decern — TypeScript client

Website · Repository · Commands · Issues

Ask whether an action is allowed, and get an answer somebody can check afterwards. Global fetch, zero dependencies — no axios, node-fetch or undici. Node ≥ 24.

npm install decern
# and a server to ask:
cargo install decern-server && decern-serve --trust-proxy

import { Client } from "decern";

const c = new Client({ baseUrl: "http://127.0.0.1:8080", token: "eyJ..." }); // token optional

const d = await c.evaluate({
  subject: { type: "Principal", id: "corp" },
  action: "Read", // or { name: "Read" }
  resource: { type: "Resource", id: "claim1" },
});

d.allowed; // true / false
d.reasons; // the policies that decided it, on allow
d.errors;  // why not, on deny

Also on the client: c.pubkey() (the Ed25519 key id the log is signed with) and c.healthy(). A non-2xx response or transport failure throws DecernError with the HTTP status and body, so a denial is distinguishable from a misconfigured endpoint. context is advisory — the server overrides anything it derives itself (the clock, the accountable owner), so a caller cannot talk its way into a decision by supplying them. token is sent as Authorization: Bearer <token> on every request, for a deployment that requires bearer tokens on the evaluation endpoint; leave it unset otherwise.

What the server gives you

decern is an AuthZEN 1.0 authorization server whose safety rules are machine-checked over every input, and whose decisions land in an append-only, signed, hash-chained log before they are served — a decision that cannot be recorded is refused, and a third party can verify what was decided without trusting the operator:

decern verify --ledger <file> --pubkey <key>   # the chain and every signature
decern explain --ledger <file> --seq 12        # one decision, in full

Obtain the public key out of band; a key handed over by the party being audited establishes nothing.

Test

cd sdks/typescript && npm test

Apache-2.0. Published from CI by OIDC with provenance and no stored credential.