@xen-orchestra/acl 1.0.0

package/dist/generated/privilege-types.d.mts

@@ -0,0 +1,378 @@
+// -----------------------------------------------------------------------
+// AUTO-GENERATED — do not edit manually.
+// Regenerated on every `npm run build`.
+// -----------------------------------------------------------------------
+import type { XoAclBasePrivilege } from '@vates/types'
+
+
+export type AclPrivilegePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'acl-privilege'
+  action: '*' | 'create' | 'delete' | 'read' | 'update' | '*' | 'update:action' | 'update:effect' | 'update:resource' | 'update:selector'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type AclRolePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'acl-role'
+  action: '*' | 'create' | 'delete' | 'read' | 'update' | '*' | 'update:description' | 'update:groups' | 'update:name' | 'update:users'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type AlarmPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'alarm'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type BackupArchivePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'backup-archive'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type BackupJobPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'backup-job'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type BackupLogPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'backup-log'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type BackupRepositoryPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'backup-repository'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type GroupPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'group'
+  action: '*' | 'create' | 'delete' | 'read' | 'update' | '*' | 'update:name' | 'update:users'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type GpuGroupPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'gpuGroup'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type HostPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'host'
+  action: '*' | 'allow-vm' | 'export' | '*' | 'export:logs' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type MessagePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'message'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type NetworkPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'network'
+  action: '*' | 'create' | 'delete' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type PbdPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'pbd'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type PciPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'pci'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type PgpuPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'pgpu'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type PifPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'pif'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type PoolPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'pool'
+  action: '*' | 'create' | '*' | 'create:network' | 'create:vm' | 'emergency-shutdown' | 'read' | 'rolling-reboot' | 'rolling-update' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type ProxyPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'proxy'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type RestoreLogPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'restore-log'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type SchedulePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'schedule'
+  action: '*' | 'read' | 'run'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type ServerPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'server'
+  action: '*' | 'connect' | 'create' | 'delete' | 'disconnect' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type SmPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'sm'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type SrPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'sr'
+  action: '*' | 'import' | '*' | 'import:vdi' | 'import:vm' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type TaskPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'task'
+  action: '*' | 'abort' | 'delete' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type UserPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'user'
+  action: '*' | 'create' | 'delete' | 'read' | 'update' | '*' | 'update:name' | 'update:password' | 'update:permission' | 'update:preferences'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VbdPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vbd'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VdiSnapshotPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vdi-snapshot'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VdiUnmanagedPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vdi-unmanaged'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VdiPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vdi'
+  action: '*' | 'boot' | 'create' | 'delete' | 'export-content' | 'import-content' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VgpuPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vgpu'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VgpuTypePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vgpuType'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VifPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vif'
+  action: '*' | 'read' | 'create'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VmControllerPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vm-controller'
+  action: '*' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VmSnapshotPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vm-snapshot'
+  action: '*' | 'delete' | 'export' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VmTemplatePrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vm-template'
+  action: '*' | 'delete' | 'export' | 'instantiate' | 'read' | 'update' | '*' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VmPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vm'
+  action: '*' | 'delete' | 'export' | 'pause' | 'read' | 'reboot' | '*' | 'reboot:clean' | 'reboot:hard' | 'resume' | 'shutdown' | '*' | 'shutdown:clean' | 'shutdown:hard' | 'snapshot' | 'start' | 'suspend' | 'unpause' | 'update' | '*' | 'update:datasources' | 'update:tags'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type VtpmPrivilege = {
+  id: XoAclBasePrivilege['id']
+  resource: 'vtpm'
+  action: '*' | 'read'
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}
+
+export type AnyPrivilege =
+  | AclPrivilegePrivilege
+  | AclRolePrivilege
+  | AlarmPrivilege
+  | BackupArchivePrivilege
+  | BackupJobPrivilege
+  | BackupLogPrivilege
+  | BackupRepositoryPrivilege
+  | GroupPrivilege
+  | GpuGroupPrivilege
+  | HostPrivilege
+  | MessagePrivilege
+  | NetworkPrivilege
+  | PbdPrivilege
+  | PciPrivilege
+  | PgpuPrivilege
+  | PifPrivilege
+  | PoolPrivilege
+  | ProxyPrivilege
+  | RestoreLogPrivilege
+  | SchedulePrivilege
+  | ServerPrivilege
+  | SmPrivilege
+  | SrPrivilege
+  | TaskPrivilege
+  | UserPrivilege
+  | VbdPrivilege
+  | VdiSnapshotPrivilege
+  | VdiUnmanagedPrivilege
+  | VdiPrivilege
+  | VgpuPrivilege
+  | VgpuTypePrivilege
+  | VifPrivilege
+  | VmControllerPrivilege
+  | VmSnapshotPrivilege
+  | VmTemplatePrivilege
+  | VmPrivilege
+  | VtpmPrivilege

package/dist/generated/privilege-types.mjs

@@ -0,0 +1,5 @@
+// DO NOT EDIT
+// Overwritten by scripts/generate-types.mjs after running npm run build
+// scripts/generate-types.mjs will replace this file to automatically generate and export all privileged types.
+// This makes external use easier because it's not necessary to resolve the type every time.
+export {};

package/dist/index.d.mts

@@ -0,0 +1,40 @@
+import type { XoUser } from '@vates/types/xo';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from './actions/index.mjs';
+import { TPrivilege as Privilege, SupportedActions, SupportedActionsByResource, SupportedResource } from './class/privilege.mjs';
+export type { Privilege, SupportedActions, SupportedActionsByResource, SupportedResource };
+export { SUPPORTED_ACTIONS_BY_RESOURCE };
+export type * from './generated/privilege-types.mjs';
+import { AnyPrivilege } from './generated/privilege-types.mjs';
+export type AnyPrivilegeOnParam = {
+    [Resource in SupportedResource]: {
+        user: XoUser;
+        resource: Resource;
+        action: SupportedActions<Resource>;
+        objects: object | object[];
+    };
+}[SupportedResource];
+export declare function hasPrivilegeOn<T extends SupportedResource>({ user, action, resource, objects, userPrivileges, }: {
+    user: XoUser;
+    resource: T;
+    action: SupportedActions<T>;
+    objects: object | object[];
+    userPrivileges: AnyPrivilege[];
+}): boolean;
+export declare function getMissingPrivileges(params: AnyPrivilegeOnParam[], userPrivileges: AnyPrivilege[]): {
+    objectId: unknown;
+    objectIds: unknown[] | undefined;
+    action: "create" | "delete" | "read" | "update" | "allow-vm" | "export" | "emergency-shutdown" | "rolling-reboot" | "rolling-update" | "run" | "connect" | "disconnect" | "import" | "abort" | "boot" | "export-content" | "import-content" | "instantiate" | "pause" | "reboot" | "resume" | "shutdown" | "snapshot" | "start" | "suspend" | "unpause" | "*" | "update:action" | "update:resource" | "update:effect" | "update:selector" | "update:description" | "update:groups" | "update:name" | "update:users" | "update:tags" | "export:logs" | "create:network" | "create:vm" | "import:vdi" | "import:vm" | "update:password" | "update:permission" | "update:preferences" | "update:datasources" | "reboot:clean" | "reboot:hard" | "shutdown:clean" | "shutdown:hard";
+    resource: "acl-privilege" | "acl-role" | "alarm" | "backup-archive" | "backup-job" | "backup-log" | "backup-repository" | "group" | "gpuGroup" | "host" | "message" | "network" | "pbd" | "pci" | "pgpu" | "pif" | "pool" | "proxy" | "restore-log" | "schedule" | "server" | "sm" | "sr" | "task" | "user" | "vbd" | "vdi-snapshot" | "vdi-unmanaged" | "vdi" | "vgpu" | "vgpuType" | "vif" | "vm-controller" | "vm-snapshot" | "vm-template" | "vm" | "vtpm";
+}[];
+export declare function hasPrivileges(params: AnyPrivilegeOnParam[], userPrivileges: AnyPrivilege[]): boolean;
+export declare function filterObjectsWithPrivilege<Resource extends SupportedResource, Object extends object>(param: {
+    user: XoUser;
+    resource: Resource;
+    action: SupportedActions<Resource>;
+    objects: Object[];
+    userPrivileges: AnyPrivilege[];
+}): Object[];
+/**
+ * Mirror GetKeysRecursively from @vates/types
+ */
+export declare function getActionStrings<Resource extends SupportedResource, Actions = SupportedActions<Resource>>(resource: Resource): Actions[];

package/dist/index.mjs

@@ -0,0 +1,97 @@
+import assert from 'node:assert';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from './actions/index.mjs';
+import { Privilege as CPrivilege, } from './class/privilege.mjs';
+export { SUPPORTED_ACTIONS_BY_RESOURCE };
+export function hasPrivilegeOn({ user, action, resource, objects, userPrivileges, }) {
+    // Function that will be called outside of the module
+    // We cannot be sure types are respected
+    assert.strictEqual(typeof user?.permission, 'string');
+    assert.strictEqual(typeof action, 'string');
+    assert.strictEqual(typeof resource, 'string');
+    assert.strictEqual(objects === undefined, false);
+    CPrivilege.checkActionIsValid(resource, action);
+    if (user.permission === 'admin') {
+        return true;
+    }
+    const effectsByObject = new Map();
+    if (Array.isArray(objects)) {
+        objects.forEach(obj => effectsByObject.set(obj, []));
+    }
+    else {
+        effectsByObject.set(objects, []);
+    }
+    for (const userPrivilege of userPrivileges) {
+        const privilege = new CPrivilege(userPrivilege);
+        for (const [object, effects] of effectsByObject.entries()) {
+            if (!privilege.match({ action, resource, object })) {
+                continue;
+            }
+            effects.push(privilege.effect);
+        }
+    }
+    if (Array.from(effectsByObject.values()).some(effects => effects.length === 0 || effects.some(effect => effect === 'deny'))) {
+        return false;
+    }
+    return true;
+}
+export function getMissingPrivileges(params, userPrivileges) {
+    return params
+        .filter(param => !hasPrivilegeOn({
+        user: param.user,
+        resource: param.resource,
+        action: param.action,
+        objects: param.objects,
+        userPrivileges,
+    }))
+        .map(({ action, objects, resource }) => {
+        let objectIds;
+        let objectId;
+        if (Array.isArray(objects)) {
+            if (objects.length > 1) {
+                objectIds = [];
+                objects.forEach(obj => {
+                    if ('id' in obj) {
+                        objectIds.push(obj.id);
+                    }
+                });
+            }
+            else {
+                objects = objects?.[0] ?? {};
+            }
+        }
+        if (!Array.isArray(objects)) {
+            objectId = 'id' in objects ? objects.id : undefined;
+        }
+        return {
+            objectId,
+            objectIds,
+            action,
+            resource,
+        };
+    });
+}
+export function hasPrivileges(params, userPrivileges) {
+    return getMissingPrivileges(params, userPrivileges).length === 0;
+}
+export function filterObjectsWithPrivilege(param) {
+    return param.objects.filter(obj => hasPrivilegeOn({ ...param, objects: obj }));
+}
+// Utils
+/**
+ * Mirror GetKeysRecursively from @vates/types
+ */
+export function getActionStrings(resource) {
+    function collectActions(obj, prefix) {
+        const actions = ['*'];
+        for (const [key, value] of Object.entries(obj)) {
+            const action = (prefix !== undefined ? `${prefix}:${key}` : key);
+            actions.push(action);
+            if (typeof value === 'boolean') {
+                continue;
+            }
+            actions.push(...collectActions(value, action));
+        }
+        return actions;
+    }
+    return collectActions(SUPPORTED_ACTIONS_BY_RESOURCE[resource]);
+}

package/dist/tests/acl.test.d.mts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,47 @@
+{
+  "author": {
+    "name": "Vates SAS",
+    "url": "https://vates.fr"
+  },
+  "main": "dist/index.mjs",
+  "name": "@xen-orchestra/acl",
+  "homepage": "https://github.com/vatesfr/xen-orchestra/tree/master/@xen-orchestra/acl",
+  "version": "1.0.0",
+  "license": "AGPL-3.0-or-later",
+  "private": false,
+  "type": "module",
+  "engines": {
+    "node": ">= 20.18"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "scripts": {
+    "build": "tsc && node scripts/generate-types.mjs",
+    "clean": "rimraf dist/",
+    "dev": "tsc --watch",
+    "postversion": "npm publish --access public",
+    "test": "npm run build && node --test ./dist/**/*.test.mjs",
+    "prebuild": "npm run clean",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.19.0",
+    "@vates/types": "^1.24.0",
+    "rimraf": "^6.0.1",
+    "typescript": "~5.6",
+    "typescript-eslint": "^8.23.0"
+  },
+  "bugs": "https://github.com/vatesfr/xen-orchestra/issues",
+  "repository": {
+    "directory": "@xen-orchestra/acl",
+    "type": "git",
+    "url": "https://github.com/vatesfr/xen-orchestra.git"
+  },
+  "dependencies": {
+    "complex-matcher": "^1.0.0"
+  }
+}

package/scripts/generate-types.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// AUTO-GENERATES dist/generated/privilege-types.d.mts
+// Run via `npm run build` (after tsc).
+
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '../dist/actions/index.mjs'
+import { getActionStrings } from '../dist/index.mjs'
+
+function toPascalCase(str) {
+  return str
+    .split(/[-_]/)
+    .map(s => s.charAt(0).toUpperCase() + s.slice(1))
+    .join('')
+}
+
+const resources = Object.keys(SUPPORTED_ACTIONS_BY_RESOURCE)
+
+const typeBlocks = resources.map(resource => {
+  const actionUnion = getActionStrings(resource)
+    .map(action => `'${action}'`)
+    .join(' | ')
+  return `export type ${toPascalCase(resource)}Privilege = {
+  id: XoAclBasePrivilege['id']
+  resource: '${resource}'
+  action: ${actionUnion}
+  selector?: XoAclBasePrivilege['selector']
+  effect: XoAclBasePrivilege['effect']
+  roleId: XoAclBasePrivilege['roleId']
+}`
+})
+
+const anyUnion = resources.map(resource => `  | ${toPascalCase(resource)}Privilege`).join('\n')
+
+const types = `\
+// -----------------------------------------------------------------------
+// AUTO-GENERATED — do not edit manually.
+// Regenerated on every \`npm run build\`.
+// -----------------------------------------------------------------------
+import type { XoAclBasePrivilege } from '@vates/types'
+
+
+${typeBlocks.join('\n\n')}
+
+export type AnyPrivilege =
+${anyUnion}
+`
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+const outDir = join(root, 'dist/generated')
+
+mkdirSync(outDir, { recursive: true })
+writeFileSync(join(outDir, 'privilege-types.d.mts'), types, 'utf-8')

package/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src",
+
+    "strict": true,
+    "module": "nodenext",
+    "lib": ["ESNext"],
+    "moduleResolution": "nodenext",
+    "target": "ES2022",
+    "skipLibCheck": true,
+    "types": ["node"], // Only use types from Node.js and packages that are explicitly imported
+    "noImplicitAny": false, // otherwise it will throw an error when importing packages without type definition
+    "noUncheckedIndexedAccess": true,
+    "declaration": true
+  },
+  "include": ["./src/**/*"],
+  "exclude": ["./node_modules", "./dist"]
+}