identifier> [<type-record-identifier>, ...] ")"
  | "(" "with-types-superset-of" <type-record-identifier> [<type-record-identifier>, ...] ")"
  | "(" "with-types-subset-of" <type-record-identifier> [<type-record-identifier>, ...] ")"
  | "(" "with-types-overlapping" <type-record-identifier> [<type-record-identifier>, ...] ")"
  ;

• with-any-description
• (with-description-equal-to n)
• (with-description-not-equal-to n)
• (with-description-similar-to n)
• (with-description-not-similar-to n)

match_description_evaluate with-any-description n                 ⇒ true
match_description_evaluate (with-description-equal-to m) n        ⇒ n = m
match_description_evaluate (with-description-not-equal-to m) n    ⇒ n ≠ m
match_description_evaluate (with-description-similar-to m) n      ⇒ n ≃ m
match_description_evaluate (with-description-not-similar-to m) n  ⇒ not (n ≃ m)

• An expression with-any-description always evaluates to true.
• For all descriptions m, (with-description-equal-to n) m evaluates to true iff m = n.
• For all descriptions m, (with-description-not-equal-to n) m evaluates to true iff m ≠ n.
• For all descriptions m, (with-description-similar-to n) m evaluates to true iff m is sufficiently similar to n according to an implementation-defined, language-specific similarity function.
• For all descriptions m, (with-description-not-similar-to n) m evaluates to true iff m is not sufficiently similar to n according to an implementation-defined, language-specific similarity function.

match_description ::=
    "with-any-description"
  | "(" "with-description-equal-to" <description> ")"
  | "(" "with-description-not-equal-to" <description> ")"
  | "(" "with-description-similar-to" <string> ")"
  | "(" "with-description-not-similar-to" <string> ")"
  ;

• with-any-mediatype
• (with-mediatype-equal-to n)
• (with-mediatype-not-equal-to n)
• (with-mediatype-similar-to n)
• (with-mediatype-not-similar-to n)

match_mediatype_evaluate with-any-mediatype n                 ⇒ true
match_mediatype_evaluate (with-mediatype-equal-to m) n        ⇒ n = m
match_mediatype_evaluate (with-mediatype-not-equal-to m) n    ⇒ n ≠ m
match_mediatype_evaluate (with-mediatype-similar-to m) n      ⇒ n ≃ m
match_mediatype_evaluate (with-mediatype-not-similar-to m) n  ⇒ not (n ≃ m)

• An expression with-any-mediatype always evaluates to true.
• For all media types m, (with-mediatype-equal-to n) m evaluates to true iff m = n.
• For all media types m, (with-mediatype-not-equal-to n) m evaluates to true iff m ≠ n.
• For all media types m, (with-mediatype-similar-to n) m evaluates to true iff m is sufficiently similar to n according to an implementation-defined, language-specific similarity function.
• For all media types m, (with-mediatype-not-similar-to n) m evaluates to true iff m is not sufficiently similar to n according to an implementation-defined, language-specific similarity function.

match_mediatype ::=
    "with-any-mediatype"
  | "(" "with-mediatype-equal-to" <mediatype> ")"
  | "(" "with-mediatype-not-equal-to" <mediatype> ")"
  | "(" "with-mediatype-similar-to" <string> ")"
  | "(" "with-mediatype-not-similar-to" <string> ")"
  ;

• with-any-serial
• (with-serial-equal-to n)
• (with-serial-not-equal-to n)

match_serial_evaluate with-any-serial n                 ⇒ true
match_serial_evaluate (with-serial-equal-to m) n        ⇒ n = m
match_serial_evaluate (with-serial-not-equal-to m) n    ⇒ n ≠ m

• An expression with-any-serial always evaluates to true.
• For all descriptions m, (with-serial-equal-to n) m evaluates to true iff m = n.
• For all descriptions m, (with-serial-not-equal-to n) m evaluates to true iff m ≠ n.

match_serial ::=
    "with-any-serial"
  | "(" "with-serial-equal-to" <serial> ")"
  | "(" "with-serial-not-equal-to" <serial> ")"
  ;

• with-any-package
• (with-package-equal-to n)
• (with-package-not-equal-to n)

match_package_evaluate with-any-package n                 ⇒ true
match_package_evaluate (with-package-equal-to m) n        ⇒ n = m
match_package_evaluate (with-package-not-equal-to m) n    ⇒ n ≠ m

• An expression with-any-package always evaluates to true.
• For all descriptions m, (with-package-equal-to n) m evaluates to true iff m = n.
• For all descriptions m, (with-package-not-equal-to n) m evaluates to true iff m ≠ n.

match_package ::=
    "with-any-package"
  | "(" "with-package-equal-to" <package> ")"
  | "(" "with-package-not-equal-to" <package> ")"
  ;

• with-any-field
• (with-field-equal-to n)
• (with-field-not-equal-to n)

match_field_evaluate with-any-field n                 ⇒ true
match_field_evaluate (with-field-equal-to m) n        ⇒ n = m
match_field_evaluate (with-field-not-equal-to m) n    ⇒ n ≠ m

• An expression with-any-field always evaluates to true.
• For all descriptions m, (with-field-equal-to n) m evaluates to true iff m = n.
• For all descriptions m, (with-field-not-equal-to n) m evaluates to true iff m ≠ n.

match_field ::=
    "with-any-field"
  | "(" "with-field-equal-to" <type-record-field-identifier> ")"
  | "(" "with-field-not-equal-to" <type-record-field-identifier> ")"
  ;