@wtfalch/authz-store 0.2.1 → 0.4.0

package/dist/policy-access.d.ts

@@ -0,0 +1,260 @@
+import { type ResourceAssignment, type ResourceRestrictions, type ResourceRole } from '@wtfalch/authz';
+import type { StoreBinding } from './binding.js';
+import { policyAssignments, policyRoles } from './policy-schema.js';
+import { type DbOrTx, type Scope } from './scoped.js';
+import type { Access, Principal, TenantRow } from './types.js';
+export declare function policyRole(row: typeof policyRoles.$inferSelect): ResourceRole;
+export declare function policyAssignment(row: typeof policyAssignments.$inferSelect): ResourceAssignment;
+export declare function restriction(tenant: TenantRow, support?: ResourceRestrictions['support']): ResourceRestrictions;
+export declare function policyTarget(access: Pick<Access, 'binding' | 'tenant'>, permission: string, id?: string, platform?: boolean): {
+    id: string;
+    type: string;
+    applicationId: string;
+    platformId: string;
+    organisationId: string | null;
+    teamId: null;
+};
+/** For organisation-wide administrative operations; scoped domain reads pass a real resource to authority.allows. */
+export declare function permits(access: Access, permission: string): boolean;
+export declare function permitsPlatform(access: Access, permission: string): boolean;
+/**
+ * The one choke point every read-effect permission's gate runs through
+ * (`membersOf`, `credentialsFor`, `allTenants`, `securityLogFor`,
+ * `pendingInvitations`, the attach-proposal readers in `nesting.ts`,
+ * `scopedAuditLog`), rather than each writing its own `break_glass.viewed`
+ * call: when access is granted and the request is inside an open support
+ * session, it writes `break_glass.viewed` — with the session's id/reason/
+ * reference, via `record`'s existing break-glass auto-fill — so the tenant
+ * can see what a session actually read, not only that one was open. A
+ * denied read writes nothing here; `deny()` already audits a denied
+ * sensitive/depth-0 permission on its own path.
+ *
+ * `db` is the host's root handle, passed through to `record`, rather than
+ * imported: the store has no database of its own to reach for.
+ *
+ * Dynamic import of `./audit.js`, not a static one: `audit.ts` imports
+ * `permitsRead` from this module, so a static import the other way would be
+ * a circular one evaluated at module-load time instead of call time.
+ */
+export declare function auditedReadGate(access: Access, db: DbOrTx, permission: string, allowed: boolean): Promise<boolean>;
+/** `permits`, audited under an open support session. Use for every org-scoped read gate. */
+export declare function permitsRead(access: Access, db: DbOrTx, permission: string): Promise<boolean>;
+/** `permitsPlatform`, audited under an open support session. Use for every platform-scoped read gate. */
+export declare function permitsPlatformRead(access: Access, db: DbOrTx, permission: string): Promise<boolean>;
+export declare function requirePolicySchema(tx: DbOrTx, binding: StoreBinding): Promise<void>;
+export declare function loadPolicyState(tx: DbOrTx, binding: StoreBinding, tenantId: string): Promise<{
+    teams: {
+        id: string;
+        tenantId: string;
+        parentId: string | null;
+        name: string;
+        archivedAt: Date | null;
+        createdAt: Date;
+    }[];
+    participants: {
+        tenantId: string;
+        teamId: string;
+        principalId: string;
+        principalClass: string;
+    }[];
+    roleRows: {
+        id: string;
+        tenantId: string;
+        applicationId: string;
+        platformId: string;
+        key: string;
+        name: string;
+        description: string;
+        builtIn: boolean;
+        revision: number;
+        entries: {
+            permission: string;
+            boundary: {
+                kind: "organisation";
+                organisationId: string;
+                descendants?: boolean | undefined;
+            } | {
+                kind: "organisations";
+                organisationIds: string[];
+            } | {
+                kind: "platform";
+            };
+            scope: {
+                kind: "organisation";
+            } | {
+                kind: "team";
+                teamId: string;
+                descendants: boolean;
+            } | {
+                kind: "own_teams";
+                descendants: boolean;
+            } | {
+                kind: "resource";
+                resourceType: string;
+                resourceId: string;
+            };
+            relation: "any" | "owner" | "actor" | "subject";
+        }[];
+        guards: string[];
+        createdBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        updatedBy: string | null;
+    }[];
+    assignmentRows: {
+        id: string;
+        tenantId: string;
+        applicationId: string;
+        platformId: string;
+        roleId: string;
+        principalId: string | null;
+        principalClass: string | null;
+        teamId: string | null;
+        recipientDescendants: boolean;
+        boundary: {
+            kind: "organisation";
+            organisationId: string;
+            descendants?: boolean | undefined;
+        } | {
+            kind: "organisations";
+            organisationIds: string[];
+        } | {
+            kind: "platform";
+        };
+        scope: {
+            kind: "organisation";
+        } | {
+            kind: "team";
+            teamId: string;
+            descendants: boolean;
+        } | {
+            kind: "own_teams";
+            descendants: boolean;
+        } | {
+            kind: "resource";
+            resourceType: string;
+            resourceId: string;
+        };
+        source: string;
+        viaTenantId: string | null;
+        primary: boolean;
+        expiresAt: Date | null;
+        createdBy: string | null;
+        createdAt: Date;
+    }[];
+    tenantRows: {
+        id: string;
+        kind: import("@wtfalch/authz").TenantKind;
+        slug: string;
+        name: string;
+        state: import("@wtfalch/authz").TenantState;
+        parentId: string | null;
+        ceiling: string[];
+        selfDenied: string[];
+        frozen: boolean;
+        createdBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[];
+    memberRows: {
+        tenantId: string;
+        principalId: string;
+        principalClass: string;
+        source: string;
+        viaTenantId: string | null;
+        tenantName: string;
+        grantedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }[];
+    grants: {
+        id: string;
+        applicationId: string;
+        platformId: string;
+        boundary: {
+            kind: "organisation";
+            organisationId: string;
+            descendants?: boolean | undefined;
+        } | {
+            kind: "organisations";
+            organisationIds: string[];
+        } | {
+            kind: "platform";
+        };
+        permission: string;
+        recipient: {
+            kind: "principal";
+            principal: {
+                id: string;
+                class: "human" | "api_key" | "agent" | "service";
+            };
+        } | {
+            kind: "team";
+            teamId: string;
+            descendants: boolean;
+        };
+        scope: {
+            kind: "organisation";
+        } | {
+            kind: "team";
+            teamId: string;
+            descendants: boolean;
+        } | {
+            kind: "own_teams";
+            descendants: boolean;
+        } | {
+            kind: "resource";
+            resourceType: string;
+            resourceId: string;
+        };
+        relation: "any" | "owner" | "actor" | "subject";
+        constraints?: ({
+            kind: "organisation";
+        } | {
+            kind: "team";
+            teamId: string;
+            descendants: boolean;
+        } | {
+            kind: "own_teams";
+            descendants: boolean;
+        } | {
+            kind: "resource";
+            resourceType: string;
+            resourceId: string;
+        })[] | undefined;
+        startsAt?: number | undefined;
+        expiresAt?: number | undefined;
+        conditions?: ({
+            kind: "attribute";
+            attribute: string;
+            in: string[];
+        } | {
+            kind: "schedule";
+            timeZone: string;
+            windows: {
+                days: ("mon" | "tue" | "wed" | "thu" | "fri" | "sat" | "sun")[];
+                from: string;
+                to: string;
+            }[];
+        })[] | undefined;
+        guest?: true | undefined;
+        budget?: {
+            limit: number;
+            windowSeconds: number;
+        } | undefined;
+    }[];
+}>;
+export type PolicyState = Awaited<ReturnType<typeof loadPolicyState>>;
+/**
+ * Authoritative loader shared by reads and locked writes. No membership role field is consulted.
+ *
+ * `db` and `scopeColumn` are separate from `tx`: the returned `Access.db` is always opened
+ * against `db` (the host's root handle), never against `tx`, even when `tx` is an open
+ * transaction a caller passed in for a fresher read — the same split the host's own copy made.
+ * `scopeColumn` is the host's tenant-table registry turned into a `Scope['column']` function
+ * (`scopeColumnOf(TENANT_TABLES)` in a host); the registry itself stays in the host because it
+ * grows with every feature table a host adds.
+ */
+export declare function loadAccess(tx: DbOrTx, binding: StoreBinding, db: DbOrTx, scopeColumn: Scope['column'], principal: Principal, tenantId: string, allowSupport?: boolean, acceptingInvitation?: boolean): Promise<Access | null>;
+/** Must be called inside the same transaction as the mutation. */
+export declare function refreshAccess(tx: DbOrTx, db: DbOrTx, scopeColumn: Scope['column'], access: Access): Promise<Access | null>;

package/dist/policy-access.js

@@ -0,0 +1,357 @@
+import { compileRoleGrants, credentialAccess, resourceAccess, } from '@wtfalch/authz';
+import { and, eq, gt, isNull } from 'drizzle-orm';
+import { policyResource } from './policy-resources.js';
+import { policyAssignments, policyRoles, policyVersion } from './policy-schema.js';
+import { accessTeamMembers, accessTeams } from './resource-schema.js';
+import { isCustomRoleKey } from './role-keys.js';
+import { breakGlassSessions, credentials, memberships, tenants } from './schema.js';
+import { openScopedDb } from './scoped.js';
+export function policyRole(row) {
+    return {
+        id: row.id,
+        key: row.key,
+        applicationId: row.applicationId,
+        platformId: row.platformId,
+        organisationId: row.tenantId,
+        label: row.name,
+        description: row.description || row.name,
+        revision: row.revision,
+        builtIn: row.builtIn,
+        entries: row.entries,
+        guards: row.guards,
+    };
+}
+export function policyAssignment(row) {
+    if (row.principalId && !row.principalClass)
+        throw new Error('Untyped assignment');
+    return {
+        id: row.id,
+        roleId: row.roleId,
+        applicationId: row.applicationId,
+        platformId: row.platformId,
+        organisationId: row.tenantId,
+        boundary: row.boundary,
+        scope: row.scope,
+        recipient: row.principalId
+            ? {
+                kind: 'principal',
+                principal: {
+                    id: row.principalId,
+                    class: row.principalClass,
+                },
+            }
+            : { kind: 'team', teamId: row.teamId, descendants: row.recipientDescendants },
+        ...(row.expiresAt ? { expiresAt: row.expiresAt.getTime() } : {}),
+    };
+}
+export function restriction(tenant, support = null) {
+    return {
+        kind: tenant.kind,
+        state: tenant.state,
+        ceiling: [...tenant.ceiling],
+        selfDenied: [...tenant.selfDenied],
+        denied: [],
+        support,
+    };
+}
+export function policyTarget(access, permission, id = access.tenant.id, platform = false) {
+    const def = access.binding.catalogue[permission];
+    return {
+        id,
+        type: def?.resourceType ?? 'unknown',
+        applicationId: access.binding.applicationId,
+        platformId: access.binding.platformId,
+        organisationId: platform ? null : access.tenant.id,
+        teamId: null,
+    };
+}
+/** For organisation-wide administrative operations; scoped domain reads pass a real resource to authority.allows. */
+export function permits(access, permission) {
+    return access.authority
+        .clauses(permission)
+        .some((c) => c.applicationId === access.binding.applicationId &&
+        c.platformId === access.binding.platformId &&
+        c.organisationId === access.tenant.id &&
+        c.resourceType === access.binding.catalogue[permission]?.resourceType &&
+        c.teamIds === null &&
+        c.resourceId === undefined &&
+        c.relation === 'any');
+}
+export function permitsPlatform(access, permission) {
+    return access.authority
+        .clauses(permission)
+        .some((c) => c.applicationId === access.binding.applicationId &&
+        c.platformId === access.binding.platformId &&
+        c.organisationId === null &&
+        c.resourceType === access.binding.catalogue[permission]?.resourceType &&
+        c.teamIds === null &&
+        c.resourceId === undefined &&
+        c.relation === 'any');
+}
+/**
+ * The one choke point every read-effect permission's gate runs through
+ * (`membersOf`, `credentialsFor`, `allTenants`, `securityLogFor`,
+ * `pendingInvitations`, the attach-proposal readers in `nesting.ts`,
+ * `scopedAuditLog`), rather than each writing its own `break_glass.viewed`
+ * call: when access is granted and the request is inside an open support
+ * session, it writes `break_glass.viewed` — with the session's id/reason/
+ * reference, via `record`'s existing break-glass auto-fill — so the tenant
+ * can see what a session actually read, not only that one was open. A
+ * denied read writes nothing here; `deny()` already audits a denied
+ * sensitive/depth-0 permission on its own path.
+ *
+ * `db` is the host's root handle, passed through to `record`, rather than
+ * imported: the store has no database of its own to reach for.
+ *
+ * Dynamic import of `./audit.js`, not a static one: `audit.ts` imports
+ * `permitsRead` from this module, so a static import the other way would be
+ * a circular one evaluated at module-load time instead of call time.
+ */
+export async function auditedReadGate(access, db, permission, allowed) {
+    if (allowed && access.context === 'break_glass') {
+        const { record } = await import('./audit.js');
+        await record(db, access, {
+            action: 'break_glass.viewed',
+            tenantId: access.tenant.id,
+            targetType: 'permission',
+            targetId: permission,
+        });
+    }
+    return allowed;
+}
+/** `permits`, audited under an open support session. Use for every org-scoped read gate. */
+export async function permitsRead(access, db, permission) {
+    return auditedReadGate(access, db, permission, permits(access, permission));
+}
+/** `permitsPlatform`, audited under an open support session. Use for every platform-scoped read gate. */
+export async function permitsPlatformRead(access, db, permission) {
+    return auditedReadGate(access, db, permission, permitsPlatform(access, permission));
+}
+export async function requirePolicySchema(tx, binding) {
+    const [version] = await tx.select().from(policyVersion).where(eq(policyVersion.id, 1));
+    if (version?.version !== 2 ||
+        version.applicationId !== binding.applicationId ||
+        version.platformId !== binding.platformId)
+        throw new Error('This application requires the completed authz v2 maintenance migration');
+}
+export async function loadPolicyState(tx, binding, tenantId) {
+    const [teamRows, participants, roleRows, assignmentRows, tenantRows, memberRows] = await Promise.all([
+        tx.select().from(accessTeams),
+        tx.select().from(accessTeamMembers),
+        tx
+            .select()
+            .from(policyRoles)
+            .where(and(eq(policyRoles.tenantId, tenantId), eq(policyRoles.applicationId, binding.applicationId), eq(policyRoles.platformId, binding.platformId))),
+        tx
+            .select()
+            .from(policyAssignments)
+            .where(and(eq(policyAssignments.tenantId, tenantId), eq(policyAssignments.applicationId, binding.applicationId), eq(policyAssignments.platformId, binding.platformId))),
+        tx.select().from(tenants),
+        tx.select().from(memberships).where(eq(memberships.tenantId, tenantId)),
+    ]);
+    const roleMap = new Map(roleRows.map((r) => [r.id, r]));
+    const grants = [];
+    for (const a of assignmentRows) {
+        const r = roleMap.get(a.roleId);
+        if (!r)
+            throw new Error('Orphaned role assignment');
+        grants.push(...compileRoleGrants(policyRole(r), policyAssignment(a), binding.catalogue));
+    }
+    return {
+        teams: teamRows,
+        participants,
+        roleRows,
+        assignmentRows,
+        tenantRows,
+        memberRows,
+        grants,
+    };
+}
+/**
+ * Authoritative loader shared by reads and locked writes. No membership role field is consulted.
+ *
+ * `db` and `scopeColumn` are separate from `tx`: the returned `Access.db` is always opened
+ * against `db` (the host's root handle), never against `tx`, even when `tx` is an open
+ * transaction a caller passed in for a fresher read — the same split the host's own copy made.
+ * `scopeColumn` is the host's tenant-table registry turned into a `Scope['column']` function
+ * (`scopeColumnOf(TENANT_TABLES)` in a host); the registry itself stays in the host because it
+ * grows with every feature table a host adds.
+ */
+export async function loadAccess(tx, binding, db, scopeColumn, principal, tenantId, allowSupport = true, acceptingInvitation = false) {
+    await requirePolicySchema(tx, binding);
+    const state = await loadPolicyState(tx, binding, tenantId);
+    const tenant = state.tenantRows.find((t) => t.id === tenantId);
+    if (!tenant)
+        return null;
+    const member = state.memberRows.find((m) => m.principalId === principal.id && m.principalClass === principal.class);
+    let support = null;
+    let grants = state.grants;
+    let role = state.roleRows.find((r) => state.assignmentRows.some((a) => a.primary &&
+        (!a.expiresAt || a.expiresAt.getTime() > Date.now()) &&
+        a.roleId === r.id &&
+        a.principalId === principal.id &&
+        a.principalClass === principal.class))?.key ?? '';
+    if (!member) {
+        if (!allowSupport || principal.class !== 'human')
+            return null;
+        const [session] = await tx
+            .select()
+            .from(breakGlassSessions)
+            .where(and(eq(breakGlassSessions.operatorId, principal.id), eq(breakGlassSessions.tenantId, tenantId), isNull(breakGlassSessions.endedAt), gt(breakGlassSessions.expiresAt, new Date())))
+            .limit(1);
+        if (!session)
+            return null;
+        const operator = state.tenantRows.find((t) => t.kind === 'operator');
+        if (!operator)
+            return null;
+        const operatorAccess = await loadAccess(tx, binding, db, scopeColumn, principal, operator.id, false);
+        if (!operatorAccess || !permits(operatorAccess, 'break_glass:start'))
+            return null;
+        // Not `r.builtIn`: a starter role (ADR 0016) is `built_in: false` for a
+        // tenant created after that change but must still be honoured here, or a
+        // session started against it would read as immediately invalid.
+        const supportRole = state.roleRows.find((r) => r.id === session.roleId && !isCustomRoleKey(r.key));
+        if (!supportRole)
+            return null;
+        support = {
+            id: session.id,
+            expiresAt: session.expiresAt,
+            readOnly: session.readOnly || !permits(operatorAccess, 'break_glass:start-write'),
+            reason: session.reasonCode,
+            reference: session.reference,
+        };
+        role = supportRole.key;
+        grants = [
+            ...compileRoleGrants(policyRole(supportRole), {
+                id: session.id,
+                roleId: supportRole.id,
+                applicationId: binding.applicationId,
+                platformId: binding.platformId,
+                organisationId: tenantId,
+                boundary: { kind: 'organisation', organisationId: tenantId },
+                recipient: { kind: 'principal', principal: { id: principal.id, class: principal.class } },
+                expiresAt: session.expiresAt.getTime(),
+            }, binding.catalogue),
+        ];
+    }
+    else if (tenant.state === 'archived')
+        return null;
+    const operatorTenant = state.tenantRows.find((t) => t.kind === 'operator');
+    const now = Date.now();
+    const input = {
+        applicationId: binding.applicationId,
+        platformId: binding.platformId,
+        principal: { id: principal.id, class: principal.class },
+        catalogue: binding.catalogue,
+        now,
+        grants,
+        organisations: state.tenantRows.map((t) => ({
+            id: t.id,
+            restrictions: restriction((acceptingInvitation && !allowSupport && t.id === tenantId && t.state === 'read_only'
+                ? { ...t, state: 'active' }
+                : t), t.id === tenantId && support
+                ? { id: support.id, expiresAt: support.expiresAt.getTime(), readOnly: support.readOnly }
+                : null),
+        })),
+        platformRestrictions: {
+            kind: 'operator',
+            state: 'active',
+            ceiling: [],
+            selfDenied: [],
+            denied: [],
+            support: null,
+            frozen: operatorTenant?.frozen ?? false,
+        },
+        teams: state.teams.map((t) => ({ id: t.id, organisationId: t.tenantId, parentId: t.parentId })),
+        memberships: state.participants.map((p) => ({
+            teamId: p.teamId,
+            principal: { id: p.principalId, class: p.principalClass },
+        })),
+    };
+    let authority = resourceAccess(input);
+    if (principal.class !== 'human') {
+        const links = [];
+        const visited = new Set();
+        let cursor = { id: principal.id, class: principal.class };
+        while (cursor.class !== 'human') {
+            if (visited.has(`${cursor.class}:${cursor.id}`) || visited.size >= 32)
+                return null;
+            visited.add(`${cursor.class}:${cursor.id}`);
+            // Narrow to the columns this walk reads: a service-credential chain
+            // never needs `secretHash`/`secretPrefix`/`keysIssuedId`, and a host
+            // that dropped those columns (files, ai) would otherwise fail every
+            // request through this path with "column does not exist".
+            const [credential] = await tx
+                .select({
+                issuerId: credentials.issuerId,
+                issuerClass: credentials.issuerClass,
+                expiresAt: credentials.expiresAt,
+                revokedAt: credentials.revokedAt,
+            })
+                .from(credentials)
+                .where(and(eq(credentials.id, cursor.id), eq(credentials.kind, cursor.class)))
+                .limit(1);
+            if (!credential?.issuerId || !credential.issuerClass)
+                return null;
+            const issuer = {
+                id: credential.issuerId,
+                class: credential.issuerClass,
+            };
+            links.unshift({
+                principal: cursor,
+                issuer,
+                expiresAt: credential.expiresAt?.getTime() ?? Number.MAX_SAFE_INTEGER,
+                revokedAt: credential.revokedAt?.getTime() ?? null,
+                grants: grants.filter((g) => g.recipient.kind === 'principal' &&
+                    g.recipient.principal.id === cursor.id &&
+                    g.recipient.principal.class === cursor.class),
+            });
+            cursor = issuer;
+        }
+        const issuerMember = state.memberRows.some((m) => m.principalId === cursor.id && m.principalClass === cursor.class);
+        const resources = new Map();
+        for (const grant of links.flatMap((l) => l.grants))
+            for (const scope of [grant.scope, ...(grant.constraints ?? [])]) {
+                if (scope.kind !== 'resource')
+                    continue;
+                const key = `${scope.resourceType}:${scope.resourceId}`;
+                if (!resources.has(key)) {
+                    const resource = await policyResource(tx, binding, tenantId, scope.resourceType, scope.resourceId);
+                    if (resource)
+                        resources.set(key, resource);
+                }
+            }
+        authority = credentialAccess({
+            root: { ...input, principal: cursor, grants: issuerMember ? grants : [] },
+            chain: links,
+            resources,
+        });
+    }
+    const readOnly = tenant.state !== 'active' || support?.readOnly === true;
+    return {
+        actor: principal,
+        tenant,
+        role,
+        authority,
+        policyState: state,
+        context: support ? 'break_glass' : tenant.kind === 'operator' ? 'operator' : 'standard',
+        breakGlass: support,
+        readOnly,
+        db: openScopedDb(db, {
+            column: scopeColumn,
+            value: tenantId,
+            readOnly,
+            label: 'tenant',
+        }),
+        binding,
+    };
+}
+/** Must be called inside the same transaction as the mutation. */
+export async function refreshAccess(tx, db, scopeColumn, access) {
+    await tx
+        .select({ id: tenants.id })
+        .from(tenants)
+        .where(eq(tenants.id, access.tenant.id))
+        .for('update');
+    return loadAccess(tx, access.binding, db, scopeColumn, access.actor, access.tenant.id);
+}

package/dist/policy-entry.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
+ * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
+ * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * labels cannot import from `.` without pulling Node into a production browser build
+ * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
+ * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by
+ * `scripts/tests/package-contract.test.mjs`.
+ */
+export { definePolicy, type PolicyData, type PolicyRoleTemplate, type StorePolicy, } from './policy.js';
+export type { StoreBinding } from './binding.js';

package/dist/policy-entry.js

@@ -0,0 +1,10 @@
+/**
+ * `@wtfalch/authz-store/policy` — a client-safe subpath for `definePolicy` and the types its
+ * signature needs. The main entry (`.`) re-exports `migrateStore`, which imports
+ * `node:fs/promises`, so a client component that only reads the policy catalogue for permission
+ * labels cannot import from `.` without pulling Node into a production browser build
+ * (https://github.com/wtfalch/boule/pull/162). Nothing this module imports, directly or
+ * transitively, may import a `node:` module, `drizzle-orm`, or a database handle — proved by
+ * `scripts/tests/package-contract.test.mjs`.
+ */
+export { definePolicy, } from './policy.js';

package/dist/policy-resources.d.ts

@@ -0,0 +1,5 @@
+import type { AccessResource } from '@wtfalch/authz';
+import type { StoreBinding } from './binding.js';
+import type { DbOrTx } from './scoped.js';
+/** Authoritative resource metadata, shared by delegation and credential lineage evaluation. */
+export declare function policyResource(tx: DbOrTx, binding: StoreBinding, organisationId: string, type: string, id: string): Promise<AccessResource | undefined>;