@aventara/access 0.0.0-stage → 1.0.0-rc.1

package/dist/access/better-auth.require.d.ts

@@ -0,0 +1,90 @@
+import type { BetterAuthOptions, betterAuth } from "better-auth";
+import type { createAuthEndpoint } from "better-auth/api";
+import type { jwt } from "better-auth/plugins/jwt";
+import type { NodePasswordCrypto, PasswordHook } from "../passwords/argon2id.hasher.js";
+/**
+ * Better Auth's `getBaseURL`: the base URL it resolves from the one given, else from
+ * its environment variables (`BETTER_AUTH_URL` first), with `basePath` added.
+ */
+export type BetterAuthBaseURL = (url: string | undefined, basePath: string | undefined) => string | undefined;
+/**
+ * Better Auth's `createAuthMiddleware`, as Access calls it: a hook's handler from a
+ * function of the endpoint's context. Typed as Access uses it, so its generic
+ * context types are not instantiated for Access's own hooks.
+ */
+export type BetterAuthMiddlewareFactory = (handler: (context: never) => Promise<unknown>) => unknown;
+/** Better Auth's `APIError`, as Access throws it: a status (its name, or a number), an optional body (`message`, `code`) and headers. */
+export type BetterAuthAPIError = new (status: string | number, body?: {
+    readonly message?: unknown;
+    readonly code?: unknown;
+}, headers?: {
+    readonly [name: string]: string;
+}) => Error;
+/** Better Auth's `getSessionFromCtx`, as Access calls it: an endpoint's context in, its session (or `null`) out. */
+export type BetterAuthSessionReader = (context: never, config?: {
+    readonly disableCookieCache?: boolean;
+}) => Promise<unknown>;
+/**
+ * Better Auth's `getOAuthState`: the OAuth sign-in state of the request being
+ * handled (on a social callback, the state it parsed, `serverContext` the part the
+ * server set when the sign-in began); `null` when there is none.
+ */
+export type BetterAuthOAuthStateReader = () => Promise<{
+    readonly serverContext?: {
+        readonly [key: string]: unknown;
+    };
+} | null>;
+/** Better Auth's `setSessionCookie` and `deleteSessionCookie`, as Access calls them on an endpoint's context. */
+export type BetterAuthSessionCookies = {
+    readonly setSessionCookie: (context: never, session: {
+        readonly session: unknown;
+        readonly user: unknown;
+    }, dontRememberMe?: boolean) => Promise<void>;
+    readonly deleteSessionCookie: (context: never) => void;
+};
+/** What hashing passwords takes from Node.js and Better Auth. */
+export type BetterAuthPasswords = {
+    /** Node.js's `node:crypto`; `argon2` is missing before Node.js 24.7.0. */
+    readonly crypto: Partial<NodePasswordCrypto>;
+    /** Better Auth's scrypt verify (`better-auth/crypto`), for hashes stored before argon2id. */
+    readonly verifyScrypt: PasswordHook["verify"];
+};
+/**
+ * What loading Better Auth gave: its entry (with `getAuthTables` and its base URL
+ * rules), its `jwt()` plugin, its plugin API (endpoints, hooks and their error) and
+ * what hashing passwords takes (Node.js's `node:crypto` and Better Auth's scrypt
+ * verify), the error a `require` threw, or `undefined` where the runtime has no
+ * Node.js module loader.
+ */
+export type BetterAuthRequired = {
+    readonly core: {
+        readonly betterAuth: typeof betterAuth;
+        /** Better Auth's tables for a set of options: its own, and its plugins'. */
+        readonly getAuthTables: (options: BetterAuthOptions) => unknown;
+        readonly getBaseURL: BetterAuthBaseURL;
+        readonly isDynamicBaseURLConfig: (baseURL: unknown) => boolean;
+    };
+    readonly plugin: {
+        readonly jwt: typeof jwt;
+    };
+    readonly api: {
+        readonly createAuthEndpoint: typeof createAuthEndpoint;
+        readonly createAuthMiddleware: BetterAuthMiddlewareFactory;
+        readonly APIError: BetterAuthAPIError;
+        /** The origin check Better Auth's router runs before every route, as a hook's handler. */
+        readonly originCheckMiddleware: unknown;
+        /** The client address Better Auth's options read from a request's headers. */
+        readonly getIP: (headers: Headers, options: unknown) => string | null;
+        /** The session an endpoint's request carries, as Better Auth's own routes read it. */
+        readonly getSessionFromCtx: BetterAuthSessionReader;
+        /** The OAuth sign-in state of the request being handled. */
+        readonly getOAuthState: BetterAuthOAuthStateReader;
+    };
+    /** Better Auth's session cookies (`better-auth/cookies`). */
+    readonly cookies: BetterAuthSessionCookies;
+    readonly passwords: BetterAuthPasswords;
+} | {
+    readonly error: unknown;
+} | undefined;
+/** No Node.js module loader here: nothing to load Better Auth with. */
+export declare const requireBetterAuth: () => BetterAuthRequired;

package/dist/access/better-auth.require.js

@@ -0,0 +1,6 @@
+// Better Auth, where no Node.js module loader exists: a browser, an edge runtime.
+// The package's `#better-auth.require` import resolves here under every condition
+// but `node`, so the engine can be bundled for those runtimes without naming a
+// Node.js API; `createAccess` there refuses, since Better Auth runs on Node.js.
+/** No Node.js module loader here: nothing to load Better Auth with. */
+export const requireBetterAuth = () => undefined;

package/dist/access/better-auth.require.node.d.ts

@@ -0,0 +1,7 @@
+import type { BetterAuthRequired } from "./better-auth.require.js";
+/**
+ * Better Auth's entry, its `jwt()` plugin, its plugin API, and what hashing
+ * passwords takes (Node.js's `node:crypto`, Better Auth's scrypt verify), or the
+ * error loading them threw.
+ */
+export declare const requireBetterAuth: () => BetterAuthRequired;

package/dist/access/better-auth.require.node.js

@@ -0,0 +1,52 @@
+// Better Auth, required from Node.js's own module loader. This is the module the
+// package's `#better-auth.require` import resolves to under the `node` condition:
+// Node.js itself, and a bundler building for Node.js (Next.js's server, with
+// Turbopack or webpack). A bundler reads `createRequire(import.meta.url)` and the
+// `require` calls below as dependencies, so `better-auth` goes into the server bundle
+// and its traced output with the rest of the app; inside `try`, a `better-auth` that
+// is not installed is no build error, only the refusal `createAccess` reports.
+// Browsers and edge runtimes resolve the other module, which names no Node.js API.
+//
+// Hashing passwords takes Node.js's `crypto.argon2` (Node.js 24.7.0 and later). On
+// Node.js 22, which lacks it, `@node-rs/argon2` (an exact optional peer) stands in,
+// required only then; not installed, `createAccess` refuses.
+import { createRequire } from "node:module";
+import { passwordCryptoOf, } from "../passwords/node-rs-argon2.adapter.js";
+const require = createRequire(import.meta.url);
+/** `@node-rs/argon2`, or `undefined` when it is not installed. */
+const requireNodeRsArgon2 = () => {
+    try {
+        return require("@node-rs/argon2");
+    }
+    catch (error) {
+        const { code, message } = (error ?? {});
+        if (code === "MODULE_NOT_FOUND" &&
+            typeof message === "string" &&
+            message.includes("'@node-rs/argon2'")) {
+            return undefined;
+        }
+        throw error;
+    }
+};
+/**
+ * Better Auth's entry, its `jwt()` plugin, its plugin API, and what hashing
+ * passwords takes (Node.js's `node:crypto`, Better Auth's scrypt verify), or the
+ * error loading them threw.
+ */
+export const requireBetterAuth = () => {
+    try {
+        return {
+            core: require("better-auth"),
+            plugin: require("better-auth/plugins/jwt"),
+            api: require("better-auth/api"),
+            cookies: require("better-auth/cookies"),
+            passwords: {
+                crypto: passwordCryptoOf(require("node:crypto"), requireNodeRsArgon2),
+                verifyScrypt: require("better-auth/crypto").verifyPassword,
+            },
+        };
+    }
+    catch (error) {
+        return { error };
+    }
+};

package/dist/access/claims.mapper.d.ts

@@ -0,0 +1,79 @@
+import type { AccessClaimType } from "../policies-contract.js";
+/** `policies.claims`: each global claim the tokens carry, by its type. */
+export type AccessClaimsDeclaration = {
+    readonly [claim: string]: "string" | "number" | "boolean";
+};
+/** The claims a declaration allows: each one optional, typed as declared. */
+export type AccessClaimsOf<C extends AccessClaimsDeclaration> = {
+    readonly [K in keyof C]?: C[K] extends "string" ? string : C[K] extends "number" ? number : C[K] extends "boolean" ? boolean : never;
+};
+/**
+ * What `policies.claimsOf` answers: the declared claims, each typed as declared,
+ * where every declared boolean claim is required. A token always carries its
+ * boolean claims, so one the answer forgot would be minted `false`: a ban it never
+ * read would read as no ban. The other claims stay optional.
+ */
+export type AccessClaimsAnswer<C extends AccessClaimsDeclaration> = AccessClaimsOf<C> & {
+    readonly [K in keyof C as C[K] extends "boolean" ? K : never]: boolean;
+};
+/** Who a verified token or session says the caller is: the login (`sub`) and its declared claims. */
+export type AccessIdentity<C extends AccessClaimsDeclaration> = {
+    readonly sub: string;
+    readonly claims: AccessClaimsOf<C>;
+};
+/** What a claims function reads: Better Auth's user and session, as the session endpoint returns them. */
+export type AccessClaimsSource = {
+    readonly user: {
+        readonly id: string;
+    } & {
+        readonly [field: string]: unknown;
+    };
+    readonly session: {
+        readonly [field: string]: unknown;
+    };
+};
+type ClaimsMap = {
+    readonly [claim: string]: string | number | boolean;
+};
+/** `policies.claims`, checked: an object of claim names to `"string"`, `"number"` or `"boolean"`. */
+export declare const checkClaimsDeclaration: (declared: unknown) => AccessClaimsDeclaration;
+/**
+ * Refuses a file whose rules (a policies file) or guardrails (a guardrails file) read
+ * a claim the declaration does not have, or read it as another type.
+ */
+export declare const checkRulesClaims: (file: {
+    readonly claims: {
+        readonly [claim: string]: AccessClaimType;
+    };
+}, declared: AccessClaimsDeclaration, reader?: "rules" | "guardrails") => void;
+/** One field of Better Auth's user table, as `getAuthTables(options).user.fields` states it. */
+type UserField = {
+    readonly input?: boolean;
+};
+/**
+ * Refuses a declared claim that the default mapping (no `claimsOf`) would read from
+ * a user field a user can set themselves: one without `input: false`, which Better
+ * Auth takes from the sign-up body and from `/update-user`. A claim from it would be
+ * whatever the user chose (`role: "admin"`). The fields are the user table's as
+ * Better Auth is built: its own, its plugins' and `user.additionalFields`.
+ */
+export declare const checkClaimSources: (declared: AccessClaimsDeclaration, userFields: {
+    readonly [field: string]: UserField;
+} | undefined) => void;
+/**
+ * The claims a signed-in user's token is issued with. With `claimsOf`, its answer,
+ * which must name every declared boolean claim; without, each declared claim is read
+ * from the user's field of the same name (a Better Auth `user.additionalFields`
+ * entry, say). Every declared boolean claim is issued: one left unset (`null` or
+ * `undefined`, or a field the user record lacks) is `false`.
+ */
+export declare const issuedClaims: (source: AccessClaimsSource, declared: AccessClaimsDeclaration, claimsOf: ((source: AccessClaimsSource) => unknown | Promise<unknown>) | undefined) => Promise<ClaimsMap>;
+/**
+ * The claims a verified token's payload carries, or `undefined` when it carries
+ * anything beyond `sub`, the registered claims and the declared ones: an
+ * undeclared claim is a token Access did not issue, and is refused.
+ */
+export declare const acceptedClaims: (payload: {
+    readonly [key: string]: unknown;
+}, declared: AccessClaimsDeclaration) => ClaimsMap | undefined;
+export {};

package/dist/access/claims.mapper.js

@@ -0,0 +1,152 @@
+// Claims: the global facts about a user that travel in the token, beside `sub`.
+// `policies.claims` declares each one's type; it is the one list three places are
+// held to: the claims the rules read, the claims a token is issued with, and the
+// claims a token is accepted with. Nothing undeclared passes any of the three.
+import { isRecord } from "../policies.compiler.js";
+import { AccessError } from "./access.error.js";
+/** The JWT's registered claims, which no declaration may take. */
+const REGISTERED = new Set(["sub", "iat", "exp", "nbf", "iss", "aud", "jti"]);
+const SCALARS = new Set(["string", "number", "boolean"]);
+const listed = (names) => names.length === 0 ? "none" : names.join(", ");
+/**
+ * What a refused value is, never the value itself: a claim comes from a user's
+ * record, and an error's message reaches logs.
+ */
+const kindOf = (value) => Array.isArray(value)
+    ? "an array"
+    : value === null
+        ? "null"
+        : typeof value === "object"
+            ? "an object"
+            : typeof value === "undefined"
+                ? "undefined"
+                : `a ${typeof value}`;
+/** `policies.claims`, checked: an object of claim names to `"string"`, `"number"` or `"boolean"`. */
+export const checkClaimsDeclaration = (declared) => {
+    if (!isRecord(declared)) {
+        throw new AccessError("ACCESS_OPTIONS_INVALID", '`policies.claims` declares the token\'s claims by type, as an object: `{ role: "string" }`, or `{}` for none.');
+    }
+    for (const [claim, type] of Object.entries(declared)) {
+        if (claim === "__proto__") {
+            throw new AccessError("ACCESS_OPTIONS_INVALID", "`policies.claims.__proto__` names the prototype of a JavaScript object, which no claim can be; give the claim another name.");
+        }
+        if (REGISTERED.has(claim)) {
+            throw new AccessError("ACCESS_OPTIONS_INVALID", `\`policies.claims.${claim}\` is a registered JWT claim, which the token sets itself; declare only your own claims.`);
+        }
+        if (typeof type !== "string" || !SCALARS.has(type)) {
+            throw new AccessError("ACCESS_OPTIONS_INVALID", `\`policies.claims.${claim}\` is ${JSON.stringify(type)}; a claim is declared as "string", "number" or "boolean".`);
+        }
+    }
+    return declared;
+};
+/**
+ * Refuses a file whose rules (a policies file) or guardrails (a guardrails file) read
+ * a claim the declaration does not have, or read it as another type.
+ */
+export const checkRulesClaims = (file, declared, reader = "rules") => {
+    const fix = reader === "rules" ? "correct the rule" : "correct the guardrails";
+    for (const [claim, { scalar }] of Object.entries(file.claims)) {
+        const type = declared[claim];
+        if (type === undefined) {
+            throw new AccessError("ACCESS_CLAIMS_UNDECLARED", `the ${reader} read the claim \`${claim}\`, which \`policies.claims\` does not declare (it declares ${listed(Object.keys(declared))}); declare it, or ${fix}.`);
+        }
+        if (type !== scalar) {
+            throw new AccessError("ACCESS_CLAIMS_UNDECLARED", `the ${reader} compare the claim \`${claim}\` with a ${scalar}, and \`policies.claims\` declares it as ${type}; make the two agree.`);
+        }
+    }
+};
+/** The declared claims of one map, each checked against its type; `null` and `undefined` mean the claim is absent. */
+const declaredClaims = (from, values, declared) => {
+    const claims = {};
+    for (const [claim, value] of Object.entries(values)) {
+        const type = Object.hasOwn(declared, claim) ? declared[claim] : undefined;
+        if (type === undefined) {
+            throw new AccessError("ACCESS_CLAIMS_UNDECLARED", `${from} returned the claim \`${claim}\`, which \`policies.claims\` does not declare (it declares ${listed(Object.keys(declared))}); declare it, or leave it out.`);
+        }
+        if (value === null || value === undefined) {
+            continue;
+        }
+        if (typeof value !== type) {
+            throw new AccessError("ACCESS_CLAIMS_UNDECLARED", `${from} returned the claim \`${claim}\` as ${kindOf(value)}, and \`policies.claims\` declares it as ${type}.`);
+        }
+        claims[claim] = value;
+    }
+    return claims;
+};
+/**
+ * Refuses a declared claim that the default mapping (no `claimsOf`) would read from
+ * a user field a user can set themselves: one without `input: false`, which Better
+ * Auth takes from the sign-up body and from `/update-user`. A claim from it would be
+ * whatever the user chose (`role: "admin"`). The fields are the user table's as
+ * Better Auth is built: its own, its plugins' and `user.additionalFields`.
+ */
+export const checkClaimSources = (declared, userFields) => {
+    for (const claim of Object.keys(declared)) {
+        const field = userFields?.[claim];
+        if (field !== undefined && field.input !== false) {
+            throw new AccessError("ACCESS_OPTIONS_INVALID", `the claim \`${claim}\` is read from the user's field \`${claim}\`, which a user can set themselves (at sign-up, or with \`/update-user\`): a claim from it would be the user's own choice. Give the field \`input: false\` in Better Auth's options, or return the claim from \`policies.claimsOf\`.`);
+        }
+    }
+};
+/**
+ * Every declared boolean claim, `false` where the user has none: a flag that is not
+ * set is minted as not set. The engine reads a missing claim as unknown, so a deny
+ * such as `banned: true` matches a token that lacks it (a foreign or stale one); a
+ * token Access issues never lacks one.
+ */
+const withBooleans = (claims, declared) => {
+    const minted = { ...claims };
+    for (const [claim, type] of Object.entries(declared)) {
+        if (type === "boolean" && !Object.hasOwn(minted, claim)) {
+            minted[claim] = false;
+        }
+    }
+    return minted;
+};
+/**
+ * The claims a signed-in user's token is issued with. With `claimsOf`, its answer,
+ * which must name every declared boolean claim; without, each declared claim is read
+ * from the user's field of the same name (a Better Auth `user.additionalFields`
+ * entry, say). Every declared boolean claim is issued: one left unset (`null` or
+ * `undefined`, or a field the user record lacks) is `false`.
+ */
+export const issuedClaims = async (source, declared, claimsOf) => {
+    if (claimsOf === undefined) {
+        const sameNamed = {};
+        for (const claim of Object.keys(declared)) {
+            sameNamed[claim] = source.user[claim];
+        }
+        return withBooleans(declaredClaims("the user's fields", sameNamed, declared), declared);
+    }
+    const answer = await claimsOf(source);
+    if (!isRecord(answer)) {
+        throw new AccessError("ACCESS_OPTIONS_INVALID", "`policies.claimsOf` returns the user's claims as an object: `{ role: user.role }`, or `{}` for none.");
+    }
+    // A boolean claim `claimsOf` forgot would be minted `false`: a ban it never read
+    // would read as no ban. Its key must be there; `null` or `undefined` is `false`.
+    for (const [claim, type] of Object.entries(declared)) {
+        if (type === "boolean" && !Object.hasOwn(answer, claim)) {
+            throw new AccessError("ACCESS_OPTIONS_INVALID", `\`policies.claimsOf\` returned no \`${claim}\`, a boolean claim \`policies.claims\` declares; every token carries it, so return it: \`${claim}: user.${claim} === true\`.`);
+        }
+    }
+    return withBooleans(declaredClaims("`policies.claimsOf`", answer, declared), declared);
+};
+/**
+ * The claims a verified token's payload carries, or `undefined` when it carries
+ * anything beyond `sub`, the registered claims and the declared ones: an
+ * undeclared claim is a token Access did not issue, and is refused.
+ */
+export const acceptedClaims = (payload, declared) => {
+    const claims = {};
+    for (const [key, value] of Object.entries(payload)) {
+        if (REGISTERED.has(key)) {
+            continue;
+        }
+        const type = Object.hasOwn(declared, key) ? declared[key] : undefined;
+        if (type === undefined || typeof value !== type) {
+            return undefined;
+        }
+        claims[key] = value;
+    }
+    return claims;
+};

package/dist/access/key-set.cache.d.ts

@@ -0,0 +1,10 @@
+import { type JSONWebKeySet, type JWTVerifyGetKey } from "jose";
+type KeySetCache = {
+    /**
+     * Runs `verify` with the current key set and, when the token names a key the set
+     * does not hold, once more with a fresh read of it. Rethrows what `verify` throws.
+     */
+    withKeys<T>(verify: (keys: JWTVerifyGetKey) => Promise<T>): Promise<T>;
+};
+export declare const createKeySetCache: (keys: () => Promise<JSONWebKeySet>, now: () => number) => KeySetCache;
+export {};

package/dist/access/key-set.cache.js

@@ -0,0 +1,63 @@
+// The key set Better Auth's `jwt()` plugin publishes, as Access's verifiers read it:
+// read once and kept, and read again when it is older than its TTL, so a key removed
+// from the set stops verifying within that TTL. A token signed with a key the cache
+// does not hold (a rotation) reads the set at once, no more often than every few
+// seconds. A read that fails keeps the last good set, so a token keeps verifying
+// while the key store is down. Each verifier builds its own cache (`createKeySetCache`
+// per call): the session tokens' verifier, and each access-token verifier (the MCP
+// endpoint's, the service's own audience), so each reads the one key set `jwt()`
+// signs both kinds with on its own schedule.
+import { createLocalJWKSet, errors, } from "jose";
+/** How long a key set read is kept before it is read again. */
+const KEY_SET_TTL_MS = 300_000;
+/** How long after a read (or a failed one) the key set may be read again early. */
+const REFRESH_AFTER_MS = 5_000;
+export const createKeySetCache = (keys, now) => {
+    let keySet;
+    let readAt = Number.NEGATIVE_INFINITY;
+    let triedAt = Number.NEGATIVE_INFINITY;
+    let reading;
+    const read = () => {
+        reading ??= keys()
+            .then((set) => {
+            keySet = createLocalJWKSet(set);
+            readAt = now();
+            return keySet;
+        })
+            .finally(() => {
+            triedAt = now();
+            reading = undefined;
+        });
+        return reading;
+    };
+    /** The key set, read again once it is stale; the last good one when that read fails. */
+    const current = async () => {
+        const kept = keySet;
+        if (kept === undefined) {
+            return read();
+        }
+        if (now() - readAt >= KEY_SET_TTL_MS &&
+            now() - triedAt >= REFRESH_AFTER_MS) {
+            return read().catch(() => kept);
+        }
+        return kept;
+    };
+    return {
+        async withKeys(verify) {
+            try {
+                return await verify(await current());
+            }
+            catch (error) {
+                if (!(error instanceof errors.JWKSNoMatchingKey) ||
+                    now() - triedAt < REFRESH_AFTER_MS) {
+                    throw error;
+                }
+                const refreshed = await read().catch(() => undefined);
+                if (refreshed === undefined) {
+                    throw error;
+                }
+                return verify(refreshed);
+            }
+        },
+    };
+};

package/dist/access/policies-block.checker.d.ts

@@ -0,0 +1,64 @@
+import { type AccessEngine, type PoliciesSource } from "../access.engine.js";
+import { type AuditLog } from "../audit/audit.log.js";
+import type { AccessGuardrails } from "../guardrails/guardrails-contract.js";
+import type { AccessLock } from "../lock/lock-contract.js";
+import type { AccessPolicies } from "../policies-contract.js";
+import { type AuthTable, type AuthTableNaming } from "../resources/auth-tables.catalog.js";
+import { type ResourcesChoice } from "../resources/auth-tables.guard.js";
+import { type BetterAuthBlock } from "./better-auth.hardening.js";
+import type { BetterAuthModules } from "./better-auth.loader.js";
+import { type AccessClaimsDeclaration, type AccessClaimsSource } from "./claims.mapper.js";
+/** The engine's options from the `policies` block: guardrails, lock, `requireLock`. */
+type EngineOptions = {
+    readonly guardrails?: AccessGuardrails;
+    readonly lock?: AccessLock;
+    readonly requireLock?: boolean;
+} | undefined;
+/** The `policies` block and `principal`, checked. */
+export type CheckedPolicies = {
+    readonly claims: AccessClaimsDeclaration;
+    /** The rules' file: the compiled builder, or the file given. */
+    readonly file: AccessPolicies;
+    readonly source: PoliciesSource;
+    readonly engineOptions: EngineOptions;
+    readonly claimsOf: ((source: AccessClaimsSource) => unknown) | undefined;
+    readonly tokenTtl: number;
+    readonly principal: ((identity: never) => unknown) | undefined;
+};
+/** Refuses a `policies` block (`given`) and a `principal` that Access does not take. */
+export declare const checkPoliciesBlock: (given: unknown, principal: unknown) => CheckedPolicies;
+/**
+ * The engine the framework asks, with Access's built-in rules over Better Auth's
+ * tables (as Better Auth is built: its plugins' tables and Access's own included),
+ * named as the app's schema names them, the audit log's observer when it is on, and
+ * the agent gate before it all (`mcp/agent-scope.gate.ts`): a principal an agent's
+ * access token yielded is held to that token's audience and scopes first.
+ */
+export declare const guardedPolicy: (input: {
+    readonly checked: CheckedPolicies;
+    readonly auditLog: AuditLog | undefined;
+    readonly resources: ResourcesChoice;
+    readonly tables: ReadonlyMap<string, AuthTable>;
+    readonly naming: AuthTableNaming;
+}) => AccessEngine;
+/** Better Auth's tables as the rules' schema names them, and how it names them. */
+export type BetterAuthTablesFacts = {
+    readonly tables: ReadonlyMap<string, AuthTable>;
+    readonly naming: AuthTableNaming;
+};
+/**
+ * Better Auth's tables for the options it is built with (`options`, its plugins and
+ * Access's own included), checked against the claims and the rules: a declared
+ * claim the default mapping (no `claimsOf`) reads must come from a user field the
+ * user cannot set (`bridged`, the claims the organization bridge fills, are not read
+ * from the user); and the rules' schema names each table, on the Prisma adapter by
+ * the models it reads, on any other by `resources.authTables`.
+ */
+export declare const betterAuthTablesFor: (input: {
+    readonly options: BetterAuthBlock;
+    readonly modules: Pick<BetterAuthModules, "getAuthTables">;
+    readonly checked: CheckedPolicies;
+    readonly resources: ResourcesChoice;
+    readonly bridged?: readonly string[];
+}) => BetterAuthTablesFacts;
+export {};