@aventara/access 0.0.0-stage → 1.0.0-rc.1

package/dist/access/access.factory.js

@@ -0,0 +1,440 @@
+// `createAccess`: Better Auth with Access's concerns beside it. Better Auth's own
+// options sit in the `betterAuth` block, typed as Better Auth types them and passed
+// to `betterAuth()` as they are; Access adds its blocks beside it (`policies`,
+// `principal`, `profile`, `registry`, `audit`, `resources`, `passwords`) and installs two plugins of its own:
+// Better Auth's `jwt()`, whose tokens carry `sub` and the declared claims under one
+// fixed issuer and audience, and the Access plugin, which holds the service
+// profile's refusals, with `registry: { enabled: true }` the registry's tables and
+// routes, and with `audit` the hooks that log sessions and tokens (and, for
+// `audit: true`, the audit table). Agents' and services' OAuth tokens are Better Auth's
+// own: its OAuth provider (`@better-auth/oauth-provider`), which the app adds to
+// `betterAuth.plugins` itself, issues them, and Access issues none. With `mcp`, Access
+// reads the provider's tokens for the MCP endpoint: `access.mcp` is the framework's
+// `mcp.authorization`, and an agent's principal is held to its token's audience and
+// scopes. With `audience`, the service opts in to tokens addressed to it alone (RFC
+// 8707). Either way Access checks the provider and requires PKCE of every
+// authorization request. Over Better Auth's tables the engine runs
+// built-in rules beside the app's (`resources`): a table no key opens is closed, an
+// opened one takes only the writes Better Auth's hooks do not guard, and a secret
+// column is never readable. Passwords are hashed with argon2id (`passwords`) unless
+// the app set Better Auth's `emailAndPassword.password` hook itself. The instance mounts nothing: the app mounts
+// `access.handler` the way it would mount Better Auth's. It satisfies the
+// framework's access provider by shape (`policy`, `state`) without importing it.
+//
+// Building it reads no network and opens no port: Better Auth itself is built on
+// the first request, `access.api` read or `state` call.
+import { auditDestinationOf, createAuditLog, } from "../audit/audit.log.js";
+import { auditSchema, kioskAuditSchema } from "../audit/audit.schema.js";
+import { adapterBeaconStore, beaconSchema, } from "../beacon/beacon.schema.js";
+import { accessClient, meEndpoint, } from "../client/access-client.factory.js";
+import { verbRateLimiter, } from "../client/verb-rate.limiter.js";
+import { kioskPlugin, } from "../kiosk/kiosk.plugin.js";
+import { kioskSchema } from "../kiosk/kiosk.schema.js";
+import { PIN_LENGTH } from "../kiosk/pin.policy.js";
+import { authorizationServerOf, checkMcpOptions, } from "../mcp/mcp-options.js";
+import { createAccessTokenVerifier, mcpAuthorizationOf, userInfoAudience, } from "../oauth/access-token.verifier.js";
+import { checkOAuthProvider, checkResourceUrl, oauthUseOf, pkceGuard, } from "../oauth/oauth-provider.hardening.js";
+import { passwordsOf, pinHasherOf, } from "../passwords/passwords.options.js";
+import { isRecord } from "../policies.compiler.js";
+import { POLICIES_FORMAT } from "../policies-contract.js";
+import { createRegistry, } from "../registry/access.registry.js";
+import { registryEndpoints, registryOnRequest, } from "../registry/registry.endpoints.js";
+import { registryOptionsOf, } from "../registry/registry.options.js";
+import { registrySchema } from "../registry/registry.schema.js";
+import { checkResourcesOptions, } from "../resources/auth-tables.guard.js";
+import { AccessError } from "./access.error.js";
+import { baseURLOf, cookieCacheOn, crossSiteSessionCookie, refuseInstalledPlugins, refuseKioskOptions, refuseUnverifiedInvitations, } from "./better-auth.hardening.js";
+import { loadBetterAuth } from "./better-auth.loader.js";
+import { issuedClaims, } from "./claims.mapper.js";
+import { betterAuthTablesFor, checkPoliciesBlock, guardedPolicy, } from "./policies-block.checker.js";
+import { checkProfile } from "./profile.policy.js";
+import { meOf, requestIdentity, requestState, sessionStillLive, verbMeOf, } from "./request.state.js";
+import { sessionCookies, sessionWatch, signInIdentifier, withoutSessionCookies, } from "./session.hooks.js";
+import { createTokenVerifier } from "./token.verifier.js";
+/**
+ * The plugins `createAccess` installs itself, by id, as a sentence names each.
+ */
+const INSTALLED_PLUGINS = {
+    "aventara-access": "aventaraAccess()",
+    jwt: "jwt()",
+};
+/** The shortest and longest a token may live, in seconds, and the default. */
+/**
+ * The `policies` block of a registry-only server, which has no rules of its own: no
+ * Resource, no claim beside `sub`, and so every policy question is denied.
+ */
+const REGISTRY_ONLY_POLICIES = {
+    rules: {
+        format: POLICIES_FORMAT,
+        claims: {},
+        schema: {},
+        roles: {},
+        govern: {},
+        grants: [],
+        denies: [],
+    },
+    claims: {},
+};
+const TOP_LEVEL = new Set([
+    "betterAuth",
+    "policies",
+    "principal",
+    "profile",
+    "registry",
+    "audit",
+    "resources",
+    "passwords",
+    "mcp",
+    "audience",
+]);
+const refuse = (message) => {
+    throw new AccessError("ACCESS_OPTIONS_INVALID", message);
+};
+/**
+ * Builds an Access instance: Better Auth (from the `betterAuth` block, with `jwt()`
+ * and the Access plugin installed), the policy engine (from `policies.rules`) and
+ * the request state the framework's `access` option reads. It mounts nothing and
+ * opens no connection; `better-auth` is loaded here, and must be the exact version
+ * Access is built against.
+ */
+export function createAccess(options) {
+    if (!isRecord(options)) {
+        return refuse("createAccess takes one object: `{ betterAuth, policies, principal?, profile?, registry?, audit?, resources?, passwords?, mcp?, audience? }`.");
+    }
+    for (const key of Object.keys(options)) {
+        if (!TOP_LEVEL.has(key)) {
+            refuse(`createAccess does not take \`${key}\`; it takes \`betterAuth\`, \`policies\`, \`principal\`, \`profile\`, \`registry\`, \`audit\`, \`resources\`, \`passwords\`, \`mcp\` and \`audience\`.`);
+        }
+    }
+    const { betterAuth: block, policies, principal, profile, registry, audit, resources, passwords, mcp, audience, } = options;
+    if (block === undefined) {
+        return refuse("the `betterAuth` option is missing: pass Better Auth's options there, as `betterAuth({...})` takes them (`{ database, ... }`).");
+    }
+    if (!isRecord(block)) {
+        return refuse("`betterAuth` holds Better Auth's options, as `betterAuth({...})` takes them.");
+    }
+    const { kind, kiosk: kioskSettings } = checkProfile(profile);
+    const plugins = refuseInstalledPlugins(block.plugins, {
+        by: "createAccess",
+        at: "betterAuth.plugins",
+        installs: INSTALLED_PLUGINS,
+        me: true,
+        kiosk: kind === "kiosk",
+        registry: isRecord(registry) && registry.enabled === true,
+    });
+    if (policies === undefined &&
+        !(isRecord(registry) && registry.enabled === true)) {
+        return refuse("the `policies` option is missing: pass `{ rules, claims }`, the rules (`definePolicies(model)…`) and the claims they read. Only a registry-only server (`registry: { enabled: true }`) may leave it out.");
+    }
+    const checked = checkPoliciesBlock(policies ?? REGISTRY_ONLY_POLICIES, principal);
+    const { claims, claimsOf, tokenTtl } = checked;
+    const auditTo = auditDestinationOf(audit);
+    // The audit log, when on: events reach the table through Better Auth's adapter
+    // (once Better Auth is built), or the app's sink.
+    const auditLog = auditTo === undefined
+        ? undefined
+        : createAuditLog(auditTo, async () => (await instance().$context));
+    const registrySettings = registryOptionsOf(registry);
+    const registryOn = registrySettings !== undefined;
+    const opened = checkResourcesOptions(resources);
+    // The rules read the organization plugin's memberships when `members` opens
+    // them: a membership an unverified account took by invitation is refused.
+    if (opened.members) {
+        refuseUnverifiedInvitations(plugins, "`resources: { members: true }`");
+    }
+    const modules = loadBetterAuth();
+    // Better Auth's `emailAndPassword` with the argon2id hook in it, unless the app
+    // set its own `password` hook (then the block passes through as given), and with
+    // that hook the one that rehashes a password at the profile at sign-in.
+    const { emailAndPassword, rehash } = passwordsOf(passwords, block, modules, async () => await instance().$context);
+    // Every token's issuer and audience, fixed now: the app's base URL.
+    const writtenBase = baseURLOf(block, modules, "betterAuth.baseURL");
+    const issuer = new URL(writtenBase).origin;
+    // With `mcp` or `audience`: the resources whose tokens Better Auth's OAuth provider
+    // issues and Access reads, the provider checked, and with `mcp` the issuer as the
+    // authorization server the framework names.
+    const checkedMcp = checkMcpOptions(mcp, "mcp", issuer);
+    const ownAudience = audience === undefined
+        ? undefined
+        : checkResourceUrl(audience, "audience", issuer);
+    let server;
+    const oauth = oauthUseOf(checkedMcp, ownAudience, userInfoAudience(block, modules));
+    if (oauth !== undefined) {
+        if (kind === "service") {
+            refuse(`\`${oauth.by}\` reads the tokens Better Auth's OAuth provider issues after its user signs in and consents in a browser, and the \`service\` profile hands no caller a session: use the \`web\` profile.`);
+        }
+        if (checkedMcp !== undefined) {
+            server = authorizationServerOf(issuer, "betterAuth.baseURL");
+        }
+        checkOAuthProvider(plugins, oauth, { at: "betterAuth.plugins" });
+    }
+    // A session cookie a browser sends from any site is read only from the origins
+    // Better Auth trusts (`state`, below), so there must be some.
+    const crossSite = crossSiteSessionCookie(block, "betterAuth.trustedOrigins");
+    // With Better Auth's cookie cache on, a session read from its cookie may have
+    // been revoked since: a token is issued only for a session the store still has.
+    const cookieCache = cookieCacheOn(block);
+    // On a till network's plain http: base URL (`profile.insecureLan`), the ranges it
+    // is served on: Better Auth's logger warns of them when it starts.
+    const servedOnLan = kioskSettings === undefined
+        ? undefined
+        : refuseKioskOptions(block, plugins, cookieCache, writtenBase, "betterAuth.baseURL", kioskSettings.insecureLan);
+    // Better Auth's database adapter, once Better Auth is built: the registry stores
+    // its tables through it, whichever adapter the app gave Better Auth.
+    const registryStore = registryOn
+        ? createRegistry(async () => (await instance().$context).adapter, registrySettings)
+        : undefined;
+    // The Access server (the registry on) whose rules name a namespace is one of the
+    // org's namespaces: it keeps its own beacon, through Better Auth's adapter.
+    const beaconStore = registryOn && typeof checked.file.namespace === "string"
+        ? adapterBeaconStore(async () => (await instance().$context).adapter)
+        : undefined;
+    const schema = {
+        ...(registryStore === undefined ? {} : registrySchema),
+        ...(beaconStore === undefined ? {} : beaconSchema),
+        ...(auditTo?.kind === "table"
+            ? kioskSettings === undefined
+                ? auditSchema
+                : kioskAuditSchema
+            : {}),
+        ...(kioskSettings === undefined ? {} : kioskSchema),
+    };
+    // The requests `access.client`'s calls build, each standing for the caller's: the
+    // Access plugin runs Better Auth's router origin check on them (a direct API call
+    // skips the router).
+    const clientCalls = new WeakSet();
+    const claimsFor = (source) => issuedClaims(source, claims, claimsOf);
+    // The kiosk profile's routes and its hook: PINs hashed with argon2id at the
+    // `passwords` profile, whatever hashes the app's passwords.
+    const kiosk = kioskSettings === undefined
+        ? undefined
+        : kioskPlugin({
+            settings: kioskSettings,
+            endpoint: modules.createAuthEndpoint,
+            serverOnly: modules.createAuthEndpoint.serverOnly,
+            middleware: modules.createAuthMiddleware,
+            refusal: modules.APIError,
+            getSessionFromCtx: modules.getSessionFromCtx,
+            cookies: modules.cookies,
+            oauthState: modules.getOAuthState,
+            pins: pinHasherOf(passwords, modules, async () => await instance().$context, PIN_LENGTH.max),
+            claimsFor: claimsFor,
+            auditLog,
+            secureDevice: issuer.startsWith("https:"),
+        });
+    const watch = sessionWatch({
+        kind,
+        auditLog,
+        modules,
+        plugins,
+        ...(kiosk === undefined
+            ? {}
+            : {
+                sessionCreating: kiosk.sessionCreating,
+                sessionCreated: kiosk.sessionCreated,
+            }),
+    });
+    const NO_HOOKS = [];
+    const watchedBefore = watch.hooks === undefined ? NO_HOOKS : watch.hooks.before;
+    const watchedAfter = watch.hooks === undefined ? NO_HOOKS : watch.hooks.after;
+    const accessPlugin = {
+        id: "aventara-access",
+        ...(Object.keys(schema).length === 0 ? {} : { schema }),
+        // A push's key is checked before Better Auth reads its body, on any mount.
+        ...(registryStore === undefined
+            ? {}
+            : { onRequest: registryOnRequest(registryStore) }),
+        endpoints: {
+            ...(registryStore === undefined
+                ? {}
+                : registryEndpoints(registryStore, modules.createAuthEndpoint)),
+            ...meEndpoint(modules.createAuthEndpoint, 
+            // An agent's access token opens nothing over HTTP but the MCP endpoint: the
+            // route answers it `null`. `access.client.verbs.me` below answers it, for the
+            // MCP `me` tool, marked for `agentOf`.
+            async (headers, request) => meOf(await identityOf(headers, request))),
+            ...(kiosk === undefined ? {} : kiosk.endpoints),
+        },
+        ...(servedOnLan === undefined
+            ? watch.init === undefined
+                ? {}
+                : { init: watch.init }
+            : {
+                init: (context) => {
+                    context.logger.warn(`Aventara Access: the kiosk profile is served on ${issuer}, plain http:, under \`profile.insecureLan\` (${servedOnLan.map((range) => range.cidr).join(", ")}). Device credentials, PIN sessions and PINs cross that network in the clear: keep it to the tills alone (a router of their own, WPA3, no guest devices), and run nothing else on the server's address, since cookies are not kept apart by port.`);
+                    return watch.init?.(context);
+                },
+            }),
+        hooks: {
+            before: [
+                {
+                    matcher: (context) => typeof context?.request === "object" &&
+                        context.request !== null &&
+                        clientCalls.has(context.request),
+                    handler: modules.originCheckMiddleware,
+                },
+                ...(oauth === undefined ? [] : [pkceGuard(modules)]),
+                ...watchedBefore,
+                ...(kiosk === undefined ? [] : kiosk.hooks.before),
+            ],
+            after: [
+                ...(rehash === undefined ? [] : [rehash]),
+                ...watchedAfter,
+                ...(kiosk === undefined ? [] : kiosk.hooks.after),
+            ],
+        },
+    };
+    const effective = {
+        ...block,
+        ...(emailAndPassword === undefined ? {} : { emailAndPassword }),
+        plugins: [
+            ...plugins,
+            modules.jwt({
+                // A PIN session gets no token (below), so `/get-session` hands out none
+                // beside any session on the kiosk profile; `GET /token` still does for a
+                // session opened with full credentials.
+                ...(kind === "kiosk" ? { disableSettingJwtHeader: true } : {}),
+                jwt: {
+                    issuer,
+                    audience: issuer,
+                    expirationTime: `${tokenTtl}s`,
+                    definePayload: async (source) => {
+                        // A session on a kiosk device is bound to it: a token would carry
+                        // it anywhere, past the device's lock.
+                        if (typeof source.session.kioskDeviceId === "string") {
+                            throw new modules.APIError("FORBIDDEN", {
+                                code: "KIOSK_SESSION_NOT_ALLOWED",
+                                message: "A session bound to a kiosk device is not issued a token.",
+                            });
+                        }
+                        if (cookieCache) {
+                            await sessionStillLive(() => instance().$context, source.session, () => new modules.APIError("UNAUTHORIZED", {
+                                message: "The session has ended.",
+                            }));
+                        }
+                        return claimsFor(source);
+                    },
+                },
+            }),
+            accessPlugin,
+        ],
+    };
+    // Better Auth's tables as it is built (its plugins' fields included): a declared
+    // claim the default mapping reads must come from a field the user cannot set, and
+    // the rules' schema names each table (on the Prisma adapter, the models it reads;
+    // on any other, the app's `authTables`).
+    const facts = betterAuthTablesFor({
+        options: effective,
+        modules,
+        checked,
+        resources: opened,
+    });
+    // The engine the framework asks, with Access's built-in rules over Better Auth's
+    // tables. Built on the first read of `access.policy`, which is the framework's
+    // construction: a `resources` key whose tables are missing refuses the app's
+    // start, while a tool that reads only `access.options` (`npx auth generate`,
+    // before the schema has the tables) loads the configuration.
+    let guarded;
+    const policyOf = () => {
+        guarded ??= guardedPolicy({
+            checked,
+            auditLog,
+            resources: opened,
+            tables: facts.tables,
+            naming: facts.naming,
+        });
+        return guarded;
+    };
+    let auth;
+    const instance = () => {
+        auth ??= modules.betterAuth(effective);
+        return auth;
+    };
+    const keys = async () => (await instance().api.getJwks());
+    const tokensFor = (resource) => createAccessTokenVerifier({
+        keys,
+        issuer,
+        resource,
+        userInfo: userInfoAudience(block, modules),
+        context: async () => await instance().$context,
+        claimsFor,
+    });
+    const agents = checkedMcp === undefined ? undefined : tokensFor(checkedMcp.resource);
+    const ownTokens = ownAudience === undefined ? undefined : tokensFor(ownAudience);
+    const identityOf = requestIdentity({
+        auth: instance,
+        verifier: createTokenVerifier({
+            claims,
+            keys,
+            issuer,
+            tokenTtl,
+        }),
+        ...(agents === undefined ? {} : { agents }),
+        ...(ownTokens === undefined ? {} : { audience: ownTokens }),
+        kind,
+        crossSite,
+        claimsFor,
+    });
+    const state = requestState(identityOf, checked.principal);
+    const client = accessClient({
+        block,
+        kind,
+        claims,
+        baseOf: modules.getBaseURL,
+        isDynamicBaseURL: modules.isDynamicBaseURLConfig,
+        // Read untyped: Better Auth's API type is the app's, and `call` names its endpoints itself.
+        api: () => instance().api,
+        identityOf: async (headers, request) => verbMeOf(await identityOf(headers, request)),
+        calls: clientCalls,
+        refusal: modules.APIError,
+        identify: signInIdentifier(plugins),
+        context: () => instance()
+            .$context,
+        limit: verbRateLimiter({
+            context: async () => (await instance().$context),
+            ipOf: modules.getIP,
+            refusal: modules.APIError,
+            auditLog,
+        }),
+    });
+    const access = {
+        client,
+        // On the service profile, the handler's own last step: no session cookie
+        // leaves, whatever plugin or route set it.
+        handler: kind === "service"
+            ? async (request) => withoutSessionCookies(await instance().handler(request), sessionCookies((await instance().$context)))
+            : (request) => instance().handler(request),
+        options: effective,
+        $Infer: Object.freeze({}),
+        ...(registryStore === undefined
+            ? {}
+            : { registry: Object.freeze({ ...registryStore.operator }) }),
+        ...(kiosk === undefined
+            ? {}
+            : {
+                kiosk: Object.freeze(kiosk.operator(async () => (await instance().$context))),
+            }),
+        ...(beaconStore === undefined
+            ? {}
+            : { beacon: Object.freeze(beaconStore) }),
+        ...(agents === undefined || server === undefined
+            ? {}
+            : { mcp: mcpAuthorizationOf(agents, server) }),
+        state,
+    };
+    // `api` is read on use: reading it builds Better Auth. Not enumerable, so a walk
+    // over the instance (a configuration check, a log line) builds nothing.
+    Object.defineProperty(access, "api", {
+        get: () => instance().api,
+        enumerable: false,
+    });
+    // `policy` is built on first read, with the built-in rules over Better Auth's
+    // tables; not enumerable either, so a tool that loads the configuration and walks
+    // it (`npx auth generate`, which merges what the module exports) runs no startup
+    // check. The framework reads it by name.
+    Object.defineProperty(access, "policy", {
+        get: policyOf,
+        enumerable: false,
+    });
+    return access;
+}

package/dist/access/better-auth.hardening.d.ts

@@ -0,0 +1,120 @@
+import { type LanRange } from "../kiosk/lan-range.policy.js";
+import type { BetterAuthModules } from "./better-auth.loader.js";
+/** Better Auth's options, as the checks read them: any object. */
+export type BetterAuthBlock = {
+    readonly [key: string]: unknown;
+};
+/** The id of the Access plugin: `aventaraAccess()`, or the one `createAccess` installs. */
+export declare const ACCESS_PLUGIN_ID = "aventara-access";
+/** The id of Better Auth's `jwt()` plugin. */
+export declare const JWT_PLUGIN_ID = "jwt";
+/** A plugin id as Better Auth's checks could take it: no case, no surrounding space. */
+export declare const normalisedId: (id: unknown) => string | undefined;
+/** How a refusal names the one that installs the plugins it guards. */
+type PluginInstaller = {
+    /** Who installs them, as the sentence names it: `createAccess`, `aventaraAccess()`. */
+    readonly by: string;
+    /** Where the app put the plugin, as the sentence names it: `betterAuth.plugins`, `plugins`. */
+    readonly at: string;
+    /** The plugins it installs, by id, as a sentence names each. */
+    readonly installs: {
+        readonly [id: string]: string;
+    };
+    /** The one plugin of the list that is the installer's own (`aventaraAccess()` in its own list), skipped. */
+    readonly own?: unknown;
+    /** The installer serves Access's own `me` route (`createAccess`): a plugin defining it is refused too. */
+    readonly me?: boolean;
+    /** The installer serves the kiosk profile's routes: a plugin defining one (`/kiosk/…`) is refused too. */
+    readonly kiosk?: boolean;
+    /**
+     * The installer serves the registry (`registry: { enabled: true }`): a plugin
+     * defining one of its routes, or a middleware whose path reaches them, is refused
+     * too. Other plugins' `onRequest` and `hooks` run in the app's own process, inside
+     * its trust boundary, and are not checked.
+     */
+    readonly registry?: boolean;
+};
+/**
+ * The plugins of a Better Auth configuration, refusing one the installer puts in
+ * itself (under any case or spacing of its id) and one that defines `jwt()`'s
+ * endpoints. `ACCESS_PLUGIN_DUPLICATE`, with a sentence naming the plugin.
+ */
+export declare const refuseInstalledPlugins: (plugins: unknown, installer: PluginInstaller) => readonly unknown[];
+/**
+ * The issuer and audience of every token: the origin of Better Auth's base URL,
+ * fixed when Access starts, as Better Auth resolves it (`baseURL`, else its
+ * environment variables, `BETTER_AUTH_URL` first), or a dynamic `baseURL`'s
+ * `fallback`. Better Auth's own default follows the request's host when the base URL
+ * is dynamic or unset; a fixed one keeps a token from one host or app from passing
+ * as another's.
+ */
+export declare const issuerOf: (block: BetterAuthBlock, modules: Pick<BetterAuthModules, "getBaseURL" | "isDynamicBaseURLConfig">, baseURLAt: string) => string;
+/** Better Auth's base URL as {@link issuerOf} resolves it, as it was written (before the URL parser reads it). */
+export declare const baseURLOf: (block: BetterAuthBlock, modules: Pick<BetterAuthModules, "getBaseURL" | "isDynamicBaseURLConfig">, baseURLAt: string) => string;
+/**
+ * Whether the session cookie is `sameSite: "none"`: what Better Auth sets it with,
+ * `advanced.cookies.session_token.attributes` over `advanced.defaultCookieAttributes`.
+ * Refuses it when Better Auth trusts no origin: a session cookie a browser sends
+ * from any site is read only from the origins Better Auth trusts, so there must be
+ * some.
+ */
+export declare const crossSiteSessionCookie: (block: BetterAuthBlock, trustedOriginsAt: string) => boolean;
+/** Whether Better Auth's cookie cache is on: a session read from its cookie may have been revoked since. */
+export declare const cookieCacheOn: (block: BetterAuthBlock) => boolean;
+/**
+ * The kiosk profile's refusals of Better Auth's options, each a way around the
+ * device binding of a session:
+ *
+ * - the cookie cache: a session the device's lock ended would still be answered
+ *   from its cookie;
+ * - `secondaryStorage` without `session.storeSessionInDatabase`: a device's sessions
+ *   must be found in the database to be ended;
+ * - `bearer()`: it hands every session's token to page code (`set-auth-token`) and
+ *   reads it back from `Authorization`, where no device credential goes with it;
+ * - `multiSession()`: it keeps every session the browser signed into and switches
+ *   back to one by its token, so a cashier would restore the manager before them;
+ * - `crossSubDomainCookies` and `SameSite=None`: the device's credential and the
+ *   session would be sent to other hosts, or from other sites;
+ * - a plain http: base URL but on a loopback host, or (`profile.insecureLan`) on an
+ *   IPv4 address inside one of the till network's ranges: the device's credential
+ *   and the sessions would cross the network in the clear. On such a LAN address no
+ *   cookie may be `Secure` (or named `__Secure-` or `__Host-`): a browser drops it
+ *   over http, and the till would silently hold no session.
+ *
+ * Answers the ranges an http: base URL is served on under `profile.insecureLan`,
+ * for the startup warning; `undefined` when it is https: or loopback.
+ */
+export declare const refuseKioskOptions: (block: BetterAuthBlock, plugins: readonly unknown[], cookieCache: boolean, 
+/** The app's base URL as written (`baseURLOf`), and where the app set it. */
+written: string, baseURLAt: string, 
+/** `profile.insecureLan`, read. */
+insecureLan: readonly LanRange[] | undefined) => readonly LanRange[] | undefined;
+/**
+ * Better Auth's Prisma adapter's naming, when `database` is that adapter: read from
+ * the adapter the factory builds (its id, and `usePlural`). Building it touches no
+ * database, and Better Auth builds its own from the factory again when it starts,
+ * with its own options, so this one leaves nothing behind.
+ */
+export declare const prismaAdapterOf: (database: unknown, options: unknown) => {
+    readonly usePlural: boolean;
+} | undefined;
+/** The organization plugin among `plugins`, with its options; `undefined` when it is not installed. */
+export declare const organizationPluginOf: (plugins: readonly unknown[]) => {
+    readonly options: BetterAuthBlock;
+} | undefined;
+/**
+ * Refuses an organization plugin whose invitations a session with an unverified
+ * email may accept, when Access trusts its memberships (`reads` says how).
+ *
+ * Better Auth's advisory GHSA-fmh4-wcc4-5jm3: from better-auth 1.6.14 on, with
+ * Better Auth's own invitation ids, `acceptInvitation` takes a session whose email
+ * matches the invitation's and is not verified, unless the organization plugin sets
+ * `requireEmailVerificationOnInvitation: true`. Anyone who signs up with the invited
+ * address first and learns the invitation's id (a forwarded email, an admin screen,
+ * an invitation list) joins at the invited role. Better Auth ships no fix (the
+ * advisory lists `>= 1.6.14` with none; the GitHub advisory database's entry still
+ * says `< 1.6.11` only), so Access refuses to trust a membership the plugin let in
+ * that way. Fail closed: only `true`, given explicitly, passes.
+ */
+export declare const refuseUnverifiedInvitations: (plugins: readonly unknown[], reads: string) => void;
+export {};