@btst/stack 3.0.0-rc.2 → 3.0.0-rc.4

package/dist/components/stepped-auto-form/index.d.mts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { z } from 'zod';
 import { UseFormReturn } from 'react-hook-form';
-import { a as FieldConfig } from '../../shared/stack.CPsYC2-Z.mjs';
+import { a as FieldConfig } from '../../shared/stack.fdi94T4S.mjs';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.mjs';
 
 interface StepperComponentProps {

package/dist/components/stepped-auto-form/index.d.ts

@@ -2,7 +2,7 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 import { z } from 'zod';
 import { UseFormReturn } from 'react-hook-form';
-import { a as FieldConfig } from '../../shared/stack.CPsYC2-Z.js';
+import { a as FieldConfig } from '../../shared/stack.fdi94T4S.js';
 import { Z as ZodObjectOrWrapped } from '../../shared/stack.CZMWR72v.js';
 
 interface StepperComponentProps {

package/dist/context/index.cjs

@@ -1,6 +1,8 @@
 'use strict';
 
 const provider = require('../packages/stack/src/context/provider.cjs');
+const router = require('../packages/stack/src/context/router.cjs');
+const siteNavigation = require('../packages/stack/src/context/site-navigation.cjs');
 const auth = require('../packages/stack/src/context/auth.cjs');
 const notify = require('../packages/stack/src/context/notify.cjs');
 const i18n = require('../packages/stack/src/context/i18n.cjs');
@@ -12,9 +14,13 @@ exports.useBasePath = provider.useBasePath;
 exports.usePluginOverrides = provider.usePluginOverrides;
 exports.useStack = provider.useStack;
 exports.useStackOrNull = provider.useStackOrNull;
-exports.CanAccess = auth.CanAccess;
-exports.useCan = auth.useCan;
+exports.joinBasePath = router.joinBasePath;
+exports.usePluginSiteNavigation = siteNavigation.usePluginSiteNavigation;
+exports.PermissionAccess = auth.PermissionAccess;
+exports.PermissionCheck = auth.PermissionCheck;
 exports.useIdentity = auth.useIdentity;
+exports.useIdentityResolutionPromise = auth.useIdentityResolutionPromise;
+exports.useIdentitySourceGeneration = auth.useIdentitySourceGeneration;
 exports.defaultNotifyProvider = notify.defaultNotifyProvider;
 exports.useNotify = notify.useNotify;
 exports.useTranslate = i18n.useTranslate;

package/dist/context/index.d.cts

@@ -1,8 +1,18 @@
+import * as React$1 from 'react';
+import { ReactNode, ReactElement } from 'react';
+import { QueryClient } from '@tanstack/react-query';
+import { v as ResolvedClientStack, T as InferredPluginOverrides, U as RegisteredClientPlugins, y as ClientLocation, H as ClientProviderPluginRuntime, K as ClientStackContext } from '../shared/stack.DiuRuzIs.cjs';
+import { S as StackClientAuth, a as StackIdentity } from '../shared/stack.BYMentwB.cjs';
+import { a as StackRouterConfig, b as StackRouter, c as StackApiConfig, d as StackClientLike } from '../shared/stack.BRvqQWGt.cjs';
+export { j as joinBasePath } from '../shared/stack.BRvqQWGt.cjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { ReactNode } from 'react';
-import { a as StackAuthProvider, C as CanParams, b as StackIdentity } from '../shared/stack.C4_gEENS.cjs';
-export { S as StackServerAuthProvider } from '../shared/stack.C4_gEENS.cjs';
-import { S as StackRouterConfig, a as StackApiConfig, b as StackRouter } from '../shared/stack.aqVZ6PEW.cjs';
+import { PermissionRequest } from '../authorization/index.cjs';
+import '@btst/yar';
+import '@btst/db';
+import 'better-call';
+import '../authorization/server.cjs';
+import '../shared/stack.CKXzdGiJ.cjs';
+import 'zod';
 
 /**
  * Optional i18n provider, passed to `StackProvider` via the `i18n` prop.
@@ -83,31 +93,67 @@ interface StackContextValue<TPluginOverrides extends Record<string, any>> {
      * Top-level API config applied to all plugins.
      */
     api?: StackApiConfig;
+    /** Resolved top-level site location used to compare plugin site origins. */
+    site?: ClientLocation;
+    /** Effective browser-safe runtime for each registered client plugin. */
+    plugins?: Record<string, ClientProviderPluginRuntime>;
+    /** The query client owned by the resolved client stack. */
+    queryClient?: QueryClient;
+    /** Resolved plugin definitions used by client-only introspection helpers. */
+    clientStackContext?: ClientStackContext;
+    /** Canonical resolved stack supplied to this provider. */
+    resolvedStack?: StackClientLike;
     /** Top-level auth provider used by identity-aware components. */
-    auth?: StackAuthProvider;
+    auth?: StackClientAuth;
 }
-/**
- * The `overrides` prop shape for `StackProvider`.
- * Plugin blocks are optional; fields inside each block retain the plugin's
- * declared requirements.
- */
-type StackProviderOverrides<TPluginOverrides extends Record<string, any>> = Partial<TPluginOverrides>;
+type StackProviderServices = {
+    children?: ReactNode;
+    router?: StackRouterConfig;
+    /**
+     * Browser authorization created by `createClientAuth()`. When omitted,
+     * identity is `null` and presentation-only descriptor checks remain
+     * permissive; backend authorization is independent and authoritative.
+     */
+    auth?: StackClientAuth;
+    /**
+     * Request identity resolved on the server. `undefined` means no snapshot was
+     * supplied; `null` is an explicitly hydrated anonymous identity.
+     */
+    initialIdentity?: StackIdentity | null;
+    notify?: StackNotifyProvider;
+    i18n?: StackI18nProvider;
+};
+type CanonicalStackProviderOverrideProps<TStack extends ResolvedClientStack<any, any>> = InferredPluginOverrides<NoInfer<RegisteredClientPlugins<TStack>>> extends infer TOverrides extends Record<string, any> ? {} extends TOverrides ? {
+    overrides?: TOverrides;
+} : {
+    overrides: TOverrides;
+} : never;
+type CanonicalStackProviderProps<TStack extends ResolvedClientStack<any, any>> = StackProviderServices & {
+    /** Resolved browser client stack; supplies API/site/plugin runtime once. */
+    stack: TStack;
+    /** API configuration belongs to createClientStack(). */
+    api?: never;
+    /** Site paths belong to createClientStack(). */
+    basePath?: never;
+} & CanonicalStackProviderOverrideProps<TStack>;
 /**
  * Provider component for BTST context
  * Provides type-safe access to plugin-specific overrides
  *
- * Only requires override values, not plugin objects - keeps bundle size minimal!
- *
  * @example
  * ```tsx
- * // Define the type shape (no import of plugin values needed!)
- * type MyPluginOverrides = {
- *   messages: MessagesPluginOverrides;
- * };
+ * const clientStack = createClientStack({
+ *   api,
+ *   site,
+ *   queryClient,
+ *   plugins: {
+ *     messages: messagesClientPlugin(),
+ *   },
+ * });
  *
- * <StackProvider<MyPluginOverrides>
+ * <StackProvider
+ *   stack={clientStack}
  *   router={frameworkRouter}
- *   api={{ baseURL, basePath: "/api/data" }}
  *   overrides={{
  *     messages: {
  *       MarkdownRenderer: (props) => <ReactMarkdown {...props} />,
@@ -118,49 +164,24 @@ type StackProviderOverrides<TPluginOverrides extends Record<string, any>> = Part
  * </StackProvider>
  * ```
  *
- * Framework router and API wiring live at the top level. Per-plugin overrides
- * carry only genuinely plugin-specific values:
+ * Runtime locations and plugin override types come from the resolved stack.
+ * Framework services and optional identity hydration remain provider concerns.
  *
  * @example
  * ```tsx
  * import { nextRouter } from "@btst/stack/next";
  *
- * <StackProvider<MyPluginOverrides>
- *   basePath="/pages"
+ * <StackProvider
+ *   stack={clientStack}
  *   router={nextRouter()}
- *   api={{ baseURL, basePath: "/api/data" }}
- *   overrides={{
- *     blog: { uploadImage },
- *   }}
+ *   auth={clientAuth}
+ *   initialIdentity={initialIdentity}
  * >
  *   {children}
  * </StackProvider>
  * ```
  */
-declare function StackProvider<TPluginOverrides extends Record<string, any> = Record<string, any>>({ children, overrides, basePath, router, api, auth, notify, i18n, }: {
-    children?: ReactNode;
-    overrides?: StackProviderOverrides<TPluginOverrides>;
-    basePath: string;
-    router?: StackRouterConfig;
-    api?: StackApiConfig;
-    /**
-     * Optional auth provider. When set, `useIdentity()` / `useCan()` and
-     * `<CanAccess>` resolve identity and permissions through it. When omitted,
-     * behavior is identical to before: identity is `null` and all permission
-     * checks pass.
-     */
-    auth?: StackAuthProvider;
-    /**
-     * Optional notification provider. When omitted, sonner toasts are used via
-     * `useNotify()`.
-     */
-    notify?: StackNotifyProvider;
-    /**
-     * Optional i18n provider. When omitted, `useTranslate()` returns English
-     * defaults with `{{param}}` interpolation.
-     */
-    i18n?: StackI18nProvider;
-}): react_jsx_runtime.JSX.Element;
+declare function StackProvider<const TStack extends ResolvedClientStack<any, any>>({ children, overrides, stack, router, auth, initialIdentity, notify, i18n, }: CanonicalStackProviderProps<TStack>): ReactElement;
 /**
  * Hook to access the entire BTST context
  * Useful if you need access to multiple plugins or the full context
@@ -222,6 +243,24 @@ declare function usePluginOverrides<TOverrides = any, TDefaults extends Partial<
  */
 declare function useBasePath(): string;
 
+/**
+ * Resolve one registered plugin's page links and programmatic navigation.
+ *
+ * Uses the plugin's resolved site endpoint, including per-plugin overrides.
+ * Same-origin destinations use the configured router; cross-origin destinations
+ * and stacks without a router use full-page browser navigation.
+ */
+declare function usePluginSiteNavigation(pluginId: string): {
+    Link: string | React$1.ComponentType<React$1.ClassAttributes<HTMLAnchorElement> & React$1.AnchorHTMLAttributes<HTMLAnchorElement> & Record<string, any>>;
+    navigate: (...segments: string[]) => void | Promise<void>;
+    resolve: (...segments: string[]) => {
+        path: string;
+        href: string;
+        crossOrigin: boolean;
+    };
+};
+
+type AnyPermissionRequest = PermissionRequest;
 /**
  * Returns the current user's identity as resolved by the auth provider
  * configured on `StackProvider`.
@@ -237,51 +276,34 @@ declare function useBasePath(): string;
 declare function useIdentity(): {
     identity: StackIdentity | null;
     isPending: boolean;
+    error?: Error;
     refetch: () => Promise<void>;
 };
+/** @internal Serializable identity-resolution key for protected query caches. */
+declare function useIdentitySourceGeneration(): number;
+/** @internal Promise that settles when the current identity lookup finishes. */
+declare function useIdentityResolutionPromise(): Promise<void> | undefined;
 type CanState = {
     can: boolean;
     isPending: boolean;
 };
+/** State yielded by a plugin-owned permission descriptor gate. */
+type PermissionCheckState = CanState & {
+    error?: Error;
+};
 /**
- * Checks whether the current user can perform `action` on `resource` using
- * the auth provider's `can()` function.
- *
- * Resolves to `{ can: true, isPending: false }` immediately when no auth
- * provider is configured or the provider has no `can()` function — permission
- * checks are opt-in and non-breaking.
- *
- * While the identity or the `can()` result is still resolving, returns
- * `{ can: false, isPending: true }` so callers can avoid flashing
- * permission-gated UI.
- *
- * @example
- * ```tsx
- * const { can, isPending } = useCan({ resource: "blog:post", action: "delete" });
- * if (!isPending && can) return <DeletePostButton />;
- * ```
- */
-declare function useCan(params: CanParams): CanState;
-/**
- * Element-level permission gate (Refine's `<CanAccess>` pattern).
- *
- * - Without an auth provider configured, always renders `children`.
- * - While the check is pending, renders `loading` (default `null`) to avoid
- *   flashing gated UI.
- * - Renders `children` when `can()` allows, `fallback` (default `null`)
- *   otherwise.
- *
- * @example
- * ```tsx
- * <CanAccess resource="blog:post" action="delete" fallback={null}>
- *   <DeletePostButton />
- * </CanAccess>
- * ```
+ * Evaluate a plugin-owned descriptor through the configured client auth.
+ * Omitting browser authorization remains presentation-only permissive; the
+ * backend is always the security boundary.
  */
-declare function CanAccess({ resource, action, params, fallback, loading, children, }: CanParams & {
-    /** Rendered when access is denied (default `null`) */
+declare function PermissionCheck({ permission, children, }: {
+    permission: AnyPermissionRequest;
+    children: (state: PermissionCheckState) => ReactNode;
+}): react_jsx_runtime.JSX.Element;
+/** Element-level gate for a plugin-owned, schema-backed descriptor. */
+declare function PermissionAccess({ permission, fallback, loading, children, }: {
+    permission: AnyPermissionRequest;
     fallback?: ReactNode;
-    /** Rendered while the permission check is pending (default `null`) */
     loading?: ReactNode;
     children?: ReactNode;
 }): react_jsx_runtime.JSX.Element;
@@ -316,5 +338,5 @@ type TranslateFn = (key: string, defaultValue: string, params?: Record<string, u
  */
 declare function useTranslate(): TranslateFn;
 
-export { CanAccess, CanParams, StackApiConfig, StackAuthProvider, StackIdentity, StackProvider, StackRouter, StackRouterConfig, defaultNotifyProvider, useBasePath, useCan, useIdentity, useNotify, usePluginOverrides, useStack, useStackOrNull, useTranslate };
-export type { NotifyOptions, StackI18nProvider, StackNotifyProvider, StackProviderOverrides, TranslateFn };
+export { PermissionAccess, PermissionCheck, StackApiConfig, StackClientAuth, StackIdentity, StackProvider, StackRouter, StackRouterConfig, defaultNotifyProvider, useBasePath, useIdentity, useIdentityResolutionPromise, useIdentitySourceGeneration, useNotify, usePluginOverrides, usePluginSiteNavigation, useStack, useStackOrNull, useTranslate };
+export type { NotifyOptions, PermissionCheckState, StackI18nProvider, StackNotifyProvider, TranslateFn };

package/dist/context/index.d.mts

@@ -1,8 +1,18 @@
+import * as React$1 from 'react';
+import { ReactNode, ReactElement } from 'react';
+import { QueryClient } from '@tanstack/react-query';
+import { v as ResolvedClientStack, T as InferredPluginOverrides, U as RegisteredClientPlugins, y as ClientLocation, H as ClientProviderPluginRuntime, K as ClientStackContext } from '../shared/stack.CfK5NKlK.mjs';
+import { S as StackClientAuth, a as StackIdentity } from '../shared/stack.BYMentwB.mjs';
+import { a as StackRouterConfig, b as StackRouter, c as StackApiConfig, d as StackClientLike } from '../shared/stack.BRvqQWGt.mjs';
+export { j as joinBasePath } from '../shared/stack.BRvqQWGt.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { ReactNode } from 'react';
-import { a as StackAuthProvider, C as CanParams, b as StackIdentity } from '../shared/stack.C4_gEENS.mjs';
-export { S as StackServerAuthProvider } from '../shared/stack.C4_gEENS.mjs';
-import { S as StackRouterConfig, a as StackApiConfig, b as StackRouter } from '../shared/stack.aqVZ6PEW.mjs';
+import { PermissionRequest } from '../authorization/index.mjs';
+import '@btst/yar';
+import '@btst/db';
+import 'better-call';
+import '../authorization/server.mjs';
+import '../shared/stack.CKXzdGiJ.mjs';
+import 'zod';
 
 /**
  * Optional i18n provider, passed to `StackProvider` via the `i18n` prop.
@@ -83,31 +93,67 @@ interface StackContextValue<TPluginOverrides extends Record<string, any>> {
      * Top-level API config applied to all plugins.
      */
     api?: StackApiConfig;
+    /** Resolved top-level site location used to compare plugin site origins. */
+    site?: ClientLocation;
+    /** Effective browser-safe runtime for each registered client plugin. */
+    plugins?: Record<string, ClientProviderPluginRuntime>;
+    /** The query client owned by the resolved client stack. */
+    queryClient?: QueryClient;
+    /** Resolved plugin definitions used by client-only introspection helpers. */
+    clientStackContext?: ClientStackContext;
+    /** Canonical resolved stack supplied to this provider. */
+    resolvedStack?: StackClientLike;
     /** Top-level auth provider used by identity-aware components. */
-    auth?: StackAuthProvider;
+    auth?: StackClientAuth;
 }
-/**
- * The `overrides` prop shape for `StackProvider`.
- * Plugin blocks are optional; fields inside each block retain the plugin's
- * declared requirements.
- */
-type StackProviderOverrides<TPluginOverrides extends Record<string, any>> = Partial<TPluginOverrides>;
+type StackProviderServices = {
+    children?: ReactNode;
+    router?: StackRouterConfig;
+    /**
+     * Browser authorization created by `createClientAuth()`. When omitted,
+     * identity is `null` and presentation-only descriptor checks remain
+     * permissive; backend authorization is independent and authoritative.
+     */
+    auth?: StackClientAuth;
+    /**
+     * Request identity resolved on the server. `undefined` means no snapshot was
+     * supplied; `null` is an explicitly hydrated anonymous identity.
+     */
+    initialIdentity?: StackIdentity | null;
+    notify?: StackNotifyProvider;
+    i18n?: StackI18nProvider;
+};
+type CanonicalStackProviderOverrideProps<TStack extends ResolvedClientStack<any, any>> = InferredPluginOverrides<NoInfer<RegisteredClientPlugins<TStack>>> extends infer TOverrides extends Record<string, any> ? {} extends TOverrides ? {
+    overrides?: TOverrides;
+} : {
+    overrides: TOverrides;
+} : never;
+type CanonicalStackProviderProps<TStack extends ResolvedClientStack<any, any>> = StackProviderServices & {
+    /** Resolved browser client stack; supplies API/site/plugin runtime once. */
+    stack: TStack;
+    /** API configuration belongs to createClientStack(). */
+    api?: never;
+    /** Site paths belong to createClientStack(). */
+    basePath?: never;
+} & CanonicalStackProviderOverrideProps<TStack>;
 /**
  * Provider component for BTST context
  * Provides type-safe access to plugin-specific overrides
  *
- * Only requires override values, not plugin objects - keeps bundle size minimal!
- *
  * @example
  * ```tsx
- * // Define the type shape (no import of plugin values needed!)
- * type MyPluginOverrides = {
- *   messages: MessagesPluginOverrides;
- * };
+ * const clientStack = createClientStack({
+ *   api,
+ *   site,
+ *   queryClient,
+ *   plugins: {
+ *     messages: messagesClientPlugin(),
+ *   },
+ * });
  *
- * <StackProvider<MyPluginOverrides>
+ * <StackProvider
+ *   stack={clientStack}
  *   router={frameworkRouter}
- *   api={{ baseURL, basePath: "/api/data" }}
  *   overrides={{
  *     messages: {
  *       MarkdownRenderer: (props) => <ReactMarkdown {...props} />,
@@ -118,49 +164,24 @@ type StackProviderOverrides<TPluginOverrides extends Record<string, any>> = Part
  * </StackProvider>
  * ```
  *
- * Framework router and API wiring live at the top level. Per-plugin overrides
- * carry only genuinely plugin-specific values:
+ * Runtime locations and plugin override types come from the resolved stack.
+ * Framework services and optional identity hydration remain provider concerns.
  *
  * @example
  * ```tsx
  * import { nextRouter } from "@btst/stack/next";
  *
- * <StackProvider<MyPluginOverrides>
- *   basePath="/pages"
+ * <StackProvider
+ *   stack={clientStack}
  *   router={nextRouter()}
- *   api={{ baseURL, basePath: "/api/data" }}
- *   overrides={{
- *     blog: { uploadImage },
- *   }}
+ *   auth={clientAuth}
+ *   initialIdentity={initialIdentity}
  * >
  *   {children}
  * </StackProvider>
  * ```
  */
-declare function StackProvider<TPluginOverrides extends Record<string, any> = Record<string, any>>({ children, overrides, basePath, router, api, auth, notify, i18n, }: {
-    children?: ReactNode;
-    overrides?: StackProviderOverrides<TPluginOverrides>;
-    basePath: string;
-    router?: StackRouterConfig;
-    api?: StackApiConfig;
-    /**
-     * Optional auth provider. When set, `useIdentity()` / `useCan()` and
-     * `<CanAccess>` resolve identity and permissions through it. When omitted,
-     * behavior is identical to before: identity is `null` and all permission
-     * checks pass.
-     */
-    auth?: StackAuthProvider;
-    /**
-     * Optional notification provider. When omitted, sonner toasts are used via
-     * `useNotify()`.
-     */
-    notify?: StackNotifyProvider;
-    /**
-     * Optional i18n provider. When omitted, `useTranslate()` returns English
-     * defaults with `{{param}}` interpolation.
-     */
-    i18n?: StackI18nProvider;
-}): react_jsx_runtime.JSX.Element;
+declare function StackProvider<const TStack extends ResolvedClientStack<any, any>>({ children, overrides, stack, router, auth, initialIdentity, notify, i18n, }: CanonicalStackProviderProps<TStack>): ReactElement;
 /**
  * Hook to access the entire BTST context
  * Useful if you need access to multiple plugins or the full context
@@ -222,6 +243,24 @@ declare function usePluginOverrides<TOverrides = any, TDefaults extends Partial<
  */
 declare function useBasePath(): string;
 
+/**
+ * Resolve one registered plugin's page links and programmatic navigation.
+ *
+ * Uses the plugin's resolved site endpoint, including per-plugin overrides.
+ * Same-origin destinations use the configured router; cross-origin destinations
+ * and stacks without a router use full-page browser navigation.
+ */
+declare function usePluginSiteNavigation(pluginId: string): {
+    Link: string | React$1.ComponentType<React$1.ClassAttributes<HTMLAnchorElement> & React$1.AnchorHTMLAttributes<HTMLAnchorElement> & Record<string, any>>;
+    navigate: (...segments: string[]) => void | Promise<void>;
+    resolve: (...segments: string[]) => {
+        path: string;
+        href: string;
+        crossOrigin: boolean;
+    };
+};
+
+type AnyPermissionRequest = PermissionRequest;
 /**
  * Returns the current user's identity as resolved by the auth provider
  * configured on `StackProvider`.
@@ -237,51 +276,34 @@ declare function useBasePath(): string;
 declare function useIdentity(): {
     identity: StackIdentity | null;
     isPending: boolean;
+    error?: Error;
     refetch: () => Promise<void>;
 };
+/** @internal Serializable identity-resolution key for protected query caches. */
+declare function useIdentitySourceGeneration(): number;
+/** @internal Promise that settles when the current identity lookup finishes. */
+declare function useIdentityResolutionPromise(): Promise<void> | undefined;
 type CanState = {
     can: boolean;
     isPending: boolean;
 };
+/** State yielded by a plugin-owned permission descriptor gate. */
+type PermissionCheckState = CanState & {
+    error?: Error;
+};
 /**
- * Checks whether the current user can perform `action` on `resource` using
- * the auth provider's `can()` function.
- *
- * Resolves to `{ can: true, isPending: false }` immediately when no auth
- * provider is configured or the provider has no `can()` function — permission
- * checks are opt-in and non-breaking.
- *
- * While the identity or the `can()` result is still resolving, returns
- * `{ can: false, isPending: true }` so callers can avoid flashing
- * permission-gated UI.
- *
- * @example
- * ```tsx
- * const { can, isPending } = useCan({ resource: "blog:post", action: "delete" });
- * if (!isPending && can) return <DeletePostButton />;
- * ```
- */
-declare function useCan(params: CanParams): CanState;
-/**
- * Element-level permission gate (Refine's `<CanAccess>` pattern).
- *
- * - Without an auth provider configured, always renders `children`.
- * - While the check is pending, renders `loading` (default `null`) to avoid
- *   flashing gated UI.
- * - Renders `children` when `can()` allows, `fallback` (default `null`)
- *   otherwise.
- *
- * @example
- * ```tsx
- * <CanAccess resource="blog:post" action="delete" fallback={null}>
- *   <DeletePostButton />
- * </CanAccess>
- * ```
+ * Evaluate a plugin-owned descriptor through the configured client auth.
+ * Omitting browser authorization remains presentation-only permissive; the
+ * backend is always the security boundary.
  */
-declare function CanAccess({ resource, action, params, fallback, loading, children, }: CanParams & {
-    /** Rendered when access is denied (default `null`) */
+declare function PermissionCheck({ permission, children, }: {
+    permission: AnyPermissionRequest;
+    children: (state: PermissionCheckState) => ReactNode;
+}): react_jsx_runtime.JSX.Element;
+/** Element-level gate for a plugin-owned, schema-backed descriptor. */
+declare function PermissionAccess({ permission, fallback, loading, children, }: {
+    permission: AnyPermissionRequest;
     fallback?: ReactNode;
-    /** Rendered while the permission check is pending (default `null`) */
     loading?: ReactNode;
     children?: ReactNode;
 }): react_jsx_runtime.JSX.Element;
@@ -316,5 +338,5 @@ type TranslateFn = (key: string, defaultValue: string, params?: Record<string, u
  */
 declare function useTranslate(): TranslateFn;
 
-export { CanAccess, CanParams, StackApiConfig, StackAuthProvider, StackIdentity, StackProvider, StackRouter, StackRouterConfig, defaultNotifyProvider, useBasePath, useCan, useIdentity, useNotify, usePluginOverrides, useStack, useStackOrNull, useTranslate };
-export type { NotifyOptions, StackI18nProvider, StackNotifyProvider, StackProviderOverrides, TranslateFn };
+export { PermissionAccess, PermissionCheck, StackApiConfig, StackClientAuth, StackIdentity, StackProvider, StackRouter, StackRouterConfig, defaultNotifyProvider, useBasePath, useIdentity, useIdentityResolutionPromise, useIdentitySourceGeneration, useNotify, usePluginOverrides, usePluginSiteNavigation, useStack, useStackOrNull, useTranslate };
+export type { NotifyOptions, PermissionCheckState, StackI18nProvider, StackNotifyProvider, TranslateFn };