@mszr/idb-dux 1.0.0

package/dist/esm/perms/ast.js

@@ -0,0 +1,140 @@
+/**
+ * The expression layer: immutable, phantom-typed nodes that render to CEL.
+ *
+ * Every authoring helper (`e.title.eq('x')`, `er(...).contains(auth.id)`,
+ * `f.or(...)`) builds one of these nodes; `.compile()` walks the tree and
+ * emits the plain CEL strings Instant already accepts. The phantom `T` carries
+ * the value type so fluent composition type-checks at the cursor; at runtime a
+ * node is just a rendered string plus a precedence, so parentheses are added
+ * deterministically and only where CEL precedence requires them.
+ *
+ * The renderer targets the exact bindings the backend installs
+ * (`server/src/instant/db/cel.clj`): `auth`, `data`, `newData`, `linkedData`,
+ * `ruleParams`, `request`, `rateLimit`.
+ */
+// ==========
+// precedence
+/**
+ * CEL operator precedence, low to high. A child operand is parenthesized only
+ * when its precedence is lower than its parent's — minimal, correct, stable.
+ * `raw` sits below everything so any composition around it is always wrapped.
+ */
+const RAW = 0;
+const OR = 1;
+const AND = 2;
+const NOT = 3;
+const CMP = 4;
+const ATOM = 5;
+// ==========
+// the node
+const BRAND = Symbol('idb-perms-expr');
+/** The one runtime node behind both `Expr` and `ListExpr`. */
+export class ExprNode {
+    cel;
+    prec;
+    [BRAND] = true;
+    constructor(cel, prec) {
+        this.cel = cel;
+        this.prec = prec;
+    }
+    render() {
+        return this.cel;
+    }
+    op(operator, value, prec) {
+        const right = coerce(value);
+        return new ExprNode(`${wrap(this, prec)} ${operator} ${wrap(right, prec)}`, prec);
+    }
+    eq(value) { return this.op('==', value, CMP); }
+    neq(value) { return this.op('!=', value, CMP); }
+    gt(value) { return this.op('>', value, CMP); }
+    gte(value) { return this.op('>=', value, CMP); }
+    lt(value) { return this.op('<', value, CMP); }
+    lte(value) { return this.op('<=', value, CMP); }
+    in(list) { return this.op('in', list, CMP); }
+    and(other) { return this.op('&&', other, AND); }
+    or(other) { return this.op('||', other, OR); }
+    not() {
+        return new ExprNode(`!${this.prec < ATOM ? `(${this.cel})` : this.cel}`, NOT);
+    }
+    method(name, value) {
+        return new ExprNode(`${wrap(this, ATOM)}.${name}(${coerce(value).cel})`, ATOM);
+    }
+    startsWith(value) { return this.method('startsWith', value); }
+    endsWith(value) { return this.method('endsWith', value); }
+    // CEL spells substring containment `string.contains`.
+    includes(value) { return this.method('contains', value); }
+    matches(value) { return this.method('matches', value); }
+    // ----- list methods
+    contains(value) {
+        // `value in list` — the membership test the backend optimizes for refs.
+        return new ExprNode(`${coerce(value).cel} in ${wrap(this, CMP)}`, CMP);
+    }
+    isEmpty() { return new ExprNode(`${wrap(this, CMP)} == []`, CMP); }
+    isNonEmpty() { return new ExprNode(`${wrap(this, CMP)} != []`, CMP); }
+    size() { return new ExprNode(`size(${this.cel})`, ATOM); }
+    at(index) { return new ExprNode(`${wrap(this, ATOM)}[${index}]`, ATOM); }
+    some(fn) { return this.macro('exists', fn); }
+    every(fn) { return this.macro('all', fn); }
+    macro(name, fn) {
+        const variable = bindVarName(fn);
+        const body = fn(new ExprNode(variable, ATOM));
+        return new ExprNode(`${wrap(this, ATOM)}.${name}(${variable}, ${body.render()})`, ATOM);
+    }
+}
+function wrap(node, parentPrec) {
+    return node.prec < parentPrec ? `(${node.cel})` : node.cel;
+}
+/** Is this an expression node (vs a raw literal value)? */
+export function isExprNode(value) {
+    return typeof value === 'object' && value !== null && BRAND in value;
+}
+// ==========
+// literals
+/** Single-quote a CEL string literal, escaping the characters CEL cares about. */
+function quote(value) {
+    const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, '\\\'')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+    return `'${escaped}'`;
+}
+/** Render a JS literal as a CEL atom. */
+function literal(value) {
+    if (value === null || value === undefined)
+        return 'null';
+    if (typeof value === 'string')
+        return quote(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    if (value instanceof Date)
+        return String(value.getTime());
+    if (Array.isArray(value))
+        return `[${value.map(literal).join(', ')}]`;
+    throw new TypeError(`Cannot render ${typeof value} as a CEL literal`);
+}
+/** Pass an expression through; turn anything else into an atom literal node. */
+export function coerce(value) {
+    return isExprNode(value) ? value : new ExprNode(literal(value), ATOM);
+}
+// ==========
+// node factories (used by the context helpers)
+/** A bare CEL atom — identifiers, property/field access, calls. */
+export function atom(cel) {
+    return new ExprNode(cel, ATOM);
+}
+/** A raw, user-authored CEL string — always wrapped when composed. */
+export function raw(cel) {
+    return new ExprNode(cel, RAW);
+}
+/**
+ * Recover the macro variable name from the callback's source so the emitted
+ * CEL reads naturally (`.exists(types, 'admin' in types)`); falls back to
+ * `item` when the source can't be parsed.
+ */
+function bindVarName(fn) {
+    const match = /^[\s(]*([A-Z_$][\w$]*)/i.exec(fn.toString());
+    return match?.[1] ?? 'item';
+}
+//# sourceMappingURL=ast.js.map

package/dist/esm/perms/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../../src/perms/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAmDH,aAAa;AACb,aAAa;AAEb;;;;GAIG;AACH,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,EAAE,GAAG,CAAC,CAAA;AACZ,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,IAAI,GAAG,CAAC,CAAA;AAEd,aAAa;AACb,WAAW;AAEX,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;AAEtC,8DAA8D;AAC9D,MAAM,OAAO,QAAQ;IAEE;IAAsB;IADlC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IACvB,YAAqB,GAAW,EAAW,IAAY;QAAlC,QAAG,GAAH,GAAG,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE3D,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAEO,EAAE,CAAC,QAAgB,EAAE,KAAc,EAAE,IAAY;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACnF,CAAC;IAED,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACvD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACtD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACtD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,IAAa,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACrD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAEtD,GAAG;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC;IAEO,MAAM,CAAC,IAAY,EAAE,KAAc;QACzC,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAA;IAChF,CAAC;IAED,UAAU,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAClE,sDAAsD;IACtD,QAAQ,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAClE,OAAO,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAEhE,qBAAqB;IAErB,QAAQ,CAAC,KAAc;QACrB,wEAAwE;QACxE,OAAO,IAAI,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IAClE,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACrE,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAA,CAAC,CAAC;IACzD,EAAE,CAAC,KAAa,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAA,CAAC,CAAC;IAEhF,IAAI,CAAC,EAAgC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAC1E,KAAK,CAAC,EAAgC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAEhE,KAAK,CAAC,IAAY,EAAE,EAAgC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAwB,CAAA;QACpE,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,CAAC;CACF;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,UAAkB;IAC9C,OAAO,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AAC5D,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK,CAAA;AACtE,CAAC;AAED,aAAa;AACb,WAAW;AAEX,kFAAkF;AAClF,SAAS,KAAK,CAAC,KAAa;IAC1B,MAAM,OAAO,GAAG,KAAK;SAClB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACxB,OAAO,IAAI,OAAO,GAAG,CAAA;AACvB,CAAC;AAED,yCAAyC;AACzC,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QACvC,OAAO,MAAM,CAAA;IACf,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,IAAI,KAAK,YAAY,IAAI;QACvB,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IAC7C,MAAM,IAAI,SAAS,CAAC,iBAAiB,OAAO,KAAK,mBAAmB,CAAC,CAAA;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;AACvE,CAAC;AAED,aAAa;AACb,+CAA+C;AAE/C,mEAAmE;AACnE,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;AAC7B,CAAC","sourcesContent":["/**\n * The expression layer: immutable, phantom-typed nodes that render to CEL.\n *\n * Every authoring helper (`e.title.eq('x')`, `er(...).contains(auth.id)`,\n * `f.or(...)`) builds one of these nodes; `.compile()` walks the tree and\n * emits the plain CEL strings Instant already accepts. The phantom `T` carries\n * the value type so fluent composition type-checks at the cursor; at runtime a\n * node is just a rendered string plus a precedence, so parentheses are added\n * deterministically and only where CEL precedence requires them.\n *\n * The renderer targets the exact bindings the backend installs\n * (`server/src/instant/db/cel.clj`): `auth`, `data`, `newData`, `linkedData`,\n * `ruleParams`, `request`, `rateLimit`.\n */\n\n// ==========\n// authoring types\n\n/** A value position accepts a raw literal or another expression of that type. */\nexport type ExprArg<T> = T | Expr<T>\n\n/**\n * A scalar CEL expression. `and`/`or`/`not` return a boolean expression so\n * fluent chains read subject-first (`b.isMember.and(b.isSignedIn)`); the\n * string methods are available everywhere but only meaningful on strings.\n */\nexport interface Expr<T = unknown> {\n  // `null` is allowed so the `x != null` / `x == null` idiom reads naturally.\n  eq: (value: ExprArg<T> | null) => Expr<boolean>\n  neq: (value: ExprArg<T> | null) => Expr<boolean>\n  gt: (value: ExprArg<T>) => Expr<boolean>\n  gte: (value: ExprArg<T>) => Expr<boolean>\n  lt: (value: ExprArg<T>) => Expr<boolean>\n  lte: (value: ExprArg<T>) => Expr<boolean>\n  in: (list: readonly ExprArg<T>[]) => Expr<boolean>\n  and: (other: ExprArg<boolean>) => Expr<boolean>\n  or: (other: ExprArg<boolean>) => Expr<boolean>\n  not: () => Expr<boolean>\n  startsWith: (value: ExprArg<string>) => Expr<boolean>\n  endsWith: (value: ExprArg<string>) => Expr<boolean>\n  includes: (value: ExprArg<string>) => Expr<boolean>\n  matches: (value: ExprArg<string>) => Expr<boolean>\n  render: () => string\n}\n\n/** The element view of a list — a JSON-array terminal yields a nested list. */\nexport type ItemExpr<T> = T extends readonly (infer E)[] ? ListExpr<E> : Expr<T>\n\n/**\n * A list-valued CEL expression — what every ref helper (`er`/`ar`/`elr`) and\n * `request.modifiedFields` return. `.some`/`.every` compile to CEL's\n * `.exists`/`.all` macros.\n */\nexport interface ListExpr<T = unknown> {\n  contains: (value: ExprArg<T>) => Expr<boolean>\n  isEmpty: () => Expr<boolean>\n  isNonEmpty: () => Expr<boolean>\n  size: () => Expr<number>\n  at: (index: number) => ItemExpr<T>\n  some: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>\n  every: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>\n  render: () => string\n}\n\n// ==========\n// precedence\n\n/**\n * CEL operator precedence, low to high. A child operand is parenthesized only\n * when its precedence is lower than its parent's — minimal, correct, stable.\n * `raw` sits below everything so any composition around it is always wrapped.\n */\nconst RAW = 0\nconst OR = 1\nconst AND = 2\nconst NOT = 3\nconst CMP = 4\nconst ATOM = 5\n\n// ==========\n// the node\n\nconst BRAND = Symbol('idb-perms-expr')\n\n/** The one runtime node behind both `Expr` and `ListExpr`. */\nexport class ExprNode {\n  readonly [BRAND] = true\n  constructor(readonly cel: string, readonly prec: number) {}\n\n  render(): string {\n    return this.cel\n  }\n\n  private op(operator: string, value: unknown, prec: number): ExprNode {\n    const right = coerce(value)\n    return new ExprNode(`${wrap(this, prec)} ${operator} ${wrap(right, prec)}`, prec)\n  }\n\n  eq(value: unknown) { return this.op('==', value, CMP) }\n  neq(value: unknown) { return this.op('!=', value, CMP) }\n  gt(value: unknown) { return this.op('>', value, CMP) }\n  gte(value: unknown) { return this.op('>=', value, CMP) }\n  lt(value: unknown) { return this.op('<', value, CMP) }\n  lte(value: unknown) { return this.op('<=', value, CMP) }\n  in(list: unknown) { return this.op('in', list, CMP) }\n  and(other: unknown) { return this.op('&&', other, AND) }\n  or(other: unknown) { return this.op('||', other, OR) }\n\n  not(): ExprNode {\n    return new ExprNode(`!${this.prec < ATOM ? `(${this.cel})` : this.cel}`, NOT)\n  }\n\n  private method(name: string, value: unknown): ExprNode {\n    return new ExprNode(`${wrap(this, ATOM)}.${name}(${coerce(value).cel})`, ATOM)\n  }\n\n  startsWith(value: unknown) { return this.method('startsWith', value) }\n  endsWith(value: unknown) { return this.method('endsWith', value) }\n  // CEL spells substring containment `string.contains`.\n  includes(value: unknown) { return this.method('contains', value) }\n  matches(value: unknown) { return this.method('matches', value) }\n\n  // ----- list methods\n\n  contains(value: unknown): ExprNode {\n    // `value in list` — the membership test the backend optimizes for refs.\n    return new ExprNode(`${coerce(value).cel} in ${wrap(this, CMP)}`, CMP)\n  }\n\n  isEmpty() { return new ExprNode(`${wrap(this, CMP)} == []`, CMP) }\n  isNonEmpty() { return new ExprNode(`${wrap(this, CMP)} != []`, CMP) }\n  size() { return new ExprNode(`size(${this.cel})`, ATOM) }\n  at(index: number) { return new ExprNode(`${wrap(this, ATOM)}[${index}]`, ATOM) }\n\n  some(fn: (item: any) => Expr<boolean>) { return this.macro('exists', fn) }\n  every(fn: (item: any) => Expr<boolean>) { return this.macro('all', fn) }\n\n  private macro(name: string, fn: (item: any) => Expr<boolean>): ExprNode {\n    const variable = bindVarName(fn)\n    const body = fn(new ExprNode(variable, ATOM)) as unknown as ExprNode\n    return new ExprNode(`${wrap(this, ATOM)}.${name}(${variable}, ${body.render()})`, ATOM)\n  }\n}\n\nfunction wrap(node: ExprNode, parentPrec: number): string {\n  return node.prec < parentPrec ? `(${node.cel})` : node.cel\n}\n\n/** Is this an expression node (vs a raw literal value)? */\nexport function isExprNode(value: unknown): value is ExprNode {\n  return typeof value === 'object' && value !== null && BRAND in value\n}\n\n// ==========\n// literals\n\n/** Single-quote a CEL string literal, escaping the characters CEL cares about. */\nfunction quote(value: string): string {\n  const escaped = value\n    .replace(/\\\\/g, '\\\\\\\\')\n    .replace(/'/g, '\\\\\\'')\n    .replace(/\\n/g, '\\\\n')\n    .replace(/\\r/g, '\\\\r')\n    .replace(/\\t/g, '\\\\t')\n  return `'${escaped}'`\n}\n\n/** Render a JS literal as a CEL atom. */\nfunction literal(value: unknown): string {\n  if (value === null || value === undefined)\n    return 'null'\n  if (typeof value === 'string')\n    return quote(value)\n  if (typeof value === 'number' || typeof value === 'boolean')\n    return String(value)\n  if (value instanceof Date)\n    return String(value.getTime())\n  if (Array.isArray(value))\n    return `[${value.map(literal).join(', ')}]`\n  throw new TypeError(`Cannot render ${typeof value} as a CEL literal`)\n}\n\n/** Pass an expression through; turn anything else into an atom literal node. */\nexport function coerce(value: unknown): ExprNode {\n  return isExprNode(value) ? value : new ExprNode(literal(value), ATOM)\n}\n\n// ==========\n// node factories (used by the context helpers)\n\n/** A bare CEL atom — identifiers, property/field access, calls. */\nexport function atom(cel: string): ExprNode {\n  return new ExprNode(cel, ATOM)\n}\n\n/** A raw, user-authored CEL string — always wrapped when composed. */\nexport function raw(cel: string): ExprNode {\n  return new ExprNode(cel, RAW)\n}\n\n/**\n * Recover the macro variable name from the callback's source so the emitted\n * CEL reads naturally (`.exists(types, 'admin' in types)`); falls back to\n * `item` when the source can't be parsed.\n */\nfunction bindVarName(fn: (item: any) => unknown): string {\n  const match = /^[\\s(]*([A-Z_$][\\w$]*)/i.exec(fn.toString())\n  return match?.[1] ?? 'item'\n}\n"]}

package/dist/esm/perms/builder.d.ts

@@ -0,0 +1,18 @@
+import type { IdbSchema } from '../schema/defineSchema.js';
+import type { IdbRegisteredSchema } from '../schema/register.js';
+import type { PermsBuilder } from './types.js';
+/**
+ * The typed permissions authoring entry. With the schema registered, no
+ * argument is needed; pass the schema value to add runtime validation; pass an
+ * explicit type param for a different schema (spec §2).
+ *
+ * @example
+ *   export default definePerms(schema)
+ *     .namespaces({
+ *       tasks: ns => ns.allow({ view: true }),
+ *     })
+ *     .compile()
+ */
+export declare function definePerms<S extends IdbSchema>(schema: S): PermsBuilder<S>;
+export declare function definePerms<S extends IdbSchema = IdbRegisteredSchema>(): PermsBuilder<S>;
+//# sourceMappingURL=builder.d.ts.map

package/dist/esm/perms/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../src/perms/builder.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,KAAK,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAA;AAsUlE;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;AAC5E,wBAAgB,WAAW,CAAC,CAAC,SAAS,SAAS,GAAG,mBAAmB,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/esm/perms/builder.js

@@ -0,0 +1,257 @@
+import { makeContext } from './context.js';
+import { makeValidator, namespaceExists, noValidate } from './validate.js';
+// ==========
+// resolution
+function asCel(value) {
+    return typeof value === 'boolean' ? String(value) : value.render();
+}
+function resolveRule(rule, ctx) {
+    return asCel(typeof rule === 'function' ? rule(ctx) : rule);
+}
+function renderBinds(binds) {
+    return Object.fromEntries(Object.entries(binds).map(([name, node]) => [name, node.render()]));
+}
+const ACTIONS = ['view', 'create', 'update', 'delete'];
+// ==========
+// namespace builder
+class NamespaceRuntime {
+    schema;
+    ns;
+    /** Common staged values — inlined, inherited from defaults, merged into every action. */
+    commonStaged;
+    /** All emitted bind aliases — common and action-specific share one block. */
+    binds = {};
+    /** Per-whole-entity-action staged values, visible only in that action. */
+    actionStaged = {};
+    /** Per-(dir, label) staged values, visible only in that link/unlink rule. */
+    linkStaged = {};
+    inheritedBindNames;
+    allowOut = {};
+    fieldsOut = {};
+    constructor(schema, ns, defaultStaged, defaultBindNames) {
+        this.schema = schema;
+        this.ns = ns;
+        this.commonStaged = { ...defaultStaged };
+        this.inheritedBindNames = new Set(defaultBindNames);
+    }
+    /** Is this name already a common staged value, an emitted bind, or inherited? */
+    known(name) {
+        return name in this.commonStaged || name in this.binds || this.inheritedBindNames.has(name);
+    }
+    linkTargetOf(label) {
+        return this.schema?.entities[this.ns]?.links?.[label]?.entityName;
+    }
+    /** Build a context over a staged snapshot, validating against ns (or a link target). */
+    ctxFor(staged, linkTarget) {
+        const validator = this.schema
+            ? makeValidator(this.schema, this.ns, linkTarget)
+            : noValidate;
+        return makeContext({ staged, binds: this.binds }, validator);
+    }
+    mergedStaged(action) {
+        return { ...this.commonStaged, ...this.actionStaged[action] };
+    }
+    mergedLinkStaged(dir, label) {
+        return { ...this.commonStaged, ...this.linkStaged[dir]?.[label] };
+    }
+    add(produced, into, guard, seen) {
+        for (const [name, node] of Object.entries(produced)) {
+            if (guard && seen(name))
+                throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined on '${this.ns}' — use .overrideStage/.overrideBind`);
+            into[name] = node;
+        }
+        return this;
+    }
+    stage(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, true, n => this.known(n));
+    }
+    overrideStage(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, false, () => false);
+    }
+    bind(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, true, n => this.known(n));
+    }
+    overrideBind(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, false, () => false);
+    }
+    stageFor(actionOrDir, labelOrFn, maybeFn) {
+        if (maybeFn === undefined) {
+            const action = actionOrDir;
+            const into = (this.actionStaged[action] ??= {});
+            return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), into, true, n => this.known(n) || n in into);
+        }
+        const [dir, label] = [actionOrDir, labelOrFn];
+        const into = ((this.linkStaged[dir] ??= {})[label] ??= {});
+        return this.add(maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))), into, true, n => this.known(n) || n in into);
+    }
+    bindFor(actionOrDir, labelOrFn, maybeFn) {
+        if (maybeFn === undefined) {
+            const action = actionOrDir;
+            return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), this.binds, true, n => this.known(n));
+        }
+        const [dir, label] = [actionOrDir, labelOrFn];
+        return this.add(maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))), this.binds, true, n => this.known(n));
+    }
+    allow(input) {
+        const block = typeof input === 'function' ? input(this.ctxFor(this.commonStaged)) : input;
+        for (const action of ACTIONS) {
+            if (block[action] !== undefined)
+                this.allowOut[action] = resolveRule(block[action], this.ctxFor(this.mergedStaged(action)));
+        }
+        for (const dir of ['link', 'unlink']) {
+            const labels = block[dir];
+            if (!labels)
+                continue;
+            const map = this.allowOut[dir] ?? {};
+            for (const [label, rule] of Object.entries(labels)) {
+                if (rule !== undefined) {
+                    const ctx = this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label));
+                    map[label] = resolveRule(rule, ctx);
+                }
+            }
+            this.allowOut[dir] = map;
+        }
+        return this;
+    }
+    fields(input) {
+        const ctx = this.ctxFor(this.commonStaged);
+        const block = typeof input === 'function' ? input(ctx) : input;
+        for (const [field, rule] of Object.entries(block)) {
+            if (rule !== undefined)
+                this.fieldsOut[field] = resolveRule(rule, ctx);
+        }
+        return this;
+    }
+    /** The compiled namespace block. */
+    block() {
+        const out = { allow: this.allowOut };
+        const bind = renderBinds(this.binds);
+        if (Object.keys(bind).length)
+            out.bind = bind;
+        if (Object.keys(this.fieldsOut).length)
+            out.fields = this.fieldsOut;
+        return out;
+    }
+}
+// ==========
+// defaults builder
+class DefaultsRuntime {
+    staged = {};
+    binds = {};
+    allowOut = {};
+    ctx() {
+        // The default context is namespace-loose; the type layer narrows it.
+        return makeContext({ staged: this.staged, binds: this.binds }, noValidate);
+    }
+    known(name) {
+        return name in this.staged || name in this.binds;
+    }
+    collect(fn, into) {
+        for (const [name, node] of Object.entries(fn(this.ctx()))) {
+            if (this.known(name))
+                throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined in defaults — use .overrideStage/.overrideBind`);
+            into[name] = node;
+        }
+        return this;
+    }
+    stage(fn) {
+        return this.collect(fn, this.staged);
+    }
+    bind(fn) {
+        return this.collect(fn, this.binds);
+    }
+    allow(input) {
+        const ctx = this.ctx();
+        const block = typeof input === 'function' ? input(ctx) : input;
+        for (const key of ['$default', ...ACTIONS]) {
+            if (block[key] !== undefined)
+                this.allowOut[key] = resolveRule(block[key], ctx);
+        }
+        return this;
+    }
+}
+// ==========
+// attrs builder
+class AttrsRuntime {
+    schema;
+    out = {};
+    constructor(schema) {
+        this.schema = schema;
+    }
+    allow(input) {
+        const ctx = makeContext({ staged: {}, binds: {} }, noValidate);
+        const block = typeof input === 'function' ? input(ctx) : input;
+        if (block.create !== undefined)
+            this.out.create = resolveRule(block.create, ctx);
+        return this;
+    }
+}
+// ==========
+// the top-level builder
+class PermsRuntime {
+    schema;
+    defaultStaged = {};
+    defaultBinds = {};
+    defaultAllow;
+    hasDefaults = false;
+    attrsOut;
+    rateLimitsConfig;
+    nsBuilders = {};
+    constructor(schema) {
+        this.schema = schema;
+    }
+    attrs(fn) {
+        const a = new AttrsRuntime(this.schema);
+        fn(a);
+        this.attrsOut = a.out;
+        return this;
+    }
+    defaults(fn) {
+        const d = new DefaultsRuntime();
+        fn(d);
+        this.hasDefaults = true;
+        this.defaultStaged = d.staged;
+        this.defaultBinds = d.binds;
+        this.defaultAllow = d.allowOut;
+        return this;
+    }
+    rateLimits(config) {
+        this.rateLimitsConfig = config;
+        return this;
+    }
+    namespaces(map) {
+        const defaultBindNames = Object.keys(this.defaultBinds);
+        for (const [ns, build] of Object.entries(map)) {
+            if (this.schema && !namespaceExists(this.schema, ns))
+                throw new Error(`QERR_PERMS_SCHEMA: '${ns}' is not a namespace in the schema`);
+            const nsb = new NamespaceRuntime(this.schema, ns, this.defaultStaged, defaultBindNames);
+            build(nsb);
+            this.nsBuilders[ns] = nsb;
+        }
+        return this;
+    }
+    compile() {
+        const out = {};
+        if (this.attrsOut) {
+            out.attrs = {
+                allow: this.attrsOut.create !== undefined ? { create: this.attrsOut.create } : {},
+            };
+        }
+        if (this.hasDefaults) {
+            const block = { allow: this.defaultAllow ?? {} };
+            const bind = renderBinds(this.defaultBinds);
+            if (Object.keys(bind).length)
+                block.bind = bind;
+            out.$default = block;
+        }
+        if (this.rateLimitsConfig)
+            out.$rateLimits = this.rateLimitsConfig;
+        for (const [ns, nsb] of Object.entries(this.nsBuilders))
+            out[ns] = nsb.block();
+        return out;
+    }
+}
+export function definePerms(schema) {
+    return new PermsRuntime(schema);
+}
+//# sourceMappingURL=builder.js.map

package/dist/esm/perms/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../src/perms/builder.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAK1E,aAAa;AACb,aAAa;AAEb,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,IAAe,EAAE,GAAQ;IAC5C,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,KAA+B;IAClD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CACnE,CAAA;AACH,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAE/D,aAAa;AACb,oBAAoB;AAEpB,MAAM,gBAAgB;IAcD;IACA;IAdnB,yFAAyF;IACxE,YAAY,CAA0B;IACvD,6EAA6E;IAC5D,KAAK,GAA6B,EAAE,CAAA;IACrD,0EAA0E;IACzD,YAAY,GAA6C,EAAE,CAAA;IAC5E,6EAA6E;IAC5D,UAAU,GAA6D,EAAE,CAAA;IACzE,kBAAkB,CAAa;IACxC,QAAQ,GAAwB,EAAE,CAAA;IAClC,SAAS,GAA2B,EAAE,CAAA;IAE9C,YACmB,MAA6B,EAC7B,EAAU,EAC3B,aAAuC,EACvC,gBAA0B;QAHT,WAAM,GAAN,MAAM,CAAuB;QAC7B,OAAE,GAAF,EAAE,CAAQ;QAI3B,IAAI,CAAC,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAA;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7F,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IACnE,CAAC;IAED,wFAAwF;IAChF,MAAM,CAAC,MAAgC,EAAE,UAAmB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM;YAC3B,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACjD,CAAC,CAAC,UAAU,CAAA;QACd,OAAO,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC9D,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAA;IAC/D,CAAC;IAEO,gBAAgB,CAAC,GAAW,EAAE,KAAa;QACjD,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;IACnE,CAAC;IAEO,GAAG,CACT,QAAkC,EAClC,IAA8B,EAC9B,KAAc,EACd,IAA+B;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,4BAA4B,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAA;YAC/H,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,EAA0C;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAClG,CAAC;IAED,aAAa,CAAC,EAA0C;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC,EAA0C;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,CAAC;IAED,YAAY,CAAC,EAA0C;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IACrF,CAAC;IAED,QAAQ,CAAC,WAAmB,EAAE,SAAc,EAAE,OAAa;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,WAAW,CAAA;YAC1B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAC,GAAG,CACb,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EACjD,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAChC,CAAA;QACH,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,GAAG,CACb,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAChC,CAAA;IACH,CAAC;IAED,OAAO,CAAC,WAAmB,EAAE,SAAc,EAAE,OAAa;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,WAAW,CAAA;YAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1G,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,GAAG,CACb,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,IAAI,CAAC,KAAK,EACV,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CACnB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,KAAU;QACd,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACzF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;gBAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAU,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,CAAC,MAAM;gBACT,SAAQ;YACV,MAAM,GAAG,GAA2B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;oBACpF,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,IAAiB,EAAE,GAAG,CAAC,CAAA;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,KAAK,SAAS;gBACpB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,IAAiB,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,KAAK;QACH,MAAM,GAAG,GAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAC1B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;QACjB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;YACpC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,aAAa;AACb,mBAAmB;AAEnB,MAAM,eAAe;IACV,MAAM,GAA6B,EAAE,CAAA;IACrC,KAAK,GAA6B,EAAE,CAAA;IAC7C,QAAQ,GAAwB,EAAE,CAAA;IAE1B,GAAG;QACT,qEAAqE;QACrE,OAAO,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAA;IAC5E,CAAC;IAEO,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAA;IAClD,CAAC;IAEO,OAAO,CAAC,EAA0C,EAAE,IAA8B;QACxF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qEAAqE,CAAC,CAAA;YAC3H,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,EAA0C;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,CAAC,EAA0C;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,KAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gBAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,aAAa;AACb,gBAAgB;AAEhB,MAAM,YAAY;IAGa;IAF7B,GAAG,GAAwB,EAAE,CAAA;IAE7B,YAA6B,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAE9D,KAAK,CAAC,KAAU;QACd,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,aAAa;AACb,wBAAwB;AAExB,MAAM,YAAY;IASa;IARrB,aAAa,GAA6B,EAAE,CAAA;IAC5C,YAAY,GAA6B,EAAE,CAAA;IAC3C,YAAY,CAAiC;IAC7C,WAAW,GAAG,KAAK,CAAA;IACnB,QAAQ,CAAiC;IACzC,gBAAgB,CAAgC;IAChD,UAAU,GAAqC,EAAE,CAAA;IAEzD,YAA6B,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAEnD,KAAK,CAAC,EAAqC;QACzC,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,EAAE,CAAC,CAAC,CAAC,CAAA;QACL,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,EAA2C;QAClD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAA;QAC/B,EAAE,CAAC,CAAC,CAAC,CAAA;QACL,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,MAA0B;QACnC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAA+D;QACxE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAA;YAChF,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;YACvF,KAAK,CAAC,GAAG,CAAC,CAAA;YACV,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,GAAG,CAAA;QAC3B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAwB,EAAE,CAAA;QAEnC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,KAAK,GAAG;gBACV,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aAClF,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,KAAK,GAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAA;YACrD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC1B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YACnB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAA;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB;YACvB,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAEzC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAA;QAEvB,OAAO,GAAwB,CAAA;IACjC,CAAC;CACF;AAmBD,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,OAAO,IAAI,YAAY,CAAC,MAAM,CAAiC,CAAA;AACjE,CAAC","sourcesContent":["/**\n * The builder runtime and the `.compile()` pipeline.\n *\n * The chainable builders accumulate authoring state (staged expressions, bind\n * aliases, allow/fields rules) and `.compile()` walks them into the plain\n * `IdbPerms` object — CEL strings under ordinary Instant keys. Creativity is in\n * the authoring surface; the output is exactly what Instant already accepts.\n *\n * Inheritance follows the backend (`server/.../rule.clj` `with-binds`):\n * `$default.bind` is concatenated into every namespace there, so dux emits an\n * inherited bind once under `$default.bind` and references it by bare alias —\n * never re-emitting it per namespace. Staged values are authoring-only and are\n * copied into each namespace's scope so `s.*` resolves.\n */\nimport type { InstantRules } from '@instantdb/core'\nimport type { IdbSchema } from '../schema/defineSchema.js'\nimport type { IdbRegisteredSchema } from '../schema/register.js'\nimport type { ExprNode } from './ast.js'\nimport type { IdbPermsRateLimits, PermsBuilder } from './types.js'\nimport { makeContext } from './context.js'\nimport { makeValidator, namespaceExists, noValidate } from './validate.js'\n\ntype RuleValue = boolean | ExprNode | ((ctx: any) => boolean | ExprNode)\ntype Ctx = any\n\n// ==========\n// resolution\n\nfunction asCel(value: boolean | ExprNode): string {\n  return typeof value === 'boolean' ? String(value) : value.render()\n}\n\nfunction resolveRule(rule: RuleValue, ctx: Ctx): string {\n  return asCel(typeof rule === 'function' ? rule(ctx) : rule)\n}\n\nfunction renderBinds(binds: Record<string, ExprNode>): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(binds).map(([name, node]) => [name, node.render()]),\n  )\n}\n\nconst ACTIONS = ['view', 'create', 'update', 'delete'] as const\n\n// ==========\n// namespace builder\n\nclass NamespaceRuntime {\n  /** Common staged values — inlined, inherited from defaults, merged into every action. */\n  private readonly commonStaged: Record<string, ExprNode>\n  /** All emitted bind aliases — common and action-specific share one block. */\n  private readonly binds: Record<string, ExprNode> = {}\n  /** Per-whole-entity-action staged values, visible only in that action. */\n  private readonly actionStaged: Record<string, Record<string, ExprNode>> = {}\n  /** Per-(dir, label) staged values, visible only in that link/unlink rule. */\n  private readonly linkStaged: Record<string, Record<string, Record<string, ExprNode>>> = {}\n  private readonly inheritedBindNames: Set<string>\n  private allowOut: Record<string, any> = {}\n  private fieldsOut: Record<string, string> = {}\n\n  constructor(\n    private readonly schema: IdbSchema | undefined,\n    private readonly ns: string,\n    defaultStaged: Record<string, ExprNode>,\n    defaultBindNames: string[],\n  ) {\n    this.commonStaged = { ...defaultStaged }\n    this.inheritedBindNames = new Set(defaultBindNames)\n  }\n\n  /** Is this name already a common staged value, an emitted bind, or inherited? */\n  private known(name: string): boolean {\n    return name in this.commonStaged || name in this.binds || this.inheritedBindNames.has(name)\n  }\n\n  private linkTargetOf(label: string): string | undefined {\n    return this.schema?.entities[this.ns]?.links?.[label]?.entityName\n  }\n\n  /** Build a context over a staged snapshot, validating against ns (or a link target). */\n  private ctxFor(staged: Record<string, ExprNode>, linkTarget?: string): Ctx {\n    const validator = this.schema\n      ? makeValidator(this.schema, this.ns, linkTarget)\n      : noValidate\n    return makeContext({ staged, binds: this.binds }, validator)\n  }\n\n  private mergedStaged(action: string): Record<string, ExprNode> {\n    return { ...this.commonStaged, ...this.actionStaged[action] }\n  }\n\n  private mergedLinkStaged(dir: string, label: string): Record<string, ExprNode> {\n    return { ...this.commonStaged, ...this.linkStaged[dir]?.[label] }\n  }\n\n  private add(\n    produced: Record<string, ExprNode>,\n    into: Record<string, ExprNode>,\n    guard: boolean,\n    seen: (name: string) => boolean,\n  ): this {\n    for (const [name, node] of Object.entries(produced)) {\n      if (guard && seen(name))\n        throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined on '${this.ns}' — use .overrideStage/.overrideBind`)\n      into[name] = node\n    }\n    return this\n  }\n\n  stage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, true, n => this.known(n))\n  }\n\n  overrideStage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, false, () => false)\n  }\n\n  bind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, true, n => this.known(n))\n  }\n\n  overrideBind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, false, () => false)\n  }\n\n  stageFor(actionOrDir: string, labelOrFn: any, maybeFn?: any) {\n    if (maybeFn === undefined) {\n      const action = actionOrDir\n      const into = (this.actionStaged[action] ??= {})\n      return this.add(\n        labelOrFn(this.ctxFor(this.mergedStaged(action))),\n        into,\n        true,\n        n => this.known(n) || n in into,\n      )\n    }\n    const [dir, label] = [actionOrDir, labelOrFn]\n    const into = ((this.linkStaged[dir] ??= {})[label] ??= {})\n    return this.add(\n      maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))),\n      into,\n      true,\n      n => this.known(n) || n in into,\n    )\n  }\n\n  bindFor(actionOrDir: string, labelOrFn: any, maybeFn?: any) {\n    if (maybeFn === undefined) {\n      const action = actionOrDir\n      return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), this.binds, true, n => this.known(n))\n    }\n    const [dir, label] = [actionOrDir, labelOrFn]\n    return this.add(\n      maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))),\n      this.binds,\n      true,\n      n => this.known(n),\n    )\n  }\n\n  allow(input: any) {\n    const block = typeof input === 'function' ? input(this.ctxFor(this.commonStaged)) : input\n    for (const action of ACTIONS) {\n      if (block[action] !== undefined)\n        this.allowOut[action] = resolveRule(block[action], this.ctxFor(this.mergedStaged(action)))\n    }\n    for (const dir of ['link', 'unlink'] as const) {\n      const labels = block[dir]\n      if (!labels)\n        continue\n      const map: Record<string, string> = this.allowOut[dir] ?? {}\n      for (const [label, rule] of Object.entries(labels)) {\n        if (rule !== undefined) {\n          const ctx = this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))\n          map[label] = resolveRule(rule as RuleValue, ctx)\n        }\n      }\n      this.allowOut[dir] = map\n    }\n    return this\n  }\n\n  fields(input: any) {\n    const ctx = this.ctxFor(this.commonStaged)\n    const block = typeof input === 'function' ? input(ctx) : input\n    for (const [field, rule] of Object.entries(block)) {\n      if (rule !== undefined)\n        this.fieldsOut[field] = resolveRule(rule as RuleValue, ctx)\n    }\n    return this\n  }\n\n  /** The compiled namespace block. */\n  block(): any {\n    const out: any = { allow: this.allowOut }\n    const bind = renderBinds(this.binds)\n    if (Object.keys(bind).length)\n      out.bind = bind\n    if (Object.keys(this.fieldsOut).length)\n      out.fields = this.fieldsOut\n    return out\n  }\n}\n\n// ==========\n// defaults builder\n\nclass DefaultsRuntime {\n  readonly staged: Record<string, ExprNode> = {}\n  readonly binds: Record<string, ExprNode> = {}\n  allowOut: Record<string, any> = {}\n\n  private ctx(): Ctx {\n    // The default context is namespace-loose; the type layer narrows it.\n    return makeContext({ staged: this.staged, binds: this.binds }, noValidate)\n  }\n\n  private known(name: string): boolean {\n    return name in this.staged || name in this.binds\n  }\n\n  private collect(fn: (ctx: Ctx) => Record<string, ExprNode>, into: Record<string, ExprNode>) {\n    for (const [name, node] of Object.entries(fn(this.ctx()))) {\n      if (this.known(name))\n        throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined in defaults — use .overrideStage/.overrideBind`)\n      into[name] = node\n    }\n    return this\n  }\n\n  stage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.collect(fn, this.staged)\n  }\n\n  bind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.collect(fn, this.binds)\n  }\n\n  allow(input: any) {\n    const ctx = this.ctx()\n    const block = typeof input === 'function' ? input(ctx) : input\n    for (const key of ['$default', ...ACTIONS]) {\n      if (block[key] !== undefined)\n        this.allowOut[key] = resolveRule(block[key], ctx)\n    }\n    return this\n  }\n}\n\n// ==========\n// attrs builder\n\nclass AttrsRuntime {\n  out: { create?: string } = {}\n\n  constructor(private readonly schema: IdbSchema | undefined) {}\n\n  allow(input: any) {\n    const ctx = makeContext({ staged: {}, binds: {} }, noValidate)\n    const block = typeof input === 'function' ? input(ctx) : input\n    if (block.create !== undefined)\n      this.out.create = resolveRule(block.create, ctx)\n    return this\n  }\n}\n\n// ==========\n// the top-level builder\n\nclass PermsRuntime {\n  private defaultStaged: Record<string, ExprNode> = {}\n  private defaultBinds: Record<string, ExprNode> = {}\n  private defaultAllow: Record<string, any> | undefined\n  private hasDefaults = false\n  private attrsOut: { create?: string } | undefined\n  private rateLimitsConfig: IdbPermsRateLimits | undefined\n  private nsBuilders: Record<string, NamespaceRuntime> = {}\n\n  constructor(private readonly schema?: IdbSchema) {}\n\n  attrs(fn: (a: AttrsRuntime) => AttrsRuntime) {\n    const a = new AttrsRuntime(this.schema)\n    fn(a)\n    this.attrsOut = a.out\n    return this\n  }\n\n  defaults(fn: (d: DefaultsRuntime) => DefaultsRuntime) {\n    const d = new DefaultsRuntime()\n    fn(d)\n    this.hasDefaults = true\n    this.defaultStaged = d.staged\n    this.defaultBinds = d.binds\n    this.defaultAllow = d.allowOut\n    return this\n  }\n\n  rateLimits(config: IdbPermsRateLimits) {\n    this.rateLimitsConfig = config\n    return this\n  }\n\n  namespaces(map: Record<string, (ns: NamespaceRuntime) => NamespaceRuntime>) {\n    const defaultBindNames = Object.keys(this.defaultBinds)\n    for (const [ns, build] of Object.entries(map)) {\n      if (this.schema && !namespaceExists(this.schema, ns))\n        throw new Error(`QERR_PERMS_SCHEMA: '${ns}' is not a namespace in the schema`)\n      const nsb = new NamespaceRuntime(this.schema, ns, this.defaultStaged, defaultBindNames)\n      build(nsb)\n      this.nsBuilders[ns] = nsb\n    }\n    return this\n  }\n\n  compile(): InstantRules<any> {\n    const out: Record<string, any> = {}\n\n    if (this.attrsOut) {\n      out.attrs = {\n        allow: this.attrsOut.create !== undefined ? { create: this.attrsOut.create } : {},\n      }\n    }\n\n    if (this.hasDefaults) {\n      const block: any = { allow: this.defaultAllow ?? {} }\n      const bind = renderBinds(this.defaultBinds)\n      if (Object.keys(bind).length)\n        block.bind = bind\n      out.$default = block\n    }\n\n    if (this.rateLimitsConfig)\n      out.$rateLimits = this.rateLimitsConfig\n\n    for (const [ns, nsb] of Object.entries(this.nsBuilders))\n      out[ns] = nsb.block()\n\n    return out as InstantRules<any>\n  }\n}\n\n// ==========\n// definePerms\n\n/**\n * The typed permissions authoring entry. With the schema registered, no\n * argument is needed; pass the schema value to add runtime validation; pass an\n * explicit type param for a different schema (spec §2).\n *\n * @example\n *   export default definePerms(schema)\n *     .namespaces({\n *       tasks: ns => ns.allow({ view: true }),\n *     })\n *     .compile()\n */\nexport function definePerms<S extends IdbSchema>(schema: S): PermsBuilder<S>\nexport function definePerms<S extends IdbSchema = IdbRegisteredSchema>(): PermsBuilder<S>\nexport function definePerms(schema?: IdbSchema): PermsBuilder<any> {\n  return new PermsRuntime(schema) as unknown as PermsBuilder<any>\n}\n"]}

package/dist/esm/perms/context.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The runtime context — the object every authoring callback receives.
+ *
+ * One full context is built and handed to every callback; the *types* (in
+ * `types.ts`) decide which helpers are visible where, so an action-only helper
+ * (`eu`, `el`) simply isn't in scope outside its action. At runtime each helper
+ * is a thin factory over the CEL globals the backend installs: `auth`, `data`,
+ * `newData`, `linkedData`, `ruleParams`, `request`, `rateLimit`.
+ *
+ * `s` (staged) inlines the stored expression; `b` (bindings) renders the bare
+ * alias the backend resolves from the emitted `bind` block.
+ */
+import type { ExprNode } from './ast.js';
+import type { Validator } from './validate.js';
+/** The mutable state a namespace/defaults builder threads into its callbacks. */
+export interface ContextState {
+    /** Staged name → its inlined expression. */
+    staged: Record<string, ExprNode>;
+    /** Bound name → its emitted expression (the alias renders bare). */
+    binds: Record<string, ExprNode>;
+}
+/**
+ * Build the full context. The same object serves common, write, update,
+ * link/unlink, default, and attrs callbacks — types gate visibility.
+ */
+export declare function makeContext(state: ContextState, v?: Validator): any;
+//# sourceMappingURL=context.d.ts.map

package/dist/esm/perms/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/perms/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAI9C,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChC,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;CAChC;AAyDD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,GAAE,SAAsB,GAAG,GAAG,CAkC/E"}

package/dist/esm/perms/context.js

@@ -0,0 +1,93 @@
+import { atom, coerce, raw as rawNode } from './ast.js';
+import { noValidate } from './validate.js';
+/** Property access over a CEL root: `entityProxy('data').title` → `data.title`. */
+function entityProxy(root, check) {
+    return new Proxy({}, {
+        get: (_t, key) => {
+            check?.(key);
+            return atom(`${root}.${key}`);
+        },
+    });
+}
+/** `data.ref(...)` / `auth.ref(...)` / `linkedData.ref(...)` — always a list. */
+function refFn(root, check) {
+    return (path) => {
+        check?.(path);
+        return atom(`${root}.ref('${path}')`);
+    };
+}
+/** Functional composition helpers (`f` / `ops`). */
+function makeFns() {
+    const fold = (op, empty) => (...exprs) => {
+        if (exprs.length === 0)
+            return atom(empty);
+        return exprs.map(coerce).reduce((acc, next) => acc[op](next));
+    };
+    return {
+        and: fold('and', 'true'),
+        or: fold('or', 'false'),
+        not: (expr) => coerce(expr).not(),
+        eq: (a, b) => coerce(a).eq(b),
+        neq: (a, b) => coerce(a).neq(b),
+        gt: (a, b) => coerce(a).gt(b),
+        gte: (a, b) => coerce(a).gte(b),
+        lt: (a, b) => coerce(a).lt(b),
+        lte: (a, b) => coerce(a).lte(b),
+        in: (item, list) => coerce(item).in(list),
+        contains: (list, item) => coerce(list).contains(item),
+        size: (value) => coerce(value).size(),
+        list: (...values) => atom(`[${values.map(v => coerce(v).cel).join(', ')}]`),
+        str: (value) => coerce(value),
+        num: (value) => coerce(value),
+        bool: (value) => coerce(value),
+        null: () => atom('null'),
+    };
+}
+/** Buckets resolve lazily: `rl.createTask.limit(auth.id)` → `rateLimit.createTask.limit(...)`. */
+function rateLimitProxy() {
+    return new Proxy({}, {
+        get: (_t, bucket) => ({
+            limit: (key) => atom(`rateLimit.${bucket}.limit(${coerce(key).cel})`),
+        }),
+    });
+}
+/**
+ * Build the full context. The same object serves common, write, update,
+ * link/unlink, default, and attrs callbacks — types gate visibility.
+ */
+export function makeContext(state, v = noValidate) {
+    const fns = makeFns();
+    return {
+        auth: entityProxy('auth'),
+        ar: refFn('auth', v.authRef),
+        e: entityProxy('data', v.field),
+        ef: (key) => {
+            v.field(key);
+            return atom(`data.${key}`);
+        },
+        er: refFn('data', v.ref),
+        rp: (key) => {
+            v.ruleParam(key);
+            return atom(`ruleParams.${key}`);
+        },
+        req: entityProxy('request'),
+        eu: entityProxy('newData', v.field),
+        euf: (key) => {
+            v.field(key);
+            return atom(`newData.${key}`);
+        },
+        el: entityProxy('linkedData', v.linkedField),
+        elf: (key) => {
+            v.linkedField(key);
+            return atom(`linkedData.${key}`);
+        },
+        elr: refFn('linkedData', v.linkedRef),
+        f: fns,
+        ops: fns,
+        raw: (cel) => rawNode(cel),
+        rl: rateLimitProxy(),
+        s: state.staged,
+        b: new Proxy({}, { get: (_t, name) => atom(name) }),
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/esm/perms/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/perms/context.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,UAAU,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAU1C,mFAAmF;AACnF,SAAS,WAAW,CAAC,IAAY,EAAE,KAA6B;IAC9D,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE;YACvB,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;YACZ,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QAC/B,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,KAAK,CAAC,IAAY,EAAE,KAA8B;IACzD,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;QACb,OAAO,IAAI,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,CAAA;IACvC,CAAC,CAAA;AACH,CAAC;AAED,oDAAoD;AACpD,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,CAAC,EAAgB,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAY,EAAE;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAA;IACD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QACxB,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACvB,GAAG,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE;QAC1C,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,EAAE,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,EAAE,CAAC,CAAU,EAAE,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,EAAE,EAAE,CAAC,IAAa,EAAE,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAW,CAAC;QAClE,QAAQ,EAAE,CAAC,IAAa,EAAE,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvE,IAAI,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,GAAG,MAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtF,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACtC,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACtC,IAAI,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;KACzB,CAAA;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc;IACrB,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,MAAM,UAAU,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;SAC/E,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAmB,EAAE,IAAe,UAAU;IACxE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IACrB,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;QAC5B,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC;QAC/B,EAAE,EAAE,CAAC,GAAW,EAAE,EAAE;YAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACZ,OAAO,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAA;QAC5B,CAAC;QACD,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;QACxB,EAAE,EAAE,CAAC,GAAW,EAAE,EAAE;YAClB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAChB,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAA;QAClC,CAAC;QACD,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC;QAC3B,EAAE,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;QACnC,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE;YACnB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACZ,OAAO,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAA;QAC/B,CAAC;QACD,EAAE,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC;QAC5C,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE;YACnB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;YAClB,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAA;QAClC,CAAC;QACD,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;QACrC,CAAC,EAAE,GAAG;QACN,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QAClC,EAAE,EAAE,cAAc,EAAE;QACpB,CAAC,EAAE,KAAK,CAAC,MAAM;QACf,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KAC5D,CAAA;AACH,CAAC","sourcesContent":["/**\n * The runtime context — the object every authoring callback receives.\n *\n * One full context is built and handed to every callback; the *types* (in\n * `types.ts`) decide which helpers are visible where, so an action-only helper\n * (`eu`, `el`) simply isn't in scope outside its action. At runtime each helper\n * is a thin factory over the CEL globals the backend installs: `auth`, `data`,\n * `newData`, `linkedData`, `ruleParams`, `request`, `rateLimit`.\n *\n * `s` (staged) inlines the stored expression; `b` (bindings) renders the bare\n * alias the backend resolves from the emitted `bind` block.\n */\nimport type { ExprNode } from './ast.js'\nimport type { Validator } from './validate.js'\nimport { atom, coerce, raw as rawNode } from './ast.js'\nimport { noValidate } from './validate.js'\n\n/** The mutable state a namespace/defaults builder threads into its callbacks. */\nexport interface ContextState {\n  /** Staged name → its inlined expression. */\n  staged: Record<string, ExprNode>\n  /** Bound name → its emitted expression (the alias renders bare). */\n  binds: Record<string, ExprNode>\n}\n\n/** Property access over a CEL root: `entityProxy('data').title` → `data.title`. */\nfunction entityProxy(root: string, check?: (key: string) => void): any {\n  return new Proxy({}, {\n    get: (_t, key: string) => {\n      check?.(key)\n      return atom(`${root}.${key}`)\n    },\n  })\n}\n\n/** `data.ref(...)` / `auth.ref(...)` / `linkedData.ref(...)` — always a list. */\nfunction refFn(root: string, check?: (path: string) => void) {\n  return (path: string) => {\n    check?.(path)\n    return atom(`${root}.ref('${path}')`)\n  }\n}\n\n/** Functional composition helpers (`f` / `ops`). */\nfunction makeFns() {\n  const fold = (op: 'and' | 'or', empty: string) => (...exprs: unknown[]): ExprNode => {\n    if (exprs.length === 0)\n      return atom(empty)\n    return exprs.map(coerce).reduce((acc, next) => acc[op](next))\n  }\n  return {\n    and: fold('and', 'true'),\n    or: fold('or', 'false'),\n    not: (expr: unknown) => coerce(expr).not(),\n    eq: (a: unknown, b: unknown) => coerce(a).eq(b),\n    neq: (a: unknown, b: unknown) => coerce(a).neq(b),\n    gt: (a: unknown, b: unknown) => coerce(a).gt(b),\n    gte: (a: unknown, b: unknown) => coerce(a).gte(b),\n    lt: (a: unknown, b: unknown) => coerce(a).lt(b),\n    lte: (a: unknown, b: unknown) => coerce(a).lte(b),\n    in: (item: unknown, list: unknown) => coerce(item).in(list as any),\n    contains: (list: unknown, item: unknown) => coerce(list).contains(item),\n    size: (value: unknown) => coerce(value).size(),\n    list: (...values: unknown[]) => atom(`[${values.map(v => coerce(v).cel).join(', ')}]`),\n    str: (value: unknown) => coerce(value),\n    num: (value: unknown) => coerce(value),\n    bool: (value: unknown) => coerce(value),\n    null: () => atom('null'),\n  }\n}\n\n/** Buckets resolve lazily: `rl.createTask.limit(auth.id)` → `rateLimit.createTask.limit(...)`. */\nfunction rateLimitProxy(): any {\n  return new Proxy({}, {\n    get: (_t, bucket: string) => ({\n      limit: (key: unknown) => atom(`rateLimit.${bucket}.limit(${coerce(key).cel})`),\n    }),\n  })\n}\n\n/**\n * Build the full context. The same object serves common, write, update,\n * link/unlink, default, and attrs callbacks — types gate visibility.\n */\nexport function makeContext(state: ContextState, v: Validator = noValidate): any {\n  const fns = makeFns()\n  return {\n    auth: entityProxy('auth'),\n    ar: refFn('auth', v.authRef),\n    e: entityProxy('data', v.field),\n    ef: (key: string) => {\n      v.field(key)\n      return atom(`data.${key}`)\n    },\n    er: refFn('data', v.ref),\n    rp: (key: string) => {\n      v.ruleParam(key)\n      return atom(`ruleParams.${key}`)\n    },\n    req: entityProxy('request'),\n    eu: entityProxy('newData', v.field),\n    euf: (key: string) => {\n      v.field(key)\n      return atom(`newData.${key}`)\n    },\n    el: entityProxy('linkedData', v.linkedField),\n    elf: (key: string) => {\n      v.linkedField(key)\n      return atom(`linkedData.${key}`)\n    },\n    elr: refFn('linkedData', v.linkedRef),\n    f: fns,\n    ops: fns,\n    raw: (cel: string) => rawNode(cel),\n    rl: rateLimitProxy(),\n    s: state.staged,\n    b: new Proxy({}, { get: (_t, name: string) => atom(name) }),\n  }\n}\n"]}