@forgezero/access 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,379 @@
+/**
+ * @forgezero/access — declare your security posture as seven lists.
+ *
+ * Zero runtime dependencies. The contract is `fetch` types plus plain JSON
+ * Schema, so the core runs on Bun, Node 18+, Cloudflare Workers, Deno and every
+ * runtime implementing the WinterTC baseline. Adapters are glue over it.
+ *
+ * ## The seven declarations
+ *
+ *   1 FACTORS           how a proof is verified
+ *   2 ROUTES            every route, with its full request/response contract
+ *   3 SESSION POLICIES  who you must be            → bind route keys
+ *   4 ACTION POLICIES   fresh proof for this call  → bind route keys
+ *   5 BEFORE HANDLERS   run first, produce state   → bind route keys
+ *   6 AFTER HANDLERS    run last, queued           → bind route keys
+ *   7 RATE POLICIES     how often                  → bind route keys
+ *
+ * Lists 3–7 are ORTHOGONAL. A route's session requirement has nothing to do
+ * with which `before` it runs, so each list is auditable on its own — "which
+ * routes need a fresh proof" is one list, not a scan of every declaration.
+ *
+ * The alternative was security declared per route. It is unauditable: a new
+ * route can silently omit a factor, and reviewing the surface means reading
+ * every handler. Here, omission fails the build.
+ *
+ * This file must never import a sibling package. `packages.test.ts` enforces it.
+ */
+/**
+ * Present from the first release with no migrations, because adding a version
+ * field later means guessing what unversioned data meant — and every consumer
+ * who stored a policy before v2 becomes a support ticket.
+ */
+export declare const SCHEMA_VERSION: 1;
+export interface Versioned {
+    /** Absent means 1 — the release before the field was read. */
+    version?: number;
+}
+/**
+ * Refuses documents NEWER than this build rather than ignoring unknown fields.
+ * Silently dropping a field is how a v2 policy that added a factor gets
+ * enforced as if it had none.
+ */
+export declare function assertReadable(document: Versioned, what: string): void;
+export declare class AccessError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * A condition refusing the request, with the status it deserves.
+ *
+ * Without this every guard in a `before` chain collapsed to 500, which is a lie:
+ * "this withdrawal is already approved" is a 409 the client can act on, and a
+ * 500 tells it to retry — which is precisely the wrong thing to do with money.
+ *
+ * `retryable` is stated rather than inferred from the status. 409 is permanent
+ * for a state conflict and transient for a lock held by another request, and
+ * only the condition that threw knows which.
+ */
+export declare class Refusal extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details: Record<string, unknown>;
+    readonly retryable: boolean;
+    /** Branded so `isRefusal` survives two copies of this package in one process. */
+    readonly refusal: true;
+    constructor(status: number, code: string, message: string, details?: Record<string, unknown>, retryable?: boolean);
+}
+export declare function isRefusal(error: unknown): error is Refusal;
+/**
+ * The request is already answered — stop, and return this.
+ *
+ * An idempotent replay is not a refusal and not an error: the caller asked for
+ * something that already happened and is owed the original answer. Modelling it
+ * as a 409 would be correct-ish and useless, because a retrying client would
+ * still not learn the transfer succeeded.
+ */
+export declare class Settled extends Error {
+    readonly value: unknown;
+    readonly status: number;
+    readonly headers: Record<string, string>;
+    readonly settled: true;
+    constructor(value: unknown, status?: number, headers?: Record<string, string>);
+}
+export declare function isSettled(error: unknown): error is Settled;
+export type FactorKind = 'session' | 'action' | 'both';
+export interface FactorContext {
+    /**
+     * Server-issued and single-use. A fixed challenge makes a captured proof
+     * replayable forever, which is why key DERIVATION and AUTHENTICATION must
+     * never share one.
+     */
+    challenge: string;
+    userKey?: string;
+    secret(name: string): Promise<string>;
+}
+export interface FactorSpec<Proof = unknown> extends Versioned {
+    kind: FactorKind;
+    label: string;
+    /** JSON Schema. The admin UI renders its fields; `writeOnly` goes to a vault. */
+    credentials?: Record<string, unknown>;
+    verify(context: FactorContext, proof: Proof): Promise<boolean>;
+    /** Delivery tracking, so "is this method actually tested" is a query. */
+    status?: 'shipped' | 'active' | 'planned';
+    tests?: readonly string[];
+    surface?: string;
+}
+export type FactorRegistry = Record<string, FactorSpec<never>>;
+export declare function defineFactors<F extends FactorRegistry>(factors: F): F;
+export type Method = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+/** One shared refusal shape, so `ok:false` narrowing works across every route. */
+export interface Problem {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+}
+export interface RouteContract {
+    params?: unknown;
+    query?: unknown;
+    body?: unknown;
+    headers?: unknown;
+    /**
+     * Keyed by status, not one success type. A route that can 409 and does not
+     * say so produces a client that crashes on it — and a generated client can
+     * only narrow correctly when every branch is declared.
+     */
+    response?: Record<number, unknown>;
+}
+export interface RouteBase extends RouteContract {
+    label: string;
+    /** Disabled feature → 404, never 403. A 403 confirms the route exists. */
+    feature?: string;
+    /** Outside its stage → 404, for the same reason. */
+    stages?: readonly string[];
+    /** Wrong realm → 404. Stops a tenant session being scored against platform routes. */
+    realms?: readonly string[];
+    /**
+     * Named preconditions that must hold before the route is reachable at all,
+     * independent of who is asking.
+     *
+     * Deliberately opaque strings rather than an enum. A secrets platform gates
+     * on `vault-unlocked`, a marketplace on `kyc-complete`, a game on
+     * `season-open` — the package cannot know the vocabulary and has no business
+     * inventing one. It carries the declaration; the host decides what each name
+     * means and supplies the answers to `authorise`.
+     *
+     * An unmet gate is 423, not 403: the caller's rights are fine and something
+     * has to change in the system, not in their session.
+     */
+    gates?: readonly string[];
+    /**
+     * How a grant on an ancestor is treated.
+     *
+     * `inherit` — holding `orders` covers `orders/refund` and everything under it.
+     * `own`     — only a grant naming this exact key covers it.
+     *
+     * `own` exists because inheritance is the right default and the wrong
+     * behaviour for the handful of routes that are genuinely more dangerous than
+     * their parent. Granting somebody the settings page should not silently hand
+     * them the one action under it that deletes the tenant.
+     */
+    grantMode?: 'inherit' | 'own';
+    /**
+     * Another route key whose grant ALSO grants this one.
+     *
+     * For pairs where a permission genuinely implies another and the key names do
+     * not nest — issuing a credit implies being able to debit it back.
+     */
+    sharesGrantWith?: string;
+}
+export interface PageRoute extends RouteBase {
+    kind: 'page';
+    icon?: string;
+    nav?: string;
+    /** Heading this item sits under, so navigation cannot disagree with the matrix. */
+    navSection?: string;
+}
+export interface ActionRoute extends RouteBase {
+    kind: 'action';
+    method: Method;
+    /** Owning page. Drives grant inheritance across the `api/` boundary. */
+    page?: string;
+}
+export type RouteSpec = PageRoute | ActionRoute;
+export type RouteRegistry = Record<string, RouteSpec>;
+export declare function page(label: string, options?: Omit<Partial<PageRoute>, 'kind' | 'label'>): PageRoute;
+export declare function action(label: string, method: Method, options?: Omit<Partial<ActionRoute>, 'kind' | 'label' | 'method'>): ActionRoute;
+export declare function defineRoutes<R extends RouteRegistry>(routes: R): R;
+/** Every binding names route keys, and every key is checked against ROUTES. */
+export interface Binding<K extends string> {
+    routes: readonly K[];
+}
+export interface SessionPolicy<K extends string> extends Binding<K>, Versioned {
+    /** Empty means public. */
+    factors: readonly string[];
+}
+export interface ActionPolicy<K extends string> extends Binding<K>, Versioned {
+    factors: readonly string[];
+    /**
+     * A COUNT, not a mode: 1 is any-one, `factors.length` is all-of, and
+     * anything between is M-of-N with no special case.
+     */
+    required: number;
+    /** Binds the proof to one record. A key minted for A cannot authorise B. */
+    target?: string;
+}
+export interface BeforeHandler<K extends string> extends Binding<K> {
+    run(context: RequestContext, state: Record<string, unknown>): unknown;
+}
+export interface AfterHandler<K extends string> extends Binding<K> {
+    run(context: RequestContext, result: unknown, state: Record<string, unknown>): void;
+}
+export interface RatePolicy<K extends string> extends Binding<K>, Versioned {
+    /** `30s`, `1m`, `15m`, `1h`, `1d`. */
+    window: string;
+    limit: number;
+    by: 'ip' | 'session' | 'apiKey' | 'realm';
+}
+export interface RequestContext {
+    route: string;
+    method: Method;
+    url: URL;
+    params: Record<string, string>;
+    query: Record<string, unknown>;
+    body: unknown;
+    headers: Headers;
+    session?: SessionContext;
+    realm?: string;
+    stage?: string;
+    ok(value: unknown): Response;
+}
+export interface SessionContext {
+    userKey: string;
+    roleKeys: readonly string[];
+    factors: readonly string[];
+}
+export interface Role extends Versioned {
+    roleKey: string;
+    label: string;
+    grants: readonly string[];
+}
+/**
+ * Where roles come from. Two implementations ship; a ForgeZero vault is a third
+ * somebody writes. The package never learns which store it talks to.
+ */
+export interface PolicySource {
+    roles(): Promise<readonly Role[]>;
+    enabledFactors(): Promise<readonly string[]>;
+}
+export declare function codePolicy(config: {
+    roles: readonly Role[];
+    enabledFactors: readonly string[];
+}): PolicySource;
+export declare function externalPolicy(reader: PolicySource): PolicySource;
+/**
+ * A route key reduced to the thing a grant actually names.
+ *
+ * Two reductions, and both exist because a grant is a PERMISSION and a route key
+ * is a URL — they are not the same vocabulary and should not be forced to be.
+ *
+ * The `api/` prefix goes because holding `orders` should cover the page and
+ * every action behind it; making a role list both is bookkeeping that drifts.
+ *
+ * `strip` handles a routing prefix that carries no permission meaning. A
+ * multi-tenant platform serving `/t/acme/workspace` and `/workspace` from one
+ * matrix means the same permission in both places — leaving the prefix in would
+ * force every role to spell out a URL shape, and would orphan every tenant route
+ * from the page it belongs to. Optional, because a single-tenant app has no such
+ * prefix and should not pay for the concept.
+ */
+export declare function stemOf(routeKey: string, strip?: RegExp): string;
+export interface GrantOptions {
+    /** Defaults to `inherit`. */
+    mode?: 'inherit' | 'own';
+    /** Another key whose grant also covers this route. */
+    sharesGrantWith?: string;
+    /** Routing prefix with no permission meaning — see `stemOf`. */
+    strip?: RegExp;
+}
+/**
+ * Does any held grant cover this route?
+ *
+ * Default-DENY. A principal with no matching grant is refused, so creating a
+ * role grants nothing until somebody is actually given it.
+ */
+export declare function grantsRoute(grants: readonly string[], routeKey: string, options?: GrantOptions): boolean;
+/**
+ * Fresh proof is ALWAYS required. Returns nothing, on purpose.
+ *
+ * A five-minute `verifiedAt` timestamp looks equivalent and is not: a timestamp
+ * IS a persisted factor, so a left-open laptop or a stolen cookie replays the
+ * privileged action. Returning nothing makes that impossible by construction.
+ */
+export declare function fulfilledActionFactors(): readonly string[];
+export interface AccessControlConfig<R extends RouteRegistry> extends Versioned {
+    factors: FactorRegistry;
+    routes: R;
+    sessionPolicies: Record<string, SessionPolicy<Extract<keyof R, string>>>;
+    actionPolicies?: Record<string, ActionPolicy<Extract<keyof R, string>>>;
+    beforeHandlers?: Record<string, BeforeHandler<Extract<keyof R, string>>>;
+    afterHandlers?: Record<string, AfterHandler<Extract<keyof R, string>>>;
+    ratePolicies?: Record<string, RatePolicy<Extract<keyof R, string>>>;
+    features?: readonly string[];
+    source?: PolicySource;
+}
+export interface AccessControl<R extends RouteRegistry> {
+    version: number;
+    routes: R;
+    features: readonly string[];
+    source?: PolicySource;
+    keys(): readonly (keyof R & string)[];
+    get(key: string): RouteSpec | undefined;
+    exists(key: string, context?: {
+        stage?: string;
+        realm?: string;
+    }): boolean;
+    sessionPolicyFor(key: string): SessionPolicy<string> | undefined;
+    actionPolicyFor(key: string): ActionPolicy<string> | undefined;
+    ratePolicyFor(key: string): RatePolicy<string> | undefined;
+    beforeFor(key: string): readonly BeforeHandler<string>[];
+    afterFor(key: string): readonly AfterHandler<string>[];
+}
+/**
+ * Assemble and validate.
+ *
+ * Everything is checked at construction rather than at first request. A route
+ * whose required count exceeds its factor list can never be called, and finding
+ * that out in production means finding it out from a customer.
+ */
+export declare function defineAccessControl<R extends RouteRegistry>(config: AccessControlConfig<R>): AccessControl<R>;
+export type Outcome = {
+    allow: true;
+} | {
+    allow: false;
+    status: 404 | 401 | 403 | 428 | 429;
+    code: string;
+    /** Which policy refused, so a 403 is debuggable without reading config. */
+    policy?: string;
+    missing?: readonly string[];
+};
+/**
+ * Layer 1 — does this caller reach the handler at all?
+ *
+ * Layer 2 runs later, after `before` has loaded the record a fresh proof binds
+ * to. Splitting them is what lets a proof name a target.
+ */
+export declare function authorise<R extends RouteRegistry>(args: {
+    access: AccessControl<R>;
+    routeKey: string;
+    stage?: string;
+    realm?: string;
+    session?: SessionContext;
+    roles: readonly Role[];
+}): Outcome;
+/**
+ * Which of an action policy's factors this deployment can satisfy.
+ *
+ * If the intersection is smaller than the required count the route is
+ * UNAVAILABLE — never quietly weakened to whatever remains, which is the
+ * failure that turns disabling an unused login method into a silently
+ * downgraded refund flow.
+ */
+export declare function resolveActionFactors(policy: ActionPolicy<string>, enabled: readonly string[]): {
+    available: readonly string[];
+    required: number;
+    satisfiable: boolean;
+};
+/**
+ * Which routes a proposed factor change would break — computed BEFORE saving,
+ * so an admin disabling a method sees the damage rather than discovering it
+ * during an incident.
+ */
+export declare function impactOfDisabling<R extends RouteRegistry>(access: AccessControl<R>, enabledAfter: readonly string[]): readonly {
+    route: string;
+    available: number;
+    required: number;
+}[];
+export declare const VERSION = "0.1.0";

package/dist/index.js

@@ -0,0 +1,298 @@
+// src/index.ts
+var SCHEMA_VERSION = 1;
+function assertReadable(document, what) {
+  const version = document.version ?? 1;
+  if (version > SCHEMA_VERSION) {
+    throw new AccessError("ACCESS_VERSION_TOO_NEW", `${what} is version ${version}; this build reads ${SCHEMA_VERSION}. Upgrade @forgezero/access.`);
+  }
+}
+
+class AccessError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "AccessError";
+  }
+}
+
+class Refusal extends Error {
+  status;
+  code;
+  details;
+  retryable;
+  refusal = true;
+  constructor(status, code, message, details = {}, retryable = false) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.retryable = retryable;
+    this.name = "Refusal";
+  }
+}
+function isRefusal(error) {
+  return typeof error === "object" && error !== null && error.refusal === true;
+}
+
+class Settled extends Error {
+  value;
+  status;
+  headers;
+  settled = true;
+  constructor(value, status = 200, headers = {}) {
+    super("Already settled.");
+    this.value = value;
+    this.status = status;
+    this.headers = headers;
+    this.name = "Settled";
+  }
+}
+function isSettled(error) {
+  return typeof error === "object" && error !== null && error.settled === true;
+}
+function defineFactors(factors) {
+  for (const [id, factor] of Object.entries(factors)) {
+    if (factor.status === "shipped" && !(factor.tests?.length ?? 0)) {
+      throw new AccessError("FACTOR_UNTESTED", `Factor "${id}" is marked shipped with no tests. A method nobody exercises is a claim.`);
+    }
+  }
+  return factors;
+}
+function page(label, options = {}) {
+  return { kind: "page", label, ...options };
+}
+function action(label, method, options = {}) {
+  return { kind: "action", label, method, ...options };
+}
+function defineRoutes(routes) {
+  for (const [key, route] of Object.entries(routes)) {
+    const isApi = key.startsWith("api/");
+    if (isApi !== (route.kind === "action")) {
+      throw new AccessError("ROUTE_KIND_MISMATCH", `"${key}": routes under api/ must be actions, and actions must be under api/.`);
+    }
+    if (route.kind === "action" && route.page && !(route.page in routes)) {
+      throw new AccessError("ROUTE_DANGLING_PAGE", `"${key}" names page "${route.page}", which does not exist.`);
+    }
+    if (route.kind === "action" && route.response) {
+      for (const status of Object.keys(route.response)) {
+        if (!route.response[Number(status)]) {
+          throw new AccessError("ROUTE_EMPTY_RESPONSE", `"${key}" declares status ${status} with no schema.`);
+        }
+      }
+    }
+  }
+  return routes;
+}
+function codePolicy(config) {
+  return {
+    roles: async () => config.roles,
+    enabledFactors: async () => config.enabledFactors
+  };
+}
+function externalPolicy(reader) {
+  return {
+    async roles() {
+      const roles = await reader.roles();
+      for (const role of roles)
+        assertReadable(role, `role "${role.roleKey}"`);
+      return roles;
+    },
+    enabledFactors: () => reader.enabledFactors()
+  };
+}
+function stemOf(routeKey, strip) {
+  const withoutApi = routeKey.startsWith("api/") ? routeKey.slice(4) : routeKey;
+  return strip ? withoutApi.replace(strip, "") : withoutApi;
+}
+function grantsRoute(grants, routeKey, options = {}) {
+  const { mode = "inherit", sharesGrantWith, strip } = options;
+  const stem = stemOf(routeKey, strip);
+  const shared = sharesGrantWith ? stemOf(sharesGrantWith, strip) : undefined;
+  return grants.some((grant) => {
+    const granted = stemOf(grant, strip);
+    if (stem === granted || granted === routeKey)
+      return true;
+    if (shared !== undefined && (granted === shared || granted === sharesGrantWith))
+      return true;
+    return mode === "inherit" && stem.startsWith(granted + "/");
+  });
+}
+function fulfilledActionFactors() {
+  return [];
+}
+function defineAccessControl(config) {
+  assertReadable(config, "access control");
+  const routeKeys = new Set(Object.keys(config.routes));
+  const actionKeys = Object.entries(config.routes).filter(([, route]) => route.kind === "action").map(([key]) => key);
+  const checkKeys = (listName, name, keys) => {
+    if (keys.length === 0) {
+      throw new AccessError("POLICY_ORPHANED", `${listName} "${name}" binds no routes.`);
+    }
+    for (const key of keys) {
+      if (!routeKeys.has(key)) {
+        throw new AccessError("POLICY_UNKNOWN_ROUTE", `${listName} "${name}" names "${key}", which is not a route.`);
+      }
+    }
+  };
+  const sessionOf = new Map;
+  for (const [name, policy] of Object.entries(config.sessionPolicies)) {
+    checkKeys("Session policy", name, policy.routes);
+    for (const key of policy.routes) {
+      if (sessionOf.has(key)) {
+        throw new AccessError("SESSION_DUPLICATE", `"${key}" is in more than one session policy.`);
+      }
+      sessionOf.set(key, policy);
+    }
+    for (const factor of policy.factors) {
+      const spec = config.factors[factor];
+      if (!spec)
+        throw new AccessError("FACTOR_UNKNOWN", `Session policy "${name}" names unknown factor "${factor}".`);
+      if (spec.kind === "action") {
+        throw new AccessError("FACTOR_WRONG_KIND", `"${factor}" is action-only and cannot establish a session.`);
+      }
+    }
+  }
+  const unclassified = [...routeKeys].filter((key) => !sessionOf.has(key));
+  if (unclassified.length > 0) {
+    throw new AccessError("SESSION_INCOMPLETE", `No session policy covers: ${unclassified.join(", ")}. Every route needs exactly one.`);
+  }
+  const actionOf = new Map;
+  for (const [name, policy] of Object.entries(config.actionPolicies ?? {})) {
+    checkKeys("Action policy", name, policy.routes);
+    if (policy.required < 1 || policy.required > policy.factors.length) {
+      throw new AccessError("ACTION_UNSATISFIABLE", `Action policy "${name}" requires ${policy.required} of ${policy.factors.length} factors.`);
+    }
+    for (const factor of policy.factors) {
+      const spec = config.factors[factor];
+      if (!spec)
+        throw new AccessError("FACTOR_UNKNOWN", `Action policy "${name}" names unknown factor "${factor}".`);
+      if (spec.kind === "session") {
+        throw new AccessError("FACTOR_WRONG_KIND", `"${factor}" is session-only and cannot authorise an action.`);
+      }
+    }
+    for (const key of policy.routes) {
+      if (actionOf.has(key)) {
+        throw new AccessError("ACTION_DUPLICATE", `"${key}" is in more than one action policy.`);
+      }
+      actionOf.set(key, policy);
+    }
+  }
+  const rateOf = new Map;
+  const rateLists = Object.entries(config.ratePolicies ?? {});
+  for (const [name, policy] of rateLists) {
+    checkKeys("Rate policy", name, policy.routes);
+    for (const key of policy.routes) {
+      if (rateOf.has(key)) {
+        throw new AccessError("RATE_DUPLICATE", `"${key}" is in more than one rate policy.`);
+      }
+      rateOf.set(key, policy);
+    }
+  }
+  if (rateLists.length > 0) {
+    const unrated = actionKeys.filter((key) => !rateOf.has(key));
+    if (unrated.length > 0) {
+      throw new AccessError("RATE_INCOMPLETE", `No rate policy covers: ${unrated.join(", ")}. Declaring any means declaring all.`);
+    }
+  }
+  const beforeOf = new Map;
+  for (const [name, handler] of Object.entries(config.beforeHandlers ?? {})) {
+    checkKeys("Before handler", name, handler.routes);
+    for (const key of handler.routes) {
+      beforeOf.set(key, [...beforeOf.get(key) ?? [], handler]);
+    }
+  }
+  const afterOf = new Map;
+  for (const [name, handler] of Object.entries(config.afterHandlers ?? {})) {
+    checkKeys("After handler", name, handler.routes);
+    for (const key of handler.routes) {
+      afterOf.set(key, [...afterOf.get(key) ?? [], handler]);
+    }
+  }
+  const features = config.features ?? [];
+  return {
+    version: config.version ?? SCHEMA_VERSION,
+    routes: config.routes,
+    features,
+    source: config.source,
+    keys: () => Object.keys(config.routes),
+    get: (key) => config.routes[key],
+    exists(key, context) {
+      const route = config.routes[key];
+      if (!route)
+        return false;
+      if (route.feature && !features.includes(route.feature))
+        return false;
+      if (context?.stage && route.stages && !route.stages.includes(context.stage))
+        return false;
+      if (context?.realm && route.realms && !route.realms.includes(context.realm))
+        return false;
+      return true;
+    },
+    sessionPolicyFor: (key) => sessionOf.get(key),
+    actionPolicyFor: (key) => actionOf.get(key),
+    ratePolicyFor: (key) => rateOf.get(key),
+    beforeFor: (key) => beforeOf.get(key) ?? [],
+    afterFor: (key) => afterOf.get(key) ?? []
+  };
+}
+function authorise(args) {
+  const { access, routeKey, stage, realm, session, roles } = args;
+  if (!access.exists(routeKey, { stage, realm })) {
+    return { allow: false, status: 404, code: "NOT_FOUND" };
+  }
+  const policy = access.sessionPolicyFor(routeKey);
+  if (!policy || policy.factors.length === 0)
+    return { allow: true };
+  if (!session)
+    return { allow: false, status: 401, code: "AUTH_REQUIRED" };
+  const missing = policy.factors.filter((factor) => !session.factors.includes(factor));
+  if (missing.length > 0) {
+    return { allow: false, status: 428, code: "SECURITY_REQUIRED", missing };
+  }
+  const grants = roles.filter((role) => session.roleKeys.includes(role.roleKey)).flatMap((role) => role.grants);
+  if (!grantsRoute(grants, routeKey)) {
+    return { allow: false, status: 403, code: "ACCESS_DENIED" };
+  }
+  return { allow: true };
+}
+function resolveActionFactors(policy, enabled) {
+  const available = policy.factors.filter((factor) => enabled.includes(factor));
+  return { available, required: policy.required, satisfiable: available.length >= policy.required };
+}
+function impactOfDisabling(access, enabledAfter) {
+  const broken = [];
+  for (const key of access.keys()) {
+    const policy = access.actionPolicyFor(key);
+    if (!policy)
+      continue;
+    const { available, required, satisfiable } = resolveActionFactors(policy, enabledAfter);
+    if (!satisfiable)
+      broken.push({ route: key, available: available.length, required });
+  }
+  return broken;
+}
+var VERSION = "0.1.0";
+export {
+  stemOf,
+  resolveActionFactors,
+  page,
+  isSettled,
+  isRefusal,
+  impactOfDisabling,
+  grantsRoute,
+  fulfilledActionFactors,
+  externalPolicy,
+  defineRoutes,
+  defineFactors,
+  defineAccessControl,
+  codePolicy,
+  authorise,
+  assertReadable,
+  action,
+  VERSION,
+  Settled,
+  SCHEMA_VERSION,
+  Refusal,
+  AccessError
+};