@lenso/authorization 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,464 @@
+import {
+  AuthorizationError2,
+  AuthorizationConfigurationError2
+} from "./index-6f5nrdh9.js";
+import {
+  all2,
+  any2,
+  predicate2,
+  attribute2,
+  relation2,
+  sameScope2,
+  matchesPermission2,
+  snapshot,
+  RoleGraphError2,
+  samePrincipal,
+  permissionCovers,
+  validateRoleGraph2,
+  effectiveRolePermissions2,
+  effectivePermissions2,
+  immutableRoleSnapshot,
+  memoryRoleStore2,
+  rbacPredicate2,
+  rbacPolicy2
+} from "./index-5k98eatm.js";
+
+// src/core.ts
+function identifier(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 256;
+}
+function validResource(resource) {
+  return !!resource && identifier(resource.type) && identifier(resource.id) && !!resource.scope && identifier(resource.scope.type) && identifier(resource.scope.id);
+}
+function compileCondition(condition, stack = new Set, depth = 0, budget = { nodes: 0 }) {
+  if (!condition || stack.has(condition) || depth > 32 || ++budget.nodes > 1024)
+    throw new AuthorizationConfigurationError2;
+  stack.add(condition);
+  let result;
+  switch (condition.kind) {
+    case "all":
+    case "any":
+      if (!Array.isArray(condition.conditions) || condition.conditions.length === 0)
+        throw new AuthorizationConfigurationError2;
+      result = Object.freeze({
+        kind: condition.kind,
+        conditions: Object.freeze(condition.conditions.map((child) => compileCondition(child, stack, depth + 1, budget)))
+      });
+      break;
+    case "predicate":
+      if (typeof condition.test !== "function")
+        throw new AuthorizationConfigurationError2;
+      result = Object.freeze({ kind: "predicate", test: condition.test });
+      break;
+    case "attribute": {
+      const primitive = (item) => item === null || typeof item === "string" || typeof item === "boolean" || typeof item === "number" && Number.isFinite(item);
+      if (!["principal", "resource", "context"].includes(condition.source) || !identifier(condition.key) || (condition.operator === "equals" ? !primitive(condition.value) : condition.operator !== "in" || !Array.isArray(condition.value) || condition.value.length === 0 || !condition.value.every(primitive)))
+        throw new AuthorizationConfigurationError2;
+      result = snapshot(condition);
+      break;
+    }
+    case "relation":
+      if (!identifier(condition.relation) || condition.target && !validResource(condition.target))
+        throw new AuthorizationConfigurationError2;
+      result = snapshot(condition);
+      break;
+    default:
+      throw new AuthorizationConfigurationError2;
+  }
+  stack.delete(condition);
+  return result;
+}
+function createAuthorization(options) {
+  const actions = new Set(options.actions);
+  const timeoutMs = options.timeoutMs ?? 1000;
+  if (!actions.size || actions.size !== options.actions.length || [...actions].some((action) => !identifier(action)) || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60000)
+    throw new AuthorizationConfigurationError2;
+  const ids = new Set;
+  const rules = Object.freeze((options.rules ?? []).map((rule) => {
+    if (!identifier(rule.id) || ids.has(rule.id) || !["allow", "deny"].includes(rule.effect) || !identifier(rule.resourceType) || !rule.actions.length || rule.actions.some((action) => !actions.has(action)) || rule.scope && (!identifier(rule.scope.type) || !identifier(rule.scope.id)) || rule.resourceId !== undefined && !identifier(rule.resourceId))
+      throw new AuthorizationConfigurationError2;
+    ids.add(rule.id);
+    return Object.freeze({
+      ...rule,
+      actions: Object.freeze([...rule.actions]),
+      ...rule.scope ? { scope: snapshot(rule.scope) } : {},
+      when: compileCondition(rule.when)
+    });
+  }));
+  const policies = Object.freeze((options.policies ?? []).map((policy) => {
+    if (typeof policy.evaluate !== "function")
+      throw new AuthorizationConfigurationError2;
+    return policy.evaluate.bind(policy);
+  }));
+  const boundaries = Object.freeze([...options.boundaries ?? []]);
+  if (boundaries.some((boundary) => typeof boundary !== "function"))
+    throw new AuthorizationConfigurationError2;
+  const identity = snapshot(options.identity ?? {});
+  if ([identity.required, identity.credentialRequired].some((value) => value !== undefined && typeof value !== "boolean"))
+    throw new AuthorizationConfigurationError2;
+  for (const values of [identity.realms, identity.audiences]) {
+    if (values !== undefined && (!Array.isArray(values) || !values.length || values.some((value) => !identifier(value))))
+      throw new AuthorizationConfigurationError2;
+  }
+  const resolveResource = options.resolveResource;
+  const resolveRelation = options.relations?.check.bind(options.relations);
+  const resolveAttributes = options.attributes?.resolve.bind(options.attributes);
+  const clock = options.clock ?? Date.now;
+  const observe = options.observe;
+  const explainGate = options.explain ? snapshot(options.explain) : undefined;
+  if (explainGate && (!actions.has(explainGate.action) || !validResource(explainGate.resource)))
+    throw new AuthorizationConfigurationError2;
+  async function conditionMatches(condition, request, evaluation) {
+    evaluation.signal.throwIfAborted();
+    switch (condition.kind) {
+      case "all":
+      case "any": {
+        const results = [];
+        for (const child of condition.conditions)
+          results.push(await conditionMatches(child, request, evaluation));
+        return condition.kind === "all" ? results.every(Boolean) : results.some(Boolean);
+      }
+      case "predicate": {
+        const result = await condition.test(request, evaluation);
+        if (typeof result !== "boolean")
+          throw new Error("Invalid predicate outcome");
+        return result;
+      }
+      case "attribute": {
+        const facts = condition.source === "principal" ? request.principal?.attributes : condition.source === "resource" ? request.resource.attributes : request.context;
+        if (!facts || typeof facts !== "object" || !Object.hasOwn(facts, condition.key))
+          return false;
+        const value = facts[condition.key];
+        return condition.operator === "equals" ? value === condition.value : condition.value.includes(value);
+      }
+      case "relation": {
+        if (!request.principal)
+          return false;
+        if (!resolveRelation)
+          throw new Error("Missing resolver");
+        const result = await resolveRelation(request.principal, condition.relation, condition.target ?? request.resource, evaluation);
+        if (typeof result !== "boolean")
+          throw new Error("Invalid relation outcome");
+        return result;
+      }
+    }
+  }
+  async function evaluate(input, signal) {
+    const controller = new AbortController;
+    const combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+    const started = performance.now();
+    let timedOut = false;
+    let timer;
+    const paths = [];
+    const decision = (code) => Object.freeze({
+      decision: Object.freeze({ effect: code === "ALLOWED" ? "allow" : "deny", code }),
+      paths: Object.freeze([...paths])
+    });
+    const stopped = () => timedOut || performance.now() - started >= timeoutMs ? "TIMEOUT" : signal?.aborted ? "CANCELLED" : "EVALUATION_FAILED";
+    try {
+      const request = snapshot(input);
+      const now = clock();
+      if (!Number.isSafeInteger(now) || now < 0 || !validResource(request.resource) || request.principal !== null && (!request.principal || !identifier(request.principal.realmId) || !identifier(request.principal.subjectId) || !identifier(request.principal.kind)))
+        return decision("EVALUATION_FAILED");
+      if (!actions.has(request.action))
+        return decision("UNKNOWN_ACTION");
+      if (signal?.aborted)
+        return decision("CANCELLED");
+      const interrupted = new Promise((resolve) => {
+        timer = setTimeout(() => {
+          timedOut = true;
+          controller.abort();
+        }, timeoutMs);
+        combined.addEventListener("abort", () => resolve(decision(stopped())), { once: true });
+      });
+      const work = async () => {
+        const evaluation = Object.freeze({ signal: combined, now });
+        if (identity.required === true && !request.principal || identity.realms && (!request.principal || !identity.realms.includes(request.principal.realmId)) || identity.audiences && (!request.audience || !identity.audiences.includes(request.audience)) || identity.credentialRequired === true && !request.credential)
+          return decision("BOUNDARY_DENIED");
+        const resolved = resolveResource ? snapshot(await resolveResource(request.resource, evaluation)) : request.resource;
+        if (!validResource(resolved) || resolved.type !== request.resource.type || resolved.id !== request.resource.id)
+          return decision("BOUNDARY_DENIED");
+        let facts = Object.freeze({ ...request, resource: resolved });
+        if (facts.credential) {
+          const credential = facts.credential;
+          if (!Array.isArray(credential.permissions) || credential.permissions.some((permission) => !permission || !actions.has(permission.action) || !identifier(permission.resourceType) || !permission.scope || !identifier(permission.scope.type) || !identifier(permission.scope.id) || permission.resourceId !== undefined && !identifier(permission.resourceId)) || credential.expiresAt !== undefined && (!Number.isSafeInteger(credential.expiresAt) || credential.expiresAt <= now) || !credential.permissions.some((permission) => matchesPermission2(permission, facts)))
+            return decision("BOUNDARY_DENIED");
+        }
+        if (resolveAttributes) {
+          const attributes = snapshot(await resolveAttributes(facts, evaluation));
+          const validAttributes = (value) => value === undefined || value !== null && typeof value === "object" && !Array.isArray(value);
+          if (!validAttributes(attributes.principal) || !validAttributes(attributes.resource) || attributes.principal !== undefined && facts.principal === null)
+            throw new Error("Invalid resolved attributes");
+          facts = snapshot({
+            ...facts,
+            principal: facts.principal && attributes.principal !== undefined ? { ...facts.principal, attributes: attributes.principal } : facts.principal,
+            resource: attributes.resource !== undefined ? { ...facts.resource, attributes: attributes.resource } : facts.resource,
+            context: attributes.context === undefined ? facts.context : attributes.context
+          });
+        }
+        for (const boundary of boundaries) {
+          if (await boundary(facts, evaluation) !== true)
+            return decision("BOUNDARY_DENIED");
+        }
+        let allowed = false;
+        let denied = false;
+        for (let index = 0;index < rules.length; index++) {
+          const rule = rules[index];
+          if (!rule.actions.includes(facts.action) || rule.resourceType !== facts.resource.type || rule.scope && !sameScope2(rule.scope, facts.resource.scope) || rule.resourceId !== undefined && rule.resourceId !== facts.resource.id)
+            continue;
+          if (await conditionMatches(rule.when, facts, evaluation)) {
+            paths.push(`rules/${index}/${rule.effect}`);
+            if (rule.effect === "deny")
+              denied = true;
+            else
+              allowed = true;
+          }
+        }
+        for (let index = 0;index < policies.length; index++) {
+          combined.throwIfAborted();
+          const effect = await policies[index](facts, evaluation);
+          if (!["allow", "deny", "abstain"].includes(effect))
+            throw new Error("Invalid policy outcome");
+          if (effect !== "abstain")
+            paths.push(`policies/${index}/${effect}`);
+          if (effect === "deny")
+            denied = true;
+          if (effect === "allow")
+            allowed = true;
+        }
+        const result = decision(denied ? "EXPLICIT_DENY" : allowed ? "ALLOWED" : "DEFAULT_DENY");
+        if (observe)
+          await observe(result.decision);
+        combined.throwIfAborted();
+        if (performance.now() - started >= timeoutMs)
+          return decision("TIMEOUT");
+        return result;
+      };
+      return await Promise.race([work().catch(() => decision(stopped())), interrupted]);
+    } catch {
+      return decision(stopped());
+    } finally {
+      if (timer !== undefined)
+        clearTimeout(timer);
+      controller.abort();
+    }
+  }
+  const check = async (request, opts) => (await evaluate(request, opts?.signal)).decision;
+  return Object.freeze({
+    check,
+    async can(request, opts) {
+      return (await check(request, opts)).effect === "allow";
+    },
+    async enforce(request, opts) {
+      if ((await check(request, opts)).effect !== "allow")
+        throw new AuthorizationError2;
+    },
+    async explain(manager, target, opts) {
+      let managerFacts;
+      let targetFacts;
+      try {
+        managerFacts = snapshot(manager);
+        targetFacts = snapshot(target);
+      } catch {
+        throw new AuthorizationError2;
+      }
+      if (!explainGate || managerFacts.action !== explainGate.action || managerFacts.resource.type !== explainGate.resource.type || managerFacts.resource.id !== explainGate.resource.id || !sameScope2(managerFacts.resource.scope, explainGate.resource.scope) || (await check(managerFacts, opts)).effect !== "allow")
+        throw new AuthorizationError2;
+      return evaluate(targetFacts, opts?.signal);
+    }
+  });
+}
+// src/list.ts
+async function authorizeList(authorization, candidates, request, options) {
+  const { maxCandidates, offset = 0, limit = maxCandidates, signal } = options;
+  if (!Number.isSafeInteger(maxCandidates) || maxCandidates < 1 || maxCandidates > 1000 || candidates.length > maxCandidates || !Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(limit) || limit < 0 || limit > maxCandidates)
+    throw new AuthorizationError2;
+  const facts = snapshot(request);
+  const resources = snapshot(candidates);
+  const visible = [];
+  for (const resource of resources) {
+    const decision = await authorization.check({ ...facts, resource }, { signal });
+    if (["EVALUATION_FAILED", "TIMEOUT", "CANCELLED", "UNKNOWN_ACTION"].includes(decision.code))
+      throw new AuthorizationError2;
+    if (decision.effect === "allow")
+      visible.push(resource);
+  }
+  return Object.freeze({
+    items: Object.freeze(visible.slice(offset, offset + limit)),
+    total: visible.length
+  });
+}
+// src/management.ts
+class RoleManagementError extends Error {
+  code;
+  constructor(code = "DENIED") {
+    super(code === "CONFLICT" ? "Concurrent modification" : "Access denied");
+    this.name = "RoleManagementError";
+    this.code = code;
+  }
+}
+function cloneFacts(value) {
+  try {
+    return snapshot(value);
+  } catch {
+    throw new RoleManagementError;
+  }
+}
+function invocation(evaluation) {
+  return Object.freeze({ now: evaluation.now, signal: evaluation.signal });
+}
+function createRoleManagement(options) {
+  if (typeof options.authorize !== "function" || typeof options.grantAuthority !== "function") {
+    throw new RoleManagementError;
+  }
+  const actions = [...options.actions];
+  const denied = () => {
+    throw new RoleManagementError;
+  };
+  async function mutate(actor, action, scope, targetId, evaluation, change, proposal = {}) {
+    try {
+      if (!actor || !actor.realmId || !actor.subjectId || !actor.kind || !Number.isFinite(evaluation.now) || evaluation.signal.aborted)
+        denied();
+      const request = cloneFacts({ actor, action, scope, targetId, ...proposal });
+      const trustedRequest = Object.freeze({ ...request, evaluation });
+      const current = immutableRoleSnapshot(await options.store.read(evaluation), actions);
+      if (evaluation.signal.aborted)
+        denied();
+      if (await options.authorize(trustedRequest) !== true)
+        denied();
+      if (evaluation.signal.aborted)
+        denied();
+      const authority = action === "revoke" ? null : cloneFacts(await options.grantAuthority(trustedRequest));
+      if (evaluation.signal.aborted)
+        denied();
+      if (action !== "revoke" && (!authority || !Number.isFinite(authority.maxExpiresAt) || authority.maxExpiresAt <= evaluation.now || !authority.scopes.some((s) => sameScope2(s, scope))))
+        denied();
+      const graph = change(current.graph, authority);
+      const next = immutableRoleSnapshot({ revision: crypto.randomUUID(), graph }, actions);
+      if (evaluation.signal.aborted)
+        denied();
+      if (!await options.store.compareAndSwap(current.revision, next, evaluation)) {
+        throw new RoleManagementError("CONFLICT");
+      }
+      if (evaluation.signal.aborted)
+        denied();
+      return Object.freeze({ revision: next.revision });
+    } catch (error) {
+      if (error instanceof RoleManagementError)
+        throw error;
+      throw new RoleManagementError;
+    }
+  }
+  function within(permissions, authority) {
+    if (permissions.some((p) => !authority.scopes.some((s) => sameScope2(s, p.scope)) || !authority.permissions.some((c) => permissionCovers(c, p))))
+      denied();
+  }
+  function expiry(binding, authority, now) {
+    if (binding.expiresAt === undefined || !Number.isFinite(binding.expiresAt) || binding.expiresAt <= now || binding.expiresAt > authority.maxExpiresAt)
+      denied();
+  }
+  return {
+    async createRole(actor, role, evaluation) {
+      evaluation = invocation(evaluation);
+      actor = cloneFacts(actor);
+      const proposed = cloneFacts(role);
+      return mutate(actor, "grant", proposed.scope, proposed.id, evaluation, (graph, authority) => {
+        const next = { ...graph, roles: [...graph.roles, proposed] };
+        immutableRoleSnapshot({ revision: "validation", graph: next }, actions);
+        within(effectiveRolePermissions2(next, proposed.id, proposed.scope), authority);
+        return next;
+      }, { role: proposed });
+    },
+    async editRole(actor, role, evaluation) {
+      evaluation = invocation(evaluation);
+      actor = cloneFacts(actor);
+      const proposed = cloneFacts(role);
+      return mutate(actor, "edit", proposed.scope, proposed.id, evaluation, (graph, authority) => {
+        if (!graph.roles.some((r) => r.id === proposed.id && sameScope2(r.scope, proposed.scope)))
+          denied();
+        const next = {
+          ...graph,
+          roles: graph.roles.map((r) => r.id === proposed.id && sameScope2(r.scope, proposed.scope) ? proposed : r)
+        };
+        immutableRoleSnapshot({ revision: "validation", graph: next }, actions);
+        for (const r of next.roles.filter((candidate) => sameScope2(candidate.scope, proposed.scope))) {
+          const after = effectiveRolePermissions2(next, r.id, r.scope);
+          const before = effectiveRolePermissions2(graph, r.id, r.scope);
+          const changed = after.some((p) => !before.some((c) => permissionCovers(c, p))) || before.some((p) => !after.some((c) => permissionCovers(c, p)));
+          if (r.id === proposed.id || changed) {
+            within(after, authority);
+            for (const b of graph.bindings.filter((candidate) => candidate.roleId === r.id && sameScope2(candidate.scope, r.scope) && (candidate.expiresAt === undefined || candidate.expiresAt > evaluation.now))) {
+              expiry(b, authority, evaluation.now);
+            }
+          }
+        }
+        const before = effectivePermissions2(graph, actor, proposed.scope, evaluation.now);
+        const after = effectivePermissions2(next, actor, proposed.scope, evaluation.now);
+        if (after.some((p) => !before.some((c) => permissionCovers(c, p))))
+          denied();
+        return next;
+      }, { role: proposed });
+    },
+    async bindRole(actor, binding, evaluation) {
+      evaluation = invocation(evaluation);
+      actor = cloneFacts(actor);
+      const proposed = cloneFacts(binding);
+      return mutate(actor, "bind", proposed.scope, proposed.id, evaluation, (graph, authority) => {
+        expiry(proposed, authority, evaluation.now);
+        within(effectiveRolePermissions2(graph, proposed.roleId, proposed.scope), authority);
+        return { ...graph, bindings: [...graph.bindings, proposed] };
+      }, { binding: proposed });
+    },
+    async revokeBinding(actor, scope, bindingId, evaluation) {
+      evaluation = invocation(evaluation);
+      actor = cloneFacts(actor);
+      scope = cloneFacts(scope);
+      return mutate(actor, "revoke", scope, bindingId, evaluation, (graph) => {
+        if (!graph.bindings.some((b) => b.id === bindingId && sameScope2(b.scope, scope)))
+          denied();
+        return { ...graph, bindings: graph.bindings.filter((b) => b.id !== bindingId) };
+      });
+    },
+    async delegateRole(actor, sourceBindingId, binding, evaluation) {
+      evaluation = invocation(evaluation);
+      actor = cloneFacts(actor);
+      const proposed = cloneFacts(binding);
+      return mutate(actor, "delegate", proposed.scope, proposed.id, evaluation, (graph, authority) => {
+        const source = graph.bindings.find((b) => b.id === sourceBindingId && samePrincipal(b.principal, actor) && sameScope2(b.scope, proposed.scope) && (b.expiresAt === undefined || b.expiresAt > evaluation.now));
+        if (!source)
+          denied();
+        expiry(proposed, authority, evaluation.now);
+        if (source.expiresAt !== undefined && proposed.expiresAt > source.expiresAt)
+          denied();
+        const permissions = effectiveRolePermissions2(graph, proposed.roleId, proposed.scope);
+        within(permissions, authority);
+        const sourcePermissions = effectiveRolePermissions2(graph, source.roleId, source.scope);
+        if (permissions.some((p) => !sourcePermissions.some((c) => permissionCovers(c, p))))
+          denied();
+        return { ...graph, bindings: [...graph.bindings, proposed] };
+      }, { binding: proposed, sourceBindingId });
+    }
+  };
+}
+export {
+  AuthorizationConfigurationError2 as AuthorizationConfigurationError,
+  AuthorizationError2 as AuthorizationError,
+  RoleGraphError2 as RoleGraphError,
+  RoleManagementError,
+  all2 as all,
+  any2 as any,
+  attribute2 as attribute,
+  authorizeList,
+  createAuthorization,
+  createRoleManagement,
+  effectivePermissions2 as effectivePermissions,
+  effectiveRolePermissions2 as effectiveRolePermissions,
+  matchesPermission2 as matchesPermission,
+  memoryRoleStore2 as memoryRoleStore,
+  predicate2 as predicate,
+  rbacPolicy2 as rbacPolicy,
+  rbacPredicate2 as rbacPredicate,
+  relation2 as relation,
+  sameScope2 as sameScope,
+  validateRoleGraph2 as validateRoleGraph
+};

package/dist/list.d.ts

@@ -0,0 +1,11 @@
+import type { Attributes, Authorization, Request, Resource } from "./types";
+/** Evaluate a complete bounded candidate set, then paginate; never reuse backend totals. */
+export declare function authorizeList<A extends string, R extends Resource, C = Attributes>(authorization: Authorization<A, R, C>, candidates: readonly R[], request: Omit<Request<A, R, C>, "resource">, options: {
+    maxCandidates: number;
+    offset?: number;
+    limit?: number;
+    signal?: AbortSignal;
+}): Promise<{
+    readonly items: readonly R[];
+    readonly total: number;
+}>;

package/dist/management.d.ts

@@ -0,0 +1,43 @@
+import type { Awaitable, Binding, Evaluation, Permission, Principal, Role, RoleStore, Scope } from "./types";
+export type ManagementAction = "use" | "grant" | "edit" | "bind" | "revoke" | "delegate";
+export interface ManagementRequest {
+    readonly actor: Principal;
+    readonly action: ManagementAction;
+    readonly scope: Scope;
+    readonly targetId: string;
+    readonly role?: Role;
+    readonly binding?: Binding;
+    readonly sourceBindingId?: string;
+    readonly evaluation: Evaluation;
+}
+export interface GrantAuthority<A extends string = string> {
+    readonly permissions: readonly Permission<A>[];
+    readonly scopes: readonly Scope[];
+    readonly maxExpiresAt: number;
+}
+export interface RoleMutationResult {
+    readonly revision: string;
+}
+export interface RoleManagementOptions<A extends string> {
+    readonly store: RoleStore<A>;
+    readonly actions: readonly A[];
+    /**
+     * Trusted application adapter: invoke Auth/authorization enforcement here.
+     * Supply a deadline signal in Evaluation; adapters must honor it.
+     * Cancellation cannot undo an already committed CAS.
+     */
+    readonly authorize: (request: ManagementRequest) => Awaitable<boolean>;
+    readonly grantAuthority: (request: ManagementRequest) => Awaitable<GrantAuthority<A> | null>;
+}
+export declare class RoleManagementError extends Error {
+    readonly code: "DENIED" | "CONFLICT";
+    constructor(code?: "DENIED" | "CONFLICT");
+}
+export declare function createRoleManagement<A extends string>(options: RoleManagementOptions<A>): {
+    createRole(actor: Principal, role: Role<A>, evaluation: Evaluation): Promise<RoleMutationResult>;
+    editRole(actor: Principal, role: Role<A>, evaluation: Evaluation): Promise<RoleMutationResult>;
+    bindRole(actor: Principal, binding: Binding, evaluation: Evaluation): Promise<RoleMutationResult>;
+    revokeBinding(actor: Principal, scope: Scope, bindingId: string, evaluation: Evaluation): Promise<RoleMutationResult>;
+    /** Issues an independent binding; revoking the source does not cascade to it. */
+    delegateRole(actor: Principal, sourceBindingId: string, binding: Binding, evaluation: Evaluation): Promise<RoleMutationResult>;
+};

package/dist/plugin.d.ts

@@ -0,0 +1,11 @@
+import { type Plugin, type PluginContext } from "@lenso/core/plugin";
+import type { Authorization, Resource } from "./types";
+export interface AuthorizationPluginOptions<A extends string, R extends Resource, C> {
+    readonly id: string;
+    /** Preserve the exact dependency instances supplied by the application. */
+    readonly requires?: readonly Plugin<unknown>[];
+    /** Build the service during setup; any resources remain application-owned. */
+    readonly setup: (context: PluginContext) => Authorization<A, R, C> | Promise<Authorization<A, R, C>>;
+}
+/** A thin lifecycle adapter; it acquires and closes no resources itself. */
+export declare function createAuthorizationPlugin<A extends string, R extends Resource = Resource, C = unknown>(options: AuthorizationPluginOptions<A, R, C>): Plugin<Authorization<A, R, C>>;

package/dist/plugin.js

@@ -0,0 +1,12 @@
+// src/plugin.ts
+import { definePlugin } from "@lenso/core/plugin";
+function createAuthorizationPlugin(options) {
+  return definePlugin({
+    id: options.id,
+    requires: options.requires,
+    setup: options.setup
+  });
+}
+export {
+  createAuthorizationPlugin
+};

package/dist/rbac.d.ts

@@ -0,0 +1,24 @@
+import type { Attributes, Permission, Policy, Predicate, Principal, Resource, RoleGraph, RoleSnapshot, RoleStore, Scope } from "./types";
+export declare class RoleGraphError extends Error {
+    constructor();
+}
+export { sameScope } from "./conditions";
+export declare const samePrincipal: (a: Principal, b: Principal) => boolean;
+export declare function permissionCovers(ceiling: Permission, permission: Permission): boolean;
+export declare function validateRoleGraph<A extends string>(graph: RoleGraph<A>, actions: readonly A[]): void;
+/** Call after graph validation; inheritance is confined to the exact role scope. */
+export declare function effectiveRolePermissions<A extends string>(graph: RoleGraph<A>, roleId: string, scope: Scope): readonly Permission<A>[];
+export declare function effectivePermissions<A extends string>(graph: RoleGraph<A>, principal: Principal, scope: Scope, now: number): readonly Permission<A>[];
+export declare function immutableRoleSnapshot<A extends string>(value: RoleSnapshot<A>, actions: readonly A[]): RoleSnapshot<A>;
+export declare function memoryRoleStore<A extends string>(graph: RoleGraph<A>, actions: readonly A[]): RoleStore<A>;
+export type RbacOptions<A extends string> = {
+    readonly actions: readonly A[];
+} & ({
+    readonly store: RoleStore<A>;
+    readonly graph?: never;
+} | {
+    readonly graph: RoleGraph<A>;
+    readonly store?: never;
+});
+export declare function rbacPredicate<A extends string, R extends Resource = Resource, C = Attributes>(options: RbacOptions<A>): Predicate<A, R, C>;
+export declare function rbacPolicy<A extends string, R extends Resource = Resource, C = Attributes>(options: RbacOptions<A>): Policy<A, R, C>;

package/dist/snapshot.d.ts

@@ -0,0 +1,5 @@
+/** Copy finite plain facts before awaiting user code; never freeze borrowed application objects. */
+export declare function snapshot<T>(value: T, limits?: {
+    maxNodes: number;
+    maxDepth: number;
+}): T;