@aventara/access 0.0.0-stage → 0.1.0-rc.0

package/dist/scope.resolver.js

@@ -0,0 +1,512 @@
+// The principal fold: substitute the principal into every rule, fold what
+// the principal alone decides (claims, origin, `signedIn`), expand roles, and keep only
+// row conditions. Grants combine with OR, denies with AND NOT. What leaves this module
+// holds literals only.
+export const TRUE = { k: "true" };
+export const FALSE = { k: "false" };
+const junction = (k, args) => {
+    const kept = [];
+    for (const arg of args) {
+        if (arg.k === "false") {
+            return FALSE;
+        }
+        if (arg.k !== "true") {
+            kept.push(arg);
+        }
+    }
+    if (kept.length === 0) {
+        return TRUE;
+    }
+    return kept.length === 1 ? kept[0] : { k, args: kept };
+};
+/** A conjunction the author wrote as one object. */
+export const andOf = (args) => junction("and", args);
+/** A conjunction the engine builds. */
+export const allOf = (args) => junction("all", args);
+export const orOf = (args) => {
+    const kept = [];
+    for (const arg of args) {
+        if (arg.k === "true") {
+            return TRUE;
+        }
+        if (arg.k !== "false") {
+            kept.push(arg);
+        }
+    }
+    if (kept.length === 0) {
+        return FALSE;
+    }
+    return kept.length === 1 ? kept[0] : { k: "or", args: kept };
+};
+export const notOf = (arg) => arg.k === "true" ? FALSE : arg.k === "false" ? TRUE : { k: "not", arg };
+export function ownOf(record, key) {
+    return record !== undefined && Object.hasOwn(record, key)
+        ? record[key]
+        : undefined;
+}
+/** A plain object: made by `{}` or JSON, not an array, a `Date`, a `Map` or a class instance. */
+export const isPlainObject = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+/**
+ * Reads the principal off a question: any object, an instance of a class included
+ * (an entity), is a principal; an array, a function or a primitive is anonymous.
+ */
+export const principalFactsOf = (principal, origin) => ({
+    principal: typeof principal === "object" &&
+        principal !== null &&
+        !Array.isArray(principal)
+        ? principal
+        : null,
+    origin,
+});
+/** The value at `path`, through own members only; `undefined` where one is missing. */
+const readPath = (from, path) => {
+    let value = from;
+    for (const key of path) {
+        if (typeof value !== "object" ||
+            value === null ||
+            !Object.hasOwn(value, key)) {
+            return undefined;
+        }
+        value = value[key];
+    }
+    return value;
+};
+/**
+ * A `me` value the principal does not have: anonymous, a missing or null property,
+ * an empty string (no identity is `""`), a number JSON cannot carry, or anything but
+ * a string, number or boolean.
+ */
+class MissingPrincipalValue extends Error {
+}
+const literalOf = (operand, facts) => {
+    if (operand === null || typeof operand !== "object") {
+        return operand;
+    }
+    const value = facts.principal === null
+        ? undefined
+        : readPath(facts.principal, operand.principal);
+    if (value === "" ||
+        (typeof value === "number" && !Number.isFinite(value)) ||
+        (typeof value !== "string" &&
+            typeof value !== "number" &&
+            typeof value !== "boolean")) {
+        throw new MissingPrincipalValue();
+    }
+    return value;
+};
+/** A condition on the principal, three-valued: a claim it lacks is `"unknown"`. */
+const principalTruth = (condition, facts) => {
+    switch (condition.op) {
+        case "and": {
+            let unknown = false;
+            for (const arg of condition.args) {
+                const truth = principalTruth(arg, facts);
+                if (truth === false) {
+                    return false;
+                }
+                unknown ||= truth === "unknown";
+            }
+            return unknown ? "unknown" : true;
+        }
+        case "origin":
+            return facts.origin === condition.value;
+        case "cmp": {
+            if (facts.principal === null) {
+                // The anonymous caller has no token, so none can be stale: no flag is set on
+                // it (a ban does not close an `anyone` grant), and any other claim is unknown.
+                return condition.value === true ? false : "unknown";
+            }
+            const value = readPath(facts.principal, ["claims", ...condition.claim]);
+            if (value === undefined || value === null) {
+                return "unknown";
+            }
+            return typeof value === typeof condition.value
+                ? value === condition.value
+                : "unknown";
+        }
+    }
+};
+/**
+ * Folds a condition on the principal alone (claims, origin) to a boolean. A claim
+ * the principal lacks, or holds as another type, fails closed: a grant's global role
+ * is not held, and a deny's `if` holds, whatever value it compares with. Access mints
+ * every declared boolean claim, `false` when unset, so a token it issued lacks none;
+ * a foreign or stale token without `banned` is denied by `banned: true`. The
+ * anonymous caller is the one exception: a comparison with `true` never holds for it.
+ */
+export const foldPrincipalCondition = (condition, facts, rule) => {
+    const truth = principalTruth(condition, facts);
+    return truth === "unknown" ? rule === "deny" : truth;
+};
+const resolveIn = (policies, predicate, facts, mode) => {
+    switch (predicate.op) {
+        case "true":
+            return TRUE;
+        case "false":
+            return FALSE;
+        case "and":
+            return andOf(predicate.args.map((arg) => resolveIn(policies, arg, facts, mode)));
+        case "or":
+            return orOf(predicate.args.map((arg) => resolveIn(policies, arg, facts, mode)));
+        case "not":
+            return notOf(resolveIn(policies, predicate.arg, facts, mode));
+        case "cmp": {
+            const value = Array.isArray(predicate.value)
+                ? predicate.value.map((item) => literalOf(item, facts))
+                : literalOf(predicate.value, facts);
+            return { k: "cmp", field: predicate.field, cmp: predicate.cmp, value };
+        }
+        case "rel": {
+            const where = resolveIn(policies, predicate.where, facts, mode);
+            return where.k === "false"
+                ? FALSE
+                : {
+                    k: "rel",
+                    relation: predicate.relation,
+                    target: predicate.target,
+                    where,
+                };
+        }
+        case "some":
+        case "every":
+        case "none": {
+            const where = resolveIn(policies, predicate.where, facts, mode);
+            if (predicate.op === "some" && where.k === "false") {
+                return FALSE;
+            }
+            if (predicate.op === "none" && where.k === "false") {
+                return TRUE;
+            }
+            if (predicate.op === "every" && where.k === "true") {
+                return TRUE;
+            }
+            return {
+                k: predicate.op,
+                relation: predicate.relation,
+                target: predicate.target,
+                where,
+            };
+        }
+        case "role": {
+            const role = ownOf(policies.roles, predicate.role);
+            if (role === undefined || !("on" in role)) {
+                return FALSE;
+            }
+            return resolveIn(policies, role.where, facts, mode);
+        }
+    }
+};
+/**
+ * Substitutes the principal into a row condition. A `me` value the principal lacks
+ * makes the whole rule `false` for a grant (`drop-rule`) and `true` for a deny
+ * (`match-rule`).
+ */
+export const resolvePredicate = (policies, predicate, facts, mode) => {
+    try {
+        return resolveIn(policies, predicate, facts, mode);
+    }
+    catch (error) {
+        if (error instanceof MissingPrincipalValue) {
+            return mode === "drop-rule" ? FALSE : TRUE;
+        }
+        throw error;
+    }
+};
+/** Whether a rule names this action on this Resource. */
+const covers = (resource, action, rule) => (rule.resource === resource || rule.resource === "*") &&
+    (rule.actions === "*" || rule.actions.includes(action));
+/**
+ * The grants and denies a question about `action` on `resource` reads. A grant on
+ * `"*"` reaches the file's own Resources only: never a foreign one, and never one
+ * its schema does not list. A deny on `"*"` reaches every Resource.
+ */
+export const rulesFor = (policies, resource, action) => {
+    const facts = ownOf(policies.schema, resource);
+    const own = facts !== undefined && facts.foreign === undefined;
+    return {
+        grants: policies.grants.filter((grant) => (own || grant.resource !== "*") && covers(resource, action, grant)),
+        denies: policies.denies.filter((deny) => covers(resource, action, deny)),
+    };
+};
+/** What a subject contributes to a grant, folded: `true`, `false` or a row condition. */
+const subjectCondition = (policies, grant, subject, facts) => {
+    if (subject === "anyone") {
+        return TRUE;
+    }
+    if (subject === "signedIn") {
+        return facts.principal === null ? FALSE : TRUE;
+    }
+    const role = ownOf(policies.roles, subject);
+    if (role === undefined) {
+        return FALSE;
+    }
+    if ("global" in role) {
+        return foldPrincipalCondition(role.global, facts, "grant") ? TRUE : FALSE;
+    }
+    const held = { op: "role", role: subject };
+    const predicate = grant.in === undefined
+        ? held
+        : { op: "rel", relation: grant.in, target: role.on, where: held };
+    return resolvePredicate(policies, predicate, facts, "drop-rule");
+};
+/**
+ * Each grant's condition per subject: its `where`, then the subject's (its row
+ * role, through `in`), then, with `after`, the `after` condition. A grant that reads
+ * a `me` value the principal lacks drops.
+ */
+export const foldGrants = (policies, grants, facts, withAfter = false) => grants.flatMap((grant) => grant.subjects.map((subject) => {
+    const parts = [];
+    if (grant.where !== undefined) {
+        parts.push(resolvePredicate(policies, grant.where, facts, "drop-rule"));
+    }
+    parts.push(subjectCondition(policies, grant, subject, facts));
+    if (withAfter && grant.after !== undefined) {
+        parts.push(resolvePredicate(policies, grant.after, facts, "drop-rule"));
+    }
+    return { grant, subject, condition: allOf(parts) };
+}));
+/**
+ * Each deny's row condition: `false` when its `if` does not hold for this principal,
+ * `true` when its `where` reads a `me` value the principal lacks.
+ */
+export const foldDenies = (policies, denies, facts) => denies.map((deny) => {
+    if (deny.if !== undefined &&
+        !foldPrincipalCondition(deny.if, facts, "deny")) {
+        return { deny, condition: FALSE };
+    }
+    return {
+        deny,
+        condition: deny.where === undefined
+            ? TRUE
+            : resolvePredicate(policies, deny.where, facts, "match-rule"),
+    };
+});
+/** The rows a principal may `action`: OR of the grants, AND NOT each deny. */
+export const scopeCondition = (grants, denies) => {
+    const allowed = orOf(grants.map((grant) => grant.condition));
+    if (allowed.k === "false") {
+        return FALSE;
+    }
+    return allOf([allowed, ...denies.map((deny) => notOf(deny.condition))]);
+};
+/** Whether the schema entry lists `field` as nullable. A file without `nullable` has none. */
+const nullableIn = (policies, resource, field) => ownOf(policies.schema, resource)?.nullable?.includes(field) === true;
+/**
+ * Whether a to-one step can find no row: `"nullable"` when one of its reference
+ * fields is nullable, `"required"` when it holds references and none is, and
+ * `"unstated"` for the end that holds no references (the other end's step).
+ */
+const stepKind = (policies, resource, node) => {
+    const fields = ownOf(ownOf(policies.schema, resource)?.relations, node.relation)?.referenceFields;
+    if (fields === undefined) {
+        return "unstated";
+    }
+    return fields.some((field) => nullableIn(policies, resource, field))
+        ? "nullable"
+        : "required";
+};
+/**
+ * Whether SQL can read a comparison as unknown where `can` reads it as false: a
+ * nullable field compared with a value (SQL's `NULL = v` is unknown; `f = NULL` is
+ * written `IS NULL` and never is), or an `in` list that holds `null`.
+ */
+const unknownIn = (policies, resource, node) => Array.isArray(node.value)
+    ? node.value.includes(null) ||
+        nullableIn(policies, resource, node.field)
+    : node.value !== null && nullableIn(policies, resource, node.field);
+/** Whether SQL reads `node` exactly as `can` does: no unknown comparison, no step that can find no row. */
+const known = (policies, resource, node) => {
+    switch (node.k) {
+        case "true":
+        case "false":
+            return true;
+        case "cmp":
+            return !unknownIn(policies, resource, node);
+        case "and":
+        case "all":
+        case "or":
+            return node.args.every((arg) => known(policies, resource, arg));
+        case "not":
+            return known(policies, resource, node.arg);
+        case "rel":
+            return (stepKind(policies, resource, node) !== "nullable" &&
+                known(policies, node.target, node.where));
+        case "some":
+        case "every":
+        case "none":
+            return known(policies, node.target, node.where);
+    }
+};
+/**
+ * A comparison with the `null`s taken out of its `in` list: `can` never matches a
+ * NULL field through a list, and SQL's `IN (NULL, …)` is unknown for every row. A
+ * list left empty: `in` matches no row; `notIn` every row whose field is not NULL,
+ * which on a required field is every row.
+ */
+const listWithoutNull = (policies, resource, node) => {
+    if (!Array.isArray(node.value)) {
+        return node;
+    }
+    const value = [];
+    for (const item of node.value) {
+        if (item !== null) {
+            value.push(item);
+        }
+    }
+    if (value.length > 0) {
+        return { k: "cmp", field: node.field, cmp: node.cmp, value };
+    }
+    if (node.cmp === "in") {
+        return FALSE;
+    }
+    return nullableIn(policies, resource, node.field)
+        ? { k: "cmp", field: node.field, cmp: "ne", value: null }
+        : TRUE;
+};
+const isNull = (field) => ({
+    k: "cmp",
+    field,
+    cmp: "eq",
+    value: null,
+});
+/** The same to-one step, around another condition. */
+const step = (node, where) => ({
+    k: "rel",
+    relation: node.relation,
+    target: node.target,
+    where,
+});
+/** A quantifier over the same to-many relation. */
+const quantified = (k, node, where) => ({ k, relation: node.relation, target: node.target, where });
+/** One rewrite applied to each condition of a list. */
+const each = (rewrite, policies, resource, nodes) => {
+    const out = [];
+    for (const node of nodes) {
+        out.push(rewrite(policies, resource, node));
+    }
+    return out;
+};
+/** The condition, true on exactly the rows where `can` reads it as true. */
+const holds = (policies, resource, node) => {
+    if (known(policies, resource, node)) {
+        return node;
+    }
+    switch (node.k) {
+        case "true":
+        case "false":
+            return node;
+        case "cmp":
+            return listWithoutNull(policies, resource, node);
+        case "and":
+            return andOf(each(holds, policies, resource, node.args));
+        case "all":
+            return allOf(each(holds, policies, resource, node.args));
+        case "or":
+            return orOf(each(holds, policies, resource, node.args));
+        case "not":
+            return fails(policies, resource, node.arg);
+        case "rel":
+            // A step that finds no row is false, in SQL as in `can`.
+            return step(node, holds(policies, node.target, node.where));
+        case "some":
+        case "none":
+            // `EXISTS` and `NOT EXISTS`: true or false around the rows they count.
+            return quantified(node.k, node, holds(policies, node.target, node.where));
+        case "every":
+            // An ORM may write `every` as `NOT EXISTS (… WHERE NOT condition)`, where an
+            // unknown condition passes: ask that no related row fails it instead.
+            return quantified("none", node, fails(policies, node.target, node.where));
+    }
+};
+/** The condition's negation, true on exactly the rows where `can` reads it as false. */
+const fails = (policies, resource, node) => {
+    if (known(policies, resource, node)) {
+        return notOf(node);
+    }
+    switch (node.k) {
+        case "true":
+        case "false":
+            return notOf(node);
+        case "cmp": {
+            const negated = notOf(listWithoutNull(policies, resource, node));
+            return nullableIn(policies, resource, node.field)
+                ? orOf([negated, isNull(node.field)])
+                : negated;
+        }
+        case "and":
+        case "all": {
+            // Comparisons only: `NOT (a AND b) OR a IS NULL OR b IS NULL`.
+            if (node.args.every((arg) => arg.k === "cmp")) {
+                const comparisons = node.args;
+                const guards = [];
+                const guarded = [];
+                for (const arg of comparisons) {
+                    if (arg.value !== null &&
+                        nullableIn(policies, resource, arg.field) &&
+                        !guarded.includes(arg.field)) {
+                        guarded.push(arg.field);
+                        guards.push(isNull(arg.field));
+                    }
+                }
+                const lists = [];
+                for (const arg of comparisons) {
+                    lists.push(listWithoutNull(policies, resource, arg));
+                }
+                const strict = (node.k === "and" ? andOf : allOf)(lists);
+                return orOf([notOf(strict), ...guards]);
+            }
+            return orOf(each(fails, policies, resource, node.args));
+        }
+        case "or":
+            return allOf(each(fails, policies, resource, node.args));
+        case "not":
+            return holds(policies, resource, node.arg);
+        case "rel": {
+            const failing = step(node, fails(policies, node.target, node.where));
+            switch (stepKind(policies, resource, node)) {
+                case "required":
+                    // The row is always there: the step fails where its condition does.
+                    return failing;
+                case "nullable": {
+                    // No row (a NULL reference) fails it too, said on this row's own fields.
+                    const references = ownOf(ownOf(policies.schema, resource)?.relations, node.relation)
+                        ?.referenceFields ?? [];
+                    const guards = [];
+                    for (const field of references) {
+                        guards.push(isNull(field));
+                    }
+                    guards.push(failing);
+                    return orOf(guards);
+                }
+                case "unstated":
+                    // No reference fields here to say "no row" with: the `NOT` of the step
+                    // covers the missing row, the failing condition the row that is there.
+                    return orOf([
+                        notOf(step(node, holds(policies, node.target, node.where))),
+                        failing,
+                    ]);
+            }
+            return failing;
+        }
+        case "some":
+        case "none":
+            return notOf(quantified(node.k, node, holds(policies, node.target, node.where)));
+        case "every":
+            return quantified("some", node, fails(policies, node.target, node.where));
+    }
+};
+/**
+ * A folded condition on `resource` in the form a database reads as `can` does.
+ * `can` reads a comparison on a NULL field as false, so its `NOT` keeps the row; SQL
+ * reads it as unknown, and its `NOT` drops the row. Each negated comparison on a
+ * nullable field (the schema entry's `nullable`) gets its own guard, `NOT (f = v) OR
+ * f IS NULL`, and a negated to-one step whose reference is nullable gets `OR fk IS
+ * NULL`. A condition with neither is returned as it is.
+ */
+export const nullSafe = (policies, resource, node) => holds(policies, resource, node);

package/dist/sha256.digest.d.ts

@@ -0,0 +1,2 @@
+/** The SHA-256 digest of `text`'s UTF-8 bytes, as 64 lowercase hex digits. */
+export declare const sha256Hex: (text: string) => string;

package/dist/sha256.digest.js

@@ -0,0 +1,81 @@
+// SHA-256 (FIPS 180-4) over UTF-8 text, synchronous and dependency-free, so the engine
+// entry hashes a policies file the same way in Node, a browser, Electron or a build
+// step, without `node:crypto` and without WebCrypto's async API. It hashes a few
+// kilobytes at build and startup time; it is not on any request path.
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+/** The SHA-256 digest of `text`'s UTF-8 bytes, as 64 lowercase hex digits. */
+export const sha256Hex = (text) => {
+    const bytes = new TextEncoder().encode(text);
+    const bitLength = bytes.length * 8;
+    // Message, a 0x80 byte, zero padding, and the 64-bit big-endian bit length.
+    const blocks = Math.ceil((bytes.length + 9) / 64);
+    const padded = new Uint8Array(blocks * 64);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLength / 0x1_0000_0000));
+    view.setUint32(padded.length - 4, bitLength >>> 0);
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+        0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let t = 0; t < 16; t++) {
+            w[t] = view.getUint32(offset + t * 4);
+        }
+        for (let t = 16; t < 64; t++) {
+            const w15 = w[t - 15];
+            const w2 = w[t - 2];
+            const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ (w15 >>> 3);
+            const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ (w2 >>> 10);
+            w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0;
+        }
+        let a = h[0];
+        let b = h[1];
+        let c = h[2];
+        let d = h[3];
+        let e = h[4];
+        let f = h[5];
+        let g = h[6];
+        let hh = h[7];
+        for (let t = 0; t < 64; t++) {
+            const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const choose = (e & f) ^ (~e & g);
+            const t1 = (hh + s1 + choose + K[t] + w[t]) >>> 0;
+            const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (s0 + majority) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    return Array.from(h, (word) => word.toString(16).padStart(8, "0")).join("");
+};

package/dist/standalone/access.server.d.ts

@@ -0,0 +1,41 @@
+/** `serve`'s options. */
+export type AccessServeOptions = {
+    /** The port to listen on; `0` picks a free one. Default `3000`. */
+    readonly port?: number;
+    /**
+     * The interface to listen on. Default `"127.0.0.1"`, this host only; `"0.0.0.0"`
+     * listens on every interface (in a container, behind a proxy that terminates TLS).
+     */
+    readonly hostname?: string;
+    /** The largest request body taken, in bytes. Default 1 MiB (`1048576`). */
+    readonly maxBodyBytes?: number;
+};
+/** A running standalone host. */
+export type AccessServer = {
+    /** The port it listens on (the one picked, when `port` was `0`). */
+    readonly port: number;
+    /** Its base URL, such as `http://127.0.0.1:3000`. */
+    readonly url: string;
+    /**
+     * Stops accepting, lets the requests in flight finish for up to 10 s, then ends
+     * the connections left; resolves once the server is closed.
+     */
+    close(): Promise<void>;
+};
+/**
+ * What `serve` takes: an instance with a handler (`createAccess`'s, or any), and the
+ * options Better Auth runs with, which it reads for the base path and how the
+ * client's address is read; and whether the registry is on.
+ */
+type Served = {
+    readonly handler: (request: Request) => Promise<Response>;
+    readonly options?: object;
+    readonly registry?: unknown;
+};
+/**
+ * Serves an Access instance over HTTP: its routes, as `access.handler` answers them
+ * (Better Auth's base path, `/api/auth` unless `betterAuth.basePath` says otherwise),
+ * and `GET /health`. Resolves once the server listens.
+ */
+export declare const serve: (access: Served, options?: AccessServeOptions) => Promise<AccessServer>;
+export {};