@mszr/idb-dux 1.0.0

package/dist/commonjs/nuxt/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/nuxt/types.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * The `/nuxt` public types — the kit config and the mode-narrowed kit shapes.\n * `/nuxt` owns no data-plane or verification types of its own; everything it\n * returns comes from the `/admin` and `/webhooks` layers it composes.\n */\nimport type { H3Event } from 'h3'\nimport type { IdbAdminClient, IdbAuthUser } from '../admin/index.js'\nimport type { IdbSchema } from '../schema/defineSchema.js'\nimport type { IdbRegisteredSchema } from '../schema/register.js'\n\n/** `defineServerKit` config — the schema plus lazy, event-scoped credential reads. */\nexport interface IdbServerKitConfig<S extends IdbSchema = IdbRegisteredSchema> {\n  /** Your registered schema — unlocks shaping and typed `ruleParams`. */\n  schema: S\n  /** Resolve the app id from the event (runtime config, env indirection, …). */\n  getAppId: (event: H3Event) => string\n  /** Resolve the admin token from the event. */\n  getAdminToken: (event: H3Event) => string\n  /** Base URL for the Instant API (self-hosting). */\n  apiURI?: string\n}\n\n/**\n * How strict the kit is about auth, declared at the call site. The kit's keys\n * follow the mode, so there is no manual narrowing or repeated 401 boilerplate.\n */\nexport type IdbServerKitMode = 'user?' | 'user' | 'userDb?' | 'userDb'\n\n/** The kit a given mode yields — keys typed per the declared strictness. */\nexport type IdbServerKit<Mode extends IdbServerKitMode | undefined, S extends IdbSchema>\n  = Mode extends undefined\n    ? { adminDb: IdbAdminClient<S> }\n    : Mode extends 'user'\n      ? { adminDb: IdbAdminClient<S>, user: IdbAuthUser }\n      : Mode extends 'user?'\n        ? { adminDb: IdbAdminClient<S>, user: IdbAuthUser | undefined }\n        : Mode extends 'userDb'\n          ? { adminDb: IdbAdminClient<S>, user: IdbAuthUser, userDb: IdbAdminClient<S> }\n          : { adminDb: IdbAdminClient<S>, user: IdbAuthUser | undefined, userDb: IdbAdminClient<S> | undefined }\n\n/** The request-kit factory `defineServerKit` returns. */\nexport interface IdbServerKitFactory<S extends IdbSchema> {\n  (event: H3Event): Promise<IdbServerKit<undefined, S>>\n  <Mode extends IdbServerKitMode>(event: H3Event, mode: Mode): Promise<IdbServerKit<Mode, S>>\n}\n\n/** `defineAuthSyncHandler` config — the app id read from the event. */\nexport interface IdbAuthSyncConfig {\n  /** Resolve the app id from the event (must match the client's app id). */\n  getAppId: (event: H3Event) => string\n}\n"]}

package/dist/commonjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/commonjs/perms/ast.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The expression layer: immutable, phantom-typed nodes that render to CEL.
+ *
+ * Every authoring helper (`e.title.eq('x')`, `er(...).contains(auth.id)`,
+ * `f.or(...)`) builds one of these nodes; `.compile()` walks the tree and
+ * emits the plain CEL strings Instant already accepts. The phantom `T` carries
+ * the value type so fluent composition type-checks at the cursor; at runtime a
+ * node is just a rendered string plus a precedence, so parentheses are added
+ * deterministically and only where CEL precedence requires them.
+ *
+ * The renderer targets the exact bindings the backend installs
+ * (`server/src/instant/db/cel.clj`): `auth`, `data`, `newData`, `linkedData`,
+ * `ruleParams`, `request`, `rateLimit`.
+ */
+/** A value position accepts a raw literal or another expression of that type. */
+export type ExprArg<T> = T | Expr<T>;
+/**
+ * A scalar CEL expression. `and`/`or`/`not` return a boolean expression so
+ * fluent chains read subject-first (`b.isMember.and(b.isSignedIn)`); the
+ * string methods are available everywhere but only meaningful on strings.
+ */
+export interface Expr<T = unknown> {
+    eq: (value: ExprArg<T> | null) => Expr<boolean>;
+    neq: (value: ExprArg<T> | null) => Expr<boolean>;
+    gt: (value: ExprArg<T>) => Expr<boolean>;
+    gte: (value: ExprArg<T>) => Expr<boolean>;
+    lt: (value: ExprArg<T>) => Expr<boolean>;
+    lte: (value: ExprArg<T>) => Expr<boolean>;
+    in: (list: readonly ExprArg<T>[]) => Expr<boolean>;
+    and: (other: ExprArg<boolean>) => Expr<boolean>;
+    or: (other: ExprArg<boolean>) => Expr<boolean>;
+    not: () => Expr<boolean>;
+    startsWith: (value: ExprArg<string>) => Expr<boolean>;
+    endsWith: (value: ExprArg<string>) => Expr<boolean>;
+    includes: (value: ExprArg<string>) => Expr<boolean>;
+    matches: (value: ExprArg<string>) => Expr<boolean>;
+    render: () => string;
+}
+/** The element view of a list — a JSON-array terminal yields a nested list. */
+export type ItemExpr<T> = T extends readonly (infer E)[] ? ListExpr<E> : Expr<T>;
+/**
+ * A list-valued CEL expression — what every ref helper (`er`/`ar`/`elr`) and
+ * `request.modifiedFields` return. `.some`/`.every` compile to CEL's
+ * `.exists`/`.all` macros.
+ */
+export interface ListExpr<T = unknown> {
+    contains: (value: ExprArg<T>) => Expr<boolean>;
+    isEmpty: () => Expr<boolean>;
+    isNonEmpty: () => Expr<boolean>;
+    size: () => Expr<number>;
+    at: (index: number) => ItemExpr<T>;
+    some: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>;
+    every: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>;
+    render: () => string;
+}
+declare const BRAND: unique symbol;
+/** The one runtime node behind both `Expr` and `ListExpr`. */
+export declare class ExprNode {
+    readonly cel: string;
+    readonly prec: number;
+    readonly [BRAND] = true;
+    constructor(cel: string, prec: number);
+    render(): string;
+    private op;
+    eq(value: unknown): ExprNode;
+    neq(value: unknown): ExprNode;
+    gt(value: unknown): ExprNode;
+    gte(value: unknown): ExprNode;
+    lt(value: unknown): ExprNode;
+    lte(value: unknown): ExprNode;
+    in(list: unknown): ExprNode;
+    and(other: unknown): ExprNode;
+    or(other: unknown): ExprNode;
+    not(): ExprNode;
+    private method;
+    startsWith(value: unknown): ExprNode;
+    endsWith(value: unknown): ExprNode;
+    includes(value: unknown): ExprNode;
+    matches(value: unknown): ExprNode;
+    contains(value: unknown): ExprNode;
+    isEmpty(): ExprNode;
+    isNonEmpty(): ExprNode;
+    size(): ExprNode;
+    at(index: number): ExprNode;
+    some(fn: (item: any) => Expr<boolean>): ExprNode;
+    every(fn: (item: any) => Expr<boolean>): ExprNode;
+    private macro;
+}
+/** Is this an expression node (vs a raw literal value)? */
+export declare function isExprNode(value: unknown): value is ExprNode;
+/** Pass an expression through; turn anything else into an atom literal node. */
+export declare function coerce(value: unknown): ExprNode;
+/** A bare CEL atom — identifiers, property/field access, calls. */
+export declare function atom(cel: string): ExprNode;
+/** A raw, user-authored CEL string — always wrapped when composed. */
+export declare function raw(cel: string): ExprNode;
+export {};
+//# sourceMappingURL=ast.d.ts.map

package/dist/commonjs/perms/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../../src/perms/ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,iFAAiF;AACjF,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;AAEpC;;;;GAIG;AACH,MAAM,WAAW,IAAI,CAAC,CAAC,GAAG,OAAO;IAE/B,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/C,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAChD,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACxC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACzC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACxC,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACzC,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAClD,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/C,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9C,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACrD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACnD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACnD,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,MAAM,MAAM,CAAA;CACrB;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;AAEhF;;;;GAIG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,OAAO;IACnC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9C,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,UAAU,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;IACxB,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IACjE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,EAAE,MAAM,MAAM,CAAA;CACrB;AAoBD,QAAA,MAAM,KAAK,eAA2B,CAAA;AAEtC,8DAA8D;AAC9D,qBAAa,QAAQ;IAEP,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IADvD,QAAQ,CAAC,CAAC,KAAK,CAAC,QAAO;gBACF,GAAG,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;IAEvD,MAAM,IAAI,MAAM;IAIhB,OAAO,CAAC,EAAE;IAKV,EAAE,CAAC,KAAK,EAAE,OAAO;IACjB,GAAG,CAAC,KAAK,EAAE,OAAO;IAClB,EAAE,CAAC,KAAK,EAAE,OAAO;IACjB,GAAG,CAAC,KAAK,EAAE,OAAO;IAClB,EAAE,CAAC,KAAK,EAAE,OAAO;IACjB,GAAG,CAAC,KAAK,EAAE,OAAO;IAClB,EAAE,CAAC,IAAI,EAAE,OAAO;IAChB,GAAG,CAAC,KAAK,EAAE,OAAO;IAClB,EAAE,CAAC,KAAK,EAAE,OAAO;IAEjB,GAAG,IAAI,QAAQ;IAIf,OAAO,CAAC,MAAM;IAId,UAAU,CAAC,KAAK,EAAE,OAAO;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO;IAEvB,QAAQ,CAAC,KAAK,EAAE,OAAO;IACvB,OAAO,CAAC,KAAK,EAAE,OAAO;IAItB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ;IAKlC,OAAO;IACP,UAAU;IACV,IAAI;IACJ,EAAE,CAAC,KAAK,EAAE,MAAM;IAEhB,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC;IACrC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC;IAEtC,OAAO,CAAC,KAAK;CAKd;AAMD,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AA+BD,gFAAgF;AAChF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAE/C;AAKD,mEAAmE;AACnE,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAE1C;AAED,sEAAsE;AACtE,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEzC"}

package/dist/commonjs/perms/ast.js

@@ -0,0 +1,148 @@
+"use strict";
+/**
+ * The expression layer: immutable, phantom-typed nodes that render to CEL.
+ *
+ * Every authoring helper (`e.title.eq('x')`, `er(...).contains(auth.id)`,
+ * `f.or(...)`) builds one of these nodes; `.compile()` walks the tree and
+ * emits the plain CEL strings Instant already accepts. The phantom `T` carries
+ * the value type so fluent composition type-checks at the cursor; at runtime a
+ * node is just a rendered string plus a precedence, so parentheses are added
+ * deterministically and only where CEL precedence requires them.
+ *
+ * The renderer targets the exact bindings the backend installs
+ * (`server/src/instant/db/cel.clj`): `auth`, `data`, `newData`, `linkedData`,
+ * `ruleParams`, `request`, `rateLimit`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExprNode = void 0;
+exports.isExprNode = isExprNode;
+exports.coerce = coerce;
+exports.atom = atom;
+exports.raw = raw;
+// ==========
+// precedence
+/**
+ * CEL operator precedence, low to high. A child operand is parenthesized only
+ * when its precedence is lower than its parent's — minimal, correct, stable.
+ * `raw` sits below everything so any composition around it is always wrapped.
+ */
+const RAW = 0;
+const OR = 1;
+const AND = 2;
+const NOT = 3;
+const CMP = 4;
+const ATOM = 5;
+// ==========
+// the node
+const BRAND = Symbol('idb-perms-expr');
+/** The one runtime node behind both `Expr` and `ListExpr`. */
+class ExprNode {
+    cel;
+    prec;
+    [BRAND] = true;
+    constructor(cel, prec) {
+        this.cel = cel;
+        this.prec = prec;
+    }
+    render() {
+        return this.cel;
+    }
+    op(operator, value, prec) {
+        const right = coerce(value);
+        return new ExprNode(`${wrap(this, prec)} ${operator} ${wrap(right, prec)}`, prec);
+    }
+    eq(value) { return this.op('==', value, CMP); }
+    neq(value) { return this.op('!=', value, CMP); }
+    gt(value) { return this.op('>', value, CMP); }
+    gte(value) { return this.op('>=', value, CMP); }
+    lt(value) { return this.op('<', value, CMP); }
+    lte(value) { return this.op('<=', value, CMP); }
+    in(list) { return this.op('in', list, CMP); }
+    and(other) { return this.op('&&', other, AND); }
+    or(other) { return this.op('||', other, OR); }
+    not() {
+        return new ExprNode(`!${this.prec < ATOM ? `(${this.cel})` : this.cel}`, NOT);
+    }
+    method(name, value) {
+        return new ExprNode(`${wrap(this, ATOM)}.${name}(${coerce(value).cel})`, ATOM);
+    }
+    startsWith(value) { return this.method('startsWith', value); }
+    endsWith(value) { return this.method('endsWith', value); }
+    // CEL spells substring containment `string.contains`.
+    includes(value) { return this.method('contains', value); }
+    matches(value) { return this.method('matches', value); }
+    // ----- list methods
+    contains(value) {
+        // `value in list` — the membership test the backend optimizes for refs.
+        return new ExprNode(`${coerce(value).cel} in ${wrap(this, CMP)}`, CMP);
+    }
+    isEmpty() { return new ExprNode(`${wrap(this, CMP)} == []`, CMP); }
+    isNonEmpty() { return new ExprNode(`${wrap(this, CMP)} != []`, CMP); }
+    size() { return new ExprNode(`size(${this.cel})`, ATOM); }
+    at(index) { return new ExprNode(`${wrap(this, ATOM)}[${index}]`, ATOM); }
+    some(fn) { return this.macro('exists', fn); }
+    every(fn) { return this.macro('all', fn); }
+    macro(name, fn) {
+        const variable = bindVarName(fn);
+        const body = fn(new ExprNode(variable, ATOM));
+        return new ExprNode(`${wrap(this, ATOM)}.${name}(${variable}, ${body.render()})`, ATOM);
+    }
+}
+exports.ExprNode = ExprNode;
+function wrap(node, parentPrec) {
+    return node.prec < parentPrec ? `(${node.cel})` : node.cel;
+}
+/** Is this an expression node (vs a raw literal value)? */
+function isExprNode(value) {
+    return typeof value === 'object' && value !== null && BRAND in value;
+}
+// ==========
+// literals
+/** Single-quote a CEL string literal, escaping the characters CEL cares about. */
+function quote(value) {
+    const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, '\\\'')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+    return `'${escaped}'`;
+}
+/** Render a JS literal as a CEL atom. */
+function literal(value) {
+    if (value === null || value === undefined)
+        return 'null';
+    if (typeof value === 'string')
+        return quote(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    if (value instanceof Date)
+        return String(value.getTime());
+    if (Array.isArray(value))
+        return `[${value.map(literal).join(', ')}]`;
+    throw new TypeError(`Cannot render ${typeof value} as a CEL literal`);
+}
+/** Pass an expression through; turn anything else into an atom literal node. */
+function coerce(value) {
+    return isExprNode(value) ? value : new ExprNode(literal(value), ATOM);
+}
+// ==========
+// node factories (used by the context helpers)
+/** A bare CEL atom — identifiers, property/field access, calls. */
+function atom(cel) {
+    return new ExprNode(cel, ATOM);
+}
+/** A raw, user-authored CEL string — always wrapped when composed. */
+function raw(cel) {
+    return new ExprNode(cel, RAW);
+}
+/**
+ * Recover the macro variable name from the callback's source so the emitted
+ * CEL reads naturally (`.exists(types, 'admin' in types)`); falls back to
+ * `item` when the source can't be parsed.
+ */
+function bindVarName(fn) {
+    const match = /^[\s(]*([A-Z_$][\w$]*)/i.exec(fn.toString());
+    return match?.[1] ?? 'item';
+}
+//# sourceMappingURL=ast.js.map

package/dist/commonjs/perms/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../../src/perms/ast.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAwIH,gCAEC;AAgCD,wBAEC;AAMD,oBAEC;AAGD,kBAEC;AAtID,aAAa;AACb,aAAa;AAEb;;;;GAIG;AACH,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,EAAE,GAAG,CAAC,CAAA;AACZ,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,GAAG,GAAG,CAAC,CAAA;AACb,MAAM,IAAI,GAAG,CAAC,CAAA;AAEd,aAAa;AACb,WAAW;AAEX,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;AAEtC,8DAA8D;AAC9D,MAAa,QAAQ;IAEE;IAAsB;IADlC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IACvB,YAAqB,GAAW,EAAW,IAAY;QAAlC,QAAG,GAAH,GAAG,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE3D,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAEO,EAAE,CAAC,QAAgB,EAAE,KAAc,EAAE,IAAY;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACnF,CAAC;IAED,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACvD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACtD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACtD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,IAAa,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACrD,GAAG,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACxD,EAAE,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAEtD,GAAG;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAA;IAC/E,CAAC;IAEO,MAAM,CAAC,IAAY,EAAE,KAAc;QACzC,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAA;IAChF,CAAC;IAED,UAAU,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAClE,sDAAsD;IACtD,QAAQ,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAClE,OAAO,CAAC,KAAc,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA,CAAC,CAAC;IAEhE,qBAAqB;IAErB,QAAQ,CAAC,KAAc;QACrB,wEAAwE;QACxE,OAAO,IAAI,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IAClE,UAAU,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA,CAAC,CAAC;IACrE,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAA,CAAC,CAAC;IACzD,EAAE,CAAC,KAAa,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAA,CAAC,CAAC;IAEhF,IAAI,CAAC,EAAgC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAC1E,KAAK,CAAC,EAAgC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC;IAEhE,KAAK,CAAC,IAAY,EAAE,EAAgC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAwB,CAAA;QACpE,OAAO,IAAI,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,CAAC;CACF;AAzDD,4BAyDC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,UAAkB;IAC9C,OAAO,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AAC5D,CAAC;AAED,2DAA2D;AAC3D,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,KAAK,CAAA;AACtE,CAAC;AAED,aAAa;AACb,WAAW;AAEX,kFAAkF;AAClF,SAAS,KAAK,CAAC,KAAa;IAC1B,MAAM,OAAO,GAAG,KAAK;SAClB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACxB,OAAO,IAAI,OAAO,GAAG,CAAA;AACvB,CAAC;AAED,yCAAyC;AACzC,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QACvC,OAAO,MAAM,CAAA;IACf,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAA;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACzD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,IAAI,KAAK,YAAY,IAAI;QACvB,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IAC7C,MAAM,IAAI,SAAS,CAAC,iBAAiB,OAAO,KAAK,mBAAmB,CAAC,CAAA;AACvE,CAAC;AAED,gFAAgF;AAChF,SAAgB,MAAM,CAAC,KAAc;IACnC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;AACvE,CAAC;AAED,aAAa;AACb,+CAA+C;AAE/C,mEAAmE;AACnE,SAAgB,IAAI,CAAC,GAAW;IAC9B,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAChC,CAAC;AAED,sEAAsE;AACtE,SAAgB,GAAG,CAAC,GAAW;IAC7B,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAA0B;IAC7C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;AAC7B,CAAC","sourcesContent":["/**\n * The expression layer: immutable, phantom-typed nodes that render to CEL.\n *\n * Every authoring helper (`e.title.eq('x')`, `er(...).contains(auth.id)`,\n * `f.or(...)`) builds one of these nodes; `.compile()` walks the tree and\n * emits the plain CEL strings Instant already accepts. The phantom `T` carries\n * the value type so fluent composition type-checks at the cursor; at runtime a\n * node is just a rendered string plus a precedence, so parentheses are added\n * deterministically and only where CEL precedence requires them.\n *\n * The renderer targets the exact bindings the backend installs\n * (`server/src/instant/db/cel.clj`): `auth`, `data`, `newData`, `linkedData`,\n * `ruleParams`, `request`, `rateLimit`.\n */\n\n// ==========\n// authoring types\n\n/** A value position accepts a raw literal or another expression of that type. */\nexport type ExprArg<T> = T | Expr<T>\n\n/**\n * A scalar CEL expression. `and`/`or`/`not` return a boolean expression so\n * fluent chains read subject-first (`b.isMember.and(b.isSignedIn)`); the\n * string methods are available everywhere but only meaningful on strings.\n */\nexport interface Expr<T = unknown> {\n  // `null` is allowed so the `x != null` / `x == null` idiom reads naturally.\n  eq: (value: ExprArg<T> | null) => Expr<boolean>\n  neq: (value: ExprArg<T> | null) => Expr<boolean>\n  gt: (value: ExprArg<T>) => Expr<boolean>\n  gte: (value: ExprArg<T>) => Expr<boolean>\n  lt: (value: ExprArg<T>) => Expr<boolean>\n  lte: (value: ExprArg<T>) => Expr<boolean>\n  in: (list: readonly ExprArg<T>[]) => Expr<boolean>\n  and: (other: ExprArg<boolean>) => Expr<boolean>\n  or: (other: ExprArg<boolean>) => Expr<boolean>\n  not: () => Expr<boolean>\n  startsWith: (value: ExprArg<string>) => Expr<boolean>\n  endsWith: (value: ExprArg<string>) => Expr<boolean>\n  includes: (value: ExprArg<string>) => Expr<boolean>\n  matches: (value: ExprArg<string>) => Expr<boolean>\n  render: () => string\n}\n\n/** The element view of a list — a JSON-array terminal yields a nested list. */\nexport type ItemExpr<T> = T extends readonly (infer E)[] ? ListExpr<E> : Expr<T>\n\n/**\n * A list-valued CEL expression — what every ref helper (`er`/`ar`/`elr`) and\n * `request.modifiedFields` return. `.some`/`.every` compile to CEL's\n * `.exists`/`.all` macros.\n */\nexport interface ListExpr<T = unknown> {\n  contains: (value: ExprArg<T>) => Expr<boolean>\n  isEmpty: () => Expr<boolean>\n  isNonEmpty: () => Expr<boolean>\n  size: () => Expr<number>\n  at: (index: number) => ItemExpr<T>\n  some: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>\n  every: (fn: (item: ItemExpr<T>) => Expr<boolean>) => Expr<boolean>\n  render: () => string\n}\n\n// ==========\n// precedence\n\n/**\n * CEL operator precedence, low to high. A child operand is parenthesized only\n * when its precedence is lower than its parent's — minimal, correct, stable.\n * `raw` sits below everything so any composition around it is always wrapped.\n */\nconst RAW = 0\nconst OR = 1\nconst AND = 2\nconst NOT = 3\nconst CMP = 4\nconst ATOM = 5\n\n// ==========\n// the node\n\nconst BRAND = Symbol('idb-perms-expr')\n\n/** The one runtime node behind both `Expr` and `ListExpr`. */\nexport class ExprNode {\n  readonly [BRAND] = true\n  constructor(readonly cel: string, readonly prec: number) {}\n\n  render(): string {\n    return this.cel\n  }\n\n  private op(operator: string, value: unknown, prec: number): ExprNode {\n    const right = coerce(value)\n    return new ExprNode(`${wrap(this, prec)} ${operator} ${wrap(right, prec)}`, prec)\n  }\n\n  eq(value: unknown) { return this.op('==', value, CMP) }\n  neq(value: unknown) { return this.op('!=', value, CMP) }\n  gt(value: unknown) { return this.op('>', value, CMP) }\n  gte(value: unknown) { return this.op('>=', value, CMP) }\n  lt(value: unknown) { return this.op('<', value, CMP) }\n  lte(value: unknown) { return this.op('<=', value, CMP) }\n  in(list: unknown) { return this.op('in', list, CMP) }\n  and(other: unknown) { return this.op('&&', other, AND) }\n  or(other: unknown) { return this.op('||', other, OR) }\n\n  not(): ExprNode {\n    return new ExprNode(`!${this.prec < ATOM ? `(${this.cel})` : this.cel}`, NOT)\n  }\n\n  private method(name: string, value: unknown): ExprNode {\n    return new ExprNode(`${wrap(this, ATOM)}.${name}(${coerce(value).cel})`, ATOM)\n  }\n\n  startsWith(value: unknown) { return this.method('startsWith', value) }\n  endsWith(value: unknown) { return this.method('endsWith', value) }\n  // CEL spells substring containment `string.contains`.\n  includes(value: unknown) { return this.method('contains', value) }\n  matches(value: unknown) { return this.method('matches', value) }\n\n  // ----- list methods\n\n  contains(value: unknown): ExprNode {\n    // `value in list` — the membership test the backend optimizes for refs.\n    return new ExprNode(`${coerce(value).cel} in ${wrap(this, CMP)}`, CMP)\n  }\n\n  isEmpty() { return new ExprNode(`${wrap(this, CMP)} == []`, CMP) }\n  isNonEmpty() { return new ExprNode(`${wrap(this, CMP)} != []`, CMP) }\n  size() { return new ExprNode(`size(${this.cel})`, ATOM) }\n  at(index: number) { return new ExprNode(`${wrap(this, ATOM)}[${index}]`, ATOM) }\n\n  some(fn: (item: any) => Expr<boolean>) { return this.macro('exists', fn) }\n  every(fn: (item: any) => Expr<boolean>) { return this.macro('all', fn) }\n\n  private macro(name: string, fn: (item: any) => Expr<boolean>): ExprNode {\n    const variable = bindVarName(fn)\n    const body = fn(new ExprNode(variable, ATOM)) as unknown as ExprNode\n    return new ExprNode(`${wrap(this, ATOM)}.${name}(${variable}, ${body.render()})`, ATOM)\n  }\n}\n\nfunction wrap(node: ExprNode, parentPrec: number): string {\n  return node.prec < parentPrec ? `(${node.cel})` : node.cel\n}\n\n/** Is this an expression node (vs a raw literal value)? */\nexport function isExprNode(value: unknown): value is ExprNode {\n  return typeof value === 'object' && value !== null && BRAND in value\n}\n\n// ==========\n// literals\n\n/** Single-quote a CEL string literal, escaping the characters CEL cares about. */\nfunction quote(value: string): string {\n  const escaped = value\n    .replace(/\\\\/g, '\\\\\\\\')\n    .replace(/'/g, '\\\\\\'')\n    .replace(/\\n/g, '\\\\n')\n    .replace(/\\r/g, '\\\\r')\n    .replace(/\\t/g, '\\\\t')\n  return `'${escaped}'`\n}\n\n/** Render a JS literal as a CEL atom. */\nfunction literal(value: unknown): string {\n  if (value === null || value === undefined)\n    return 'null'\n  if (typeof value === 'string')\n    return quote(value)\n  if (typeof value === 'number' || typeof value === 'boolean')\n    return String(value)\n  if (value instanceof Date)\n    return String(value.getTime())\n  if (Array.isArray(value))\n    return `[${value.map(literal).join(', ')}]`\n  throw new TypeError(`Cannot render ${typeof value} as a CEL literal`)\n}\n\n/** Pass an expression through; turn anything else into an atom literal node. */\nexport function coerce(value: unknown): ExprNode {\n  return isExprNode(value) ? value : new ExprNode(literal(value), ATOM)\n}\n\n// ==========\n// node factories (used by the context helpers)\n\n/** A bare CEL atom — identifiers, property/field access, calls. */\nexport function atom(cel: string): ExprNode {\n  return new ExprNode(cel, ATOM)\n}\n\n/** A raw, user-authored CEL string — always wrapped when composed. */\nexport function raw(cel: string): ExprNode {\n  return new ExprNode(cel, RAW)\n}\n\n/**\n * Recover the macro variable name from the callback's source so the emitted\n * CEL reads naturally (`.exists(types, 'admin' in types)`); falls back to\n * `item` when the source can't be parsed.\n */\nfunction bindVarName(fn: (item: any) => unknown): string {\n  const match = /^[\\s(]*([A-Z_$][\\w$]*)/i.exec(fn.toString())\n  return match?.[1] ?? 'item'\n}\n"]}

package/dist/commonjs/perms/builder.d.ts

@@ -0,0 +1,18 @@
+import type { IdbSchema } from '../schema/defineSchema.js';
+import type { IdbRegisteredSchema } from '../schema/register.js';
+import type { PermsBuilder } from './types.js';
+/**
+ * The typed permissions authoring entry. With the schema registered, no
+ * argument is needed; pass the schema value to add runtime validation; pass an
+ * explicit type param for a different schema (spec §2).
+ *
+ * @example
+ *   export default definePerms(schema)
+ *     .namespaces({
+ *       tasks: ns => ns.allow({ view: true }),
+ *     })
+ *     .compile()
+ */
+export declare function definePerms<S extends IdbSchema>(schema: S): PermsBuilder<S>;
+export declare function definePerms<S extends IdbSchema = IdbRegisteredSchema>(): PermsBuilder<S>;
+//# sourceMappingURL=builder.d.ts.map

package/dist/commonjs/perms/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../src/perms/builder.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,KAAK,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAA;AAsUlE;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;AAC5E,wBAAgB,WAAW,CAAC,CAAC,SAAS,SAAS,GAAG,mBAAmB,KAAK,YAAY,CAAC,CAAC,CAAC,CAAA"}

package/dist/commonjs/perms/builder.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.definePerms = definePerms;
+const context_js_1 = require("./context.js");
+const validate_js_1 = require("./validate.js");
+// ==========
+// resolution
+function asCel(value) {
+    return typeof value === 'boolean' ? String(value) : value.render();
+}
+function resolveRule(rule, ctx) {
+    return asCel(typeof rule === 'function' ? rule(ctx) : rule);
+}
+function renderBinds(binds) {
+    return Object.fromEntries(Object.entries(binds).map(([name, node]) => [name, node.render()]));
+}
+const ACTIONS = ['view', 'create', 'update', 'delete'];
+// ==========
+// namespace builder
+class NamespaceRuntime {
+    schema;
+    ns;
+    /** Common staged values — inlined, inherited from defaults, merged into every action. */
+    commonStaged;
+    /** All emitted bind aliases — common and action-specific share one block. */
+    binds = {};
+    /** Per-whole-entity-action staged values, visible only in that action. */
+    actionStaged = {};
+    /** Per-(dir, label) staged values, visible only in that link/unlink rule. */
+    linkStaged = {};
+    inheritedBindNames;
+    allowOut = {};
+    fieldsOut = {};
+    constructor(schema, ns, defaultStaged, defaultBindNames) {
+        this.schema = schema;
+        this.ns = ns;
+        this.commonStaged = { ...defaultStaged };
+        this.inheritedBindNames = new Set(defaultBindNames);
+    }
+    /** Is this name already a common staged value, an emitted bind, or inherited? */
+    known(name) {
+        return name in this.commonStaged || name in this.binds || this.inheritedBindNames.has(name);
+    }
+    linkTargetOf(label) {
+        return this.schema?.entities[this.ns]?.links?.[label]?.entityName;
+    }
+    /** Build a context over a staged snapshot, validating against ns (or a link target). */
+    ctxFor(staged, linkTarget) {
+        const validator = this.schema
+            ? (0, validate_js_1.makeValidator)(this.schema, this.ns, linkTarget)
+            : validate_js_1.noValidate;
+        return (0, context_js_1.makeContext)({ staged, binds: this.binds }, validator);
+    }
+    mergedStaged(action) {
+        return { ...this.commonStaged, ...this.actionStaged[action] };
+    }
+    mergedLinkStaged(dir, label) {
+        return { ...this.commonStaged, ...this.linkStaged[dir]?.[label] };
+    }
+    add(produced, into, guard, seen) {
+        for (const [name, node] of Object.entries(produced)) {
+            if (guard && seen(name))
+                throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined on '${this.ns}' — use .overrideStage/.overrideBind`);
+            into[name] = node;
+        }
+        return this;
+    }
+    stage(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, true, n => this.known(n));
+    }
+    overrideStage(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, false, () => false);
+    }
+    bind(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, true, n => this.known(n));
+    }
+    overrideBind(fn) {
+        return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, false, () => false);
+    }
+    stageFor(actionOrDir, labelOrFn, maybeFn) {
+        if (maybeFn === undefined) {
+            const action = actionOrDir;
+            const into = (this.actionStaged[action] ??= {});
+            return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), into, true, n => this.known(n) || n in into);
+        }
+        const [dir, label] = [actionOrDir, labelOrFn];
+        const into = ((this.linkStaged[dir] ??= {})[label] ??= {});
+        return this.add(maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))), into, true, n => this.known(n) || n in into);
+    }
+    bindFor(actionOrDir, labelOrFn, maybeFn) {
+        if (maybeFn === undefined) {
+            const action = actionOrDir;
+            return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), this.binds, true, n => this.known(n));
+        }
+        const [dir, label] = [actionOrDir, labelOrFn];
+        return this.add(maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))), this.binds, true, n => this.known(n));
+    }
+    allow(input) {
+        const block = typeof input === 'function' ? input(this.ctxFor(this.commonStaged)) : input;
+        for (const action of ACTIONS) {
+            if (block[action] !== undefined)
+                this.allowOut[action] = resolveRule(block[action], this.ctxFor(this.mergedStaged(action)));
+        }
+        for (const dir of ['link', 'unlink']) {
+            const labels = block[dir];
+            if (!labels)
+                continue;
+            const map = this.allowOut[dir] ?? {};
+            for (const [label, rule] of Object.entries(labels)) {
+                if (rule !== undefined) {
+                    const ctx = this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label));
+                    map[label] = resolveRule(rule, ctx);
+                }
+            }
+            this.allowOut[dir] = map;
+        }
+        return this;
+    }
+    fields(input) {
+        const ctx = this.ctxFor(this.commonStaged);
+        const block = typeof input === 'function' ? input(ctx) : input;
+        for (const [field, rule] of Object.entries(block)) {
+            if (rule !== undefined)
+                this.fieldsOut[field] = resolveRule(rule, ctx);
+        }
+        return this;
+    }
+    /** The compiled namespace block. */
+    block() {
+        const out = { allow: this.allowOut };
+        const bind = renderBinds(this.binds);
+        if (Object.keys(bind).length)
+            out.bind = bind;
+        if (Object.keys(this.fieldsOut).length)
+            out.fields = this.fieldsOut;
+        return out;
+    }
+}
+// ==========
+// defaults builder
+class DefaultsRuntime {
+    staged = {};
+    binds = {};
+    allowOut = {};
+    ctx() {
+        // The default context is namespace-loose; the type layer narrows it.
+        return (0, context_js_1.makeContext)({ staged: this.staged, binds: this.binds }, validate_js_1.noValidate);
+    }
+    known(name) {
+        return name in this.staged || name in this.binds;
+    }
+    collect(fn, into) {
+        for (const [name, node] of Object.entries(fn(this.ctx()))) {
+            if (this.known(name))
+                throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined in defaults — use .overrideStage/.overrideBind`);
+            into[name] = node;
+        }
+        return this;
+    }
+    stage(fn) {
+        return this.collect(fn, this.staged);
+    }
+    bind(fn) {
+        return this.collect(fn, this.binds);
+    }
+    allow(input) {
+        const ctx = this.ctx();
+        const block = typeof input === 'function' ? input(ctx) : input;
+        for (const key of ['$default', ...ACTIONS]) {
+            if (block[key] !== undefined)
+                this.allowOut[key] = resolveRule(block[key], ctx);
+        }
+        return this;
+    }
+}
+// ==========
+// attrs builder
+class AttrsRuntime {
+    schema;
+    out = {};
+    constructor(schema) {
+        this.schema = schema;
+    }
+    allow(input) {
+        const ctx = (0, context_js_1.makeContext)({ staged: {}, binds: {} }, validate_js_1.noValidate);
+        const block = typeof input === 'function' ? input(ctx) : input;
+        if (block.create !== undefined)
+            this.out.create = resolveRule(block.create, ctx);
+        return this;
+    }
+}
+// ==========
+// the top-level builder
+class PermsRuntime {
+    schema;
+    defaultStaged = {};
+    defaultBinds = {};
+    defaultAllow;
+    hasDefaults = false;
+    attrsOut;
+    rateLimitsConfig;
+    nsBuilders = {};
+    constructor(schema) {
+        this.schema = schema;
+    }
+    attrs(fn) {
+        const a = new AttrsRuntime(this.schema);
+        fn(a);
+        this.attrsOut = a.out;
+        return this;
+    }
+    defaults(fn) {
+        const d = new DefaultsRuntime();
+        fn(d);
+        this.hasDefaults = true;
+        this.defaultStaged = d.staged;
+        this.defaultBinds = d.binds;
+        this.defaultAllow = d.allowOut;
+        return this;
+    }
+    rateLimits(config) {
+        this.rateLimitsConfig = config;
+        return this;
+    }
+    namespaces(map) {
+        const defaultBindNames = Object.keys(this.defaultBinds);
+        for (const [ns, build] of Object.entries(map)) {
+            if (this.schema && !(0, validate_js_1.namespaceExists)(this.schema, ns))
+                throw new Error(`QERR_PERMS_SCHEMA: '${ns}' is not a namespace in the schema`);
+            const nsb = new NamespaceRuntime(this.schema, ns, this.defaultStaged, defaultBindNames);
+            build(nsb);
+            this.nsBuilders[ns] = nsb;
+        }
+        return this;
+    }
+    compile() {
+        const out = {};
+        if (this.attrsOut) {
+            out.attrs = {
+                allow: this.attrsOut.create !== undefined ? { create: this.attrsOut.create } : {},
+            };
+        }
+        if (this.hasDefaults) {
+            const block = { allow: this.defaultAllow ?? {} };
+            const bind = renderBinds(this.defaultBinds);
+            if (Object.keys(bind).length)
+                block.bind = bind;
+            out.$default = block;
+        }
+        if (this.rateLimitsConfig)
+            out.$rateLimits = this.rateLimitsConfig;
+        for (const [ns, nsb] of Object.entries(this.nsBuilders))
+            out[ns] = nsb.block();
+        return out;
+    }
+}
+function definePerms(schema) {
+    return new PermsRuntime(schema);
+}
+//# sourceMappingURL=builder.js.map

package/dist/commonjs/perms/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../src/perms/builder.ts"],"names":[],"mappings":";;AAsWA,kCAEC;AArVD,6CAA0C;AAC1C,+CAA0E;AAK1E,aAAa;AACb,aAAa;AAEb,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,IAAe,EAAE,GAAQ;IAC5C,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,KAA+B;IAClD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CACnE,CAAA;AACH,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAE/D,aAAa;AACb,oBAAoB;AAEpB,MAAM,gBAAgB;IAcD;IACA;IAdnB,yFAAyF;IACxE,YAAY,CAA0B;IACvD,6EAA6E;IAC5D,KAAK,GAA6B,EAAE,CAAA;IACrD,0EAA0E;IACzD,YAAY,GAA6C,EAAE,CAAA;IAC5E,6EAA6E;IAC5D,UAAU,GAA6D,EAAE,CAAA;IACzE,kBAAkB,CAAa;IACxC,QAAQ,GAAwB,EAAE,CAAA;IAClC,SAAS,GAA2B,EAAE,CAAA;IAE9C,YACmB,MAA6B,EAC7B,EAAU,EAC3B,aAAuC,EACvC,gBAA0B;QAHT,WAAM,GAAN,MAAM,CAAuB;QAC7B,OAAE,GAAF,EAAE,CAAQ;QAI3B,IAAI,CAAC,YAAY,GAAG,EAAE,GAAG,aAAa,EAAE,CAAA;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACrD,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7F,CAAC;IAEO,YAAY,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IACnE,CAAC;IAED,wFAAwF;IAChF,MAAM,CAAC,MAAgC,EAAE,UAAmB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM;YAC3B,CAAC,CAAC,IAAA,2BAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACjD,CAAC,CAAC,wBAAU,CAAA;QACd,OAAO,IAAA,wBAAW,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;IAC9D,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAA;IAC/D,CAAC;IAEO,gBAAgB,CAAC,GAAW,EAAE,KAAa;QACjD,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;IACnE,CAAC;IAEO,GAAG,CACT,QAAkC,EAClC,IAA8B,EAC9B,KAAc,EACd,IAA+B;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,4BAA4B,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAA;YAC/H,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,EAA0C;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAClG,CAAC;IAED,aAAa,CAAC,EAA0C;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC,EAA0C;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,CAAC;IAED,YAAY,CAAC,EAA0C;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;IACrF,CAAC;IAED,QAAQ,CAAC,WAAmB,EAAE,SAAc,EAAE,OAAa;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,WAAW,CAAA;YAC1B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YAC/C,OAAO,IAAI,CAAC,GAAG,CACb,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EACjD,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAChC,CAAA;QACH,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,GAAG,CACb,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,IAAI,EACJ,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAChC,CAAA;IACH,CAAC;IAED,OAAO,CAAC,WAAmB,EAAE,SAAc,EAAE,OAAa;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,WAAW,CAAA;YAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1G,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,GAAG,CACb,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,IAAI,CAAC,KAAK,EACV,IAAI,EACJ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CACnB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,KAAU;QACd,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACzF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS;gBAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAU,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,CAAC,MAAM;gBACT,SAAQ;YACV,MAAM,GAAG,GAA2B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;YAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;oBACpF,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,IAAiB,EAAE,GAAG,CAAC,CAAA;gBAClD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,KAAK,SAAS;gBACpB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,IAAiB,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oCAAoC;IACpC,KAAK;QACH,MAAM,GAAG,GAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAC1B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;QACjB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;YACpC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,aAAa;AACb,mBAAmB;AAEnB,MAAM,eAAe;IACV,MAAM,GAA6B,EAAE,CAAA;IACrC,KAAK,GAA6B,EAAE,CAAA;IAC7C,QAAQ,GAAwB,EAAE,CAAA;IAE1B,GAAG;QACT,qEAAqE;QACrE,OAAO,IAAA,wBAAW,EAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,wBAAU,CAAC,CAAA;IAC5E,CAAC;IAEO,KAAK,CAAC,IAAY;QACxB,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAA;IAClD,CAAC;IAEO,OAAO,CAAC,EAA0C,EAAE,IAA8B;QACxF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,qEAAqE,CAAC,CAAA;YAC3H,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,EAA0C;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,CAAC,EAA0C;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,KAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gBAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,aAAa;AACb,gBAAgB;AAEhB,MAAM,YAAY;IAGa;IAF7B,GAAG,GAAwB,EAAE,CAAA;IAE7B,YAA6B,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAE9D,KAAK,CAAC,KAAU;QACd,MAAM,GAAG,GAAG,IAAA,wBAAW,EAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,wBAAU,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,aAAa;AACb,wBAAwB;AAExB,MAAM,YAAY;IASa;IARrB,aAAa,GAA6B,EAAE,CAAA;IAC5C,YAAY,GAA6B,EAAE,CAAA;IAC3C,YAAY,CAAiC;IAC7C,WAAW,GAAG,KAAK,CAAA;IACnB,QAAQ,CAAiC;IACzC,gBAAgB,CAAgC;IAChD,UAAU,GAAqC,EAAE,CAAA;IAEzD,YAA6B,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAEnD,KAAK,CAAC,EAAqC;QACzC,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,EAAE,CAAC,CAAC,CAAC,CAAA;QACL,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,QAAQ,CAAC,EAA2C;QAClD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAA;QAC/B,EAAE,CAAC,CAAC,CAAC,CAAA;QACL,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,MAA0B;QACnC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,GAA+D;QACxE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAA;YAChF,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;YACvF,KAAK,CAAC,GAAG,CAAC,CAAA;YACV,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,GAAG,CAAA;QAC3B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAwB,EAAE,CAAA;QAEnC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,KAAK,GAAG;gBACV,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aAClF,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,KAAK,GAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAA;YACrD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;gBAC1B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YACnB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAA;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB;YACvB,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAEzC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YACrD,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAA;QAEvB,OAAO,GAAwB,CAAA;IACjC,CAAC;CACF;AAmBD,SAAgB,WAAW,CAAC,MAAkB;IAC5C,OAAO,IAAI,YAAY,CAAC,MAAM,CAAiC,CAAA;AACjE,CAAC","sourcesContent":["/**\n * The builder runtime and the `.compile()` pipeline.\n *\n * The chainable builders accumulate authoring state (staged expressions, bind\n * aliases, allow/fields rules) and `.compile()` walks them into the plain\n * `IdbPerms` object — CEL strings under ordinary Instant keys. Creativity is in\n * the authoring surface; the output is exactly what Instant already accepts.\n *\n * Inheritance follows the backend (`server/.../rule.clj` `with-binds`):\n * `$default.bind` is concatenated into every namespace there, so dux emits an\n * inherited bind once under `$default.bind` and references it by bare alias —\n * never re-emitting it per namespace. Staged values are authoring-only and are\n * copied into each namespace's scope so `s.*` resolves.\n */\nimport type { InstantRules } from '@instantdb/core'\nimport type { IdbSchema } from '../schema/defineSchema.js'\nimport type { IdbRegisteredSchema } from '../schema/register.js'\nimport type { ExprNode } from './ast.js'\nimport type { IdbPermsRateLimits, PermsBuilder } from './types.js'\nimport { makeContext } from './context.js'\nimport { makeValidator, namespaceExists, noValidate } from './validate.js'\n\ntype RuleValue = boolean | ExprNode | ((ctx: any) => boolean | ExprNode)\ntype Ctx = any\n\n// ==========\n// resolution\n\nfunction asCel(value: boolean | ExprNode): string {\n  return typeof value === 'boolean' ? String(value) : value.render()\n}\n\nfunction resolveRule(rule: RuleValue, ctx: Ctx): string {\n  return asCel(typeof rule === 'function' ? rule(ctx) : rule)\n}\n\nfunction renderBinds(binds: Record<string, ExprNode>): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(binds).map(([name, node]) => [name, node.render()]),\n  )\n}\n\nconst ACTIONS = ['view', 'create', 'update', 'delete'] as const\n\n// ==========\n// namespace builder\n\nclass NamespaceRuntime {\n  /** Common staged values — inlined, inherited from defaults, merged into every action. */\n  private readonly commonStaged: Record<string, ExprNode>\n  /** All emitted bind aliases — common and action-specific share one block. */\n  private readonly binds: Record<string, ExprNode> = {}\n  /** Per-whole-entity-action staged values, visible only in that action. */\n  private readonly actionStaged: Record<string, Record<string, ExprNode>> = {}\n  /** Per-(dir, label) staged values, visible only in that link/unlink rule. */\n  private readonly linkStaged: Record<string, Record<string, Record<string, ExprNode>>> = {}\n  private readonly inheritedBindNames: Set<string>\n  private allowOut: Record<string, any> = {}\n  private fieldsOut: Record<string, string> = {}\n\n  constructor(\n    private readonly schema: IdbSchema | undefined,\n    private readonly ns: string,\n    defaultStaged: Record<string, ExprNode>,\n    defaultBindNames: string[],\n  ) {\n    this.commonStaged = { ...defaultStaged }\n    this.inheritedBindNames = new Set(defaultBindNames)\n  }\n\n  /** Is this name already a common staged value, an emitted bind, or inherited? */\n  private known(name: string): boolean {\n    return name in this.commonStaged || name in this.binds || this.inheritedBindNames.has(name)\n  }\n\n  private linkTargetOf(label: string): string | undefined {\n    return this.schema?.entities[this.ns]?.links?.[label]?.entityName\n  }\n\n  /** Build a context over a staged snapshot, validating against ns (or a link target). */\n  private ctxFor(staged: Record<string, ExprNode>, linkTarget?: string): Ctx {\n    const validator = this.schema\n      ? makeValidator(this.schema, this.ns, linkTarget)\n      : noValidate\n    return makeContext({ staged, binds: this.binds }, validator)\n  }\n\n  private mergedStaged(action: string): Record<string, ExprNode> {\n    return { ...this.commonStaged, ...this.actionStaged[action] }\n  }\n\n  private mergedLinkStaged(dir: string, label: string): Record<string, ExprNode> {\n    return { ...this.commonStaged, ...this.linkStaged[dir]?.[label] }\n  }\n\n  private add(\n    produced: Record<string, ExprNode>,\n    into: Record<string, ExprNode>,\n    guard: boolean,\n    seen: (name: string) => boolean,\n  ): this {\n    for (const [name, node] of Object.entries(produced)) {\n      if (guard && seen(name))\n        throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined on '${this.ns}' — use .overrideStage/.overrideBind`)\n      into[name] = node\n    }\n    return this\n  }\n\n  stage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, true, n => this.known(n))\n  }\n\n  overrideStage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.commonStaged, false, () => false)\n  }\n\n  bind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, true, n => this.known(n))\n  }\n\n  overrideBind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.add(fn(this.ctxFor(this.commonStaged)), this.binds, false, () => false)\n  }\n\n  stageFor(actionOrDir: string, labelOrFn: any, maybeFn?: any) {\n    if (maybeFn === undefined) {\n      const action = actionOrDir\n      const into = (this.actionStaged[action] ??= {})\n      return this.add(\n        labelOrFn(this.ctxFor(this.mergedStaged(action))),\n        into,\n        true,\n        n => this.known(n) || n in into,\n      )\n    }\n    const [dir, label] = [actionOrDir, labelOrFn]\n    const into = ((this.linkStaged[dir] ??= {})[label] ??= {})\n    return this.add(\n      maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))),\n      into,\n      true,\n      n => this.known(n) || n in into,\n    )\n  }\n\n  bindFor(actionOrDir: string, labelOrFn: any, maybeFn?: any) {\n    if (maybeFn === undefined) {\n      const action = actionOrDir\n      return this.add(labelOrFn(this.ctxFor(this.mergedStaged(action))), this.binds, true, n => this.known(n))\n    }\n    const [dir, label] = [actionOrDir, labelOrFn]\n    return this.add(\n      maybeFn(this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))),\n      this.binds,\n      true,\n      n => this.known(n),\n    )\n  }\n\n  allow(input: any) {\n    const block = typeof input === 'function' ? input(this.ctxFor(this.commonStaged)) : input\n    for (const action of ACTIONS) {\n      if (block[action] !== undefined)\n        this.allowOut[action] = resolveRule(block[action], this.ctxFor(this.mergedStaged(action)))\n    }\n    for (const dir of ['link', 'unlink'] as const) {\n      const labels = block[dir]\n      if (!labels)\n        continue\n      const map: Record<string, string> = this.allowOut[dir] ?? {}\n      for (const [label, rule] of Object.entries(labels)) {\n        if (rule !== undefined) {\n          const ctx = this.ctxFor(this.mergedLinkStaged(dir, label), this.linkTargetOf(label))\n          map[label] = resolveRule(rule as RuleValue, ctx)\n        }\n      }\n      this.allowOut[dir] = map\n    }\n    return this\n  }\n\n  fields(input: any) {\n    const ctx = this.ctxFor(this.commonStaged)\n    const block = typeof input === 'function' ? input(ctx) : input\n    for (const [field, rule] of Object.entries(block)) {\n      if (rule !== undefined)\n        this.fieldsOut[field] = resolveRule(rule as RuleValue, ctx)\n    }\n    return this\n  }\n\n  /** The compiled namespace block. */\n  block(): any {\n    const out: any = { allow: this.allowOut }\n    const bind = renderBinds(this.binds)\n    if (Object.keys(bind).length)\n      out.bind = bind\n    if (Object.keys(this.fieldsOut).length)\n      out.fields = this.fieldsOut\n    return out\n  }\n}\n\n// ==========\n// defaults builder\n\nclass DefaultsRuntime {\n  readonly staged: Record<string, ExprNode> = {}\n  readonly binds: Record<string, ExprNode> = {}\n  allowOut: Record<string, any> = {}\n\n  private ctx(): Ctx {\n    // The default context is namespace-loose; the type layer narrows it.\n    return makeContext({ staged: this.staged, binds: this.binds }, noValidate)\n  }\n\n  private known(name: string): boolean {\n    return name in this.staged || name in this.binds\n  }\n\n  private collect(fn: (ctx: Ctx) => Record<string, ExprNode>, into: Record<string, ExprNode>) {\n    for (const [name, node] of Object.entries(fn(this.ctx()))) {\n      if (this.known(name))\n        throw new Error(`QERR_PERMS_DUPLICATE_NAME: '${name}' is already defined in defaults — use .overrideStage/.overrideBind`)\n      into[name] = node\n    }\n    return this\n  }\n\n  stage(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.collect(fn, this.staged)\n  }\n\n  bind(fn: (ctx: Ctx) => Record<string, ExprNode>) {\n    return this.collect(fn, this.binds)\n  }\n\n  allow(input: any) {\n    const ctx = this.ctx()\n    const block = typeof input === 'function' ? input(ctx) : input\n    for (const key of ['$default', ...ACTIONS]) {\n      if (block[key] !== undefined)\n        this.allowOut[key] = resolveRule(block[key], ctx)\n    }\n    return this\n  }\n}\n\n// ==========\n// attrs builder\n\nclass AttrsRuntime {\n  out: { create?: string } = {}\n\n  constructor(private readonly schema: IdbSchema | undefined) {}\n\n  allow(input: any) {\n    const ctx = makeContext({ staged: {}, binds: {} }, noValidate)\n    const block = typeof input === 'function' ? input(ctx) : input\n    if (block.create !== undefined)\n      this.out.create = resolveRule(block.create, ctx)\n    return this\n  }\n}\n\n// ==========\n// the top-level builder\n\nclass PermsRuntime {\n  private defaultStaged: Record<string, ExprNode> = {}\n  private defaultBinds: Record<string, ExprNode> = {}\n  private defaultAllow: Record<string, any> | undefined\n  private hasDefaults = false\n  private attrsOut: { create?: string } | undefined\n  private rateLimitsConfig: IdbPermsRateLimits | undefined\n  private nsBuilders: Record<string, NamespaceRuntime> = {}\n\n  constructor(private readonly schema?: IdbSchema) {}\n\n  attrs(fn: (a: AttrsRuntime) => AttrsRuntime) {\n    const a = new AttrsRuntime(this.schema)\n    fn(a)\n    this.attrsOut = a.out\n    return this\n  }\n\n  defaults(fn: (d: DefaultsRuntime) => DefaultsRuntime) {\n    const d = new DefaultsRuntime()\n    fn(d)\n    this.hasDefaults = true\n    this.defaultStaged = d.staged\n    this.defaultBinds = d.binds\n    this.defaultAllow = d.allowOut\n    return this\n  }\n\n  rateLimits(config: IdbPermsRateLimits) {\n    this.rateLimitsConfig = config\n    return this\n  }\n\n  namespaces(map: Record<string, (ns: NamespaceRuntime) => NamespaceRuntime>) {\n    const defaultBindNames = Object.keys(this.defaultBinds)\n    for (const [ns, build] of Object.entries(map)) {\n      if (this.schema && !namespaceExists(this.schema, ns))\n        throw new Error(`QERR_PERMS_SCHEMA: '${ns}' is not a namespace in the schema`)\n      const nsb = new NamespaceRuntime(this.schema, ns, this.defaultStaged, defaultBindNames)\n      build(nsb)\n      this.nsBuilders[ns] = nsb\n    }\n    return this\n  }\n\n  compile(): InstantRules<any> {\n    const out: Record<string, any> = {}\n\n    if (this.attrsOut) {\n      out.attrs = {\n        allow: this.attrsOut.create !== undefined ? { create: this.attrsOut.create } : {},\n      }\n    }\n\n    if (this.hasDefaults) {\n      const block: any = { allow: this.defaultAllow ?? {} }\n      const bind = renderBinds(this.defaultBinds)\n      if (Object.keys(bind).length)\n        block.bind = bind\n      out.$default = block\n    }\n\n    if (this.rateLimitsConfig)\n      out.$rateLimits = this.rateLimitsConfig\n\n    for (const [ns, nsb] of Object.entries(this.nsBuilders))\n      out[ns] = nsb.block()\n\n    return out as InstantRules<any>\n  }\n}\n\n// ==========\n// definePerms\n\n/**\n * The typed permissions authoring entry. With the schema registered, no\n * argument is needed; pass the schema value to add runtime validation; pass an\n * explicit type param for a different schema (spec §2).\n *\n * @example\n *   export default definePerms(schema)\n *     .namespaces({\n *       tasks: ns => ns.allow({ view: true }),\n *     })\n *     .compile()\n */\nexport function definePerms<S extends IdbSchema>(schema: S): PermsBuilder<S>\nexport function definePerms<S extends IdbSchema = IdbRegisteredSchema>(): PermsBuilder<S>\nexport function definePerms(schema?: IdbSchema): PermsBuilder<any> {\n  return new PermsRuntime(schema) as unknown as PermsBuilder<any>\n}\n"]}