@casimesh/sdk 0.1.0 → 0.2.0

package/index.js

@@ -27,7 +27,10 @@ var ID_PREFIX = {
   principal: "prn",
   roleBinding: "rol",
   apiKey: "key",
-  task: "tsk"
+  task: "tsk",
+  token: "tok",
+  audit: "aud",
+  revocation: "rev"
 };
 var ULID_PATTERN = "[0-9A-HJKMNP-TV-Z]{26}";
 var prefixedId = (kind) => z.string().regex(new RegExp(`^${ID_PREFIX[kind]}_${ULID_PATTERN}$`), `Expected a ${kind} id (${ID_PREFIX[kind]}_<ULID>)`).meta({ description: `${kind} identifier`, example: `${ID_PREFIX[kind]}_01J9Z3K7Q8R5T2V4W6X8Y0A1B2` });
@@ -40,6 +43,10 @@ var CommandId = prefixedId("command");
 var PrincipalId = prefixedId("principal");
 var RoleBindingId = prefixedId("roleBinding");
 var TaskId = prefixedId("task");
+var TokenId = prefixedId("token");
+var AuditId = prefixedId("audit");
+var RevocationId = prefixedId("revocation");
+var ApiKeyId = prefixedId("apiKey");
 
 // ../contracts/src/agent.ts
 var AgentKind = z.enum(["standard", "mesh"]);
@@ -70,6 +77,52 @@ z.object({
   model: z.string().max(100).nullable().optional(),
   metadata: Metadata.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateAgentRequest" });
+var AuditKind = z.enum([
+  "authorization",
+  "authentication",
+  "credential",
+  "principal",
+  "policy",
+  "replication"
+]);
+var AuditOutcome = z.enum(["allowed", "denied", "done"]);
+var AuditTarget = z.object({
+  nodeId: z.string().optional(),
+  organizationId: z.string().optional(),
+  /** The entity, credential or event concerned, when there is one. */
+  id: z.string().optional()
+});
+z.object({
+  /** 1, 2, 3… with no gaps: a missing number is a removed entry. */
+  seq: z.int().min(1),
+  id: AuditId,
+  at: Timestamp,
+  kind: AuditKind,
+  /** What was attempted or done, e.g. `agent.create`, `token.issue`, `event.refused`. */
+  action: z.string().max(64),
+  outcome: AuditOutcome,
+  principalId: PrincipalId.nullable(),
+  credentialId: z.string().nullable(),
+  target: AuditTarget,
+  detail: z.string().max(500),
+  /** SHA-256 (hex) of the previous entry; 64 zeros for the first. */
+  prevHash: z.string().regex(/^[0-9a-f]{64}$/),
+  /** SHA-256 (hex) of this entry's canonical JSON without `hash` and `sig`. */
+  hash: z.string().regex(/^[0-9a-f]{64}$/),
+  /** The node key's Ed25519 signature over `hash`. */
+  sig: z.string(),
+  /** The node key that signed (keys rotate; ADR-0025). Not part of `hash`; null for entries from before rotation. */
+  signer: z.string().nullable()
+}).meta({ id: "AuditEntry", description: "One signed, hash-chained record of the node's audit log." });
+z.object({
+  valid: z.boolean(),
+  entries: z.int().min(0),
+  /** The first entry that failed, or null when the whole chain holds. */
+  brokenAt: z.int().nullable(),
+  reason: z.string().nullable(),
+  /** The node's current key; entries may also be signed by its earlier keys. */
+  publicKey: z.string()
+}).meta({ id: "AuditVerification" });
 var PrincipalKind = z.enum(["user", "service"]);
 var Principal = z.object({
   id: PrincipalId,
@@ -78,7 +131,9 @@ var Principal = z.object({
   publicKey: z.string().nullable(),
   createdAt: Timestamp
 }).meta({ id: "Principal", description: "A user or service that can be authenticated and granted roles." });
-var Role = z.enum(["node_owner", "org_owner"]);
+var Role = z.enum(["node_owner", "org_owner", "viewer", "auditor", "agent_operator"]);
+var NODE_ROLES = ["node_owner", "viewer", "auditor"];
+var TokenScope = z.enum(["read", "write", "admin"]);
 var RoleScope = z.discriminatedUnion("type", [
   z.object({ type: z.literal("node"), nodeId: NodeId }),
   z.object({ type: z.literal("organization"), organizationId: OrganizationId, nodeId: NodeId })
@@ -90,10 +145,15 @@ var RoleBinding = z.object({
   scope: RoleScope,
   createdAt: Timestamp
 }).refine(
-  (b) => b.role === "node_owner" ? b.scope.type === "node" : b.scope.type === "organization",
-  "node_owner must be node-scoped and org_owner organization-scoped"
+  (b) => NODE_ROLES.includes(b.role) ? b.scope.type === "node" : b.scope.type === "organization",
+  "node_owner, viewer and auditor are node-scoped; org_owner and agent_operator organization-scoped"
 ).meta({ id: "RoleBinding" });
 z.object({ principalId: PrincipalId }).meta({ id: "GrantOwnerRequest" });
+var RoleTarget = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("node"), nodeId: NodeId }),
+  z.object({ type: z.literal("organization"), organizationId: OrganizationId })
+]);
+z.object({ principalId: PrincipalId, role: Role, target: RoleTarget }).meta({ id: "GrantRoleRequest" });
 var TransportKind = z.enum(["memory", "ws-peer", "tcp", "mqtt", "meshtastic", "meshcore"]);
 var LinkState = z.enum(["requested", "up", "down"]);
 var LinkQuality = z.object({
@@ -111,6 +171,29 @@ var Link = z.object({
   ...EntityAudit
 }).refine((link) => link.aNodeId !== link.bNodeId, "A link must connect two different nodes").meta({ id: "Link", description: "Transport-level adjacency between two nodes \u2014 the edges of the topology." });
 z.object({ aNodeId: NodeId, bNodeId: NodeId, transport: TransportKind }).refine((body) => body.aNodeId !== body.bNodeId, "A link must connect two different nodes").meta({ id: "CreateLinkRequest" });
+var Ed25519Key = z.string().startsWith("ed25519:");
+var NodeCertificate = z.object({
+  v: z.literal(1),
+  nodeId: NodeId,
+  publicKey: Ed25519Key,
+  issuedAt: Timestamp,
+  expiresAt: Timestamp,
+  /** The mesh root's public key. */
+  rootKey: Ed25519Key,
+  /** The root's signature over the canonical JSON of every other field. */
+  sig: z.string()
+}).meta({ id: "NodeCertificate", description: "A node key certified by the mesh root (ADR-0025)." });
+var KeyRevocation = z.object({
+  v: z.literal(1),
+  publicKey: Ed25519Key,
+  nodeId: NodeId,
+  revokedAt: Timestamp,
+  reason: z.string().max(500),
+  rootKey: Ed25519Key,
+  sig: z.string()
+}).meta({ id: "KeyRevocation", description: "A node key revoked by the mesh root (ADR-0025)." });
+
+// ../contracts/src/node.ts
 var NodeStatus = z.enum(["online", "degraded", "offline"]);
 var Node = z.object({
   id: NodeId,
@@ -121,6 +204,8 @@ var Node = z.object({
   status: NodeStatus,
   metadata: Metadata,
   lastSeenAt: Timestamp.nullable(),
+  /** The mesh root's certificate for `publicKey`, in a rooted mesh (ADR-0025). */
+  certificate: NodeCertificate.nullable().default(null),
   ...EntityAudit
 }).meta({ id: "Node", description: "A physical or virtual endpoint connected to the mesh." });
 z.object({
@@ -128,12 +213,75 @@ z.object({
   endpoint: z.url().nullable().optional(),
   metadata: Metadata.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateNodeRequest" });
+var Effect = z.enum(["allow", "deny"]);
+var NamePattern = z.string().regex(/^(\*|[a-z][a-z0-9_-]*(?:\.[a-z][a-z0-9_-]*)*(?:\.\*)?)$/i, "An exact name, `prefix.*` or `*`").max(100);
+var CapabilityRule = z.object({
+  effect: Effect,
+  capability: NamePattern,
+  organizationId: OrganizationId.optional(),
+  nodeId: NodeId.optional()
+});
+var ToolRule = z.object({ effect: Effect, tool: NamePattern, agentId: AgentId.optional() });
+var section = (rule) => z.object({ default: Effect.default("allow"), rules: z.array(rule).max(100).default([]) });
+var OrganizationPolicy = z.object({
+  inbound: section(CapabilityRule).default({ default: "allow", rules: [] }),
+  outbound: section(CapabilityRule).default({ default: "allow", rules: [] }),
+  tools: section(ToolRule).default({ default: "allow", rules: [] })
+}).meta({
+  id: "OrganizationPolicy",
+  description: "Who may request which capabilities, whom its agents may ask, and which tools they may use."
+});
+var OPEN_POLICY = {
+  inbound: { default: "allow", rules: [] },
+  outbound: { default: "allow", rules: [] },
+  tools: { default: "allow", rules: [] }
+};
+function matchesPattern(pattern, name) {
+  if (pattern === "*") return true;
+  if (pattern.endsWith(".*")) return name.startsWith(pattern.slice(0, -1));
+  return pattern === name;
+}
+function decide(policySection, matches) {
+  const matching = policySection.rules.filter(matches);
+  const deny = matching.find((r) => r.effect === "deny");
+  if (deny) return { allowed: false, rule: deny };
+  const allow = matching.find((r) => r.effect === "allow");
+  if (allow) return { allowed: true, rule: allow };
+  return { allowed: policySection.default === "allow", rule: void 0 };
+}
+var party = (rule, other) => (rule.organizationId === void 0 || rule.organizationId === other.organizationId) && (rule.nodeId === void 0 || rule.nodeId === other.nodeId);
+function mayRequest(requester, provider, capability) {
+  if (requester.id === provider.id) return { allowed: true, rule: void 0 };
+  const outbound = decide(
+    requester.policy.outbound,
+    (r) => matchesPattern(r.capability, capability) && party(r, { organizationId: provider.id, nodeId: provider.nodeId })
+  );
+  if (!outbound.allowed) return outbound;
+  return decide(
+    provider.policy.inbound,
+    (r) => matchesPattern(r.capability, capability) && party(r, { organizationId: requester.id, nodeId: requester.nodeId })
+  );
+}
+function inboundAllows(provider, requester, capability) {
+  if (requester.organizationId === provider.id) return { allowed: true, rule: void 0 };
+  return decide(provider.policy.inbound, (r) => matchesPattern(r.capability, capability) && party(r, requester));
+}
+function mayUseTool(organization, agentId, tool) {
+  return decide(
+    organization.policy.tools,
+    (r) => matchesPattern(r.tool, tool) && (r.agentId === void 0 || r.agentId === agentId)
+  );
+}
+
+// ../contracts/src/organization.ts
 var Organization = z.object({
   id: OrganizationId,
   nodeId: NodeId,
   name: DisplayName,
   slug: Slug,
   metadata: Metadata,
+  /** Capability and tool policy (ADR-0023). Organizations from before it have the open policy. */
+  policy: OrganizationPolicy.default(OPEN_POLICY),
   ...EntityAudit
 }).meta({ id: "Organization", description: "A logical boundary on a node that owns policies, identities and agents." });
 z.object({
@@ -146,7 +294,8 @@ z.object({
 }).meta({ id: "CreateOrganizationRequest" });
 z.object({
   name: DisplayName.optional(),
-  metadata: Metadata.optional()
+  metadata: Metadata.optional(),
+  policy: OrganizationPolicy.optional()
 }).refine((body) => Object.keys(body).length > 0, "At least one field must be provided").meta({ id: "UpdateOrganizationRequest" });
 var TaskStatus = z.enum(["requested", "accepted", "completed", "failed"]);
 var TaskParty = z.object({ agentId: AgentId, organizationId: OrganizationId, nodeId: NodeId });
@@ -191,7 +340,9 @@ z.object({
   organizationName: z.string(),
   nodeId: NodeId,
   /** Running, on a node that is not offline — i.e. a task could be routed to it now. */
-  available: z.boolean()
+  available: z.boolean(),
+  /** Whether both organizations' policies let the agent named by `forAgent` ask this provider (ADR-0023); null without it. */
+  permitted: z.boolean().nullable()
 }).meta({ id: "CapabilityProvider" });
 
 // ../contracts/src/events.ts
@@ -202,6 +353,7 @@ var AgentSubject = subject("agent", AgentId);
 var LinkSubject = subject("link", LinkId);
 var RoleBindingSubject = subject("roleBinding", RoleBindingId);
 var TaskSubject = subject("task", TaskId);
+var RevocationSubject = subject("revocation", RevocationId);
 var event = (type, subjectSchema, payload) => z.object({ type: z.literal(type), subject: subjectSchema, payload });
 var AgentRegistration = z.object({
   meshAgentId: AgentId,
@@ -258,6 +410,7 @@ var TaskRequested = event("task.requested", TaskSubject, z.object({ task: Task }
 var TaskAccepted = event("task.accepted", TaskSubject, z.object({ task: Task }));
 var TaskCompleted = event("task.completed", TaskSubject, z.object({ task: Task }));
 var TaskFailed = event("task.failed", TaskSubject, z.object({ task: Task }));
+var MeshKeyRevoked = event("mesh.key_revoked", RevocationSubject, z.object({ revocation: KeyRevocation }));
 var DomainEvent = z.discriminatedUnion("type", [
   NodeCreated,
   NodeUpdated,
@@ -283,7 +436,8 @@ var DomainEvent = z.discriminatedUnion("type", [
   TaskRequested,
   TaskAccepted,
   TaskCompleted,
-  TaskFailed
+  TaskFailed,
+  MeshKeyRevoked
 ]).meta({ id: "DomainEvent" });
 DomainEvent.options.map((o) => o.shape.type.value);
 var ENVELOPE_VERSION = 1;
@@ -309,13 +463,37 @@ z.object({
   uptimeSeconds: z.number().nonnegative(),
   timestamp: z.iso.datetime()
 }).meta({ id: "HealthResponse", description: "Liveness and version information for a Node Server." });
-z.object({ principal: Principal, roles: z.array(RoleBinding) }).meta({ id: "Me", description: "The authenticated principal and its role bindings." });
+z.object({
+  principal: Principal,
+  roles: z.array(RoleBinding),
+  /** What the credential used for this request may do (ADR-0022). */
+  scopes: z.array(TokenScope)
+}).meta({ id: "Me", description: "The authenticated principal and its role bindings." });
 z.object({ name: DisplayName, kind: PrincipalKind.default("user") }).meta({ id: "CreatePrincipalRequest" });
 var Credential = z.discriminatedUnion("type", [
   z.object({ type: z.literal("token"), token: z.string(), expiresAt: Timestamp }),
   z.object({ type: z.literal("apiKey"), apiKey: z.string() })
 ]).meta({ id: "Credential" });
 z.object({ principal: Principal, credential: Credential }).meta({ id: "CreatePrincipalResponse" });
+var MAX_TOKEN_TTL_SECONDS = 365 * 24 * 60 * 60;
+z.object({
+  /** Defaults to all scopes the caller's own credential has. */
+  scopes: z.array(TokenScope).min(1).optional(),
+  ttlSeconds: z.int().min(60).max(MAX_TOKEN_TTL_SECONDS).default(30 * 24 * 60 * 60),
+  label: z.string().trim().max(120).optional()
+}).meta({ id: "IssueTokenRequest" });
+z.object({ id: TokenId, token: z.string(), scopes: z.array(TokenScope), expiresAt: Timestamp }).meta({ id: "IssuedToken" });
+z.object({
+  id: z.union([TokenId, ApiKeyId]),
+  type: z.enum(["token", "apiKey"]),
+  principalId: PrincipalId,
+  scopes: z.array(TokenScope),
+  label: z.string().nullable(),
+  createdAt: Timestamp,
+  expiresAt: Timestamp.nullable(),
+  revokedAt: Timestamp.nullable(),
+  lastUsedAt: Timestamp.nullable()
+}).meta({ id: "CredentialInfo" });
 var MeshCursor = z.record(NodeId, z.int().min(0)).meta({ id: "MeshCursor" });
 z.object({
   nodes: z.array(Node),
@@ -393,6 +571,8 @@ function project(event2) {
     case "task.completed":
     case "task.failed":
       return { op: "upsert", kind: "task", entity: event2.payload.task };
+    case "mesh.key_revoked":
+      return { op: "upsert", kind: "revocation", entity: { ...event2.payload.revocation, id: event2.subject.id } };
     // Registration is implied by organization membership; heartbeats are handled by the presence detector.
     case "mesh_agent.agent_registered":
     case "mesh_agent.agent_deregistered":
@@ -401,6 +581,55 @@ function project(event2) {
   }
 }
 
+// ../contracts/src/writers.ts
+var owner = (...nodeIds) => ({ kind: "owner", nodeIds });
+var ANY = { kind: "any" };
+function writersOf(event2) {
+  switch (event2.type) {
+    case "node.created":
+    case "node.updated":
+      return owner(event2.payload.node.id);
+    case "node.heartbeat":
+      return owner(event2.payload.nodeId);
+    case "organization.created":
+    case "organization.updated":
+      return owner(event2.payload.organization.nodeId);
+    case "agent.created":
+    case "agent.updated":
+    case "agent.status_changed":
+      return owner(event2.payload.agent.nodeId);
+    case "mesh_agent.agent_registered":
+      return owner(event2.payload.nodeId);
+    case "link.up":
+    case "link.updated":
+    case "link.down":
+      return owner(event2.payload.link.aNodeId);
+    case "link.requested":
+      return owner(event2.payload.link.aNodeId, event2.payload.link.bNodeId);
+    case "role.granted":
+      return owner(event2.payload.binding.scope.nodeId);
+    case "task.requested":
+      return owner(event2.payload.task.requester.nodeId);
+    case "task.accepted":
+    case "task.completed":
+    case "task.failed":
+      return owner(event2.payload.task.assignee.nodeId);
+    case "node.removed":
+    case "node.status_changed":
+    case "organization.removed":
+    case "agent.removed":
+    case "mesh_agent.agent_deregistered":
+    case "link.removed":
+    case "role.revoked":
+    case "mesh.key_revoked":
+      return ANY;
+  }
+}
+function isAuthorizedWriter(event2, originNodeId) {
+  const writers = writersOf(event2);
+  return writers.kind === "any" || writers.nodeIds.includes(originNodeId);
+}
+
 // ../contracts/src/mesh-state.ts
 var byId = (items) => Object.fromEntries(items.map((item) => [item.id, item]));
 function meshStateFromSnapshot(snapshot) {
@@ -418,6 +647,7 @@ function applyMeshEvent(state, event2) {
   const seen = state.cursor[event2.origin.nodeId] ?? 0;
   if (event2.seq <= seen) return state;
   const cursor = { ...state.cursor, [event2.origin.nodeId]: event2.seq };
+  if (!isAuthorizedWriter(event2, event2.origin.nodeId)) return { ...state, cursor };
   const op = project(event2);
   switch (op.op) {
     case "upsert":
@@ -431,6 +661,7 @@ function applyMeshEvent(state, event2) {
         case "link":
           return { ...state, cursor, links: { ...state.links, [op.entity.id]: op.entity } };
         case "roleBinding":
+        case "revocation":
           return { ...state, cursor };
         case "task": {
           const current = state.tasks[op.entity.id];
@@ -472,7 +703,7 @@ z.object({
   code: z.string().meta({ description: "Stable machine-readable error code" }),
   errors: z.array(z.object({ path: z.string(), message: z.string() })).optional()
 }).meta({ id: "ProblemDetails" });
-var Topic = z.enum(["node", "organization", "agent", "link", "roleBinding", "task"]);
+var Topic = z.enum(["node", "organization", "agent", "link", "roleBinding", "task", "revocation"]);
 z.discriminatedUnion("type", [
   z.object({
     type: z.literal("hello"),
@@ -493,6 +724,8 @@ z.discriminatedUnion("type", [
 var RealtimeCloseCode = {
   normal: 1e3,
   unauthenticated: 4401,
+  /** Authenticated, but without a role on this node (ADR-0022). */
+  forbidden: 4403,
   resyncRequired: 4409
 };
 
@@ -712,7 +945,12 @@ var MeshRealtime = class {
         this.needsSnapshot = true;
         break;
       case "error":
-        this.emitError(new RealtimeError(`${message.code}: ${message.message}`, message.code === "unauthenticated"));
+        this.emitError(
+          new RealtimeError(
+            `${message.code}: ${message.message}`,
+            message.code === "unauthenticated" || message.code === "forbidden"
+          )
+        );
         break;
     }
   }
@@ -727,8 +965,13 @@ var MeshRealtime = class {
   onClose(code) {
     this.socket = void 0;
     if (this.stopped) return;
-    if (code === RealtimeCloseCode.unauthenticated) {
-      this.emitError(new RealtimeError("The node rejected the credential", true));
+    if (code === RealtimeCloseCode.unauthenticated || code === RealtimeCloseCode.forbidden) {
+      this.emitError(
+        new RealtimeError(
+          code === RealtimeCloseCode.forbidden ? "The credential has no role on this node" : "The node rejected the credential",
+          true
+        )
+      );
       this.close();
       return;
     }
@@ -792,10 +1035,52 @@ function createMeshClient(options) {
     stats: () => http.request("GET", "/v1/mesh/stats"),
     capabilities: async (search) => (await http.request("GET", "/v1/capabilities", { query: { q: search } })).items,
     /** Agents offering a capability, available ones first (ADR-0020). */
-    capabilityProviders: async (name) => (await http.request("GET", `/v1/capabilities/${id(name)}/providers`)).items,
+    revocations: {
+      /** Revocations published to the mesh, each with whether it holds under the node's root (ADR-0025). */
+      list: async () => (await http.request(
+        "GET",
+        "/v1/mesh/revocations"
+      )).items,
+      /** Publishes a root-signed revocation through this node (node owners). */
+      publish: (revocation) => http.request("POST", "/v1/mesh/revocations", { body: revocation })
+    },
+    /** With `forAgent`, each provider also says whether policy lets that agent ask it (ADR-0023). */
+    capabilityProviders: async (name, options2 = {}) => (await http.request("GET", `/v1/capabilities/${id(name)}/providers`, {
+      query: { ...options2 }
+    })).items,
     principals: {
       /** Node owners only. The credential is returned exactly once. */
-      create: (input, options2 = {}) => http.request("POST", "/v1/principals", { body: input, ...options2 })
+      create: (input, options2 = {}) => http.request("POST", "/v1/principals", { body: input, ...options2 }),
+      /** This node's principals (node owners only). */
+      list: async () => (await http.request("GET", "/v1/principals")).items,
+      /** Deletes a principal and its credentials; revoke its roles first (node owners only). */
+      remove: (principalId) => http.request("DELETE", `/v1/principals/${id(principalId)}`),
+      /**
+       * Issues a bearer token with scopes and an expiry (ADR-0022): for yourself, never with more scopes than the
+       * credential you use, or — node owners — for anyone. The token is returned exactly once.
+       */
+      issueToken: (principalId, input = {}, options2 = {}) => http.request("POST", `/v1/principals/${id(principalId)}/tokens`, { body: input, ...options2 }),
+      /** A principal's tokens and API keys, metadata only (yourself, or node owners for anyone). */
+      credentials: async (principalId) => (await http.request("GET", `/v1/principals/${id(principalId)}/credentials`)).items,
+      /** Revokes every credential of the principal, including the one this client may be using. */
+      revokeAllCredentials: (principalId) => http.request("DELETE", `/v1/principals/${id(principalId)}/credentials`)
+    },
+    credentials: {
+      /** Revokes one token (`tok_…`) or API key (`key_…`). */
+      revoke: (credentialId) => http.request("DELETE", `/v1/credentials/${id(credentialId)}`)
+    },
+    audit: {
+      /** Newest first; page backwards with `before` (node owners and auditors; ADR-0024). */
+      list: (filter = {}) => http.request("GET", "/v1/audit", { query: { ...filter } }),
+      /** Recomputes the whole chain on the node: gaps, hashes and signatures. */
+      verify: () => http.request("GET", "/v1/audit/verify")
+    },
+    roles: {
+      /** A principal's bindings, or those of a node or organization; by default this node's and its organizations'. */
+      list: async (filter = {}) => (await http.request("GET", "/v1/role-bindings", { query: { ...filter } })).items,
+      /** Grants node_owner, viewer or auditor on a node, or org_owner or agent_operator on an organization. */
+      grant: (request, options2 = {}) => http.request("POST", "/v1/role-bindings", { body: request, ...options2 }),
+      revoke: (bindingId) => http.request("DELETE", `/v1/role-bindings/${id(bindingId)}`)
     },
     nodes: {
       list: (page = {}) => http.request("GET", "/v1/nodes", { query: { ...page } }),
@@ -879,6 +1164,6 @@ function createMeshClient(options) {
   return client;
 }
 
-export { MeshApiError, MeshRealtime, RealtimeError, applyMeshEvent, createMeshClient, decodeCursor, encodeCursor, meshStateFromSnapshot };
+export { MeshApiError, MeshRealtime, OPEN_POLICY, RealtimeError, applyMeshEvent, createMeshClient, decodeCursor, encodeCursor, inboundAllows, isAuthorizedWriter, matchesPattern, mayRequest, mayUseTool, meshStateFromSnapshot };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map