@zudojs/permissions 0.0.1 → 1.0.0

package/dist/permissionErrors/permissionError.access.d.ts

@@ -4,12 +4,27 @@
 import { PermissionError } from "./permissionError.base.js";
 /**
  * Access denied — the actor is not authorized.
+ *
+ * `AuthorizationError` exposes its body to the client, so the identifying
+ * details go in `internal` rather than `metadata`: `actorId` is an internal
+ * identifier and a policy name describes the shape of the authorization
+ * model, neither of which belongs in a 403 body.
  */
 export declare class PermissionDeniedError extends PermissionError {
+    /** Detail for logs and audit trails. Never serialized to a client. */
+    readonly details: {
+        readonly actorId?: string;
+        readonly permission?: string;
+        readonly resourceType?: string;
+        readonly reason?: string;
+        readonly policy?: string;
+    };
     constructor(message?: string, options?: {
         readonly actorId?: string;
         readonly permission?: string;
         readonly resourceType?: string;
+        readonly reason?: string;
+        readonly policy?: string;
     });
 }
 /**
@@ -36,4 +51,13 @@ export declare class RoleNotFoundError extends PermissionError {
 export declare class DuplicateRoleError extends PermissionError {
     constructor(role: string);
 }
+/**
+ * A duplicate policy was registered.
+ *
+ * Silently replacing a policy is how an authorization rule disappears without
+ * anyone noticing, so the registry rejects it unless override is asked for.
+ */
+export declare class DuplicatePolicyError extends PermissionError {
+    constructor(policy: string);
+}
 //# sourceMappingURL=permissionError.access.d.ts.map

package/dist/permissionErrors/permissionError.access.js

@@ -5,17 +5,23 @@ import { ErrorCode } from "@zudojs/errors";
 import { PermissionError } from "./permissionError.base.js";
 /**
  * Access denied — the actor is not authorized.
+ *
+ * `AuthorizationError` exposes its body to the client, so the identifying
+ * details go in `internal` rather than `metadata`: `actorId` is an internal
+ * identifier and a policy name describes the shape of the authorization
+ * model, neither of which belongs in a 403 body.
  */
 export class PermissionDeniedError extends PermissionError {
+    /** Detail for logs and audit trails. Never serialized to a client. */
+    details;
     constructor(message = "Access denied", options) {
         super(message, {
             code: ErrorCode.ACCESS_DENIED,
-            metadata: {
-                actorId: options?.actorId,
-                permission: options?.permission,
-                resourceType: options?.resourceType,
-            },
+            // Only the permission name, which the caller already knows because
+            // they attempted it.
+            metadata: { permission: options?.permission },
         });
+        this.details = Object.freeze({ ...options });
     }
 }
 /**
@@ -62,4 +68,18 @@ export class DuplicateRoleError extends PermissionError {
         });
     }
 }
+/**
+ * A duplicate policy was registered.
+ *
+ * Silently replacing a policy is how an authorization rule disappears without
+ * anyone noticing, so the registry rejects it unless override is asked for.
+ */
+export class DuplicatePolicyError extends PermissionError {
+    constructor(policy) {
+        super(`Duplicate policy: ${policy}`, {
+            code: ErrorCode.CONFLICT,
+            metadata: { policy },
+        });
+    }
+}
 //# sourceMappingURL=permissionError.access.js.map

package/dist/permissionErrors/permissionError.types.d.ts

@@ -1,6 +1,6 @@
 /**
  * Permission error types — re-exports from focused files.
  */
-export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, } from "./permissionError.access.js";
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, } from "./permissionError.access.js";
 export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
 //# sourceMappingURL=permissionError.types.d.ts.map

package/dist/permissionErrors/permissionError.types.js

@@ -1,6 +1,6 @@
 /**
  * Permission error types — re-exports from focused files.
  */
-export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, } from "./permissionError.access.js";
+export { PermissionDeniedError, PermissionNotFoundError, DuplicatePermissionError, RoleNotFoundError, DuplicateRoleError, DuplicatePolicyError, } from "./permissionError.access.js";
 export { InvalidPermissionError, InvalidRoleError, CircularRoleInheritanceError, PolicyError, PolicyTimeoutError, PermissionResolverError, AuthorizationAbortedError, } from "./permissionError.validation.js";
 //# sourceMappingURL=permissionError.types.js.map

package/dist/permissionTypes/index.d.ts

@@ -1,9 +1,9 @@
 /**
- * Core transaction type definitions.
+ * Core permission type definitions.
  *
  * @module permissionTypes
  */
 export { type PermissionActor, type Permission, type PermissionString, } from "./permissionActor.js";
-export { type RuleEffect, type PermissionRule, type PermissionConditionFn, type PermissionContext, type PermissionDecision, } from "./ruleTypes.js";
+export { type RuleEffect, type RuleCombiningAlgorithm, type RuleEvaluation, type PermissionRule, type PermissionConditionFn, type PermissionContext, type PermissionDecision, } from "./ruleTypes.js";
 export { type RoleDefinition, type PermissionResolver, type RoleResolver, type PermissionCache, type PermissionPolicyDefinition, type ExplainStep, type ExplainResult, type AuthorizationOptions, } from "./policyTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/permissionTypes/index.js

@@ -1,5 +1,5 @@
 /**
- * Core transaction type definitions.
+ * Core permission type definitions.
  *
  * @module permissionTypes
  */

package/dist/permissionTypes/policyTypes.d.ts

@@ -9,10 +9,15 @@ import type { PermissionRule, PermissionContext, PermissionDecision } from "./ru
 export interface RoleDefinition {
     /** Role name (e.g. "admin", "editor"). */
     readonly name: string;
-    /** Permissions granted by this role. */
+    /**
+     * Permissions granted by this role. May be empty for a role that exists
+     * only to combine others through {@link RoleDefinition.inherits}.
+     */
     readonly permissions: readonly string[];
     /** Roles this role inherits from. */
     readonly inherits?: readonly string[];
+    /** Rules granted by this role, for ABAC beyond a permission string. */
+    readonly rules?: readonly PermissionRule[];
     /** Role description. */
     readonly description?: string;
     /** Whether this is a system role (cannot be deleted). */
@@ -34,18 +39,30 @@ export interface PermissionCache {
     }): Promise<void>;
     delete(key: string): Promise<void>;
     invalidateActor(actorId: string): Promise<void>;
+    /** Drops every entry. */
+    clear?(): Promise<void>;
 }
 /** A named authorization policy. */
 export interface PermissionPolicyDefinition {
     readonly name: string;
+    /**
+     * Permissions this policy applies to. Wildcards are honoured, so
+     * `["post:*"]` covers `post:update` — the same matching grants use.
+     */
     readonly permissions: readonly string[];
+    /**
+     * Whether a decision from this policy may be cached. A policy that reads
+     * mutable state outside the actor and resource should set this to `false`.
+     * Default: `true`.
+     */
     readonly cacheable?: boolean;
+    /** Higher priority policies are evaluated first. Default: 0. */
     readonly priority?: number;
     evaluate(context: PermissionContext): PermissionDecision | Promise<PermissionDecision>;
 }
 /** A step in an explain trace. */
 export interface ExplainStep {
-    readonly type: "role" | "permission" | "rule" | "policy" | "deny";
+    readonly type: "role" | "permission" | "rule" | "policy" | "condition" | "cache" | "deny";
     readonly detail: string;
     readonly matched: boolean;
 }
@@ -53,10 +70,26 @@ export interface ExplainStep {
 export interface ExplainResult {
     readonly allowed: boolean;
     readonly steps: readonly ExplainStep[];
+    /** The decision the steps explain. */
+    readonly decision: PermissionDecision;
 }
 /** Options for authorization checks. */
 export interface AuthorizationOptions {
+    /**
+     * Cancels the check. Evaluation aborts with an
+     * `AuthorizationAbortedError`; it does not silently allow.
+     */
     readonly signal?: AbortSignal;
+    /** Overrides the engine's policy timeout, in milliseconds. */
     readonly policyTimeout?: number;
+    /**
+     * Request-scoped metadata made available to conditions and policies as
+     * `PermissionContext.metadata` — tenant, IP, time of day.
+     */
+    readonly metadata?: ReadonlyMap<string, unknown> | Record<string, unknown>;
+    /** Skips the decision cache for this check. */
+    readonly skipCache?: boolean;
+    /** Identifies the resource for caching. Falls back to `resource.id`. */
+    readonly resourceId?: string;
 }
 //# sourceMappingURL=policyTypes.d.ts.map

package/dist/permissionTypes/ruleTypes.d.ts

@@ -6,6 +6,15 @@
 import type { PermissionActor, Permission } from "./permissionActor.js";
 /** Whether a rule allows or denies access. */
 export type RuleEffect = "allow" | "deny";
+/**
+ * How competing rules are combined into one decision.
+ *
+ * - `"deny-overrides"` (the default) — any applicable deny wins, whatever its
+ *   priority. This is the safe reading, and the one the documentation has
+ *   always described.
+ * - `"priority"` — the highest-priority rule wins; deny breaks a tie.
+ */
+export type RuleCombiningAlgorithm = "deny-overrides" | "priority";
 /** A permission rule that grants or denies access under conditions. */
 export interface PermissionRule {
     /** Allow or deny. */
@@ -14,9 +23,12 @@ export interface PermissionRule {
     readonly action: string | readonly string[];
     /** Resource(s) this rule applies to. */
     readonly resource: string | readonly string[];
-    /** Optional condition function for ABAC. */
+    /**
+     * Optional condition for ABAC. A rule whose condition returns `false` does
+     * not apply — neither to allow nor to deny.
+     */
     readonly condition?: PermissionConditionFn;
-    /** Rule priority — higher wins. Same priority: deny wins. */
+    /** Rule priority — higher wins under the `"priority"` algorithm. */
     readonly priority?: number;
     /** Human-readable rule name for debugging. */
     readonly name?: string;
@@ -27,24 +39,45 @@ export type PermissionConditionFn = (context: PermissionContext) => boolean | Pr
 export interface PermissionContext {
     /** The actor requesting access. */
     readonly actor: PermissionActor;
-    /** The permission string being checked (e.g. "post:update"). */
+    /** The permission being checked, parsed into resource and action. */
     readonly permission: Permission;
     /** The target resource (optional). */
     readonly resource?: unknown;
-    /** Arbitrary metadata (IP, tenant, timestamp, etc.). */
+    /**
+     * Arbitrary metadata (IP, tenant, timestamp, etc.), supplied through
+     * `AuthorizationOptions.metadata`. Conditions such as `tenantIsolation`
+     * read the actor's tenant from here.
+     */
     readonly metadata?: ReadonlyMap<string, unknown>;
+    /** Cancels long-running conditions and policies. */
+    readonly signal?: AbortSignal;
 }
 /** Result of an authorization check. */
 export interface PermissionDecision {
     /** Whether the action is allowed. */
     readonly allowed: boolean;
-    /** Human-readable reason for the decision. */
+    /**
+     * Why the decision came out this way, as a stable machine-readable code.
+     *
+     * Internal by design: it names policies and rules, so it belongs in a log,
+     * not in a response body. {@link PermissionDecision.publicReason} is the
+     * one safe to return to a caller.
+     */
     readonly reason?: string;
     /** Name of the policy/rule that produced the decision. */
     readonly policy?: string;
     /** The matched permission string. */
     readonly matchedPermission?: string;
+    /** A caller-safe message, free of policy and rule names. */
+    readonly publicReason?: string;
     /** Additional decision metadata. */
     readonly metadata?: unknown;
 }
+/** The outcome of evaluating a rule set. */
+export interface RuleEvaluation {
+    readonly allowed: boolean;
+    readonly matchedRule?: PermissionRule;
+    /** Rules that matched the target and whose condition passed. */
+    readonly applicable: readonly PermissionRule[];
+}
 //# sourceMappingURL=ruleTypes.d.ts.map

package/dist/policy/index.d.ts

@@ -3,5 +3,5 @@
  *
  * @module policy
  */
-export { createPolicyRegistry } from "./policyRegistry.js";
+export { createPolicyRegistry, type PolicyRegistry, type PolicyRegistryOptions, } from "./policyRegistry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.js

@@ -3,5 +3,5 @@
  *
  * @module policy
  */
-export { createPolicyRegistry } from "./policyRegistry.js";
+export { createPolicyRegistry, } from "./policyRegistry.js";
 //# sourceMappingURL=index.js.map

package/dist/policy/policyRegistry.d.ts

@@ -4,33 +4,26 @@
  * @module policy/policyRegistry
  */
 import type { PermissionPolicyDefinition } from "../permissionTypes/index.js";
-/**
- * Create a policy registry.
- */
-export declare function createPolicyRegistry(): {
-    /**
-     * Register a policy.
-     */
+/** Options for the policy registry. */
+export interface PolicyRegistryOptions {
+    /** Allow overwriting an existing policy. Defaults to false. */
+    readonly allowOverride?: boolean;
+}
+/** A policy registry, usable directly as the engine's `policies` source. */
+export interface PolicyRegistry {
     define(definition: PermissionPolicyDefinition): void;
-    /**
-     * Get a policy by name.
-     */
     get(name: string): PermissionPolicyDefinition | undefined;
-    /**
-     * Get all policies that apply to a given permission string.
-     */
+    has(name: string): boolean;
     forPermission(permission: string): readonly PermissionPolicyDefinition[];
-    /**
-     * Get all registered policy names.
-     */
     names(): readonly string[];
-    /**
-     * Remove a policy.
-     */
+    all(): readonly PermissionPolicyDefinition[];
     remove(name: string): boolean;
-    /**
-     * Clear all policies.
-     */
     clear(): void;
-};
+}
+/**
+ * Create a policy registry.
+ *
+ * Pass it straight to `createPermissionEngine({ policies: registry })`.
+ */
+export declare function createPolicyRegistry(options?: PolicyRegistryOptions): PolicyRegistry;
 //# sourceMappingURL=policyRegistry.d.ts.map

package/dist/policy/policyRegistry.js

@@ -3,52 +3,55 @@
  *
  * @module policy/policyRegistry
  */
+import { DuplicatePolicyError } from "../permissionErrors/index.js";
+import { selectPolicies } from "../evaluator/evaluator.pipeline.js";
 /**
  * Create a policy registry.
+ *
+ * Pass it straight to `createPermissionEngine({ policies: registry })`.
  */
-export function createPolicyRegistry() {
+export function createPolicyRegistry(options) {
     const policies = new Map();
+    const allowOverride = options?.allowOverride ?? false;
     return {
         /**
          * Register a policy.
+         *
+         * Re-registering a name is rejected unless `allowOverride` was set: a
+         * second `define("owner-only", …)` used to replace the first in silence,
+         * which is an authorization rule vanishing without a trace.
          */
         define(definition) {
+            if (policies.has(definition.name) && !allowOverride) {
+                throw new DuplicatePolicyError(definition.name);
+            }
             policies.set(definition.name, Object.freeze({ ...definition }));
         },
-        /**
-         * Get a policy by name.
-         */
         get(name) {
             return policies.get(name);
         },
+        has(name) {
+            return policies.has(name);
+        },
         /**
-         * Get all policies that apply to a given permission string.
+         * Policies that apply to a permission, highest priority first.
+         *
+         * Delegates to the evaluator's own selection, so this and the engine can
+         * never disagree about which policies cover a permission — they were two
+         * copies of the same filter-and-sort before.
          */
         forPermission(permission) {
-            const results = [];
-            for (const [, policy] of policies) {
-                if (policy.permissions.includes(permission)) {
-                    results.push(policy);
-                }
-            }
-            // Sort by priority descending
-            return results.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+            return selectPolicies([...policies.values()], permission);
         },
-        /**
-         * Get all registered policy names.
-         */
         names() {
-            return Array.from(policies.keys());
+            return [...policies.keys()];
+        },
+        all() {
+            return [...policies.values()];
         },
-        /**
-         * Remove a policy.
-         */
         remove(name) {
             return policies.delete(name);
         },
-        /**
-         * Clear all policies.
-         */
         clear() {
             policies.clear();
         },

package/dist/role/index.d.ts

@@ -3,6 +3,6 @@
  *
  * @module role
  */
-export { createRoleRegistry, type RoleRegistryOptions, } from "./roleRegistry.js";
-export { resolveRolePermissions } from "./roleHierarchy.js";
+export { createRoleRegistry, type RoleRegistry, type RoleRegistryOptions, } from "./roleRegistry.js";
+export { resolveRolePermissions, memoizeRoleLookup, type RoleResolution, type RoleResolutionOptions, } from "./roleHierarchy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/role/index.js

@@ -4,5 +4,5 @@
  * @module role
  */
 export { createRoleRegistry, } from "./roleRegistry.js";
-export { resolveRolePermissions } from "./roleHierarchy.js";
+export { resolveRolePermissions, memoizeRoleLookup, } from "./roleHierarchy.js";
 //# sourceMappingURL=index.js.map

package/dist/role/roleHierarchy.d.ts

@@ -3,13 +3,43 @@
  *
  * @module role/roleHierarchy
  */
-import type { RoleDefinition } from "../permissionTypes/index.js";
+import type { PermissionRule, RoleDefinition } from "../permissionTypes/index.js";
+/** What a set of roles grants, once inheritance is followed. */
+export interface RoleResolution {
+    readonly permissions: readonly string[];
+    readonly rules: readonly PermissionRule[];
+    /** Role names the lookup could not find. */
+    readonly unknownRoles: readonly string[];
+}
+/** Options for {@link resolveRolePermissions}. */
+export interface RoleResolutionOptions {
+    /**
+     * Called for each role the lookup cannot find.
+     *
+     * Reporting rather than throwing is deliberate: a stale role name in a
+     * token is a data problem, and an authorization check that throws hands the
+     * outcome to an outer error handler instead of denying.
+     */
+    readonly onUnknownRole?: (name: string) => void;
+}
 /**
- * Resolve all permissions for a set of role names, following inheritance chains.
+ * Resolve everything a set of roles grants, following inheritance chains.
  *
  * @param roleNames - Direct role names assigned to the actor.
  * @param getRole - Function to look up a role definition by name.
- * @returns Deduplicated list of all permission strings.
+ * @returns Deduplicated permissions and rules, plus any unresolved names.
+ * @throws CircularRoleInheritanceError when the graph contains a cycle
  */
-export declare function resolveRolePermissions(roleNames: readonly string[], getRole: (name: string) => RoleDefinition | undefined): readonly string[];
+export declare function resolveRolePermissions(roleNames: readonly string[], getRole: (name: string) => RoleDefinition | undefined, options?: RoleResolutionOptions): RoleResolution;
+/**
+ * Wrap a role lookup with a memo, so a deep hierarchy is walked once per
+ * distinct role rather than on every authorization check.
+ *
+ * The cache is invalidated by `invalidate()`; a registry that changes at
+ * runtime should call it.
+ */
+export declare function memoizeRoleLookup(getRole: (name: string) => RoleDefinition | undefined): {
+    readonly lookup: (name: string) => RoleDefinition | undefined;
+    readonly invalidate: () => void;
+};
 //# sourceMappingURL=roleHierarchy.d.ts.map

package/dist/role/roleHierarchy.js

@@ -3,46 +3,71 @@
  *
  * @module role/roleHierarchy
  */
-import { CircularRoleInheritanceError, RoleNotFoundError, } from "../permissionErrors/index.js";
+import { CircularRoleInheritanceError } from "../permissionErrors/index.js";
 /**
- * Resolve all permissions for a set of role names, following inheritance chains.
+ * Resolve everything a set of roles grants, following inheritance chains.
  *
  * @param roleNames - Direct role names assigned to the actor.
  * @param getRole - Function to look up a role definition by name.
- * @returns Deduplicated list of all permission strings.
+ * @returns Deduplicated permissions and rules, plus any unresolved names.
+ * @throws CircularRoleInheritanceError when the graph contains a cycle
  */
-export function resolveRolePermissions(roleNames, getRole) {
+export function resolveRolePermissions(roleNames, getRole, options) {
     const permissions = new Set();
+    const rules = [];
+    const unknownRoles = [];
     const visited = new Set();
     for (const name of roleNames) {
-        collectPermissions(name, getRole, permissions, visited, []);
+        collect(name, getRole, permissions, rules, unknownRoles, visited, []);
     }
-    return Array.from(permissions);
-}
-/**
- * Collect permissions from a role and its ancestors, detecting cycles.
- */
-function collectPermissions(roleName, getRole, permissions, visited, chain) {
-    const role = getRole(roleName);
-    if (!role) {
-        throw new RoleNotFoundError(roleName);
+    if (options?.onUnknownRole) {
+        for (const name of unknownRoles)
+            options.onUnknownRole(name);
     }
-    // Cycle detection — check before adding to visited
+    return { permissions: [...permissions], rules, unknownRoles };
+}
+function collect(roleName, getRole, permissions, rules, unknownRoles, visited, chain) {
+    // Cycle detection comes first: a role that appears twice in the current
+    // chain is a cycle even if it has already been visited on another branch.
     if (chain.includes(roleName)) {
         throw new CircularRoleInheritanceError([...chain, roleName]);
     }
-    // Skip if already fully processed (not in current chain)
     if (visited.has(roleName))
         return;
+    const role = getRole(roleName);
+    if (!role) {
+        if (!unknownRoles.includes(roleName))
+            unknownRoles.push(roleName);
+        return;
+    }
     visited.add(roleName);
     const newChain = [...chain, roleName];
-    for (const perm of role.permissions) {
-        permissions.add(perm);
-    }
-    if (role.inherits) {
-        for (const parent of role.inherits) {
-            collectPermissions(parent, getRole, permissions, visited, newChain);
-        }
+    for (const permission of role.permissions)
+        permissions.add(permission);
+    if (role.rules)
+        rules.push(...role.rules);
+    for (const parent of role.inherits ?? []) {
+        collect(parent, getRole, permissions, rules, unknownRoles, visited, newChain);
     }
 }
+/**
+ * Wrap a role lookup with a memo, so a deep hierarchy is walked once per
+ * distinct role rather than on every authorization check.
+ *
+ * The cache is invalidated by `invalidate()`; a registry that changes at
+ * runtime should call it.
+ */
+export function memoizeRoleLookup(getRole) {
+    const cache = new Map();
+    return {
+        lookup: (name) => {
+            if (cache.has(name))
+                return cache.get(name);
+            const role = getRole(name);
+            cache.set(name, role);
+            return role;
+        },
+        invalidate: () => cache.clear(),
+    };
+}
 //# sourceMappingURL=roleHierarchy.js.map

package/dist/role/roleRegistry.d.ts

@@ -8,38 +8,29 @@ import type { RoleDefinition } from "../permissionTypes/index.js";
 export interface RoleRegistryOptions {
     /** Allow overwriting existing roles. Defaults to false. */
     readonly allowOverride?: boolean;
-}
-/**
- * Create a role registry.
- */
-export declare function createRoleRegistry(options?: RoleRegistryOptions): {
     /**
-     * Register a role definition.
+     * Reject permission strings that are not `resource:action`. Defaults to
+     * true — a malformed grant can never match, so accepting one registers a
+     * permission that silently does nothing.
      */
+    readonly validatePermissions?: boolean;
+}
+/** A role registry, usable directly as the engine's `roles` source. */
+export interface RoleRegistry {
     define(definition: RoleDefinition): void;
-    /**
-     * Get a role by name.
-     */
     get(name: string): RoleDefinition | undefined;
-    /**
-     * Check if a role exists.
-     */
+    /** Like {@link RoleRegistry.get}, but throws when the role is unregistered. */
+    require(name: string): RoleDefinition;
     has(name: string): boolean;
-    /**
-     * Get all registered role names.
-     */
     names(): readonly string[];
-    /**
-     * Get all registered role definitions.
-     */
     all(): readonly RoleDefinition[];
-    /**
-     * Remove a role from the registry.
-     */
     remove(name: string): boolean;
-    /**
-     * Clear all registered roles.
-     */
     clear(): void;
-};
+}
+/**
+ * Create a role registry.
+ *
+ * Pass it straight to `createPermissionEngine({ roles: registry })`.
+ */
+export declare function createRoleRegistry(options?: RoleRegistryOptions): RoleRegistry;
 //# sourceMappingURL=roleRegistry.d.ts.map