@mszr/idb-dux 1.0.0

package/dist/esm/perms/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@mszr/idb-dux/perms` — typed CEL authoring.
+ *
+ * `definePerms` and the expression/context machinery that compiles to the
+ * plain rules object Instant already accepts. Authoring-only: no client
+ * runtime, never bundled into client JS.
+ *
+ * Spec: `../../../docs/dux-spec-perms.md`.
+ */
+export type { Expr, ExprArg, ItemExpr, ListExpr } from './ast.js';
+export { definePerms } from './builder.js';
+export type { ActionCtx, AllowBlock, AttrsBuilder, AuthExpr, CommonCtx, DefaultsBuilder, EntityAction, EntityExpr, Fns, IdbPerms, LinkAction, LinkCtx, NsBuilder, PermsBuilder, RateLimitCtx, RefPath, RefTerminal, RequestExpr, Rule, UpdateCtx, WriteCtx, WriteRequestExpr, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/perms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/perms/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,YAAY,EACV,SAAS,EACT,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,GAAG,EACH,QAAQ,EACR,UAAU,EACV,OAAO,EACP,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,WAAW,EACX,WAAW,EACX,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,gBAAgB,GACjB,MAAM,YAAY,CAAA"}

package/dist/esm/perms/index.js

@@ -0,0 +1,2 @@
+export { definePerms } from './builder.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/perms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/perms/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA","sourcesContent":["/**\n * `@mszr/idb-dux/perms` — typed CEL authoring.\n *\n * `definePerms` and the expression/context machinery that compiles to the\n * plain rules object Instant already accepts. Authoring-only: no client\n * runtime, never bundled into client JS.\n *\n * Spec: `../../../docs/dux-spec-perms.md`.\n */\nexport type { Expr, ExprArg, ItemExpr, ListExpr } from './ast.js'\nexport { definePerms } from './builder.js'\nexport type {\n  ActionCtx,\n  AllowBlock,\n  AttrsBuilder,\n  AuthExpr,\n  CommonCtx,\n  DefaultsBuilder,\n  EntityAction,\n  EntityExpr,\n  Fns,\n  IdbPerms,\n  LinkAction,\n  LinkCtx,\n  NsBuilder,\n  PermsBuilder,\n  RateLimitCtx,\n  RefPath,\n  RefTerminal,\n  RequestExpr,\n  Rule,\n  UpdateCtx,\n  WriteCtx,\n  WriteRequestExpr,\n} from './types.js'\n"]}

package/dist/esm/perms/types.d.ts

@@ -0,0 +1,353 @@
+/**
+ * The perms-domain types: the schema-aware context every callback receives,
+ * the ref-path machinery, the allow/fields/bind/stage shapes, the chainable
+ * builders, and the compiled `IdbPerms` output.
+ *
+ * The context is **entity-rooted with current unmarked** (conventions §10):
+ * `e`/`ef`/`er` read the current entity (`data.*`), `eu`/`euf` the updated one
+ * (`newData.*`, update only), `el`/`elf`/`elr` the linked one (`linkedData.*`,
+ * link/unlink only). Action-only values exist only in the matching action
+ * callback, so misusing one (`eu` in `view`) fails at the cursor.
+ */
+import type { DataAttrDef, InstantRules } from '@instantdb/core';
+import type { IdbSchema } from '../schema/defineSchema.js';
+import type { AttrsOf, AttrValue, FieldKeys, LinkLabels, LinkTarget } from '../schema/fields.js';
+import type { IdbRegisteredSchema } from '../schema/register.js';
+import type { IdbNamespaceName } from '../schema/types.js';
+import type { Expand } from '../schema/util.js';
+import type { Expr, ExprArg, ListExpr } from './ast.js';
+/** The authoring value type of a field. */
+export type FieldValue<S extends IdbSchema, NS extends string, K extends string> = K extends 'id' ? string : K extends FieldKeys<S, NS> ? AttrValue<AttrsOf<S, NS>[K]> : never;
+/** Property-access view of an entity: `id` plus every field, each an `Expr`. */
+export type EntityExpr<S extends IdbSchema, NS extends string> = Expand<{
+    id: Expr<string>;
+} & {
+    [K in FieldKeys<S, NS>]: Expr<FieldValue<S, NS, K>>;
+}>;
+type RefDepth = readonly unknown[];
+/** Ref-path autocomplete spans up to four link hops (spec §7), then `raw`. */
+type RefMaxHops = 4;
+type NextRef<D extends RefDepth> = [...D, unknown];
+type RefAttr<S extends IdbSchema, NS extends string> = FieldKeys<S, NS> | 'id';
+/**
+ * Every valid ref path from a namespace: one or more link hops ending in an
+ * attribute (`'memberships.user.id'`). Capped at `RefMaxHops` so the union
+ * stays tractable; deeper paths use `raw`.
+ */
+export type RefPath<S extends IdbSchema, NS extends string, D extends RefDepth = []> = D['length'] extends RefMaxHops ? never : {
+    [L in LinkLabels<S, NS>]: `${L}.${RefAttr<S, LinkTarget<S, NS, L>>}` | `${L}.${RefPath<S, LinkTarget<S, NS, L>, NextRef<D>>}`;
+}[LinkLabels<S, NS>];
+/** The value type a ref path terminates in — a list of these is what `er` returns. */
+export type RefTerminal<S extends IdbSchema, NS extends string, P extends string> = P extends `${infer L}.${infer Rest}` ? L extends LinkLabels<S, NS> ? Rest extends RefAttr<S, LinkTarget<S, NS, L>> ? FieldValue<S, LinkTarget<S, NS, L>, Rest> : RefTerminal<S, LinkTarget<S, NS, L>, Rest> : never : never;
+/** Auth refs start from `$users`, spelled `$user.`-prefixed (Instant's form). */
+export type AuthRefPath<S extends IdbSchema> = `$user.${RefPath<S, '$users'>}`;
+type AuthRefTerminal<S extends IdbSchema, P extends string> = P extends `$user.${infer Rest}` ? RefTerminal<S, '$users', Rest> : never;
+type RuleParamDefs<S extends IdbSchema, NS extends string> = NS extends keyof S['$dux']['namespaces'] ? S['$dux']['namespaces'][NS]['ruleParams'] extends infer RP ? RP extends Record<string, DataAttrDef<any, any, any, any>> ? RP : {} : {} : {};
+type RuleParamKeys<S extends IdbSchema, NS extends string> = keyof RuleParamDefs<S, NS> & string;
+type RuleParamValue<S extends IdbSchema, NS extends string, K extends string> = K extends keyof RuleParamDefs<S, NS> ? AttrValue<RuleParamDefs<S, NS>[K]> : never;
+/** The authenticated user — a `$users` entity, plus `id`, read as `auth.*`. */
+export type AuthExpr<S extends IdbSchema> = '$users' extends IdbNamespaceName<S> ? EntityExpr<S, '$users'> : {
+    id: Expr<string>;
+};
+/** Request metadata always in scope (`request.*`). */
+export interface RequestExpr {
+    time: Expr<Date>;
+    ip: Expr<string>;
+    origin: Expr<string>;
+}
+/** The create/update request: the common metadata plus the modified-field set. */
+export interface WriteRequestExpr extends RequestExpr {
+    modifiedFields: ListExpr<string>;
+}
+/** Functional composition — best for nested or n-ary rules (spec §8). */
+export interface Fns {
+    and: (...exprs: ExprArg<boolean>[]) => Expr<boolean>;
+    or: (...exprs: ExprArg<boolean>[]) => Expr<boolean>;
+    not: (expr: ExprArg<boolean>) => Expr<boolean>;
+    eq: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    neq: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    gt: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    gte: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    lt: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    lte: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>;
+    in: <T>(item: ExprArg<T>, list: readonly ExprArg<T>[] | ListExpr<T>) => Expr<boolean>;
+    contains: <T>(list: readonly ExprArg<T>[] | ListExpr<T>, item: ExprArg<T>) => Expr<boolean>;
+    size: (value: ListExpr<any> | ExprArg<string>) => Expr<number>;
+    list: <T>(...values: ExprArg<T>[]) => ListExpr<T>;
+    str: (value: ExprArg<string>) => Expr<string>;
+    num: (value: ExprArg<number>) => Expr<number>;
+    bool: (value: ExprArg<boolean>) => Expr<boolean>;
+    null: () => Expr<null>;
+}
+/** Configured rate-limit buckets, used as `rl.bucket.limit(key)`. */
+export type RateLimitCtx<RL> = {
+    [K in keyof RL]: {
+        limit: (key: ExprArg<unknown>) => Expr<boolean>;
+    };
+};
+/** How a bucket refills — mirrors Instant's `$rateLimits` refill shape (spec §11). */
+export interface IdbPermsRateLimitRefill {
+    amount?: number;
+    period?: string;
+    type?: 'interval' | 'greedy';
+}
+/** One token-bucket limit. */
+export interface IdbPermsRateLimitLimit {
+    capacity: number;
+    refill?: IdbPermsRateLimitRefill;
+}
+/** A named rate-limit bucket — used in rules via `rl.<name>.limit(key)`. */
+export interface IdbPermsRateLimit {
+    limits: IdbPermsRateLimitLimit[];
+}
+/** The `$rateLimits` configuration map (structurally Instant's shape). */
+export type IdbPermsRateLimits = Record<string, IdbPermsRateLimit>;
+/** The common context — every callback's baseline (spec §6). */
+export interface CommonCtx<S extends IdbSchema, NS extends string, St, Bn, RL> {
+    auth: AuthExpr<S>;
+    ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>;
+    e: EntityExpr<S, NS>;
+    ef: <K extends FieldKeys<S, NS>>(key: K) => Expr<FieldValue<S, NS, K>>;
+    er: <P extends RefPath<S, NS>>(path: P) => ListExpr<RefTerminal<S, NS, P>>;
+    rp: <K extends RuleParamKeys<S, NS>>(key: K) => Expr<RuleParamValue<S, NS, K>>;
+    req: RequestExpr;
+    f: Fns;
+    ops: Fns;
+    raw: <T = boolean>(cel: string) => Expr<T>;
+    rl: RateLimitCtx<RL>;
+    s: St;
+    b: Bn;
+}
+/** Create/update context — common plus `request.modifiedFields`. */
+export type WriteCtx<S extends IdbSchema, NS extends string, St, Bn, RL> = Omit<CommonCtx<S, NS, St, Bn, RL>, 'req'> & {
+    req: WriteRequestExpr;
+};
+/** Update context — write context plus the updated entity (`newData.*`). */
+export type UpdateCtx<S extends IdbSchema, NS extends string, St, Bn, RL> = WriteCtx<S, NS, St, Bn, RL> & {
+    eu: EntityExpr<S, NS>;
+    euf: <K extends FieldKeys<S, NS>>(key: K) => Expr<FieldValue<S, NS, K>>;
+};
+/** Link/unlink context — common plus the linked entity, typed per link label. */
+export type LinkCtx<S extends IdbSchema, NS extends string, L extends string, St, Bn, RL> = CommonCtx<S, NS, St, Bn, RL> & {
+    el: EntityExpr<S, LinkTarget<S, NS, L>>;
+    elf: <K extends FieldKeys<S, LinkTarget<S, NS, L>>>(key: K) => Expr<FieldValue<S, LinkTarget<S, NS, L>, K>>;
+    elr: <P extends RefPath<S, LinkTarget<S, NS, L>>>(path: P) => ListExpr<RefTerminal<S, LinkTarget<S, NS, L>, P>>;
+};
+/** The loose context for `.defaults` — no namespace, so reads are string-keyed. */
+export interface DefaultCtx<S extends IdbSchema, St, Bn, RL> {
+    auth: AuthExpr<S>;
+    ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>;
+    ef: (key: string) => Expr<unknown>;
+    er: (path: string) => ListExpr<unknown>;
+    rp: (key: string) => Expr<unknown>;
+    req: RequestExpr;
+    f: Fns;
+    ops: Fns;
+    raw: <T = boolean>(cel: string) => Expr<T>;
+    rl: RateLimitCtx<RL>;
+    s: St;
+    b: Bn;
+}
+/** The narrow context for `.attrs` — no entity, no refs (spec §5). */
+export interface AttrsCtx<S extends IdbSchema, RL> {
+    auth: AuthExpr<S>;
+    ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>;
+    req: RequestExpr;
+    f: Fns;
+    ops: Fns;
+    raw: <T = boolean>(cel: string) => Expr<T>;
+    rl: RateLimitCtx<RL>;
+}
+/** The four whole-entity actions a `stageFor`/`bindFor` can target. */
+export type EntityAction = 'view' | 'create' | 'update' | 'delete';
+/** The two link-label actions. */
+export type LinkAction = 'link' | 'unlink';
+/** One action's accumulated action-specific staged (`s`) and bind (`b`) names. */
+export interface Scope {
+    s: object;
+    b: object;
+}
+interface EmptyScope {
+    s: {};
+    b: {};
+}
+/**
+ * The action-specific names a namespace builder has accumulated — threaded
+ * through the builder's type so each appears *only* in its own action's
+ * callback. Whole-entity actions hold one scope; link/unlink hold one per label.
+ */
+export interface ActionScopes {
+    view: Scope;
+    create: Scope;
+    update: Scope;
+    delete: Scope;
+    link: Record<string, Scope>;
+    unlink: Record<string, Scope>;
+}
+/** The starting scopes — nothing action-specific yet. */
+export interface EmptyScopes {
+    view: EmptyScope;
+    create: EmptyScope;
+    update: EmptyScope;
+    delete: EmptyScope;
+    link: {};
+    unlink: {};
+}
+type LinkScopeOf<AX extends ActionScopes, D extends LinkAction, L extends string> = L extends keyof AX[D] ? AX[D][L] : EmptyScope;
+interface StageScope<Sc extends Scope, O> {
+    s: Expand<Sc['s'] & O>;
+    b: Sc['b'];
+}
+interface BindScope<Sc extends Scope, O> {
+    s: Sc['s'];
+    b: Expand<Sc['b'] & O>;
+}
+interface AddStage<AX extends ActionScopes, A extends EntityAction, O> {
+    view: A extends 'view' ? StageScope<AX['view'], O> : AX['view'];
+    create: A extends 'create' ? StageScope<AX['create'], O> : AX['create'];
+    update: A extends 'update' ? StageScope<AX['update'], O> : AX['update'];
+    delete: A extends 'delete' ? StageScope<AX['delete'], O> : AX['delete'];
+    link: AX['link'];
+    unlink: AX['unlink'];
+}
+interface AddBind<AX extends ActionScopes, A extends EntityAction, O> {
+    view: A extends 'view' ? BindScope<AX['view'], O> : AX['view'];
+    create: A extends 'create' ? BindScope<AX['create'], O> : AX['create'];
+    update: A extends 'update' ? BindScope<AX['update'], O> : AX['update'];
+    delete: A extends 'delete' ? BindScope<AX['delete'], O> : AX['delete'];
+    link: AX['link'];
+    unlink: AX['unlink'];
+}
+interface AddLinkStage<AX extends ActionScopes, D extends LinkAction, L extends string, O> {
+    view: AX['view'];
+    create: AX['create'];
+    update: AX['update'];
+    delete: AX['delete'];
+    link: D extends 'link' ? AX['link'] & {
+        [P in L]: StageScope<LinkScopeOf<AX, 'link', L>, O>;
+    } : AX['link'];
+    unlink: D extends 'unlink' ? AX['unlink'] & {
+        [P in L]: StageScope<LinkScopeOf<AX, 'unlink', L>, O>;
+    } : AX['unlink'];
+}
+interface AddLinkBind<AX extends ActionScopes, D extends LinkAction, L extends string, O> {
+    view: AX['view'];
+    create: AX['create'];
+    update: AX['update'];
+    delete: AX['delete'];
+    link: D extends 'link' ? AX['link'] & {
+        [P in L]: BindScope<LinkScopeOf<AX, 'link', L>, O>;
+    } : AX['link'];
+    unlink: D extends 'unlink' ? AX['unlink'] & {
+        [P in L]: BindScope<LinkScopeOf<AX, 'unlink', L>, O>;
+    } : AX['unlink'];
+}
+/** The context a whole-entity action callback (and its `stageFor`/`bindFor`) sees. */
+export type ActionCtx<S extends IdbSchema, NS extends string, St, Bn, RL, A extends EntityAction> = A extends 'update' ? UpdateCtx<S, NS, St, Bn, RL> : A extends 'create' ? WriteCtx<S, NS, St, Bn, RL> : CommonCtx<S, NS, St, Bn, RL>;
+/** A rule value: a boolean, an expression, or a callback returning one. */
+export type Rule<Ctx> = boolean | Expr<boolean> | ((ctx: Ctx) => boolean | Expr<boolean>);
+/**
+ * The allow block for a namespace. Each action's callback sees the common
+ * scope plus that action's `stageFor`/`bindFor` names (and, for link/unlink,
+ * the per-label ones) — so action-specific aliases resolve only where they
+ * make sense.
+ */
+export interface AllowBlock<S extends IdbSchema, NS extends string, St, Bn, RL, AX extends ActionScopes = EmptyScopes> {
+    view?: Rule<CommonCtx<S, NS, St & AX['view']['s'], Bn & AX['view']['b'], RL>>;
+    create?: Rule<WriteCtx<S, NS, St & AX['create']['s'], Bn & AX['create']['b'], RL>>;
+    update?: Rule<UpdateCtx<S, NS, St & AX['update']['s'], Bn & AX['update']['b'], RL>>;
+    delete?: Rule<CommonCtx<S, NS, St & AX['delete']['s'], Bn & AX['delete']['b'], RL>>;
+    link?: {
+        [L in LinkLabels<S, NS>]?: Rule<LinkCtx<S, NS, L, St & LinkScopeOf<AX, 'link', L>['s'], Bn & LinkScopeOf<AX, 'link', L>['b'], RL>>;
+    };
+    unlink?: {
+        [L in LinkLabels<S, NS>]?: Rule<LinkCtx<S, NS, L, St & LinkScopeOf<AX, 'unlink', L>['s'], Bn & LinkScopeOf<AX, 'unlink', L>['b'], RL>>;
+    };
+}
+export type AllowInput<S extends IdbSchema, NS extends string, St, Bn, RL, AX extends ActionScopes = EmptyScopes> = AllowBlock<S, NS, St, Bn, RL, AX> | ((ctx: CommonCtx<S, NS, St, Bn, RL>) => AllowBlock<S, NS, St, Bn, RL, AX>);
+/** Field-level rules — every field except `id`. */
+export type FieldsBlock<S extends IdbSchema, NS extends string> = {
+    [F in Exclude<FieldKeys<S, NS>, 'id'>]?: boolean | Expr<boolean>;
+};
+export type FieldsInput<S extends IdbSchema, NS extends string, St, Bn, RL> = FieldsBlock<S, NS> | ((ctx: CommonCtx<S, NS, St, Bn, RL>) => FieldsBlock<S, NS>);
+/** A stage/bind callback returns named expressions. */
+export type NameObj = Record<string, Expr<any>>;
+/**
+ * Maps duplicate names (already in `Existing`) to a diagnostic and leaves
+ * valid names untouched (intersection identity), so a clash lands on the
+ * offending key with an actionable message.
+ */
+export type NoDuplicateNames<O, Existing> = {
+    [K in keyof O]: K extends keyof Existing ? `QERR_PERMS_DUPLICATE_NAME: ${K & string} is already defined — use .overrideStage/.overrideBind to replace it` : unknown;
+};
+export interface DefaultAllowBlock<S extends IdbSchema, St, Bn, RL> {
+    $default?: Rule<DefaultCtx<S, St, Bn, RL>>;
+    view?: Rule<DefaultCtx<S, St, Bn, RL>>;
+    create?: Rule<DefaultCtx<S, St, Bn, RL>>;
+    update?: Rule<DefaultCtx<S, St, Bn, RL>>;
+    delete?: Rule<DefaultCtx<S, St, Bn, RL>>;
+}
+export type DefaultAllowInput<S extends IdbSchema, St, Bn, RL> = DefaultAllowBlock<S, St, Bn, RL> | ((ctx: DefaultCtx<S, St, Bn, RL>) => DefaultAllowBlock<S, St, Bn, RL>);
+/** The namespace builder — `ns` in `.namespaces({})` (spec §4). */
+export interface NsBuilder<S extends IdbSchema, NS extends string, St = {}, Bn = {}, RL = {}, AX extends ActionScopes = EmptyScopes> {
+    stage: <O extends NameObj>(fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>) => NsBuilder<S, NS, Expand<St & O>, Bn, RL, AX>;
+    overrideStage: <O extends NameObj>(fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O) => NsBuilder<S, NS, Expand<St & O>, Bn, RL, AX>;
+    bind: <O extends NameObj>(fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>) => NsBuilder<S, NS, St, Expand<Bn & O>, RL, AX>;
+    overrideBind: <O extends NameObj>(fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O) => NsBuilder<S, NS, St, Expand<Bn & O>, RL, AX>;
+    /**
+     * Action-specific staged values — authoring-only, visible only in the
+     * matching action's callback. For link/unlink, pass the label too (spec §9).
+     */
+    stageFor: {
+        <A extends EntityAction, O extends NameObj>(action: A, fn: (ctx: ActionCtx<S, NS, St & AX[A]['s'], Bn & AX[A]['b'], RL, A>) => O & NoDuplicateNames<O, St & Bn>): NsBuilder<S, NS, St, Bn, RL, AddStage<AX, A, O>>;
+        <D extends LinkAction, L extends LinkLabels<S, NS>, O extends NameObj>(dir: D, label: L, fn: (ctx: LinkCtx<S, NS, L, St & LinkScopeOf<AX, D, L>['s'], Bn & LinkScopeOf<AX, D, L>['b'], RL>) => O & NoDuplicateNames<O, St & Bn>): NsBuilder<S, NS, St, Bn, RL, AddLinkStage<AX, D, L, O>>;
+    };
+    /**
+     * Action-specific bind aliases — emitted into the namespace `bind` block
+     * (the backend evaluates each only where referenced), visible only in the
+     * matching action's callback (spec §9).
+     */
+    bindFor: {
+        <A extends EntityAction, O extends NameObj>(action: A, fn: (ctx: ActionCtx<S, NS, St & AX[A]['s'], Bn & AX[A]['b'], RL, A>) => O & NoDuplicateNames<O, St & Bn>): NsBuilder<S, NS, St, Bn, RL, AddBind<AX, A, O>>;
+        <D extends LinkAction, L extends LinkLabels<S, NS>, O extends NameObj>(dir: D, label: L, fn: (ctx: LinkCtx<S, NS, L, St & LinkScopeOf<AX, D, L>['s'], Bn & LinkScopeOf<AX, D, L>['b'], RL>) => O & NoDuplicateNames<O, St & Bn>): NsBuilder<S, NS, St, Bn, RL, AddLinkBind<AX, D, L, O>>;
+    };
+    allow: (input: AllowInput<S, NS, St, Bn, RL, AX>) => NsBuilder<S, NS, St, Bn, RL, AX>;
+    fields: (input: FieldsInput<S, NS, St, Bn, RL>) => NsBuilder<S, NS, St, Bn, RL, AX>;
+}
+/** The defaults builder — `d` in `.defaults()` (spec §5). */
+export interface DefaultsBuilder<S extends IdbSchema, St = {}, Bn = {}, RL = {}> {
+    stage: <O extends NameObj>(fn: (ctx: DefaultCtx<S, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>) => DefaultsBuilder<S, Expand<St & O>, Bn, RL>;
+    bind: <O extends NameObj>(fn: (ctx: DefaultCtx<S, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>) => DefaultsBuilder<S, St, Expand<Bn & O>, RL>;
+    allow: (input: DefaultAllowInput<S, St, Bn, RL>) => DefaultsBuilder<S, St, Bn, RL>;
+    readonly __binds?: Bn;
+}
+/** The attrs builder — create-only (spec §5). */
+export interface AttrsBuilder<S extends IdbSchema, RL = {}> {
+    allow: (input: {
+        create?: boolean | Expr<boolean>;
+    } | ((ctx: AttrsCtx<S, RL>) => {
+        create?: boolean | Expr<boolean>;
+    })) => AttrsBuilder<S, RL>;
+}
+type DefaultStagedOf<D> = D extends DefaultsBuilder<any, infer St, any, any> ? St : {};
+type DefaultBindsOf<D> = D extends DefaultsBuilder<any, any, infer Bn, any> ? Bn : {};
+/** The `.namespaces({})` input — keys are schema namespaces, callbacks build each. */
+export type NamespacesInput<S extends IdbSchema, St, Bn, RL> = {
+    [NS in IdbNamespaceName<S>]?: (ns: NsBuilder<S, NS, St, Bn, RL>) => NsBuilder<S, NS, any, any, RL, any>;
+};
+/** The top-level builder returned by `definePerms` (spec §3). */
+export interface PermsBuilder<S extends IdbSchema, St = {}, Bn = {}, RL = {}> {
+    attrs: (fn: (a: AttrsBuilder<S, RL>) => AttrsBuilder<S, RL>) => PermsBuilder<S, St, Bn, RL>;
+    defaults: <D extends DefaultsBuilder<S, any, any, RL>>(fn: (d: DefaultsBuilder<S, {}, {}, RL>) => D) => PermsBuilder<S, DefaultStagedOf<D>, DefaultBindsOf<D>, RL>;
+    rateLimits: <R extends IdbPermsRateLimits>(config: R) => PermsBuilder<S, St, Bn, R>;
+    namespaces: (map: NamespacesInput<S, St, Bn, RL>) => PermsBuilder<S, St, Bn, RL>;
+    compile: () => IdbPerms<S>;
+}
+/**
+ * The compiled rules object — plain CEL strings, structurally assignable to
+ * the official `InstantRules<S>` (so CLI push and platform `pushPerms` accept
+ * it unchanged).
+ */
+export type IdbPerms<S extends IdbSchema = IdbRegisteredSchema> = InstantRules<S>;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/perms/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/perms/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAKvD,2CAA2C;AAC3C,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,IAC3E,CAAC,SAAS,IAAI,GAAG,MAAM,GACrB,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,IAAI,MAAM,CACrE;IAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG;KACpB,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;CACpD,CACF,CAAA;AAED,KAAK,QAAQ,GAAG,SAAS,OAAO,EAAE,CAAA;AAClC,8EAA8E;AAC9E,KAAK,UAAU,GAAG,CAAC,CAAA;AACnB,KAAK,OAAO,CAAC,CAAC,SAAS,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;AAElD,KAAK,OAAO,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAA;AAE9E;;;;GAIG;AACH,MAAM,MAAM,OAAO,CACjB,CAAC,SAAS,SAAS,EACnB,EAAE,SAAS,MAAM,EACjB,CAAC,SAAS,QAAQ,GAAG,EAAE,IACrB,CAAC,CAAC,QAAQ,CAAC,SAAS,UAAU,GAC9B,KAAK,GACL;KACG,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,GACnB,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAC1C,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;CAC3D,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAExB,sFAAsF;AACtF,MAAM,MAAM,WAAW,CACrB,CAAC,SAAS,SAAS,EACnB,EAAE,SAAS,MAAM,EACjB,CAAC,SAAS,MAAM,IACd,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,MAAM,IAAI,EAAE,GACpC,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,GACzB,IAAI,SAAS,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAC3C,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GACzC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAC5C,KAAK,GACP,KAAK,CAAA;AAET,iFAAiF;AACjF,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,SAAS,IAAI,SAAS,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAA;AAC9E,KAAK,eAAe,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,MAAM,IACtD,CAAC,SAAS,SAAS,MAAM,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,CAAA;AAK5E,KAAK,aAAa,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,IACrD,EAAE,SAAS,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GACtC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,SAAS,MAAM,EAAE,GACxD,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GACxD,EAAE,GACF,EAAE,GACJ,EAAE,GACJ,EAAE,CAAA;AAER,KAAK,aAAa,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,IAAI,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAA;AAChG,KAAK,cAAc,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,IACxE,CAAC,SAAS,MAAM,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;AAKrF,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,SAAS,IACpC,QAAQ,SAAS,gBAAgB,CAAC,CAAC,CAAC,GAClC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;CAAE,CAAA;AAE1B,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAChB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CACjC;AAED,yEAAyE;AACzE,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACpD,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9C,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACtD,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACtD,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACtD,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACvD,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACrF,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3F,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9D,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,qEAAqE;AACrE,MAAM,MAAM,YAAY,CAAC,EAAE,IAAI;KAC5B,CAAC,IAAI,MAAM,EAAE,GAAG;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE;CACrE,CAAA;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;CAC7B;AAED,8BAA8B;AAC9B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,uBAAuB,CAAA;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,sBAAsB,EAAE,CAAA;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;AAKlE,gEAAgE;AAChE,MAAM,WAAW,SAAS,CACxB,CAAC,SAAS,SAAS,EACnB,EAAE,SAAS,MAAM,EACjB,EAAE,EACF,EAAE,EACF,EAAE;IAEF,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjB,EAAE,EAAE,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpB,EAAE,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACtE,EAAE,EAAE,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,EAAE,EAAE,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9E,GAAG,EAAE,WAAW,CAAA;IAChB,CAAC,EAAE,GAAG,CAAA;IACN,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1C,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;IACpB,CAAC,EAAE,EAAE,CAAA;IACL,CAAC,EAAE,EAAE,CAAA;CACN;AAED,oEAAoE;AACpE,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IACnE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG;IAAE,GAAG,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAEzE,4EAA4E;AAC5E,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IACpE,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG;IAC9B,EAAE,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrB,GAAG,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;CACxE,CAAA;AAEH,iFAAiF;AACjF,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IACpF,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG;IAC/B,EAAE,EAAE,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACvC,GAAG,EAAE,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3G,GAAG,EAAE,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;CAChH,CAAA;AAEH,mFAAmF;AACnF,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IACzD,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjB,EAAE,EAAE,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAClC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAA;IACvC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAClC,GAAG,EAAE,WAAW,CAAA;IAChB,CAAC,EAAE,GAAG,CAAA;IACN,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1C,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;IACpB,CAAC,EAAE,EAAE,CAAA;IACL,CAAC,EAAE,EAAE,CAAA;CACN;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE;IAC/C,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACjB,EAAE,EAAE,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,GAAG,EAAE,WAAW,CAAA;IAChB,CAAC,EAAE,GAAG,CAAA;IACN,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1C,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;CACrB;AAKD,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAClE,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAA;AAE1C,kFAAkF;AAClF,MAAM,WAAW,KAAK;IAAG,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/C,UAAU,UAAU;IAAG,CAAC,EAAE,EAAE,CAAC;IAAC,CAAC,EAAE,EAAE,CAAA;CAAE;AAErC;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,KAAK,CAAA;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAC9B;AAED,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,EAAE,CAAA;IACR,MAAM,EAAE,EAAE,CAAA;CACX;AAED,KAAK,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,IAC5E,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;AAEjD,UAAU,UAAU,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE;AAChF,UAAU,SAAS,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;CAAE;AAK/E,UAAU,QAAQ,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC,SAAS,YAAY,EAAE,CAAC;IACnE,IAAI,EAAE,CAAC,SAAS,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAC/D,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACvE,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACvE,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACvE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAChB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;CACrB;AACD,UAAU,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC,SAAS,YAAY,EAAE,CAAC;IAClE,IAAI,EAAE,CAAC,SAAS,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;IACtE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAChB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;CACrB;AACD,UAAU,YAAY,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC;IACvF,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAChB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,IAAI,EAAE,CAAC,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG;SAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAC1G,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG;SAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;CACrH;AACD,UAAU,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC;IACtF,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAChB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAA;IACpB,IAAI,EAAE,CAAC,SAAS,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG;SAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IACzG,MAAM,EAAE,CAAC,SAAS,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG;SAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;CACpH;AAED,sFAAsF;AACtF,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,YAAY,IAC5F,CAAC,SAAS,QAAQ,GAChB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAC5B,CAAC,SAAS,QAAQ,GAChB,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAC3B,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AAKpC,2EAA2E;AAC3E,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,YAAY,GAAG,WAAW;IACnH,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7E,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IAClF,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACnF,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACnF,IAAI,CAAC,EAAE;SACJ,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;KACnI,CAAA;IACD,MAAM,CAAC,EAAE;SACN,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;KACvI,CAAA;CACF;AAED,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,YAAY,GAAG,WAAW,IAC5G,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAElH,mDAAmD;AACnD,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,IAAI;KAC/D,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;CACjE,CAAA;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IACtE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEpF,uDAAuD;AACvD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAE/C;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,EAAE,QAAQ,IAAI;KACzC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,MAAM,QAAQ,GACpC,8BAA8B,CAAC,GAAG,MAAM,sEAAsE,GAC9G,OAAO;CACZ,CAAA;AAKD,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAChE,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;CACzC;AAED,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IACzD,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAK7G,mEAAmE;AACnE,MAAM,WAAW,SAAS,CACxB,CAAC,SAAS,SAAS,EACnB,EAAE,SAAS,MAAM,EACjB,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE,EACP,EAAE,SAAS,YAAY,GAAG,WAAW;IAErC,KAAK,EAAE,CAAC,CAAC,SAAS,OAAO,EACvB,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KACxE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACjD,aAAa,EAAE,CAAC,CAAC,SAAS,OAAO,EAC/B,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KACzC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,EAAE,CAAC,CAAC,SAAS,OAAO,EACtB,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KACxE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACjD,YAAY,EAAE,CAAC,CAAC,SAAS,OAAO,EAC9B,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KACzC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACjD;;;OAGG;IACH,QAAQ,EAAE;QACR,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,OAAO,EACxC,MAAM,EAAE,CAAC,EACT,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GACvG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,OAAO,EACnE,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,CAAC,EACR,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GACrI,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;KAC3D,CAAA;IACD;;;;OAIG;IACH,OAAO,EAAE;QACP,CAAC,CAAC,SAAS,YAAY,EAAE,CAAC,SAAS,OAAO,EACxC,MAAM,EAAE,CAAC,EACT,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GACvG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,OAAO,EACnE,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,CAAC,EACR,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GACrI,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;KAC1D,CAAA;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACrF,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;CACpF;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe,CAC9B,CAAC,SAAS,SAAS,EACnB,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE;IAEP,KAAK,EAAE,CAAC,CAAC,SAAS,OAAO,EACvB,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KACrE,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,EAAE,CAAC,CAAC,SAAS,OAAO,EACtB,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KACrE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/C,KAAK,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAMlF,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAA;CACtB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,GAAG,EAAE;IACxD,KAAK,EAAE,CAAC,KAAK,EACT;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,GACpC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;CAC7F;AAED,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;AACtF,KAAK,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;AAErF,sFAAsF;AACtF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI;KAC5D,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5B,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAC7B,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;CACzC,CAAA;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,SAAS,EACnB,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE,EACP,EAAE,GAAG,EAAE;IAEP,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3F,QAAQ,EAAE,CAAC,CAAC,SAAS,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EACnD,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KACzC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,UAAU,EAAE,CAAC,CAAC,SAAS,kBAAkB,EAAE,MAAM,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACnF,UAAU,EAAE,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAChF,OAAO,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAA;CAC3B;AAKD;;;;GAIG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,SAAS,GAAG,mBAAmB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/esm/perms/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/perms/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/perms/types.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * The perms-domain types: the schema-aware context every callback receives,\n * the ref-path machinery, the allow/fields/bind/stage shapes, the chainable\n * builders, and the compiled `IdbPerms` output.\n *\n * The context is **entity-rooted with current unmarked** (conventions §10):\n * `e`/`ef`/`er` read the current entity (`data.*`), `eu`/`euf` the updated one\n * (`newData.*`, update only), `el`/`elf`/`elr` the linked one (`linkedData.*`,\n * link/unlink only). Action-only values exist only in the matching action\n * callback, so misusing one (`eu` in `view`) fails at the cursor.\n */\nimport type { DataAttrDef, InstantRules } from '@instantdb/core'\nimport type { IdbSchema } from '../schema/defineSchema.js'\nimport type {\n  AttrsOf,\n  AttrValue,\n  FieldKeys,\n  LinkLabels,\n  LinkTarget,\n} from '../schema/fields.js'\nimport type { IdbRegisteredSchema } from '../schema/register.js'\nimport type { IdbNamespaceName } from '../schema/types.js'\nimport type { Expand } from '../schema/util.js'\nimport type { Expr, ExprArg, ListExpr } from './ast.js'\n\n// ==========\n// field + ref resolution\n\n/** The authoring value type of a field. */\nexport type FieldValue<S extends IdbSchema, NS extends string, K extends string>\n  = K extends 'id' ? string\n    : K extends FieldKeys<S, NS> ? AttrValue<AttrsOf<S, NS>[K]> : never\n\n/** Property-access view of an entity: `id` plus every field, each an `Expr`. */\nexport type EntityExpr<S extends IdbSchema, NS extends string> = Expand<\n  { id: Expr<string> } & {\n    [K in FieldKeys<S, NS>]: Expr<FieldValue<S, NS, K>>\n  }\n>\n\ntype RefDepth = readonly unknown[]\n/** Ref-path autocomplete spans up to four link hops (spec §7), then `raw`. */\ntype RefMaxHops = 4\ntype NextRef<D extends RefDepth> = [...D, unknown]\n\ntype RefAttr<S extends IdbSchema, NS extends string> = FieldKeys<S, NS> | 'id'\n\n/**\n * Every valid ref path from a namespace: one or more link hops ending in an\n * attribute (`'memberships.user.id'`). Capped at `RefMaxHops` so the union\n * stays tractable; deeper paths use `raw`.\n */\nexport type RefPath<\n  S extends IdbSchema,\n  NS extends string,\n  D extends RefDepth = [],\n> = D['length'] extends RefMaxHops\n  ? never\n  : {\n      [L in LinkLabels<S, NS>]:\n        | `${L}.${RefAttr<S, LinkTarget<S, NS, L>>}`\n        | `${L}.${RefPath<S, LinkTarget<S, NS, L>, NextRef<D>>}`\n    }[LinkLabels<S, NS>]\n\n/** The value type a ref path terminates in — a list of these is what `er` returns. */\nexport type RefTerminal<\n  S extends IdbSchema,\n  NS extends string,\n  P extends string,\n> = P extends `${infer L}.${infer Rest}`\n  ? L extends LinkLabels<S, NS>\n    ? Rest extends RefAttr<S, LinkTarget<S, NS, L>>\n      ? FieldValue<S, LinkTarget<S, NS, L>, Rest>\n      : RefTerminal<S, LinkTarget<S, NS, L>, Rest>\n    : never\n  : never\n\n/** Auth refs start from `$users`, spelled `$user.`-prefixed (Instant's form). */\nexport type AuthRefPath<S extends IdbSchema> = `$user.${RefPath<S, '$users'>}`\ntype AuthRefTerminal<S extends IdbSchema, P extends string>\n  = P extends `$user.${infer Rest}` ? RefTerminal<S, '$users', Rest> : never\n\n// ==========\n// ruleParams resolution\n\ntype RuleParamDefs<S extends IdbSchema, NS extends string>\n  = NS extends keyof S['$dux']['namespaces']\n    ? S['$dux']['namespaces'][NS]['ruleParams'] extends infer RP\n      ? RP extends Record<string, DataAttrDef<any, any, any, any>>\n        ? RP\n        : {}\n      : {}\n    : {}\n\ntype RuleParamKeys<S extends IdbSchema, NS extends string> = keyof RuleParamDefs<S, NS> & string\ntype RuleParamValue<S extends IdbSchema, NS extends string, K extends string>\n  = K extends keyof RuleParamDefs<S, NS> ? AttrValue<RuleParamDefs<S, NS>[K]> : never\n\n// ==========\n// the fixed CEL globals\n\n/** The authenticated user — a `$users` entity, plus `id`, read as `auth.*`. */\nexport type AuthExpr<S extends IdbSchema>\n  = '$users' extends IdbNamespaceName<S>\n    ? EntityExpr<S, '$users'>\n    : { id: Expr<string> }\n\n/** Request metadata always in scope (`request.*`). */\nexport interface RequestExpr {\n  time: Expr<Date>\n  ip: Expr<string>\n  origin: Expr<string>\n}\n\n/** The create/update request: the common metadata plus the modified-field set. */\nexport interface WriteRequestExpr extends RequestExpr {\n  modifiedFields: ListExpr<string>\n}\n\n/** Functional composition — best for nested or n-ary rules (spec §8). */\nexport interface Fns {\n  and: (...exprs: ExprArg<boolean>[]) => Expr<boolean>\n  or: (...exprs: ExprArg<boolean>[]) => Expr<boolean>\n  not: (expr: ExprArg<boolean>) => Expr<boolean>\n  eq: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  neq: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  gt: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  gte: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  lt: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  lte: <T>(a: ExprArg<T>, b: ExprArg<T>) => Expr<boolean>\n  in: <T>(item: ExprArg<T>, list: readonly ExprArg<T>[] | ListExpr<T>) => Expr<boolean>\n  contains: <T>(list: readonly ExprArg<T>[] | ListExpr<T>, item: ExprArg<T>) => Expr<boolean>\n  size: (value: ListExpr<any> | ExprArg<string>) => Expr<number>\n  list: <T>(...values: ExprArg<T>[]) => ListExpr<T>\n  str: (value: ExprArg<string>) => Expr<string>\n  num: (value: ExprArg<number>) => Expr<number>\n  bool: (value: ExprArg<boolean>) => Expr<boolean>\n  null: () => Expr<null>\n}\n\n/** Configured rate-limit buckets, used as `rl.bucket.limit(key)`. */\nexport type RateLimitCtx<RL> = {\n  [K in keyof RL]: { limit: (key: ExprArg<unknown>) => Expr<boolean> }\n}\n\n/** How a bucket refills — mirrors Instant's `$rateLimits` refill shape (spec §11). */\nexport interface IdbPermsRateLimitRefill {\n  amount?: number\n  period?: string\n  type?: 'interval' | 'greedy'\n}\n\n/** One token-bucket limit. */\nexport interface IdbPermsRateLimitLimit {\n  capacity: number\n  refill?: IdbPermsRateLimitRefill\n}\n\n/** A named rate-limit bucket — used in rules via `rl.<name>.limit(key)`. */\nexport interface IdbPermsRateLimit {\n  limits: IdbPermsRateLimitLimit[]\n}\n\n/** The `$rateLimits` configuration map (structurally Instant's shape). */\nexport type IdbPermsRateLimits = Record<string, IdbPermsRateLimit>\n\n// ==========\n// contexts\n\n/** The common context — every callback's baseline (spec §6). */\nexport interface CommonCtx<\n  S extends IdbSchema,\n  NS extends string,\n  St,\n  Bn,\n  RL,\n> {\n  auth: AuthExpr<S>\n  ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>\n  e: EntityExpr<S, NS>\n  ef: <K extends FieldKeys<S, NS>>(key: K) => Expr<FieldValue<S, NS, K>>\n  er: <P extends RefPath<S, NS>>(path: P) => ListExpr<RefTerminal<S, NS, P>>\n  rp: <K extends RuleParamKeys<S, NS>>(key: K) => Expr<RuleParamValue<S, NS, K>>\n  req: RequestExpr\n  f: Fns\n  ops: Fns\n  raw: <T = boolean>(cel: string) => Expr<T>\n  rl: RateLimitCtx<RL>\n  s: St\n  b: Bn\n}\n\n/** Create/update context — common plus `request.modifiedFields`. */\nexport type WriteCtx<S extends IdbSchema, NS extends string, St, Bn, RL>\n  = Omit<CommonCtx<S, NS, St, Bn, RL>, 'req'> & { req: WriteRequestExpr }\n\n/** Update context — write context plus the updated entity (`newData.*`). */\nexport type UpdateCtx<S extends IdbSchema, NS extends string, St, Bn, RL>\n  = WriteCtx<S, NS, St, Bn, RL> & {\n    eu: EntityExpr<S, NS>\n    euf: <K extends FieldKeys<S, NS>>(key: K) => Expr<FieldValue<S, NS, K>>\n  }\n\n/** Link/unlink context — common plus the linked entity, typed per link label. */\nexport type LinkCtx<S extends IdbSchema, NS extends string, L extends string, St, Bn, RL>\n  = CommonCtx<S, NS, St, Bn, RL> & {\n    el: EntityExpr<S, LinkTarget<S, NS, L>>\n    elf: <K extends FieldKeys<S, LinkTarget<S, NS, L>>>(key: K) => Expr<FieldValue<S, LinkTarget<S, NS, L>, K>>\n    elr: <P extends RefPath<S, LinkTarget<S, NS, L>>>(path: P) => ListExpr<RefTerminal<S, LinkTarget<S, NS, L>, P>>\n  }\n\n/** The loose context for `.defaults` — no namespace, so reads are string-keyed. */\nexport interface DefaultCtx<S extends IdbSchema, St, Bn, RL> {\n  auth: AuthExpr<S>\n  ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>\n  ef: (key: string) => Expr<unknown>\n  er: (path: string) => ListExpr<unknown>\n  rp: (key: string) => Expr<unknown>\n  req: RequestExpr\n  f: Fns\n  ops: Fns\n  raw: <T = boolean>(cel: string) => Expr<T>\n  rl: RateLimitCtx<RL>\n  s: St\n  b: Bn\n}\n\n/** The narrow context for `.attrs` — no entity, no refs (spec §5). */\nexport interface AttrsCtx<S extends IdbSchema, RL> {\n  auth: AuthExpr<S>\n  ar: <P extends AuthRefPath<S>>(path: P) => ListExpr<AuthRefTerminal<S, P>>\n  req: RequestExpr\n  f: Fns\n  ops: Fns\n  raw: <T = boolean>(cel: string) => Expr<T>\n  rl: RateLimitCtx<RL>\n}\n\n// ==========\n// action scopes — what stageFor/bindFor accumulate\n\n/** The four whole-entity actions a `stageFor`/`bindFor` can target. */\nexport type EntityAction = 'view' | 'create' | 'update' | 'delete'\n/** The two link-label actions. */\nexport type LinkAction = 'link' | 'unlink'\n\n/** One action's accumulated action-specific staged (`s`) and bind (`b`) names. */\nexport interface Scope { s: object, b: object }\ninterface EmptyScope { s: {}, b: {} }\n\n/**\n * The action-specific names a namespace builder has accumulated — threaded\n * through the builder's type so each appears *only* in its own action's\n * callback. Whole-entity actions hold one scope; link/unlink hold one per label.\n */\nexport interface ActionScopes {\n  view: Scope\n  create: Scope\n  update: Scope\n  delete: Scope\n  link: Record<string, Scope>\n  unlink: Record<string, Scope>\n}\n\n/** The starting scopes — nothing action-specific yet. */\nexport interface EmptyScopes {\n  view: EmptyScope\n  create: EmptyScope\n  update: EmptyScope\n  delete: EmptyScope\n  link: {}\n  unlink: {}\n}\n\ntype LinkScopeOf<AX extends ActionScopes, D extends LinkAction, L extends string>\n  = L extends keyof AX[D] ? AX[D][L] : EmptyScope\n\ninterface StageScope<Sc extends Scope, O> { s: Expand<Sc['s'] & O>, b: Sc['b'] }\ninterface BindScope<Sc extends Scope, O> { s: Sc['s'], b: Expand<Sc['b'] & O> }\n\n// The full ActionScopes is rebuilt explicitly (rather than Omit + re-add) so the\n// result is statically known to keep all six keys, satisfying the constraint\n// even while `A` is still a generic.\ninterface AddStage<AX extends ActionScopes, A extends EntityAction, O> {\n  view: A extends 'view' ? StageScope<AX['view'], O> : AX['view']\n  create: A extends 'create' ? StageScope<AX['create'], O> : AX['create']\n  update: A extends 'update' ? StageScope<AX['update'], O> : AX['update']\n  delete: A extends 'delete' ? StageScope<AX['delete'], O> : AX['delete']\n  link: AX['link']\n  unlink: AX['unlink']\n}\ninterface AddBind<AX extends ActionScopes, A extends EntityAction, O> {\n  view: A extends 'view' ? BindScope<AX['view'], O> : AX['view']\n  create: A extends 'create' ? BindScope<AX['create'], O> : AX['create']\n  update: A extends 'update' ? BindScope<AX['update'], O> : AX['update']\n  delete: A extends 'delete' ? BindScope<AX['delete'], O> : AX['delete']\n  link: AX['link']\n  unlink: AX['unlink']\n}\ninterface AddLinkStage<AX extends ActionScopes, D extends LinkAction, L extends string, O> {\n  view: AX['view']\n  create: AX['create']\n  update: AX['update']\n  delete: AX['delete']\n  link: D extends 'link' ? AX['link'] & { [P in L]: StageScope<LinkScopeOf<AX, 'link', L>, O> } : AX['link']\n  unlink: D extends 'unlink' ? AX['unlink'] & { [P in L]: StageScope<LinkScopeOf<AX, 'unlink', L>, O> } : AX['unlink']\n}\ninterface AddLinkBind<AX extends ActionScopes, D extends LinkAction, L extends string, O> {\n  view: AX['view']\n  create: AX['create']\n  update: AX['update']\n  delete: AX['delete']\n  link: D extends 'link' ? AX['link'] & { [P in L]: BindScope<LinkScopeOf<AX, 'link', L>, O> } : AX['link']\n  unlink: D extends 'unlink' ? AX['unlink'] & { [P in L]: BindScope<LinkScopeOf<AX, 'unlink', L>, O> } : AX['unlink']\n}\n\n/** The context a whole-entity action callback (and its `stageFor`/`bindFor`) sees. */\nexport type ActionCtx<S extends IdbSchema, NS extends string, St, Bn, RL, A extends EntityAction>\n  = A extends 'update'\n    ? UpdateCtx<S, NS, St, Bn, RL>\n    : A extends 'create'\n      ? WriteCtx<S, NS, St, Bn, RL>\n      : CommonCtx<S, NS, St, Bn, RL>\n\n// ==========\n// allow / fields / bind / stage shapes\n\n/** A rule value: a boolean, an expression, or a callback returning one. */\nexport type Rule<Ctx> = boolean | Expr<boolean> | ((ctx: Ctx) => boolean | Expr<boolean>)\n\n/**\n * The allow block for a namespace. Each action's callback sees the common\n * scope plus that action's `stageFor`/`bindFor` names (and, for link/unlink,\n * the per-label ones) — so action-specific aliases resolve only where they\n * make sense.\n */\nexport interface AllowBlock<S extends IdbSchema, NS extends string, St, Bn, RL, AX extends ActionScopes = EmptyScopes> {\n  view?: Rule<CommonCtx<S, NS, St & AX['view']['s'], Bn & AX['view']['b'], RL>>\n  create?: Rule<WriteCtx<S, NS, St & AX['create']['s'], Bn & AX['create']['b'], RL>>\n  update?: Rule<UpdateCtx<S, NS, St & AX['update']['s'], Bn & AX['update']['b'], RL>>\n  delete?: Rule<CommonCtx<S, NS, St & AX['delete']['s'], Bn & AX['delete']['b'], RL>>\n  link?: {\n    [L in LinkLabels<S, NS>]?: Rule<LinkCtx<S, NS, L, St & LinkScopeOf<AX, 'link', L>['s'], Bn & LinkScopeOf<AX, 'link', L>['b'], RL>>\n  }\n  unlink?: {\n    [L in LinkLabels<S, NS>]?: Rule<LinkCtx<S, NS, L, St & LinkScopeOf<AX, 'unlink', L>['s'], Bn & LinkScopeOf<AX, 'unlink', L>['b'], RL>>\n  }\n}\n\nexport type AllowInput<S extends IdbSchema, NS extends string, St, Bn, RL, AX extends ActionScopes = EmptyScopes>\n  = AllowBlock<S, NS, St, Bn, RL, AX> | ((ctx: CommonCtx<S, NS, St, Bn, RL>) => AllowBlock<S, NS, St, Bn, RL, AX>)\n\n/** Field-level rules — every field except `id`. */\nexport type FieldsBlock<S extends IdbSchema, NS extends string> = {\n  [F in Exclude<FieldKeys<S, NS>, 'id'>]?: boolean | Expr<boolean>\n}\n\nexport type FieldsInput<S extends IdbSchema, NS extends string, St, Bn, RL>\n  = FieldsBlock<S, NS> | ((ctx: CommonCtx<S, NS, St, Bn, RL>) => FieldsBlock<S, NS>)\n\n/** A stage/bind callback returns named expressions. */\nexport type NameObj = Record<string, Expr<any>>\n\n/**\n * Maps duplicate names (already in `Existing`) to a diagnostic and leaves\n * valid names untouched (intersection identity), so a clash lands on the\n * offending key with an actionable message.\n */\nexport type NoDuplicateNames<O, Existing> = {\n  [K in keyof O]: K extends keyof Existing\n    ? `QERR_PERMS_DUPLICATE_NAME: ${K & string} is already defined — use .overrideStage/.overrideBind to replace it`\n    : unknown\n}\n\n// ==========\n// the default allow block (loose, with $default)\n\nexport interface DefaultAllowBlock<S extends IdbSchema, St, Bn, RL> {\n  $default?: Rule<DefaultCtx<S, St, Bn, RL>>\n  view?: Rule<DefaultCtx<S, St, Bn, RL>>\n  create?: Rule<DefaultCtx<S, St, Bn, RL>>\n  update?: Rule<DefaultCtx<S, St, Bn, RL>>\n  delete?: Rule<DefaultCtx<S, St, Bn, RL>>\n}\n\nexport type DefaultAllowInput<S extends IdbSchema, St, Bn, RL>\n  = DefaultAllowBlock<S, St, Bn, RL> | ((ctx: DefaultCtx<S, St, Bn, RL>) => DefaultAllowBlock<S, St, Bn, RL>)\n\n// ==========\n// builders\n\n/** The namespace builder — `ns` in `.namespaces({})` (spec §4). */\nexport interface NsBuilder<\n  S extends IdbSchema,\n  NS extends string,\n  St = {},\n  Bn = {},\n  RL = {},\n  AX extends ActionScopes = EmptyScopes,\n> {\n  stage: <O extends NameObj>(\n    fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>,\n  ) => NsBuilder<S, NS, Expand<St & O>, Bn, RL, AX>\n  overrideStage: <O extends NameObj>(\n    fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O,\n  ) => NsBuilder<S, NS, Expand<St & O>, Bn, RL, AX>\n  bind: <O extends NameObj>(\n    fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>,\n  ) => NsBuilder<S, NS, St, Expand<Bn & O>, RL, AX>\n  overrideBind: <O extends NameObj>(\n    fn: (ctx: CommonCtx<S, NS, St, Bn, RL>) => O,\n  ) => NsBuilder<S, NS, St, Expand<Bn & O>, RL, AX>\n  /**\n   * Action-specific staged values — authoring-only, visible only in the\n   * matching action's callback. For link/unlink, pass the label too (spec §9).\n   */\n  stageFor: {\n    <A extends EntityAction, O extends NameObj>(\n      action: A,\n      fn: (ctx: ActionCtx<S, NS, St & AX[A]['s'], Bn & AX[A]['b'], RL, A>) => O & NoDuplicateNames<O, St & Bn>,\n    ): NsBuilder<S, NS, St, Bn, RL, AddStage<AX, A, O>>\n    <D extends LinkAction, L extends LinkLabels<S, NS>, O extends NameObj>(\n      dir: D,\n      label: L,\n      fn: (ctx: LinkCtx<S, NS, L, St & LinkScopeOf<AX, D, L>['s'], Bn & LinkScopeOf<AX, D, L>['b'], RL>) => O & NoDuplicateNames<O, St & Bn>,\n    ): NsBuilder<S, NS, St, Bn, RL, AddLinkStage<AX, D, L, O>>\n  }\n  /**\n   * Action-specific bind aliases — emitted into the namespace `bind` block\n   * (the backend evaluates each only where referenced), visible only in the\n   * matching action's callback (spec §9).\n   */\n  bindFor: {\n    <A extends EntityAction, O extends NameObj>(\n      action: A,\n      fn: (ctx: ActionCtx<S, NS, St & AX[A]['s'], Bn & AX[A]['b'], RL, A>) => O & NoDuplicateNames<O, St & Bn>,\n    ): NsBuilder<S, NS, St, Bn, RL, AddBind<AX, A, O>>\n    <D extends LinkAction, L extends LinkLabels<S, NS>, O extends NameObj>(\n      dir: D,\n      label: L,\n      fn: (ctx: LinkCtx<S, NS, L, St & LinkScopeOf<AX, D, L>['s'], Bn & LinkScopeOf<AX, D, L>['b'], RL>) => O & NoDuplicateNames<O, St & Bn>,\n    ): NsBuilder<S, NS, St, Bn, RL, AddLinkBind<AX, D, L, O>>\n  }\n  allow: (input: AllowInput<S, NS, St, Bn, RL, AX>) => NsBuilder<S, NS, St, Bn, RL, AX>\n  fields: (input: FieldsInput<S, NS, St, Bn, RL>) => NsBuilder<S, NS, St, Bn, RL, AX>\n}\n\n/** The defaults builder — `d` in `.defaults()` (spec §5). */\nexport interface DefaultsBuilder<\n  S extends IdbSchema,\n  St = {},\n  Bn = {},\n  RL = {},\n> {\n  stage: <O extends NameObj>(\n    fn: (ctx: DefaultCtx<S, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>,\n  ) => DefaultsBuilder<S, Expand<St & O>, Bn, RL>\n  bind: <O extends NameObj>(\n    fn: (ctx: DefaultCtx<S, St, Bn, RL>) => O & NoDuplicateNames<O, St & Bn>,\n  ) => DefaultsBuilder<S, St, Expand<Bn & O>, RL>\n  allow: (input: DefaultAllowInput<S, St, Bn, RL>) => DefaultsBuilder<S, St, Bn, RL>\n  /**\n   * Phantom carriers so `.defaults` can infer the accumulated maps.\n   * @internal\n   */\n  readonly __staged?: St\n  readonly __binds?: Bn\n}\n\n/** The attrs builder — create-only (spec §5). */\nexport interface AttrsBuilder<S extends IdbSchema, RL = {}> {\n  allow: (input:\n    | { create?: boolean | Expr<boolean> }\n    | ((ctx: AttrsCtx<S, RL>) => { create?: boolean | Expr<boolean> })) => AttrsBuilder<S, RL>\n}\n\ntype DefaultStagedOf<D> = D extends DefaultsBuilder<any, infer St, any, any> ? St : {}\ntype DefaultBindsOf<D> = D extends DefaultsBuilder<any, any, infer Bn, any> ? Bn : {}\n\n/** The `.namespaces({})` input — keys are schema namespaces, callbacks build each. */\nexport type NamespacesInput<S extends IdbSchema, St, Bn, RL> = {\n  [NS in IdbNamespaceName<S>]?: (\n    ns: NsBuilder<S, NS, St, Bn, RL>,\n  ) => NsBuilder<S, NS, any, any, RL, any>\n}\n\n/** The top-level builder returned by `definePerms` (spec §3). */\nexport interface PermsBuilder<\n  S extends IdbSchema,\n  St = {},\n  Bn = {},\n  RL = {},\n> {\n  attrs: (fn: (a: AttrsBuilder<S, RL>) => AttrsBuilder<S, RL>) => PermsBuilder<S, St, Bn, RL>\n  defaults: <D extends DefaultsBuilder<S, any, any, RL>>(\n    fn: (d: DefaultsBuilder<S, {}, {}, RL>) => D,\n  ) => PermsBuilder<S, DefaultStagedOf<D>, DefaultBindsOf<D>, RL>\n  rateLimits: <R extends IdbPermsRateLimits>(config: R) => PermsBuilder<S, St, Bn, R>\n  namespaces: (map: NamespacesInput<S, St, Bn, RL>) => PermsBuilder<S, St, Bn, RL>\n  compile: () => IdbPerms<S>\n}\n\n// ==========\n// output\n\n/**\n * The compiled rules object — plain CEL strings, structurally assignable to\n * the official `InstantRules<S>` (so CLI push and platform `pushPerms` accept\n * it unchanged).\n */\nexport type IdbPerms<S extends IdbSchema = IdbRegisteredSchema> = InstantRules<S>\n"]}

package/dist/esm/perms/validate.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Runtime schema validation — the dev-time assertions `definePerms(schema)`
+ * adds on top of the type layer. The types are the primary safety net
+ * (principle 3); these catch the cases a dynamically-built rules object can
+ * smuggle past the compiler, and turn a silent bad-CEL push into a clear throw
+ * at author time.
+ *
+ * When no schema value is passed (`definePerms()` / `definePerms<S>()`), every
+ * check is a no-op — there is nothing to validate against.
+ */
+import type { IdbSchema } from '../schema/defineSchema.js';
+/** The per-callback validation hooks the context wires into its helpers. */
+export interface Validator {
+    field: (key: string) => void;
+    ref: (path: string) => void;
+    ruleParam: (key: string) => void;
+    authRef: (path: string) => void;
+    linkedField: (key: string) => void;
+    linkedRef: (path: string) => void;
+}
+/** The inert validator — used in type-only mode. */
+export declare const noValidate: Validator;
+/** Does the schema declare this namespace? */
+export declare function namespaceExists(schema: IdbSchema, ns: string): boolean;
+/**
+ * Build the validator for a namespace callback. `linkTarget` is set only when
+ * resolving a specific link/unlink rule, so `el`/`elr` validate against the
+ * linked namespace.
+ */
+export declare function makeValidator(schema: IdbSchema, ns: string, linkTarget?: string): Validator;
+//# sourceMappingURL=validate.d.ts.map

package/dist/esm/perms/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/perms/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAE1D,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC;AAED,oDAAoD;AACpD,eAAO,MAAM,UAAU,EAAE,SAOxB,CAAA;AAgCD,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,EAAE,EAAE,MAAM,EACV,UAAU,CAAC,EAAE,MAAM,GAClB,SAAS,CAeX"}

package/dist/esm/perms/validate.js

@@ -0,0 +1,61 @@
+/** The inert validator — used in type-only mode. */
+export const noValidate = {
+    field: () => { },
+    ref: () => { },
+    ruleParam: () => { },
+    authRef: () => { },
+    linkedField: () => { },
+    linkedRef: () => { },
+};
+function fail(message) {
+    throw new Error(`QERR_PERMS_SCHEMA: ${message}`);
+}
+function fieldExists(schema, ns, key) {
+    if (key === 'id')
+        return true;
+    return Boolean(schema.entities[ns]?.attrs?.[key]);
+}
+function ruleParamExists(schema, ns, key) {
+    return Boolean(schema.$dux?.namespaces?.[ns]?.ruleParams?.[key]);
+}
+/** Walk a `link(.link)*.attr` path; the terminal must be an attribute. */
+function refValid(schema, ns, path) {
+    const parts = path.split('.');
+    const terminal = parts.pop();
+    if (terminal === undefined)
+        return false;
+    let current = ns;
+    for (const label of parts) {
+        const target = schema.entities[current]?.links?.[label]?.entityName;
+        if (!target)
+            return false;
+        current = target;
+    }
+    return fieldExists(schema, current, terminal);
+}
+/** Does the schema declare this namespace? */
+export function namespaceExists(schema, ns) {
+    return Boolean(schema.entities[ns]);
+}
+/**
+ * Build the validator for a namespace callback. `linkTarget` is set only when
+ * resolving a specific link/unlink rule, so `el`/`elr` validate against the
+ * linked namespace.
+ */
+export function makeValidator(schema, ns, linkTarget) {
+    return {
+        field: key => fieldExists(schema, ns, key)
+            || fail(`'${key}' is not a field on '${ns}'`),
+        ref: path => refValid(schema, ns, path)
+            || fail(`'${path}' is not a valid ref path from '${ns}'`),
+        ruleParam: key => ruleParamExists(schema, ns, key)
+            || fail(`'${key}' is not a declared ruleParam on '${ns}'`),
+        authRef: path => refValid(schema, '$users', path.replace(/^\$user\./, ''))
+            || fail(`'${path}' is not a valid auth ref path`),
+        linkedField: key => (linkTarget && fieldExists(schema, linkTarget, key))
+            || fail(`'${key}' is not a field on linked namespace '${linkTarget}'`),
+        linkedRef: path => (linkTarget && refValid(schema, linkTarget, path))
+            || fail(`'${path}' is not a valid ref path from linked namespace '${linkTarget}'`),
+    };
+}
+//# sourceMappingURL=validate.js.map

package/dist/esm/perms/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/perms/validate.ts"],"names":[],"mappings":"AAsBA,oDAAoD;AACpD,MAAM,CAAC,MAAM,UAAU,GAAc;IACnC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;IACb,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;IACnB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;IACjB,WAAW,EAAE,GAAG,EAAE,GAAE,CAAC;IACrB,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;CACpB,CAAA;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB,EAAE,EAAU,EAAE,GAAW;IAC7D,IAAI,GAAG,KAAK,IAAI;QACd,OAAO,IAAI,CAAA;IACb,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,MAAiB,EAAE,EAAU,EAAE,GAAW;IACjE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,MAAiB,EAAE,EAAU,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IAC5B,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,KAAK,CAAA;IACd,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;QACnE,IAAI,CAAC,MAAM;YACT,OAAO,KAAK,CAAA;QACd,OAAO,GAAG,MAAM,CAAA;IAClB,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAC/C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,EAAU;IAC3D,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,EAAU,EACV,UAAmB;IAEnB,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC;eACrC,IAAI,CAAC,IAAI,GAAG,wBAAwB,EAAE,GAAG,CAAC;QAC/C,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC;eAClC,IAAI,CAAC,IAAI,IAAI,mCAAmC,EAAE,GAAG,CAAC;QAC3D,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC;eAC7C,IAAI,CAAC,IAAI,GAAG,qCAAqC,EAAE,GAAG,CAAC;QAC5D,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;eACrE,IAAI,CAAC,IAAI,IAAI,gCAAgC,CAAC;QACnD,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;eACnE,IAAI,CAAC,IAAI,GAAG,yCAAyC,UAAU,GAAG,CAAC;QACxE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;eAChE,IAAI,CAAC,IAAI,IAAI,oDAAoD,UAAU,GAAG,CAAC;KACrF,CAAA;AACH,CAAC","sourcesContent":["/**\n * Runtime schema validation — the dev-time assertions `definePerms(schema)`\n * adds on top of the type layer. The types are the primary safety net\n * (principle 3); these catch the cases a dynamically-built rules object can\n * smuggle past the compiler, and turn a silent bad-CEL push into a clear throw\n * at author time.\n *\n * When no schema value is passed (`definePerms()` / `definePerms<S>()`), every\n * check is a no-op — there is nothing to validate against.\n */\nimport type { IdbSchema } from '../schema/defineSchema.js'\n\n/** The per-callback validation hooks the context wires into its helpers. */\nexport interface Validator {\n  field: (key: string) => void\n  ref: (path: string) => void\n  ruleParam: (key: string) => void\n  authRef: (path: string) => void\n  linkedField: (key: string) => void\n  linkedRef: (path: string) => void\n}\n\n/** The inert validator — used in type-only mode. */\nexport const noValidate: Validator = {\n  field: () => {},\n  ref: () => {},\n  ruleParam: () => {},\n  authRef: () => {},\n  linkedField: () => {},\n  linkedRef: () => {},\n}\n\nfunction fail(message: string): never {\n  throw new Error(`QERR_PERMS_SCHEMA: ${message}`)\n}\n\nfunction fieldExists(schema: IdbSchema, ns: string, key: string): boolean {\n  if (key === 'id')\n    return true\n  return Boolean(schema.entities[ns]?.attrs?.[key])\n}\n\nfunction ruleParamExists(schema: IdbSchema, ns: string, key: string): boolean {\n  return Boolean(schema.$dux?.namespaces?.[ns]?.ruleParams?.[key])\n}\n\n/** Walk a `link(.link)*.attr` path; the terminal must be an attribute. */\nfunction refValid(schema: IdbSchema, ns: string, path: string): boolean {\n  const parts = path.split('.')\n  const terminal = parts.pop()\n  if (terminal === undefined)\n    return false\n  let current = ns\n  for (const label of parts) {\n    const target = schema.entities[current]?.links?.[label]?.entityName\n    if (!target)\n      return false\n    current = target\n  }\n  return fieldExists(schema, current, terminal)\n}\n\n/** Does the schema declare this namespace? */\nexport function namespaceExists(schema: IdbSchema, ns: string): boolean {\n  return Boolean(schema.entities[ns])\n}\n\n/**\n * Build the validator for a namespace callback. `linkTarget` is set only when\n * resolving a specific link/unlink rule, so `el`/`elr` validate against the\n * linked namespace.\n */\nexport function makeValidator(\n  schema: IdbSchema,\n  ns: string,\n  linkTarget?: string,\n): Validator {\n  return {\n    field: key => fieldExists(schema, ns, key)\n      || fail(`'${key}' is not a field on '${ns}'`),\n    ref: path => refValid(schema, ns, path)\n      || fail(`'${path}' is not a valid ref path from '${ns}'`),\n    ruleParam: key => ruleParamExists(schema, ns, key)\n      || fail(`'${key}' is not a declared ruleParam on '${ns}'`),\n    authRef: path => refValid(schema, '$users', path.replace(/^\\$user\\./, ''))\n      || fail(`'${path}' is not a valid auth ref path`),\n    linkedField: key => (linkTarget && fieldExists(schema, linkTarget, key))\n      || fail(`'${key}' is not a field on linked namespace '${linkTarget}'`),\n    linkedRef: path => (linkTarget && refValid(schema, linkTarget, path))\n      || fail(`'${path}' is not a valid ref path from linked namespace '${linkTarget}'`),\n  }\n}\n"]}

package/dist/esm/query/constants.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `$only` is a `true` constant sharing its name with the `$:` key it enables,
+ * so property shorthand reads as the declaration it is:
+ * `$: { where: { id }, $only }` ≡ `$: { where: { id }, $only: true }`.
+ */
+export declare const $only: true;
+/**
+ * `$skip` is an `undefined` constant: an `undefined` value in a `where`
+ * clause drops that clause before the query goes on the wire, so
+ * `where: { workspace: current?.id ?? $skip }` reads as intended.
+ */
+export declare const $skip: undefined;
+//# sourceMappingURL=constants.d.ts.map

package/dist/esm/query/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/query/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,KAAK,EAAG,IAAa,CAAA;AAElC;;;;GAIG;AACH,eAAO,MAAM,KAAK,WAAY,CAAA"}