gdp-ts README

The project's README from github.com/rauchg/gdp-ts. As one markdown file: README.md.

A pixel-art ghost carrying a TypeScript document with a green checkmark

gdp-ts

A tiny library + linter and AI skill implementation of Ghosts of Departed Proofs for TypeScript, a verification system to make API contracts more secure at compile (type check) time.

gdp-ts makes an entire category of authorization ("can this user read this resource") or entitlement ("does this user pay for this resource") bugs very difficult for humans and coding agents to introduce, by catching them at compile time with negligible runtime overhead.

Features

Installation

$ npx skills add rauchg/gdp-ts
$ pnpm add @gdp-ts/core

Requires TypeScript 5.4 or newer.

The problem

A lot of codebases feature code like this:

async function handler(req, res) {
  await assertProjectAdmin(req.user.id, req.params.projectId); // throws 403
  await setPasswordProtection(req.params.projectId, req.body.password); // nothing connects this to the line above
  res.sendStatus(204);
}

Looks great, except: all it takes is

... for a security / business disaster to occur.

The solution

We change the signature above from something anyone can call from anywhere:

function setPasswordProtection(projectId: ProjectId, password: string): Promise<void>;

...to forcing the caller to present evidence (proof) that they can do (are admin) and can get (have the plan) the thing:

function setPasswordProtection<U, P>(
  project: Named<P, ProjectId>,
  password: string,
  _proofs: { admin: UserIsProjectAdmin<U, P>; plan: PlanIncludesPasswordProtection<P> },
): Promise<void>;

The skill takes care of guiding agents and humans towards this safer pattern, and away from the boolean blindness problem.

How it works

1️⃣ Name values. name(x, k) gives a runtime value a compile-time-only name N. Every call to name creates a different N, and N exists only inside the callback. For our example, wwo project ids named separately are now distinguishable to the compiler even though both are string:

// app.ts
import { name } from "@gdp-ts/core";
import { disablePasswordProtection } from "@/data/projects";
import { ProjectId } from "@/lib/ids";
import { userIsProjectAdmin } from "@/proofs/user-is-project-admin";
import { app, authenticated, HttpError } from "@/lib/server"; // your Express app, auth middleware, error type

app.delete(
  "/projects/:id/password-protection",
  authenticated((viewer, req, res) => // authenticated() resolves the logged-in user
    name(viewer.id, ProjectId(req.params.id), async (user, project) => {
      const admin = await userIsProjectAdmin(user, project);
      if (!admin) throw new HttpError(403, "Only Owners and Members can change this");
      await disablePasswordProtection(project, admin);
      res.sendStatus(204);
    }),
  ),
);

2️⃣ Prove facts about names. A small trusted module performs a check and returns a Proof<"UserIsProjectAdmin", [U, P]>, or null. Only that module can mint that proof. At runtime a proof is a frozen { kind } object.

// proofs/user-is-project-admin.ts  (trusted: the only place that can mint this proof)
import { defineProof, type Named, type Proof } from "@gdp-ts/core";
import { db } from "@/lib/db";
import type { ProjectId, UserId } from "@/lib/ids";

const UserIsProjectAdmin = defineProof("UserIsProjectAdmin"); // not exported
export interface UserIsProjectAdmin<U, P> extends Proof<"UserIsProjectAdmin", [U, P]> {}

export async function userIsProjectAdmin<U, P>(
  user: Named<U, UserId>,
  project: Named<P, ProjectId>,
): Promise<UserIsProjectAdmin<U, P> | null> {
  const role = await db.roleInProjectTeam(user.value, project.value);
  return role === "owner" || role === "member" ? UserIsProjectAdmin.prove(user, project) : null;
}

3️⃣ Demand proofs. Sensitive functions take a proof about their exact arguments. Calling them with the wrong proof, a proof about a different value, a raw id, or no proof is a compile error 🎉

// data/projects.ts  (sensitive: demands exact proofs)
import type { Named } from "@gdp-ts/core";
import { db } from "@/lib/db";
import type { ProjectId } from "@/lib/ids";
import type { UserIsProjectAdmin } from "@/proofs/user-is-project-admin";

export function disablePasswordProtection<U, P>(
  project: Named<P, ProjectId>,
  _proof: UserIsProjectAdmin<U, P>,
): Promise<void> {
  return db.writePasswordProtection(project.value, null);
}

TL;DR:

The package

@gdp-ts/core on npm ships two things:

The skill

npx skills add rauchg/gdp-ts installs a skill that guides coding agents through applying the pattern in your codebase. It is plain Markdown, so it doubles as the reference manual for humans:

Examples

All three use the same domain, loosely modeled after Vercel's Password Protection: team admins set a password on a project, and visitors must enter it to open the project's protected URLs.

Relationship to other solutions

Prior art & Credits

License

MIT

gdp-ts (rauchg/gdp-ts)

linter
Searching Database…

818 ·GitHub
Gdp-ts
What is this?gdp-ts is a tiny TypeScript library plus a linter and an AI coding-agent skill that implements the 'Ghosts of Departed Proofs' pattern, letting you catch authorization and entitlement bugs (like checking if a user can read or pay for a resource) at compile time instead of at runtime.
Is this a framework, or just a library I drop into existing code?It is an incrementally-adoptable library (@gdp-ts/core) with no dependencies, bundled with ESLint/Oxlint presets and a Markdown-based skill file — not a framework, so it does not change how you handle I/O or effects.
How do I add it to my project?Install @gdp-ts/core from npm to get name(), defineProof(), Named and Proof, and separately enable the ESLint or Oxlint preset shipped at @gdp-ts/core/lint/eslint or /oxlint. The AI skill is added with npx skills add rauchg/gdp-ts.
Do I need a specific TypeScript version?Yes, TypeScript 5.4 or newer is required; the library itself has zero runtime dependencies.
Does the compiler catch every kind of authorization bug?No — gdp-ts relies on linting to stop people from forging proofs with casts like 'as', and it explicitly does not guarantee against forged proofs, stale proofs, or other inherent limits of TypeScript's type system.
What exactly does the bundled skill do?It is a plain-Markdown reference manual and checklist that guides coding agents (and humans) through the six-step recipe of branding ids, defining proof modules, and turning on the lint preset, installed via 'npx skills add rauchg/gdp-ts'.
How is this different from policy engines like CASL or Oso?Policy engines decide whether a subject may act on a resource; gdp-ts does not make that decision itself, it guarantees that the decision actually reaches the function that depends on it, for the exact values involved. You can even call a policy engine inside a proof function.
What's the performance cost of using it?The runtime cost is just a tiny wrapper around checked ids, and type-checking costs about 0.3ms per authorized call site on a cold TypeScript 7 check, scaling with usage rather than codebase size.
Are there working examples to learn from?Yes — the repo ships three examples: a framework-free in-memory walkthrough, an Express 5 HTTP example with the ESLint preset, and an Express + Drizzle example backed by Postgres (PGlite) with SQL-joined proofs.
What are similar projects?typescript-eslint, openqodex, react-doctor, security-audit-skill, lint, static-analysis, closure-compiler, super-linter
Which topics is it in?type-safe, access-control, linter, code-quality, static-analysis, agent-skill, best-practices, compiler, security-tools, skills, coding-agent, security
Creator
rauchg
Size
0.3 MB
Stars
818
Updated
CommitOct 07
Age
15d
Commits · 90 Days