@vexcms/core 0.0.20 → 0.1.0-alpha.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/.build

@@ -0,0 +1 @@
+1788177820990

package/dist/access/buildChecks.d.ts

@@ -0,0 +1,58 @@
+import type { AccessCheck, AccessDocFieldFor, AccessFieldValueFor, AccessIndexedFieldFor, AccessMutationCheck, AccessResourceRef } from "./types";
+/**
+ * Builds a read check narrowed to `field === value`, pushed into that field's index.
+ *
+ * @typeParam S - Resource slug, inferred from `props.resource`.
+ * @typeParam F - Field name, constrained to `S`'s index-leading fields.
+ * @param props - Input props.
+ * @param props.resource - The resource this check governs.
+ * @param props.field - Field to compare, completed from `S`'s indexed fields.
+ * @param props.value - Value to match, typed from `S`'s document.
+ * @returns A check assignable to `permissions[role][S].read`.
+ */
+export declare function indexedEqCheck<S extends string, F extends AccessIndexedFieldFor<S>>(props: {
+    field: F;
+    resource: AccessResourceRef<S>;
+    value: AccessFieldValueFor<S, F>;
+}): AccessCheck<S>;
+/**
+ * Builds a read check narrowed to rows the requesting user owns, pushed into the owner
+ * field's index.
+ *
+ * The comparison value is built per request from `user`, and its shape follows the
+ * field's declared type: a relationship column stores `Id[]`, so the value is
+ * `[user._id]`; anything else compares the id directly. That decision needs the
+ * resource config, which is why this is a distinct builder rather than a call to
+ * {@link indexedEqCheck}.
+ *
+ * @typeParam S - Resource slug, inferred from `props.resource`.
+ * @typeParam F - Owner field, constrained to `S`'s index-leading fields.
+ * @param props - Input props.
+ * @param props.resource - The resource this check governs.
+ * @param props.field - The owner field, e.g. `"authorId"`.
+ * @returns A check assignable to `permissions[role][S].read`.
+ */
+export declare function indexedOwnerCheck<S extends string, F extends AccessIndexedFieldFor<S>>(props: {
+    field: F;
+    resource: AccessResourceRef<S>;
+}): AccessCheck<S>;
+/**
+ * Builds a single-document check that passes only when `field` names the requesting
+ * user.
+ *
+ * A per-document predicate rather than an index range: `create`/`update`/`delete`
+ * authorize one document, so there is nothing to narrow (DD 14). `field` is therefore
+ * any readable field, not only an indexed one.
+ *
+ * @typeParam S - Resource slug, inferred from `props.resource`.
+ * @typeParam F - Owner field on `S`.
+ * @param props - Input props.
+ * @param props.resource - The resource this check governs.
+ * @param props.field - The owner field, e.g. `"authorId"`.
+ * @returns A check assignable to a non-query action on `S`.
+ */
+export declare function ownerPredicateCheck<S extends string, F extends AccessDocFieldFor<S>>(props: {
+    field: F;
+    resource: AccessResourceRef<S>;
+}): AccessMutationCheck<S>;
+//# sourceMappingURL=buildChecks.d.ts.map

package/dist/access/buildChecks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildChecks.d.ts","sourceRoot":"","sources":["../../src/access/buildChecks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EAEjB,mBAAmB,EACnB,qBAAqB,EAErB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,SAAS,CAAC;AAuEjB;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IAC1F,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC/B,KAAK,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAClC,GAAG,WAAW,CAAC,CAAC,CAAC,CAMjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IAC7F,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAChC,GAAG,WAAW,CAAC,CAAC,CAAC,CAiBjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;IAC3F,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CAChC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAKzB"}

package/dist/access/canAccessAdminPanel.d.ts

@@ -0,0 +1,53 @@
+import type { VexAccessConfig } from "./types";
+/**
+ * Props for {@link canAccessAdminPanel}.
+ */
+export interface CanAccessAdminPanelProps {
+    /**
+     * The resolved config from `defineAccess()`. `undefined` means RBAC is not
+     * configured, which grants access — the same escape hatch `hasPermission`
+     * uses, so a project without an access matrix keeps working.
+     */
+    access?: VexAccessConfig;
+    /**
+     * The authenticated caller. `null`/`{}` (unauthenticated) resolves to an empty
+     * role list and therefore denies.
+     */
+    user: Record<string, unknown> | null;
+    /** The caller's active organization, forwarded to permission callbacks. */
+    organization?: Record<string, unknown>;
+}
+/**
+ * Answers whether a caller may open the admin panel at all — the
+ * `adminPanel.access` gate.
+ *
+ * This is the coarse entry check. It is deliberately separate from the
+ * per-collection checks: a caller who fails this should never reach the panel,
+ * whereas a caller who passes it may still be denied individual collections.
+ *
+ * Call it in the host app's admin route (a server component, layout, or
+ * middleware) and redirect on `false`. It never throws: the `adminPanel.access`
+ * subject carries no document, so it is evaluated with
+ * `scope: "any"` — a permission callback that only reads `user`/`organization`
+ * resolves normally, and one that reaches for a document resolves to `true`
+ * rather than throwing, since "can this caller use the panel" is inherently a
+ * subject-level question.
+ *
+ * Prefer this over hand-writing `hasPermission({ resource: "adminPanel", … })`
+ * so the subject key and action are never spelled by hand.
+ *
+ * @param props - The access config plus the resolved caller.
+ * @returns `true` when the caller may open the admin panel; `false` to deny.
+ *   Also `true` when `access` is `undefined` (RBAC not configured).
+ * @example
+ * ```tsx
+ * // app/admin/[[...path]]/page.tsx
+ * const auth = await fetchAuthQuery(api.auth.api.getUserOrg, {});
+ * if (!canAccessAdminPanel({ access, user: auth.user, organization: auth.organization })) {
+ *   redirect("/unauthorized");
+ * }
+ * ```
+ * @see {@link hasPermission} for the general check this delegates to
+ */
+export declare function canAccessAdminPanel(props: CanAccessAdminPanelProps): boolean;
+//# sourceMappingURL=canAccessAdminPanel.d.ts.map

package/dist/access/canAccessAdminPanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canAccessAdminPanel.d.ts","sourceRoot":"","sources":["../../src/access/canAccessAdminPanel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAS5E"}

package/dist/access/compileConstraints.d.ts

@@ -0,0 +1,155 @@
+import type { DocumentByInfo, Expression, FilterBuilder, GenericDocument, GenericTableInfo } from "convex/server";
+import type { AccessFilterConstraint, AccessIndexConstraint } from "./constraintTypes";
+import type { IndexRangeFn } from "./types";
+/**
+ * Structural equality over Convex values.
+ *
+ * Convex compares values by CONTENT, both in an index range and in a `.filter()`
+ * expression. JS `===` compares arrays and objects by REFERENCE, so using it for the
+ * predicate made the two compile targets disagree for every array-valued field —
+ * which is every `relationship` and `select` field, since both store `v.array(...)`.
+ *
+ * The divergence was not symmetric, and one direction was unsafe: `eq` produced a
+ * false NEGATIVE (the query returned a row the predicate then rejected, so a client
+ * denied access the server had granted), while `neq` produced a false POSITIVE (the
+ * predicate admitted a row the query had excluded). The second is the dangerous one,
+ * and it is why this is content equality rather than a special case for `eq`.
+ *
+ * `undefined` equals `undefined`, which keeps "field missing" and "field explicitly
+ * undefined" indistinguishable — matching how a document read through bracket access
+ * behaves, and matching Convex, which stores neither.
+ *
+ * @param a - Left value.
+ * @param b - Right value.
+ * @returns `true` when the two values are structurally equal.
+ */
+declare function convexValuesEqual(a: unknown, b: unknown): boolean;
+/**
+ * JS-side comparator per {@link IndexOp}, used by `constraintsToPredicate`.
+ * `as never` narrows past `unknown` for the ordering operators only —
+ * `eq` never needs it. Exported so a caller building its own predicate logic
+ * (or a future compile target) reuses the same five comparisons rather than
+ * re-deriving them.
+ *
+ * The ordering operators are left as JS relational comparisons: they are only ever
+ * recorded against a single field of one type, where JS and Convex agree. Convex's
+ * cross-type total order is deliberately not reimplemented here.
+ */
+export declare const CONSTRAINT_COMPARATORS: {
+    readonly eq: typeof convexValuesEqual;
+    readonly gt: (a: unknown, b: unknown) => boolean;
+    readonly gte: (a: unknown, b: unknown) => boolean;
+    readonly lt: (a: unknown, b: unknown) => boolean;
+    readonly lte: (a: unknown, b: unknown) => boolean;
+};
+/**
+ * Compiles a recorded constraint list to a `withIndex` range function.
+ *
+ * @param props - Input props.
+ * @param props.constraints - The rule's recorded constraints, in the order
+ *   they were built. May be empty — an unrestricted range.
+ * @returns A function usable directly as `find`'s `withIndex` range: applies
+ *   each constraint's operator to the builder in order and returns the
+ *   result as an `IndexRange`.
+ */
+export declare function accessConstraintsToIndexRange<TDocument extends GenericDocument = GenericDocument>(props: {
+    constraints: readonly AccessIndexConstraint<string, TDocument>[];
+}): IndexRangeFn;
+/**
+ * Compiles a recorded constraint list to a single `FilterBuilder` expression,
+ * `and`-ing multiple constraints together.
+ *
+ * @param props - Input props.
+ * @param props.constraints - The rule's recorded constraints, in the order
+ *   they were built. Must be non-empty.
+ * @param props.q - The query's own `FilterBuilder`, from `.filter((q) => …)`.
+ * @returns A boolean expression usable directly as (or `and`-ed into) a
+ *   `.filter()` predicate. A single constraint returns its own expression
+ *   unwrapped; two or more are combined with `and`.
+ * @throws {Error} When `props.constraints` is empty — a caller contract
+ *   violation, not a config-authoring mistake. An unrestricted rule resolves to
+ *   its boolean shorthand upstream and never reaches a compile target.
+ */
+export declare function accessConstraintsToFilter<TTableInfo extends GenericTableInfo, TDocument extends DocumentByInfo<TTableInfo> = DocumentByInfo<TTableInfo>>(props: {
+    constraints: readonly AccessIndexConstraint<string, TDocument>[];
+    q: FilterBuilder<TTableInfo>;
+}): Expression<boolean>;
+/**
+ * Compiles a recorded constraint list to a JS predicate, for interpreting
+ * constraints against an already-fetched document (`hasPermission`,
+ * client-side `usePermission`).
+ *
+ * The third compile target for the SAME recorded list, and it agrees with
+ * `accessConstraintsToFilter` by construction: both walk the constraints in order
+ * and both dispatch on the operator set {@link CONSTRAINT_COMPARATORS} defines, one
+ * in JS and one as a Convex expression. `compileConstraints.test.ts` asserts that
+ * agreement on a matching and a non-matching document.
+ *
+ * @param props - Input props.
+ * @param props.constraints - The rule's recorded constraints, in the order
+ *   they were built. May be empty — an unrestricted predicate.
+ * @returns A function returning `true` when `doc` satisfies every constraint.
+ */
+export declare function accessConstraintsToPredicate<TDoc extends GenericDocument>(props: {
+    constraints: readonly AccessIndexConstraint<string, TDoc>[];
+}): (doc: TDoc) => boolean;
+/**
+ * JS-side comparator per {@link FilterOp} — {@link CONSTRAINT_COMPARATORS} plus
+ * `neq`, which `FilterBuilder` has and `IndexRangeBuilder` does not.
+ *
+ * Used by {@link accessFilterTreeToPredicate}. Kept as an extension of the index
+ * map rather than a parallel one so the two algebras cannot drift on a shared
+ * operator: change `gte` once and both compile targets follow.
+ */
+export declare const FILTER_COMPARATORS: {
+    readonly neq: (a: unknown, b: unknown) => boolean;
+    readonly eq: typeof convexValuesEqual;
+    readonly gt: (a: unknown, b: unknown) => boolean;
+    readonly gte: (a: unknown, b: unknown) => boolean;
+    readonly lt: (a: unknown, b: unknown) => boolean;
+    readonly lte: (a: unknown, b: unknown) => boolean;
+};
+/**
+ * Compiles a recorded constraint TREE to a single `FilterBuilder` expression.
+ *
+ * The tree counterpart of {@link accessConstraintsToFilter}: that one walks the
+ * flat positional list an indexed rule records, this one walks the recursive
+ * `compare`/`and`/`or`/`not` shape an unindexed rule records. Both target the
+ * same `.filter()` slot.
+ *
+ * There is no empty-tree case to guard. A rule that recorded nothing leaves
+ * `AccessCondition.filter` as `undefined`, so absence is represented by
+ * the field being missing rather than by an empty node — unlike the flat list,
+ * where `[]` is representable and has to be rejected.
+ *
+ * @typeParam TTableInfo - Convex table info for the query being filtered.
+ * @typeParam TDoc - Document shape the recorded values are typed against.
+ * @param props - Input props.
+ * @param props.node - Root of the recorded tree.
+ * @param props.q - The query's own `FilterBuilder`, from `.filter((q) => …)`.
+ * @returns A boolean expression usable directly as (or `and`-ed into) a
+ *   `.filter()` predicate.
+ */
+export declare function accessFilterTreeToFilter<TTableInfo extends GenericTableInfo, TDoc extends DocumentByInfo<TTableInfo> = DocumentByInfo<TTableInfo>>(props: {
+    node: AccessFilterConstraint<TDoc>;
+    q: FilterBuilder<TTableInfo>;
+}): Expression<boolean>;
+/**
+ * Compiles a recorded constraint TREE to a JS predicate, for interpreting an
+ * unindexed rule against an already-fetched document.
+ *
+ * The tree counterpart of {@link accessConstraintsToPredicate}, and it agrees with
+ * {@link accessFilterTreeToFilter} by construction: both walk the same nodes in the
+ * same order and both dispatch comparisons through {@link FILTER_COMPARATORS}, one
+ * in JS and one as a Convex expression.
+ *
+ * @typeParam TDoc - Document shape the recorded values are typed against.
+ * @param props - Input props.
+ * @param props.node - Root of the recorded tree.
+ * @returns A function returning `true` when `doc` satisfies the tree.
+ */
+export declare function accessFilterTreeToPredicate<TDoc extends GenericDocument>(props: {
+    node: AccessFilterConstraint<TDoc>;
+}): (doc: TDoc) => boolean;
+export {};
+//# sourceMappingURL=compileConstraints.d.ts.map

package/dist/access/compileConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compileConstraints.d.ts","sourceRoot":"","sources":["../../src/access/compileConstraints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,gBAAgB,EAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,iBAAS,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CA2B1D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB;;qBAEzB,OAAO,KAAK,OAAO;sBAClB,OAAO,KAAK,OAAO;qBACpB,OAAO,KAAK,OAAO;sBAClB,OAAO,KAAK,OAAO;CAC2C,CAAC;AAE1E;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,SAAS,eAAe,GAAG,eAAe,EACnD,KAAK,EAAE;IAAE,WAAW,EAAE,SAAS,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;CAAE,GAAG,YAAY,CAkB3F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,SAAS,gBAAgB,EACnC,SAAS,SAAS,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,EACzE,KAAK,EAAE;IACP,WAAW,EAAE,SAAS,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;IACjE,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CAC9B,GAAG,UAAU,CAAC,OAAO,CAAC,CA+BtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,eAAe,EAAE,KAAK,EAAE;IAChF,WAAW,EAAE,SAAS,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;CAC7D,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CAMzB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;sBAEpB,OAAO,KAAK,OAAO;;qBAhIpB,OAAO,KAAK,OAAO;sBAClB,OAAO,KAAK,OAAO;qBACpB,OAAO,KAAK,OAAO;sBAClB,OAAO,KAAK,OAAO;CA8H4C,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,SAAS,gBAAgB,EACnC,IAAI,SAAS,cAAc,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,EACpE,KAAK,EAAE;IAAE,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAA;CAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAkClG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,eAAe,EAAE,KAAK,EAAE;IAC/E,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;CACpC,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,OAAO,CA2BzB"}

package/dist/access/config.d.ts

@@ -0,0 +1,62 @@
+import { CollectionSlug } from "../types/generated";
+import { CustomActionsInput, type AccessResource, type CustomResourceInput, type SubjectMap, type VexAccessConfig, type VexAccessConfigInput } from "./types";
+/**
+ * Defines the RBAC configuration for a VexCMS project.
+ *
+ * Builder in the `defineCollection`/`defineGlobal` family: infers the
+ * per-subject action/data/field registry (`SubjectMap`) from `resources` and
+ * `customResources` so `hasPermission()` calls against the returned config are
+ * fully typed; validates the matrix in dev; returns a frozen `VexAccessConfig`
+ * for `defineConfig({ access })`.
+ *
+ * @typeParam TRoles - Tuple of role name literals.
+ * @typeParam TResources - Tuple of collection/global configs contributing subjects.
+ * @typeParam TCustomResources - Custom subject declarations (`{ actions, data? }`).
+ * @typeParam TUserSlug - Slug literal of the user collection; drives the callback
+ *   `user` type via the generated registry.
+ * @typeParam TOrgSlug - Slug literal of the organization collection, when
+ *   multi-tenant. Presence gates the `organization` callback key; `undefined`
+ *   when single-tenant.
+ * @param props - The access configuration.
+ * @param props.roles - All role names the matrix may reference.
+ * @param props.resources - Collections/globals to expose as subjects, keyed by slug.
+ * @param props.customResources - Non-resource subjects, keyed by name.
+ * @param props.userCollectionSlug - Slug of the collection whose documents are
+ *   `user` in callbacks. A plain string — the merged user collection
+ *   (auth-adapter fields included) does not exist yet at authoring time; the
+ *   document type resolves from the generated registry by slug.
+ * @param props.userRolesField - Field on the user document holding role(s)
+ *   (`string` or `string[]` value); `hasPermission` reads roles from it.
+ * @param props.orgCollectionSlug - Optional org collection slug enabling
+ *   org-scoped callbacks.
+ * @param props.permissions - Role → subject → check matrix (see `RolePermissions`).
+ * @returns Frozen `VexAccessConfig` carrying the `SubjectMap` phantom for inference.
+ * @throws {VexAccessConfigError} When `userCollectionSlug` or `userRolesField` is
+ *   empty, when a `customResources` key collides with a resource slug, or when a
+ *   `customResources` entry declares an empty `actions` array. Also when a rule's
+ *   recorded constraints are not an in-order prefix of a declared index or violate
+ *   Convex's operator rule (see `validateAccessConstraints`), and when a
+ *   `constraints` callback throws while being recorded — every rule's callback runs
+ *   once here, at module load, so a rule that reached past its types surfaces as a
+ *   config error naming the role, resource and action rather than as a bare
+ *   `TypeError` from whichever method was missing.
+ * @example
+ * ```ts
+ * export const access = defineAccess({
+ *   roles: ["admin", "editor"],
+ *   resources: [pages, users],
+ *   customResources: { apiKeys: { actions: ["create", "revoke"] } },
+ *   userCollectionSlug: "users",
+ *   userRolesField: "roles",
+ *   permissions: {
+ *     admin: { [WILDCARD_KEY]: true },
+ *     editor: { pages: { read: true, update: true }, apiKeys: false },
+ *   },
+ * });
+ * ```
+ *
+ * @see {@link VexAccessConfigInput} for the input type
+ * @see {@link VexAccessConfig} for the resolved return type
+ */
+export declare function defineAccess<const TRoles extends readonly string[], const TResources extends readonly AccessResource[], const TCustomResources extends Record<string, CustomResourceInput> = {}, const TUserSlug extends CollectionSlug = CollectionSlug, const TOrgSlug extends CollectionSlug | undefined = undefined, const TCustomActions extends Partial<Record<TResources[number]["slug"] | TUserSlug | Extract<TOrgSlug, string>, CustomActionsInput>> = {}>(props: VexAccessConfigInput<TRoles, TResources, TCustomResources, TUserSlug, TOrgSlug, TCustomActions>): VexAccessConfig<SubjectMap<TResources, TCustomResources, TUserSlug, TOrgSlug, TCustomActions>, TResources, TUserSlug, TOrgSlug, TCustomActions>;
+//# sourceMappingURL=config.d.ts.map

package/dist/access/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/access/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EACL,kBAAkB,EAElB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAgB,YAAY,CAC1B,KAAK,CAAC,MAAM,SAAS,SAAS,MAAM,EAAE,EACtC,KAAK,CAAC,UAAU,SAAS,SAAS,cAAc,EAAE,EAClD,KAAK,CAAC,gBAAgB,SAAS,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,EAAE,EACvE,KAAK,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,EACvD,KAAK,CAAC,QAAQ,SAAS,cAAc,GAAG,SAAS,GAAG,SAAS,EAC7D,KAAK,CAAC,cAAc,SAAS,OAAO,CAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAC/F,GAAG,EAAE,EAEN,KAAK,EAAE,oBAAoB,CACzB,MAAM,EACN,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,cAAc,CACf,GACA,eAAe,CAChB,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,EAC7E,UAAU,EACV,SAAS,EACT,QAAQ,EACR,cAAc,CACf,CA4EA"}

package/dist/access/constants.d.ts

@@ -0,0 +1,95 @@
+/**
+ * CRUD actions available on every resource subject (collections and globals).
+ *
+ * Draft actions ({@link DRAFT_ACTIONS}) are added conditionally when a resource
+ * declares `versions.drafts: true`.
+ */
+export declare const CRUD_ACTIONS: {
+    readonly create: "create";
+    readonly read: "read";
+    readonly update: "update";
+    readonly delete: "delete";
+};
+/** CRUD action union, derived from {@link CRUD_ACTIONS}. */
+export type CrudAction = (typeof CRUD_ACTIONS)[keyof typeof CRUD_ACTIONS];
+/**
+ * Draft workflow actions — present on a resource subject only when its config
+ * declares `versions.drafts: true` (globals today; collections with Spec 36).
+ */
+export declare const DRAFT_ACTIONS: {
+    readonly readDrafts: "readDrafts";
+    readonly saveDraft: "saveDraft";
+    readonly publish: "publish";
+    readonly unpublish: "unpublish";
+};
+/** Draft action union, derived from {@link DRAFT_ACTIONS}. */
+export type DraftAction = (typeof DRAFT_ACTIONS)[keyof typeof DRAFT_ACTIONS];
+/**
+ * Actions whose read shape is a query rather than a single-document check —
+ * the only actions an indexed `{ filter, withIndex }` permission check may
+ * target (design doc §3: `withIndex` on `create`/`update`/`delete` would
+ * narrow nothing, since those authorize one document, not a range).
+ */
+export declare const QUERY_ACTIONS: {
+    readonly read: "read";
+    readonly readDrafts: "readDrafts";
+};
+/** Query-shaped action union, derived from {@link QUERY_ACTIONS}. */
+export type QueryAction = (typeof QUERY_ACTIONS)[keyof typeof QUERY_ACTIONS];
+/**
+ * Field-mode object modes: `allow` = only the listed fields, `deny` = all but
+ * the listed fields.
+ */
+export declare const PERMISSION_MODES: {
+    readonly allow: "allow";
+    readonly deny: "deny";
+};
+/** Field-mode object mode, derived from {@link PERMISSION_MODES}. */
+export type PermissionMode = (typeof PERMISSION_MODES)[keyof typeof PERMISSION_MODES];
+/**
+ * How `hasPermission` answers a *quantified* question: when no `data` is
+ * supplied and a role's check is a callback that needs the document, the scope
+ * decides what "yes" would even mean.
+ *
+ * - `doc` — "may they do this to THIS document?" `data` is required; a callback
+ *   that needs it and does not get it throws {@link VexAccessError}. Opt into
+ *   this in edit views and row actions, where a silent `false` would surface as
+ *   a permanently disabled control and read like a misconfigured matrix.
+ * - `any` — "may they do this to AT LEAST ONE document?" Resolves such a callback
+ *   to `true` without invoking it. Use for nav/sidebar/list gating; per-document
+ *   filtering still happens downstream in `find`/`get`.
+ * - `all` (default) — "may they do this to EVERY document?" Resolves such a
+ *   callback to `false`: a per-document condition cannot hold for all of them.
+ *   Fail-closed, so omitting `scope` never throws and never over-permits.
+ *
+ * Static boolean checks are unaffected by scope, and any scope evaluates the
+ * callback normally once `data` is supplied.
+ */
+export declare const PERMISSION_SCOPES: {
+    readonly doc: "doc";
+    readonly any: "any";
+    readonly all: "all";
+};
+/** Permission evaluation scope, derived from {@link PERMISSION_SCOPES}. */
+export type PermissionScope = (typeof PERMISSION_SCOPES)[keyof typeof PERMISSION_SCOPES];
+/**
+ * Wildcard key usable at two matrix levels: role level (`admin: { [WILDCARD_KEY]:
+ * true }`, boolean only) and action level inside a per-action map (any
+ * `PermissionCheck`). Precedence: explicit action > subject wildcard > role
+ * wildcard > `defaults`.
+ */
+export declare const WILDCARD_KEY: "*";
+/**
+ * Built-in non-resource subjects contributed by core. Every entry becomes a
+ * subject in the {@link SubjectMap} exactly like a user-declared custom
+ * resource (no data, no fields).
+ */
+export declare const ADMIN_CUSTOM_SUBJECTS: {
+    readonly adminPanel: {
+        readonly key: "adminPanel";
+        readonly actions: readonly ["access", "impersonate"];
+    };
+};
+/** Union of built-in subject slugs (currently `"adminPanel"`). */
+export type AdminCustomSubjectSlug = keyof typeof ADMIN_CUSTOM_SUBJECTS;
+//# sourceMappingURL=constants.d.ts.map

package/dist/access/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/access/constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;;CAKf,CAAC;AACX,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AACX,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AACX,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AACX,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAG,GAAY,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,qBAAqB,CAAC"}