@gentleduck/iamWIP

Permissions, typed end to end

Roles and attribute rules in one access control engine. Enforce policies on Express, NestJS, Hono, or Next.js, and reuse them in React or Vue.

Attribute rules
Write rules over subject, resource, action, and context. Combine or negate predicates, then trace how each decision was made.
Roles
Typed roles and role hierarchies. Use them alone, or add attribute rules on top for per-resource checks.
Policy DSL
Declarative policies with typed keys. A typo in an action or resource name fails at compile time.
Server adapters
Middleware for Express, NestJS, Hono, and Next.js route handlers. The same policies run everywhere.
React and Vue
Typed <Can /> components and hooks. Your UI shows or hides things with the same policies your API enforces.
Explained decisions
Every decision comes with a reason trace. Checks aim to stay under a microsecond, and the benchmarks page shows the numbers.

Install

Install the package, then pick a server or client adapter.

import { createEngine } from '@gentleduck/iam'

export const iam = createEngine({
  roles: { admin: ['*'], editor: ['post:write'] },
})

gentleduck is MIT licensed and will always be free and open source. Every package ships with full source access — fork it, modify it, own it.