@aventara/access 0.0.0-stage → 0.1.0-rc.0

package/dist/audit/audit.log.d.ts

@@ -0,0 +1,122 @@
+import type { DecisionObserver } from "../access.engine.js";
+import type { AccessAuditEvent } from "./audit-event.js";
+/** Where events go: Better Auth's adapter into the table, or the app's function. */
+type AuditDestination = {
+    readonly kind: "table";
+} | {
+    readonly kind: "sink";
+    readonly sink: (event: AccessAuditEvent) => void | Promise<void>;
+};
+/** The part of Better Auth's context the log uses: its adapter and its logger. */
+export type AuditContext = {
+    readonly adapter: {
+        create(input: {
+            model: string;
+            data: {
+                readonly [field: string]: unknown;
+            };
+        }): Promise<unknown>;
+    };
+    readonly logger: {
+        warn(message: string): void;
+    };
+};
+/** The `audit` option, checked: where events go, or `undefined` when the log is off. */
+export declare const auditDestinationOf: (audit: unknown) => AuditDestination | undefined;
+export type AuditLog = {
+    /** Delivers one event; never throws (a failure is logged as a warning). */
+    record(event: AccessAuditEvent): Promise<void>;
+    /**
+     * Closes the repeat windows of refused sign-ins for one sign-in target now,
+     * logging their counts: a success for that target follows its failures in the log.
+     */
+    flushTarget(target: string): Promise<void>;
+};
+/**
+ * How many repeat windows stay open at once. Past it, a refusal that would open
+ * another closes the oldest window early (its count logged, `windowEnd` now), and
+ * opens its own: every target keeps its own row.
+ */
+export declare const AUDIT_OPEN_WINDOWS_MAX = 10000;
+/**
+ * The log: each event goes to its destination; a failure warns through Better
+ * Auth's logger. An anonymous refusal is logged once per window; its repeats are
+ * counted, and when the window closes (at its end, or on the next event of any kind
+ * after it, or when its sign-in target signs in) the count is logged as a summary:
+ * the first event's fields with `suppressed`, `windowStart` and `windowEnd`.
+ *
+ * The windows are kept in the order they close (each opens a minute after the
+ * clock, never before the one opened last), so finding the expired ones stops at
+ * the first that is not; at most `AUDIT_OPEN_WINDOWS_MAX` stay open.
+ */
+export declare const createAuditLog: (destination: AuditDestination, context: () => Promise<AuditContext>) => AuditLog;
+/**
+ * The engine's decision observer: a request's admission is one event; a row
+ * question adds one only when the rules refuse that row.
+ */
+export declare const decisionObserver: (log: AuditLog, userIdOf: (principal: unknown) => string | null) => DecisionObserver;
+/** A session row, as Better Auth's database hooks hand it over. */
+type SessionRow = {
+    readonly userId?: unknown;
+    readonly impersonatedBy?: unknown;
+} | null | undefined;
+/** The endpoint context Better Auth's database hooks receive: the request, the endpoint's path and body, and the auth context. */
+type HookContext = {
+    readonly request?: unknown;
+    readonly path?: unknown;
+    readonly body?: unknown;
+    readonly context?: {
+        readonly secret?: unknown;
+    } | undefined;
+} | null | undefined;
+/**
+ * The identifier a sign-in request names its user by, as the route that takes it
+ * reads it (`email:<address>`, `username:<name>`), normalized as that route
+ * normalizes it; `undefined` for a route that names none this way.
+ */
+export type SignInIdentifier = (path: unknown, body: unknown) => string | undefined;
+/**
+ * A sign-in's target: an HMAC-SHA-256, keyed by Better Auth's secret, of the
+ * identifier the request named (`SignInIdentifier`), as 64 hex digits. It ties a
+ * refused sign-in to the later ones, and to the success, for the same identifier
+ * without storing the identifier: without the secret it cannot be reversed or
+ * checked against a guess. `undefined` when the request named none.
+ */
+export declare const signInTarget: (identifier: string | undefined, secret: unknown) => Promise<string | undefined>;
+/**
+ * Better Auth's database hooks that log sign-ins and sign-outs: a session row
+ * created (and committed) is a sign-in; one deleted by `/sign-out` is a sign-out.
+ * Through Access's routes it comes from a client; a call to Better Auth's API with
+ * no request is the application's own. A sign-in first logs the refused sign-ins
+ * counted for its target, so a guessed password shows after its failures.
+ */
+export declare const sessionAuditHooks: (log: AuditLog, identify: SignInIdentifier) => {
+    session: {
+        create: {
+            after: (session: SessionRow, context: HookContext) => Promise<void>;
+        };
+        delete: {
+            after: (session: SessionRow, context: HookContext) => Promise<void>;
+        };
+    };
+};
+/** What an endpoint hook reads of Better Auth's context, once the endpoint has answered. */
+type AuditEndpointContext = {
+    readonly path?: unknown;
+    readonly request?: unknown;
+    readonly body?: unknown;
+    readonly context: {
+        /** The endpoint's answer: its body, or the `APIError` it refused with. */
+        readonly returned?: unknown;
+        readonly session?: unknown;
+        readonly secret?: unknown;
+    };
+};
+/**
+ * Better Auth's endpoint hook (after the endpoint answers) that logs a refused
+ * sign-in on a route that starts a session (`startsSession`), with its target, and
+ * a token issued by `GET /token`. (`/get-session`'s `set-auth-jwt` header is not
+ * logged: a page asks for its session on every load.)
+ */
+export declare const endpointAudit: (log: AuditLog, startsSession: (path: unknown) => boolean, identify: SignInIdentifier) => (ctx: AuditEndpointContext) => Promise<void>;
+export {};

package/dist/audit/audit.log.js

@@ -0,0 +1,345 @@
+// The audit log: where events go (the `accessAudit` table or the app's sink), the
+// places they come from (Better Auth's session hooks for sign-ins and sign-outs, its
+// endpoint hooks for refused sign-ins and issued tokens, the engine's decision
+// observer for `can` answers), the window that keeps anonymous refusals from
+// flooding it, and the rule that a failing destination never fails the request.
+import { AccessError } from "../access/access.error.js";
+import { KIOSK_SWITCH_PATH } from "../kiosk/kiosk-verbs.schema.js";
+import { isRecord } from "../policies.compiler.js";
+import { AUDIT_MODEL } from "./audit.schema.js";
+/** The `audit` option, checked: where events go, or `undefined` when the log is off. */
+export const auditDestinationOf = (audit) => {
+    if (audit === undefined || audit === false) {
+        return undefined;
+    }
+    if (audit === true) {
+        return { kind: "table" };
+    }
+    if (isRecord(audit) &&
+        typeof audit.sink === "function" &&
+        Object.keys(audit).length === 1) {
+        return {
+            kind: "sink",
+            sink: audit.sink,
+        };
+    }
+    throw new AccessError("ACCESS_OPTIONS_INVALID", "`audit` is `true` (the accessAudit table), `{ sink: (event) => … }` (the app's own destination) or `false`, the default.");
+};
+/** The event as the table stores it: its fields, absent ones left out. */
+const rowOf = (event) => Object.fromEntries(Object.entries(event).filter(([, value]) => value !== undefined));
+/** How long an anonymous refusal is logged once for its origin and reason: a minute. */
+const AUDIT_REPEAT_WINDOW_MS = 60_000;
+/**
+ * The window an event shares with its repeats: an anonymous refused decision by
+ * origin and reason; a refused sign-in by origin, route, reason and target (the
+ * keyed hash of the identifier it named). Every other event is logged each time.
+ */
+const repeatKeyOf = (event) => event.kind === "decision" && event.userId === null && !event.allowed
+    ? `decision\u0000${event.origin}\u0000${event.reason}`
+    : event.kind === "sign-in-failed"
+        ? `sign-in-failed\u0000${event.origin}\u0000${event.route}\u0000${event.reason}\u0000${event.target ?? ""}`
+        : undefined;
+/**
+ * How many repeat windows stay open at once. Past it, a refusal that would open
+ * another closes the oldest window early (its count logged, `windowEnd` now), and
+ * opens its own: every target keeps its own row.
+ */
+export const AUDIT_OPEN_WINDOWS_MAX = 10_000;
+/** A sign-in target's windows, by key: what a sign-in on that target closes. */
+const targetOf = (event) => event.kind === "sign-in-failed" ? event.target : undefined;
+/**
+ * The log: each event goes to its destination; a failure warns through Better
+ * Auth's logger. An anonymous refusal is logged once per window; its repeats are
+ * counted, and when the window closes (at its end, or on the next event of any kind
+ * after it, or when its sign-in target signs in) the count is logged as a summary:
+ * the first event's fields with `suppressed`, `windowStart` and `windowEnd`.
+ *
+ * The windows are kept in the order they close (each opens a minute after the
+ * clock, never before the one opened last), so finding the expired ones stops at
+ * the first that is not; at most `AUDIT_OPEN_WINDOWS_MAX` stay open.
+ */
+export const createAuditLog = (destination, context) => {
+    const windows = new Map();
+    const byTarget = new Map();
+    let lastUntil = Number.NEGATIVE_INFINITY;
+    let timer;
+    /** Logs a closed window's count, when it has one. */
+    const summarize = async (window, end) => {
+        if (window.suppressed > 0) {
+            await deliver({
+                ...window.first,
+                at: new Date(),
+                suppressed: window.suppressed,
+                windowStart: new Date(window.start),
+                windowEnd: new Date(end),
+            });
+        }
+    };
+    /** Closes one window, logging its count when it has one. */
+    const close = async (key, window, end) => {
+        windows.delete(key);
+        const target = targetOf(window.first);
+        if (target !== undefined) {
+            const keys = byTarget.get(target) ?? [];
+            const left = keys.length - 1;
+            const at = keys.indexOf(key);
+            if (at >= 0) {
+                keys[at] = keys[left] ?? key;
+                keys.length = left;
+            }
+            if (keys.length === 0) {
+                byTarget.delete(target);
+            }
+        }
+        await summarize(window, end);
+    };
+    /** Closes every window whose minute is over: the oldest first, stopping at the first still open. */
+    const closeExpired = async (now) => {
+        for (const [key, window] of windows) {
+            if (window.until > now) {
+                break;
+            }
+            await close(key, window, window.until);
+        }
+    };
+    /** Logs the counts when their minute ends, even with no event after it: one timer, at the earliest end. */
+    const schedule = (now) => {
+        let next;
+        for (const window of windows.values()) {
+            next = window.until;
+            break;
+        }
+        if (timer !== undefined || next === undefined) {
+            return;
+        }
+        timer = setTimeout(() => {
+            timer = undefined;
+            void closeExpired(Date.now()).then(() => schedule(Date.now()));
+        }, Math.max(0, next - now));
+        timer.unref?.();
+    };
+    return {
+        record: async (event) => {
+            const now = Date.now();
+            await closeExpired(now);
+            const key = repeatKeyOf(event);
+            if (key !== undefined) {
+                const window = windows.get(key);
+                if (window !== undefined) {
+                    window.suppressed += 1;
+                    schedule(now);
+                    return;
+                }
+                lastUntil = Math.max(now + AUDIT_REPEAT_WINDOW_MS, lastUntil);
+                for (const [oldest, open] of windows) {
+                    if (windows.size < AUDIT_OPEN_WINDOWS_MAX) {
+                        break;
+                    }
+                    await close(oldest, open, now);
+                }
+                windows.set(key, {
+                    first: event,
+                    start: now,
+                    until: lastUntil,
+                    suppressed: 0,
+                });
+                const target = targetOf(event);
+                if (target !== undefined) {
+                    const keys = byTarget.get(target);
+                    if (keys === undefined) {
+                        byTarget.set(target, [key]);
+                    }
+                    else {
+                        keys.push(key);
+                    }
+                }
+            }
+            await deliver(event);
+        },
+        flushTarget: async (target) => {
+            const now = Date.now();
+            await closeExpired(now);
+            for (const key of (byTarget.get(target) ?? []).slice()) {
+                const window = windows.get(key);
+                if (window !== undefined) {
+                    await close(key, window, now);
+                }
+            }
+        },
+    };
+    async function deliver(event) {
+        const frozen = Object.freeze({ ...event });
+        try {
+            if (destination.kind === "sink") {
+                await destination.sink(frozen);
+            }
+            else {
+                await (await context()).adapter.create({
+                    model: AUDIT_MODEL,
+                    data: rowOf(frozen),
+                });
+            }
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            const what = destination.kind === "sink"
+                ? `the audit sink threw on a ${event.kind} event`
+                : `could not write a ${event.kind} event to the ${AUDIT_MODEL} table`;
+            try {
+                (await context()).logger.warn(`Aventara Access: ${what} (${why}); the request goes on.`);
+            }
+            catch {
+                // Better Auth itself is unavailable: nothing left to tell.
+            }
+        }
+    }
+};
+/**
+ * The engine's decision observer: a request's admission is one event; a row
+ * question adds one only when the rules refuse that row.
+ */
+export const decisionObserver = (log, userIdOf) => (question, allowed, rule) => {
+    if (question.row !== undefined && allowed) {
+        return;
+    }
+    return log.record({
+        at: new Date(),
+        kind: "decision",
+        userId: userIdOf(question.principal),
+        resource: question.resource,
+        action: question.action,
+        allowed,
+        reason: rule === null ? "no grant" : `${rule.kind}:${rule.id}`,
+        origin: question.origin,
+    });
+};
+const originOf = (context) => (context?.request ? "client" : "application");
+const impersonation = (by) => typeof by === "string" && by !== "" ? { impersonatedBy: by } : {};
+/** The HMAC keys, by Better Auth secret: imported once each. */
+const targetKeys = new Map();
+const encoder = new TextEncoder();
+/**
+ * A sign-in's target: an HMAC-SHA-256, keyed by Better Auth's secret, of the
+ * identifier the request named (`SignInIdentifier`), as 64 hex digits. It ties a
+ * refused sign-in to the later ones, and to the success, for the same identifier
+ * without storing the identifier: without the secret it cannot be reversed or
+ * checked against a guess. `undefined` when the request named none.
+ */
+export const signInTarget = async (identifier, secret) => {
+    const subtle = globalThis.crypto?.subtle;
+    if (identifier === undefined ||
+        typeof secret !== "string" ||
+        secret === "" ||
+        subtle === undefined) {
+        return undefined;
+    }
+    let key = targetKeys.get(secret);
+    if (key === undefined) {
+        key = subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        targetKeys.set(secret, key);
+    }
+    const mac = await subtle.sign("HMAC", await key, encoder.encode(`aventara-access/sign-in-target:${identifier}`));
+    let hex = "";
+    for (const byte of new Uint8Array(mac)) {
+        hex += byte.toString(16).padStart(2, "0");
+    }
+    return hex;
+};
+/**
+ * Better Auth's database hooks that log sign-ins and sign-outs: a session row
+ * created (and committed) is a sign-in; one deleted by `/sign-out` is a sign-out.
+ * Through Access's routes it comes from a client; a call to Better Auth's API with
+ * no request is the application's own. A sign-in first logs the refused sign-ins
+ * counted for its target, so a guessed password shows after its failures.
+ */
+export const sessionAuditHooks = (log, identify) => ({
+    session: {
+        create: {
+            after: async (session, context) => {
+                // The kiosk's PIN switch logs its own event (`kiosk-switch`).
+                if (typeof session?.userId !== "string" ||
+                    context?.path === KIOSK_SWITCH_PATH) {
+                    return;
+                }
+                const target = await signInTarget(identify(context?.path, context?.body), context?.context?.secret);
+                if (target !== undefined) {
+                    await log.flushTarget(target);
+                }
+                await log.record({
+                    at: new Date(),
+                    kind: "sign-in",
+                    userId: session.userId,
+                    origin: originOf(context),
+                    ...impersonation(session.impersonatedBy),
+                });
+            },
+        },
+        delete: {
+            after: async (session, context) => {
+                if (typeof session?.userId !== "string" ||
+                    context?.path !== "/sign-out") {
+                    return;
+                }
+                await log.record({
+                    at: new Date(),
+                    kind: "sign-out",
+                    userId: session.userId,
+                    origin: originOf(context),
+                    ...impersonation(session.impersonatedBy),
+                });
+            },
+        },
+    },
+});
+/** The session a request ran as, as Better Auth's context holds it: its user and its impersonator. */
+const sessionOf = (value) => {
+    const { session, user } = (value ?? {});
+    return typeof user?.id === "string"
+        ? { userId: user.id, ...impersonation(session?.impersonatedBy) }
+        : undefined;
+};
+/** The refusal an endpoint answered with: Better Auth's `APIError`, a 4xx or 5xx. */
+const refusalOf = (returned) => {
+    if (!(returned instanceof Error)) {
+        return undefined;
+    }
+    const { statusCode, status, body } = returned;
+    if (typeof statusCode !== "number" || statusCode < 400) {
+        return undefined;
+    }
+    return typeof body?.code === "string" && body.code !== ""
+        ? body.code
+        : typeof status === "string"
+            ? status
+            : String(statusCode);
+};
+/**
+ * Better Auth's endpoint hook (after the endpoint answers) that logs a refused
+ * sign-in on a route that starts a session (`startsSession`), with its target, and
+ * a token issued by `GET /token`. (`/get-session`'s `set-auth-jwt` header is not
+ * logged: a page asks for its session on every load.)
+ */
+export const endpointAudit = (log, startsSession, identify) => async (ctx) => {
+    const { path, context } = ctx;
+    const origin = originOf(ctx);
+    const refused = refusalOf(context.returned);
+    if (refused !== undefined) {
+        if (startsSession(path) && typeof path === "string") {
+            const target = await signInTarget(identify(path, ctx.body), context.secret);
+            await log.record({
+                at: new Date(),
+                kind: "sign-in-failed",
+                userId: null,
+                route: path,
+                reason: refused,
+                origin,
+                ...(target === undefined ? {} : { target }),
+            });
+        }
+        return;
+    }
+    const session = sessionOf(context.session);
+    if (path === "/token" && session !== undefined) {
+        await log.record({ at: new Date(), kind: "token", origin, ...session });
+    }
+};

package/dist/audit/audit.schema.d.ts

@@ -0,0 +1,143 @@
+/** The model the audit log declares, by Better Auth model name. */
+export declare const AUDIT_MODEL = "accessAudit";
+/** The audit table, in Better Auth's plugin schema form. */
+export declare const auditSchema: {
+    readonly accessAudit: {
+        readonly fields: {
+            readonly at: {
+                readonly type: "date";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly kind: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly userId: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly resource: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly action: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly allowed: {
+                readonly type: "boolean";
+                readonly required: false;
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly route: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly target: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly impersonatedBy: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly suppressed: {
+                readonly type: "number";
+                readonly required: false;
+            };
+            readonly windowStart: {
+                readonly type: "date";
+                readonly required: false;
+            };
+            readonly windowEnd: {
+                readonly type: "date";
+                readonly required: false;
+            };
+            readonly origin: {
+                readonly type: "string";
+                readonly required: true;
+            };
+        };
+    };
+};
+/** The audit table with the kiosk profile's columns. */
+export declare const kioskAuditSchema: {
+    readonly accessAudit: {
+        readonly fields: {
+            readonly deviceId: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly previousUserId: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly at: {
+                readonly type: "date";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly kind: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly userId: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly resource: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly action: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly allowed: {
+                readonly type: "boolean";
+                readonly required: false;
+            };
+            readonly reason: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly route: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly target: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly impersonatedBy: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly suppressed: {
+                readonly type: "number";
+                readonly required: false;
+            };
+            readonly windowStart: {
+                readonly type: "date";
+                readonly required: false;
+            };
+            readonly windowEnd: {
+                readonly type: "date";
+                readonly required: false;
+            };
+            readonly origin: {
+                readonly type: "string";
+                readonly required: true;
+            };
+        };
+    };
+};

package/dist/audit/audit.schema.js

@@ -0,0 +1,50 @@
+// The audit table, declared through Better Auth's plugin schema: the Access plugin
+// carries it when `audit: true`, so Better Auth's own migration (or its CLI's
+// `generate` for an ORM's schema) creates it beside Better Auth's tables, and events
+// are written through whatever database adapter the app gave Better Auth. With
+// `audit: { sink }` the plugin declares no table.
+//
+// The name follows the registry's tables (and Better Auth's own plugins, `twoFactor`,
+// `jwks`): a camelCase model, which Better Auth's Prisma generator turns into
+// `AccessAudit`.
+//
+// `userId` is a plain column, not a reference to Better Auth's `user`: a row outlives
+// the user it names, and deleting a user never touches the log.
+/** The model the audit log declares, by Better Auth model name. */
+export const AUDIT_MODEL = "accessAudit";
+const optionalString = { type: "string", required: false };
+/** The audit table, in Better Auth's plugin schema form. */
+export const auditSchema = {
+    [AUDIT_MODEL]: {
+        fields: {
+            at: { type: "date", required: true, index: true },
+            kind: { type: "string", required: true },
+            userId: { type: "string", required: false, index: true },
+            resource: optionalString,
+            action: optionalString,
+            allowed: { type: "boolean", required: false },
+            reason: optionalString,
+            route: optionalString,
+            target: { type: "string", required: false, index: true },
+            impersonatedBy: optionalString,
+            suppressed: { type: "number", required: false },
+            windowStart: { type: "date", required: false },
+            windowEnd: { type: "date", required: false },
+            origin: { type: "string", required: true },
+        },
+    },
+};
+/**
+ * The audit table's columns for the kiosk profile's events, added to it only on that
+ * profile: the device, and the user a switch replaced.
+ */
+const kioskAuditFields = {
+    deviceId: { type: "string", required: false, index: true },
+    previousUserId: optionalString,
+};
+/** The audit table with the kiosk profile's columns. */
+export const kioskAuditSchema = {
+    [AUDIT_MODEL]: {
+        fields: { ...auditSchema[AUDIT_MODEL].fields, ...kioskAuditFields },
+    },
+};

package/dist/auth/index.d.ts

@@ -0,0 +1,12 @@
+export { type Access, type AccessBetterAuthOptions, type AccessOptions, type AccessPoliciesOptions, type AccessRegistryOptions, type AccessRules, createAccess, } from "../access/access.factory.js";
+export type { AccessClaimsAnswer, AccessClaimsSource, AccessIdentity, } from "../access/claims.mapper.js";
+export type { AccessKioskProfile, AccessProfileKind, AccessProfileOptions, } from "../access/profile.policy.js";
+export type { AccessAuditEvent, AccessAuditOptions, } from "../audit/audit-event.js";
+export type { AccessKiosk, AccessKioskDevice, } from "../kiosk/kiosk.plugin.js";
+export { type AccessAgent, agentOf } from "../mcp/agent.grant.js";
+export type { AccessAgentIdentity, AccessMcpAuthorization, AccessMcpOptions, } from "../mcp/mcp-options.js";
+export type { AccessArgon2idProfile } from "../passwords/argon2id.hasher.js";
+export type { AccessPasswordsOptions } from "../passwords/passwords.options.js";
+export type { AccessNamespaceKeys, AccessPushResult, AccessRegistry, } from "../registry/access.registry.js";
+export type { AccessKeyKind } from "../registry/registry.key.js";
+export type { AccessResourcesOptions } from "../resources/auth-tables.guard.js";

package/dist/auth/index.js

@@ -0,0 +1,2 @@
+export { createAccess, } from "../access/access.factory.js";
+export { agentOf } from "../mcp/agent.grant.js";