@astram/core
The framework-agnostic security Core for Astram. Owned by the Core team
(STATUS layer 3, 010_Architecture). Framework-agnostic per
ADR-0003 — ZERO
NestJS / React / Express / Vite imports (enforced by the root ESLint boundary rule).
What this package is
The portable contract other layers build against. At this Scaffold step it defines types/interfaces only — the engine seams and the module-registers-metadata contract. No security logic lives here yet; each layer's implementation is built later, against these seams.
Engine seams (one per layer — the request's journey)
| Layer | Module | Key exports |
|---|---|---|
| Identity | src/identity | Principal, Tenant, PrincipalKind, ExternalIdentityAssertion, IdentityBroker |
| Authentication | src/authentication | Credential, AuthFactor, AuthenticationResult, Authenticator |
| Session | src/session | Session, SessionTokens, SessionEstablishment, SessionAuthority |
| Risk | src/risk | RiskSignal, RiskScore, RiskLevel, RiskEngine |
| Authorization | src/authorization | Principal-based Action, Resource, DecisionContext, Decision, DecisionReasonCode, AccessTier, ResourceLevel, DecisionAuthority.decide(principal, action, resource, context) (§7) |
| Audit | src/audit | AuditEvent, AuditEventType, AuditSink |
Module-registers-metadata contract
src/metadata — how a business module declares its object types, actions,
access tiers, and supporting read-only dependencies to the Core (it never
implements access checks). Exports ObjectTypeDescriptor, FieldDescriptor,
ActionDescriptor, SupportingDependency, ModuleMetadata, and the
ModuleRegistry interface (static + dynamic/runtime registration, per ADR-0014 §5.5).
Scripts
pnpm --filter @astram/core build # tsc → dist/ (declarations + maps)
pnpm --filter @astram/core lint # eslint — proves no framework import leaked
pnpm --filter @astram/core test # vitest — trivial import smoke test
Rules
- No framework imports anywhere (ADR-0003). Inject platform deps across the integration boundary instead.
- Types only at this step — no decision/auth/session logic bodies. Real invariant proofs are authored per-layer as those layers are built.