Advanced overview
WIPType-safe config, engine internals, debugging, and validation - the operator- and power-user-facing surface of duck-iam
The advanced section covers everything you reach for once the basic shape from the quick start is in place: making createIam() fully type-safe, understanding what the engine does internally, debugging a specific decision, and validating policies and roles before they load.
Which page do I need
| Page | Covers |
|---|---|
| Config overview | createIam()'s typed-config surface: generics, context, $-paths, typed vs. untyped. |
| Config methods | Every method on the object createIam() returns, with a runnable example each. |
| Engine overview | IamEngine - subject resolution, policy loading, evaluation, caching. |
| Engine methods | Every public method on IamEngine: signatures, return shapes, thrown errors. |
| Caching and invalidation | The five LRU caches, single-flight coalescing, invalidation triggers and order. |
| Compiled table | How production mode compiles roles and policies into typed lookup arrays. |
| Hooks | The six engine hooks, firing order, and what happens when one throws. |
| Modes | What mode: 'development' | 'production' actually changes. |
| Admin API | Runtime CRUD for policies, roles, assignments, and attributes. |
| Explain traces | engine.explain()'s full, non-short-circuiting decision trace. |
| Devtools panel | The in-app React panel, its six panels, and the production guard. |
| Validation | validatePolicy, validateRoles, and every issue code. |
| JSON schema | POLICY_JSON_SCHEMA, the hand-authored Draft 2020-12 schema for a policy. |
| Utilities | Exported matchers, resolvers, condition primitives, caches, and key helpers. |
See also
- Core concepts - the model these pages build on: subjects, roles, policies, decisions.
- Production hardening - the pre-flight checklist that draws on several of these pages.
- Troubleshooting - symptom-first, for when you don't yet know which advanced page you need.