@flaredev/core 0.1.2 → 0.3.0

package/dist/index.js

@@ -1,21 +1,44 @@
 import {
+  DEFAULT_FILE_MAX_BYTES,
+  FILE_CATEGORIES,
+  PolicyError,
   RESERVED_FIELD_NAMES,
   ResourceDefinitionError,
+  STRING_FORMATS,
+  allowedActions,
   camelCase,
+  can,
   columnName,
+  countries,
+  countryName,
   createValidators,
   defaultFieldLabel,
+  definePolicy,
   defineResource,
+  field,
   fieldSchema,
   fileKeyPrefix,
+  fileMaxBytes,
+  flagEmoji,
+  formatPhone,
   humanize,
+  isColor,
+  isCountryCode,
+  isDomain,
+  isPhoneNumber,
+  isSlug,
   kebabCase,
+  mimeTypesFor,
+  normalizeDomain,
   pascalCase,
   pluralize,
+  slugify,
   snakeCase,
+  splitPhone,
   storedFields,
+  toE164,
   words
-} from "./chunk-DARDHZPX.js";
+} from "./chunk-434JXSDV.js";
 
 // src/password.ts
 var ALGORITHM = "pbkdf2-sha256";
@@ -466,48 +489,6 @@ function randomLetters(length = 8) {
   return Array.from(bytes, (byte) => String.fromCharCode(97 + byte % 26)).join("");
 }
 
-// src/resource/fields.ts
-var FILE_CATEGORIES = {
-  image: ["image/png", "image/jpeg", "image/gif", "image/webp", "image/avif"],
-  pdf: ["application/pdf"],
-  video: ["video/*"],
-  audio: ["audio/*"],
-  text: ["text/plain"],
-  csv: ["text/csv"],
-  document: [
-    "application/msword",
-    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-    "application/vnd.oasis.opendocument.text"
-  ],
-  spreadsheet: [
-    "application/vnd.ms-excel",
-    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-    "application/vnd.oasis.opendocument.spreadsheet"
-  ],
-  archive: ["application/zip"]
-};
-function mimeTypesFor(accept) {
-  return [...new Set(accept.flatMap((category) => FILE_CATEGORIES[category]))];
-}
-var DEFAULT_FILE_MAX_BYTES = 10 * 1024 * 1024;
-var fileMaxBytes = (field2) => field2.maxBytes ?? DEFAULT_FILE_MAX_BYTES;
-function build(kind, options, extra = {}) {
-  return { kind, ...extra, ...options, required: options?.required !== false };
-}
-var field = {
-  string: (options) => build("string", options),
-  text: (options) => build("text", options, { list: false, searchable: false }),
-  int: (options) => build("int", options),
-  float: (options) => build("float", options),
-  boolean: (options) => build("boolean", options),
-  date: (options) => build("date", options),
-  datetime: (options) => build("datetime", options),
-  enum: (values, options) => build("enum", options, { options: values }),
-  file: (accept, options) => build("file", options, { accept, list: false, sortable: false }),
-  belongsTo: (target, options) => build("belongsTo", options, { target }),
-  hasMany: (target, options) => ({ kind: "hasMany", target, ...options, required: false })
-};
-
 // src/resource/relations.ts
 var RelationError = class extends Error {
   constructor(message) {
@@ -585,7 +566,7 @@ function statusTone(value) {
   return TONES.find(([, pattern]) => pattern.test(normalized))?.[0] ?? "neutral";
 }
 function optionLabel(def, value) {
-  if (def.kind === "enum" && def.optionLabels?.[value]) return def.optionLabels[value];
+  if ((def.kind === "enum" || def.kind === "multiselect") && def.optionLabels?.[value]) return def.optionLabels[value];
   const text2 = value.replace(/[_-]+/g, " ").trim();
   return text2 ? text2[0].toUpperCase() + text2.slice(1) : value;
 }
@@ -610,6 +591,12 @@ function formatValue(def, value, options = {}) {
     }
     case "enum":
       return optionLabel(def, String(value));
+    case "multiselect":
+      return Array.isArray(value) && value.length ? value.map((item) => optionLabel(def, String(item))).join(", ") : "\u2014";
+    case "string":
+      if (def.format === "tel") return formatPhone(String(value));
+      if (def.format === "country") return `${flagEmoji(String(value))} ${countryName(String(value), locale.split("-")[0])}`.trim();
+      return String(value);
     case "file":
       return String(value).split("/").pop().replace(/^[0-9a-f-]{36}-/, "");
     default:
@@ -623,6 +610,7 @@ function initialFormValues(resource, record) {
   for (const [key, def] of storedFields(resource)) {
     const source = record ? record[key] : "default" in def ? def.default : void 0;
     if (def.kind === "boolean") values[key] = source === true || source === 1;
+    else if (def.kind === "multiselect") values[key] = JSON.stringify(Array.isArray(source) ? source : []);
     else if (source === null || source === void 0) values[key] = "";
     else if (source instanceof Date) values[key] = source.toISOString();
     else values[key] = String(source);
@@ -637,6 +625,12 @@ function formValuesToInput(resource, values, mode) {
       input[key] = raw === true;
       continue;
     }
+    if (def.kind === "multiselect") {
+      const picked = parseMultiValue(raw);
+      if (picked.length === 0 && mode === "create" && "default" in def && def.default !== void 0) continue;
+      input[key] = picked.length === 0 && !def.required ? null : picked;
+      continue;
+    }
     const text2 = typeof raw === "string" ? raw : "";
     const empty = text2.trim() === "";
     if (empty) {
@@ -655,6 +649,15 @@ function formValuesToInput(resource, values, mode) {
   }
   return input;
 }
+function parseMultiValue(raw) {
+  if (typeof raw !== "string" || raw === "") return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed.filter((value) => typeof value === "string") : [];
+  } catch {
+    return [];
+  }
+}
 function issuesByField(issues) {
   const errors = {};
   for (const issue of issues) {
@@ -665,49 +668,301 @@ function issuesByField(issues) {
   return errors;
 }
 
-// src/resource/policy.ts
-var ROLE = /^(\*|[a-z][a-z0-9_-]{0,31})$/;
-var PolicyError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "PolicyError";
-  }
-};
-function definePolicy(config) {
-  if (!/^[A-Z][A-Za-z0-9]*$/.test(config.resource)) {
-    throw new PolicyError(`Policy resource "${config.resource}" must be a PascalCase resource name.`);
-  }
-  const clean = (action) => {
-    const roles = config[action] ?? [];
-    for (const role of roles) {
-      if (!ROLE.test(role)) throw new PolicyError(`Policy ${config.resource}.${action}: invalid role "${role}" (lowercase letters, digits, _ or -, or "*").`);
-    }
-    return [...new Set(roles)];
-  };
-  return { resource: config.resource, read: clean("read"), create: clean("create"), update: clean("update"), delete: clean("delete") };
+// src/seed.ts
+function defineSeed(seed) {
+  return seed;
 }
-function can(policy, role, action) {
-  if (!policy) return true;
-  const allowed = policy[action === "list" ? "read" : action];
-  if (allowed.includes("*")) return Boolean(role);
-  return Boolean(role) && allowed.includes(role);
+
+// src/fake.ts
+var FIRST_NAMES = [
+  "Amina",
+  "Daniel",
+  "Grace",
+  "Wei",
+  "Sofia",
+  "Tendai",
+  "Noah",
+  "Priya",
+  "Lucas",
+  "Fatima",
+  "Ibrahim",
+  "Elena",
+  "Kwame",
+  "Maya",
+  "Hiroshi",
+  "Leila",
+  "Marcus",
+  "Chiara",
+  "Omar",
+  "Ana",
+  "Joseph",
+  "Nadia",
+  "Thabo",
+  "Yuki",
+  "Diego",
+  "Ruth",
+  "Samuel",
+  "Zara",
+  "Peter",
+  "Isabel",
+  "Kofi",
+  "Mei",
+  "Andr\xE9s",
+  "Halima",
+  "Jonas",
+  "Rania",
+  "Esther",
+  "Viktor",
+  "Aisha",
+  "Tom\xE1s"
+];
+var LAST_NAMES = [
+  "Okello",
+  "Silva",
+  "Nakamura",
+  "Mensah",
+  "Okafor",
+  "Rossi",
+  "Chen",
+  "Hassan",
+  "M\xFCller",
+  "Dubois",
+  "Kimani",
+  "Patel",
+  "Novak",
+  "Garcia",
+  "Haddad",
+  "Andersen",
+  "Osei",
+  "Reyes",
+  "Kowalski",
+  "Tadesse",
+  "Nguyen",
+  "Baptiste",
+  "Mwangi",
+  "Fernandes",
+  "Ivanov",
+  "Khan",
+  "Lindqvist",
+  "Santos",
+  "Abebe",
+  "Yusuf"
+];
+var COMPANY_HEADS = [
+  "North",
+  "Blue",
+  "Bright",
+  "Iron",
+  "River",
+  "Summit",
+  "Atlas",
+  "Harbour",
+  "Cedar",
+  "Copper",
+  "Lumen",
+  "Orbit",
+  "Stone",
+  "Vertex",
+  "Willow",
+  "Zenith",
+  "Kestrel",
+  "Meridian",
+  "Sable",
+  "Terra"
+];
+var COMPANY_TAILS = ["Labs", "Works", "Group", "Studio", "Systems", "Partners", "Supply", "Analytics", "Foods", "Logistics"];
+var CITIES = [
+  "Kampala",
+  "Nairobi",
+  "Lagos",
+  "Accra",
+  "Cairo",
+  "Cape Town",
+  "Dar es Salaam",
+  "Casablanca",
+  "London",
+  "Berlin",
+  "Madrid",
+  "Lisbon",
+  "Warsaw",
+  "Stockholm",
+  "Amsterdam",
+  "Dublin",
+  "New York",
+  "Toronto",
+  "Chicago",
+  "Austin",
+  "S\xE3o Paulo",
+  "Bogot\xE1",
+  "Mexico City",
+  "Lima",
+  "Mumbai",
+  "Singapore",
+  "Tokyo",
+  "Seoul",
+  "Jakarta",
+  "Manila",
+  "Sydney",
+  "Auckland"
+];
+var COUNTRIES = [
+  ["UG", "256"],
+  ["KE", "254"],
+  ["NG", "234"],
+  ["GH", "233"],
+  ["ZA", "27"],
+  ["EG", "20"],
+  ["US", "1"],
+  ["CA", "1"],
+  ["GB", "44"],
+  ["IE", "353"],
+  ["DE", "49"],
+  ["FR", "33"],
+  ["ES", "34"],
+  ["PT", "351"],
+  ["NL", "31"],
+  ["SE", "46"],
+  ["PL", "48"],
+  ["BR", "55"],
+  ["MX", "52"],
+  ["IN", "91"],
+  ["SG", "65"],
+  ["JP", "81"],
+  ["AU", "61"],
+  ["AE", "971"]
+];
+var WORDS = [
+  "account",
+  "balance",
+  "shipment",
+  "invoice",
+  "review",
+  "signal",
+  "request",
+  "channel",
+  "vendor",
+  "budget",
+  "report",
+  "delivery",
+  "contract",
+  "renewal",
+  "forecast",
+  "meeting",
+  "proposal",
+  "discount",
+  "refund",
+  "ticket",
+  "quarter",
+  "pipeline",
+  "customer",
+  "supplier",
+  "warehouse",
+  "campaign",
+  "segment",
+  "retention",
+  "onboarding",
+  "escalation",
+  "follow-up",
+  "handover",
+  "kickoff",
+  "milestone",
+  "rollout",
+  "shortfall",
+  "surplus",
+  "threshold",
+  "variance",
+  "workflow"
+];
+var DOMAINS = ["example.com", "example.org", "example.net", "mail.example.com"];
+var TLDS = ["com", "io", "co", "org", "net"];
+var COLORS = ["#f2541d", "#2563eb", "#16a34a", "#d97706", "#7c3aed", "#0891b2", "#db2777", "#4b5563"];
+var DAY_MS = 864e5;
+var CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function encodeCrockford(value, length) {
+  let out = "";
+  let rest = value;
+  for (let i = 0; i < length; i++) {
+    out = CROCKFORD[Number(rest % 32n)] + out;
+    rest /= 32n;
+  }
+  return out;
 }
-function allowedActions(policy, role) {
-  return {
-    read: can(policy, role, "read"),
-    create: can(policy, role, "create"),
-    update: can(policy, role, "update"),
-    delete: can(policy, role, "delete")
+function random(seed) {
+  let state = seed >>> 0;
+  return () => {
+    state = state + 1831565813 >>> 0;
+    let t = Math.imul(state ^ state >>> 15, 1 | state);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
   };
 }
-
-// src/seed.ts
-function defineSeed(seed) {
-  return seed;
+function createFake(seed = 20260101) {
+  const next = random(seed);
+  let count = 0;
+  const step = () => ++count;
+  const tail = BigInt(Math.floor(next() * 2 ** 40)) * 2n ** 40n;
+  let counter = 0n;
+  const int = (min, max) => min + Math.floor(next() * (max - min + 1));
+  const pick = (items) => items[Math.floor(next() * items.length)];
+  const slugify2 = (text2) => text2.toLowerCase().normalize("NFKD").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const fake2 = {
+    int,
+    float: (min, max, decimals = 2) => Number((min + next() * (max - min)).toFixed(decimals)),
+    bool: (chance = 0.5) => next() < chance,
+    pick,
+    some(items, min = 1, max = items.length) {
+      const wanted = int(Math.min(min, items.length), Math.min(max, items.length));
+      const chosen = /* @__PURE__ */ new Set();
+      while (chosen.size < wanted) chosen.add(Math.floor(next() * items.length));
+      return [...chosen].sort((a, b) => a - b).map((index) => items[index]);
+    },
+    firstName: () => pick(FIRST_NAMES),
+    lastName: () => pick(LAST_NAMES),
+    fullName: () => `${pick(FIRST_NAMES)} ${pick(LAST_NAMES)}`,
+    email(name) {
+      const local = name ? slugify2(name).replace(/-/g, ".") : `${pick(FIRST_NAMES)}.${pick(LAST_NAMES)}`.toLowerCase();
+      return `${slugify2(local).replace(/-/g, ".")}${step()}@${pick(DOMAINS)}`;
+    },
+    company: () => `${pick(COMPANY_HEADS)} ${pick(COMPANY_TAILS)}`,
+    jobTitle: () => `${pick(["Head of", "Senior", "Lead", "Regional", "Junior"])} ${pick(["Operations", "Sales", "Support", "Engineering", "Finance", "Logistics"])}`,
+    city: () => pick(CITIES),
+    country: () => pick(COUNTRIES)[0],
+    phone: () => `+${pick(COUNTRIES)[1]}${String(int(7e8, 799999999))}`,
+    domain: () => `${slugify2(`${pick(COMPANY_HEADS)}${pick(COMPANY_TAILS)}`)}${step()}.${pick(TLDS)}`,
+    url: () => `https://${slugify2(pick(COMPANY_HEADS))}.${pick(TLDS)}/${slugify2(pick(WORDS))}`,
+    slug: (text2) => `${slugify2(text2 ?? `${pick(WORDS)}-${pick(WORDS)}`)}-${step()}`,
+    color: () => pick(COLORS),
+    words: (howMany = 3) => Array.from({ length: howMany }, () => pick(WORDS)).join(" "),
+    sentence() {
+      const words2 = Array.from({ length: int(5, 12) }, () => pick(WORDS)).join(" ");
+      return `${words2[0].toUpperCase()}${words2.slice(1)}.`;
+    },
+    paragraph(sentences = 3) {
+      return Array.from({ length: sentences }, () => fake2.sentence()).join(" ");
+    },
+    timestamp: (daysBack = 365) => Date.now() - int(0, daysBack) * DAY_MS - int(0, DAY_MS - 1),
+    date: (daysBack = 365) => new Date(fake2.timestamp(daysBack)).toISOString().slice(0, 10),
+    datetime: (daysBack = 365) => new Date(fake2.timestamp(daysBack)).toISOString(),
+    uuid() {
+      const hex = "0123456789abcdef";
+      let out = "";
+      for (let i = 0; i < 32; i++) out += hex[Math.floor(next() * 16)];
+      return `${out.slice(0, 8)}-${out.slice(8, 12)}-4${out.slice(13, 16)}-a${out.slice(17, 20)}-${out.slice(20, 32)}`;
+    },
+    id() {
+      counter += 1n;
+      return encodeCrockford(BigInt(Date.now()), 10) + encodeCrockford((tail + counter) % 2n ** 80n, 16);
+    },
+    get count() {
+      return count;
+    }
+  };
+  return fake2;
 }
+var fake = createFake();
 
 // src/index.ts
-var FLARE_VERSION = "0.1.2";
+var FLARE_VERSION = "0.3.0";
 export {
   DEFAULT_FILE_MAX_BYTES,
   FILE_CATEGORIES,
@@ -718,12 +973,16 @@ export {
   RelationError,
   ResourceDefinitionError,
   SNIFF_BYTES,
+  STRING_FORMATS,
   SUBSCRIPTION_STATUSES,
   allowedActions,
   camelCase,
   can,
   checkoutPaid,
   columnName,
+  countries,
+  countryName,
+  createFake,
   createMailer,
   createObjectKey,
   createStorage,
@@ -733,23 +992,33 @@ export {
   definePolicy,
   defineResource,
   defineSeed,
+  fake,
   field,
   fieldSchema,
   fileKeyPrefix,
   fileMaxBytes,
+  flagEmoji,
   formValuesToInput,
+  formatPhone,
   formatValue,
   grantsAccess,
   hashPassword,
   humanize,
   importSigningKey,
   initialFormValues,
+  isColor,
+  isCountryCode,
+  isDomain,
   isLiveSubscription,
+  isPhoneNumber,
+  isSlug,
   issuesByField,
   kebabCase,
   matchesContentType,
   mimeTypesFor,
+  normalizeDomain,
   optionLabel,
+  parseMultiValue,
   pascalCase,
   pluralize,
   randomLetters,
@@ -757,12 +1026,15 @@ export {
   renderTransactionalEmail,
   shouldApplySubscription,
   signToken,
+  slugify,
   snakeCase,
   sniffMatches,
+  splitPhone,
   statusTone,
   storedFields,
   subscriptionPriceId,
   subscriptionState,
+  toE164,
   toSubscriptionStatus,
   verifyPassword,
   verifyToken,

package/dist/{define-D5CtCkOm.d.ts → policy-BqRg9RVM.d.ts}

@@ -6,7 +6,7 @@
  * rule in a descriptor takes effect without re-running the generator. Only
  * storage-level changes (kind, nullability, uniqueness, relations) need a migration.
  */
-type FieldKind = "string" | "text" | "int" | "float" | "boolean" | "date" | "datetime" | "enum" | "file" | "belongsTo" | "hasMany";
+type FieldKind = "string" | "text" | "int" | "float" | "boolean" | "date" | "datetime" | "enum" | "multiselect" | "file" | "belongsTo" | "hasMany";
 /** Options shared by every stored (non-hasMany) field. */
 interface CommonOptions<T> {
     label?: string;
@@ -24,10 +24,23 @@ interface CommonOptions<T> {
     /** Included in free-text search. Default true for string fields. */
     searchable?: boolean;
 }
+/**
+ * What a string holds. Each format is still a text column; the format decides
+ * validation, the admin input and how the value is shown.
+ *
+ * - email, url: validated addresses (url: http or https)
+ * - tel: an international number, stored E.164 (`+256772123456`), entered with a country picker
+ * - domain: a hostname such as `example.com`, stored lowercase
+ * - country: an ISO 3166-1 alpha-2 code (`UG`), chosen from a searchable list
+ * - color: a hex colour (`#f2541d`)
+ * - slug: lowercase words joined by hyphens (`my-first-post`)
+ */
+type StringFormat = "email" | "url" | "tel" | "domain" | "country" | "color" | "slug";
+declare const STRING_FORMATS: readonly StringFormat[];
 interface StringOptions extends CommonOptions<string> {
     maxLength?: number;
     minLength?: number;
-    format?: "email" | "url";
+    format?: StringFormat;
     pattern?: string;
 }
 interface TextOptions extends CommonOptions<string> {
@@ -43,6 +56,14 @@ type DateOptions = CommonOptions<string>;
 interface EnumOptions<O extends string> extends CommonOptions<O> {
     /** Display labels per option value. */
     optionLabels?: Partial<Record<O, string>>;
+    /** Admin input: a dropdown (default) or radio buttons (best for a few options). */
+    widget?: "select" | "radio";
+}
+interface MultiSelectOptions<O extends string> extends Omit<CommonOptions<O[]>, "unique"> {
+    optionLabels?: Partial<Record<O, string>>;
+    /** Fewest / most options that can be picked. A required field needs at least one. */
+    minItems?: number;
+    maxItems?: number;
 }
 interface FileOptions extends CommonOptions<string> {
     /** Maximum upload size in bytes. Default 10 MiB. */
@@ -75,6 +96,9 @@ type DateTimeField<R extends boolean = boolean> = Base<"datetime", R> & DateOpti
 type EnumField<O extends string = string, R extends boolean = boolean> = Base<"enum", R> & EnumOptions<O> & {
     options: readonly O[];
 };
+type MultiSelectField<O extends string = string, R extends boolean = boolean> = Base<"multiselect", R> & MultiSelectOptions<O> & {
+    options: readonly O[];
+};
 type FileField<R extends boolean = boolean> = Base<"file", R> & FileOptions & {
     /** Accepted categories from the `file:[image,pdf]` grammar. */
     accept: readonly FileCategory[];
@@ -88,7 +112,7 @@ type HasManyField = {
     required: false;
     target: string;
 } & HasManyOptions;
-type Field = StringField | TextField | IntField | FloatField | BooleanField | DateField | DateTimeField | EnumField | FileField | BelongsToField | HasManyField;
+type Field = StringField | TextField | IntField | FloatField | BooleanField | DateField | DateTimeField | EnumField | MultiSelectField | FileField | BelongsToField | HasManyField;
 type StoredField = Exclude<Field, HasManyField>;
 /** File categories usable in `file:[...]` and the MIME types each allows. */
 declare const FILE_CATEGORIES: {
@@ -119,6 +143,19 @@ declare const field: {
     date: <const O extends DateOptions>(options?: O) => DateField<Req<O>> & O;
     datetime: <const O extends DateOptions>(options?: O) => DateTimeField<Req<O>> & O;
     enum: <const V extends readonly [string, ...string[]], const O extends EnumOptions<V[number]>>(values: V, options?: O) => EnumField<V[number], Req<O>> & O;
+    /** One of a list, picked from a dropdown. The same as `enum`. */
+    select: <const V extends readonly [string, ...string[]], const O extends EnumOptions<V[number]>>(values: V, options?: O) => EnumField<V[number], Req<O>> & O;
+    /** One of a list, picked with radio buttons. Stored like `enum`. */
+    radio: <const V extends readonly [string, ...string[]], const O extends EnumOptions<V[number]>>(values: V, options?: O) => EnumField<V[number], Req<O>> & O;
+    /** Any number of a list, picked with checkboxes. Stored as a JSON array. */
+    multiselect: <const V extends readonly [string, ...string[]], const O extends MultiSelectOptions<V[number]>>(values: V, options?: O) => MultiSelectField<V[number], Req<O>> & O;
+    email: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    url: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    tel: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    domain: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    country: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    color: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
+    slug: <const O extends Omit<StringOptions, "format">>(options?: O) => StringField<Req<O>> & O;
     file: <const O extends FileOptions>(accept: readonly FileCategory[], options?: O) => FileField<Req<O>> & O;
     belongsTo: <const O extends BelongsToOptions>(target: string, options?: O) => BelongsToField<Req<O>> & O;
     hasMany: <const O extends HasManyOptions>(target: string, options?: O) => HasManyField & O;
@@ -131,6 +168,9 @@ type FieldValue<F> = F extends {
     kind: "enum";
     options: readonly (infer O)[];
 } ? O : F extends {
+    kind: "multiselect";
+    options: readonly (infer M)[];
+} ? M[] : F extends {
     kind: "hasMany";
 } ? never : string;
 type StoredKeys<Fields> = {
@@ -229,4 +269,40 @@ declare function storedFields(resource: Resource): [string, StoredField & {
 /** Database column name for a field key ("companyId" → "company_id"). */
 declare const columnName: (key: string) => string;
 
-export { type BelongsToField as B, type CreateInput as C, DEFAULT_FILE_MAX_BYTES as D, type EnumField as E, type Field as F, type HasManyField as H, type IntField as I, type Resource as R, type StoredField as S, type TextField as T, type UpdateInput as U, type BooleanField as a, type DateField as b, type DateTimeField as c, FILE_CATEGORIES as d, type FieldKind as e, type FieldValue as f, type FileCategory as g, type FileField as h, type FloatField as i, RESERVED_FIELD_NAMES as j, type RecordOf as k, type ResourceConfig as l, ResourceDefinitionError as m, type StringField as n, columnName as o, defaultFieldLabel as p, defineResource as q, field as r, fileMaxBytes as s, mimeTypesFor as t, storedFields as u };
+/**
+ * Resource-level policies: which roles may read, create, update, or delete a resource.
+ *
+ * Policies are plain data, like descriptors, so the API layer and the admin UI read the
+ * same rules at runtime. Field-level rules and per-record ownership are deliberately out
+ * of scope for v1.
+ */
+type PolicyAction = "list" | "read" | "create" | "update" | "delete";
+/** Roles allowed per action; `"*"` means any signed-in user. */
+interface Policy {
+    resource: string;
+    read: string[];
+    create: string[];
+    update: string[];
+    delete: string[];
+}
+interface PolicyConfig {
+    resource: string;
+    read?: string[];
+    create?: string[];
+    update?: string[];
+    delete?: string[];
+}
+declare class PolicyError extends Error {
+    constructor(message: string);
+}
+declare function definePolicy(config: PolicyConfig): Policy;
+/**
+ * Whether `role` may perform `action`. Without a policy any signed-in user is allowed
+ * (callers must already have required a session); generate one with
+ * `flare gen policy <Resource> --roles …` to restrict a resource.
+ */
+declare function can(policy: Policy | undefined | null, role: string | null | undefined, action: PolicyAction): boolean;
+/** Actions `role` may perform, for hiding UI it can't use. */
+declare function allowedActions(policy: Policy | undefined | null, role: string | null | undefined): Record<Exclude<PolicyAction, "list">, boolean>;
+
+export { fileMaxBytes as A, type BelongsToField as B, type CreateInput as C, DEFAULT_FILE_MAX_BYTES as D, type EnumField as E, type Field as F, mimeTypesFor as G, type HasManyField as H, type IntField as I, storedFields as J, type MultiSelectField as M, type Policy as P, type Resource as R, type StoredField as S, type TextField as T, type UpdateInput as U, type BooleanField as a, type DateField as b, type DateTimeField as c, FILE_CATEGORIES as d, type FieldKind as e, type FieldValue as f, type FileCategory as g, type FileField as h, type FloatField as i, type PolicyAction as j, type PolicyConfig as k, PolicyError as l, RESERVED_FIELD_NAMES as m, type RecordOf as n, type ResourceConfig as o, ResourceDefinitionError as p, STRING_FORMATS as q, type StringField as r, type StringFormat as s, allowedActions as t, can as u, columnName as v, defaultFieldLabel as w, definePolicy as x, defineResource as y, field as z };