@drhomet/mithaq 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 drhomet
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/LICENSES/payload.txt

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2018-2026 Payload CMS, LLC <info@payloadcms.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/LICENSES/ponytail.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/asas/actor.d.ts

@@ -0,0 +1,96 @@
+import type { Assigned } from '../rbac/index.ts';
+import type { ResolvedKayan } from '../mithaq/types.ts';
+import type { OperationEffect } from './runner/steps.ts';
+export type AuthStrategyArgs = {
+    headers: Headers;
+    canSetHeaders?: boolean;
+    isGraphQL?: boolean;
+    strategyName?: string;
+};
+export type AuthStrategyResult<Actor = unknown> = {
+    responseHeaders?: Headers;
+    user: Actor | null;
+};
+/** An auth strategy: `authenticate` resolves a request's headers to an actor, or to `null`. */
+export type AuthStrategy<Actor = unknown> = {
+    name: string;
+    authenticate(args: AuthStrategyArgs): Promise<AuthStrategyResult<Actor>> | AuthStrategyResult<Actor>;
+    /** What the HTTP layer mounts at `/api/auth/<strategy name>/*`. */
+    handler?(request: Request): Promise<Response>;
+};
+/**
+ * What a kayan's `auth` is: a shipped provider declaration, `local(...)` or `betterAuth(...)`,
+ * which `buildAsas` builds, or a strategy the project wrote.
+ */
+export type KayanAuth = AuthStrategy | {
+    provider: 'better-auth' | 'local';
+};
+export declare const isAuthDeclaration: (auth: KayanAuth) => auth is {
+    provider: 'better-auth' | 'local';
+};
+type TrustedActor = {
+    activeOrganizationId?: unknown;
+    collection: string;
+    id?: unknown;
+    memberRole?: unknown;
+    organizations?: readonly ({
+        id?: unknown;
+    } & Record<string, unknown>)[];
+    role?: unknown;
+    permissions?: true | ReadonlySet<string>;
+    roles?: readonly string[];
+    strategy?: unknown;
+    admin?: boolean;
+};
+/** Record the build's admin answer on an actor a strategy returned; an unmarked object holds none. */
+export declare const markAdminAnswer: (actor: unknown, admin: boolean) => boolean;
+/** Whether the build answered this actor as its administrator. */
+export declare const isAdminActor: (actor: unknown) => boolean;
+export declare const markAuthActor: <Actor extends object>(actor: Actor) => Actor;
+/**
+ * The permission keys the access target resolved for this actor, `true` for every key,
+ * or nothing where no target graded. Read from the build's snapshot, never the actor object.
+ */
+export declare const actorPermissions: (actor: unknown) => true | ReadonlySet<string> | undefined;
+/** The role slugs the access target resolved for this actor, read from the build's snapshot. */
+export declare const actorRoles: (actor: unknown) => readonly string[] | undefined;
+export declare const authActor: (actor: unknown) => TrustedActor | null;
+export declare const actor: <Actor>({ strategies, headers, onError, }: {
+    strategies: readonly AuthStrategy<Actor>[];
+    headers: Headers;
+    onError: (error: unknown) => void;
+}) => Promise<Actor | null>;
+/**
+ * What the build's access target answers for one actor: the slugs assigned in the tenant
+ * and every key they hold, or nothing where the build declares no access target.
+ */
+export type AssignedResolver = (args: {
+    tenant: unknown;
+    member: unknown;
+    /** The actor being made, before it is marked. */
+    actor: object;
+}) => Promise<Assigned | undefined> | Assigned | undefined;
+export declare const resolveAssigned: ({ resolver, onError, ...args }: Parameters<AssignedResolver>[0] & {
+    resolver: AssignedResolver | undefined;
+    onError: (error: unknown) => void;
+}) => Promise<Assigned | undefined>;
+export type LocalAuthPermissions = {
+    kayan: readonly ResolvedKayan[];
+    can(args: {
+        kayan: ResolvedKayan;
+        effect: OperationEffect;
+        actor: unknown;
+    }): Promise<{
+        allowed: boolean;
+        operations: Record<string, boolean>;
+    }>;
+    canAccessAdmin(actor: unknown): Promise<boolean>;
+    screens(actor: unknown): Promise<readonly string[]>;
+};
+export declare const accessReport: (permissions: LocalAuthPermissions, actor: unknown) => Promise<{
+    canAccessAdmin: boolean;
+    collections: Record<string, unknown>;
+    screens: readonly string[];
+    permissions?: string | string[] | undefined;
+}>;
+export {};

package/dist/asas/actor.js

@@ -0,0 +1,114 @@
+// Asks for `authenticate`, not `provider`: a project's own strategy may carry a
+// `provider` key of its own meaning.
+export const isAuthDeclaration = (auth) => !('authenticate' in auth);
+const trustedActors = new WeakMap();
+/** Record the build's admin answer on an actor a strategy returned; an unmarked object holds none. */
+export const markAdminAnswer = (actor, admin) => {
+    const trusted = authActor(actor);
+    if (trusted)
+        trusted.admin = admin;
+    return admin;
+};
+/** Whether the build answered this actor as its administrator. */
+export const isAdminActor = (actor) => authActor(actor)?.admin === true;
+export const markAuthActor = (actor) => {
+    const source = actor;
+    const claimed = source.permissions;
+    trustedActors.set(actor, {
+        activeOrganizationId: source.activeOrganizationId,
+        collection: source.collection,
+        id: source.id,
+        memberRole: source.memberRole,
+        organizations: source.organizations?.map((organization) => ({ ...organization })),
+        role: source.role,
+        // Present decides, absent stands aside. Any other shape is a store that answered
+        // unreadably and holds no key: reading it as absent would fail open.
+        permissions: 'permissions' in source
+            ? claimed === '*'
+                ? true
+                : new Set(Array.isArray(claimed) && claimed.every((key) => typeof key === 'string') ? claimed : [])
+            : undefined,
+        roles: Array.isArray(source.roles) && source.roles.every((one) => typeof one === 'string')
+            ? [...source.roles]
+            : undefined,
+        strategy: source.strategy,
+    });
+    return actor;
+};
+/**
+ * The permission keys the access target resolved for this actor, `true` for every key,
+ * or nothing where no target graded. Read from the build's snapshot, never the actor object.
+ */
+export const actorPermissions = (actor) => authActor(actor)?.permissions;
+/** The role slugs the access target resolved for this actor, read from the build's snapshot. */
+export const actorRoles = (actor) => authActor(actor)?.roles;
+export const authActor = (actor) => actor && typeof actor === 'object' ? trustedActors.get(actor) ?? null : null;
+// First non-null actor wins; a strategy that throws is handed to `onError` and skipped.
+export const actor = async ({ strategies, headers, onError, }) => {
+    for (const strategy of strategies) {
+        try {
+            const found = await strategy.authenticate({
+                canSetHeaders: true,
+                headers,
+                strategyName: strategy.name,
+            });
+            if (found.user)
+                return found.user;
+        }
+        catch (error) {
+            onError(new Error(`Auth strategy "${strategy.name}" failed.`, { cause: error }));
+        }
+    }
+    return null;
+};
+// A throw must not leave: the strategy loop would turn a store outage into
+// "not signed in" instead of a 403. A failed resolver holds no key and `onError` is told.
+export const resolveAssigned = async ({ resolver, onError, ...args }) => {
+    if (!resolver)
+        return undefined;
+    try {
+        return await resolver(args);
+    }
+    catch (error) {
+        onError(new Error('The access target failed to resolve, so this actor holds no role and no key.', { cause: error }));
+        return { permissions: [], roles: [] };
+    }
+};
+// Reports and never grants. A kayan the actor may not read is left out, and so is a
+// field none of `read`, `create` and `update` holds: the report discloses what it names.
+export const accessReport = async (permissions, actor) => {
+    // First: the build records its answer on the actor, and a field callback below reads it.
+    const canAccessAdmin = await permissions.canAccessAdmin(actor);
+    const collections = Object.create(null);
+    for (const kayan of permissions.kayan) {
+        const effects = ['create', 'read', 'update', 'delete'];
+        const allowed = {};
+        const operations = {};
+        for (const effect of effects) {
+            const answer = await permissions.can({ kayan, effect, actor });
+            allowed[effect] = answer.allowed;
+            Object.assign(operations, answer.operations);
+        }
+        if (!allowed.read)
+            continue;
+        const fields = {};
+        for (const field of Object.values(kayan.fields)) {
+            const answers = {};
+            for (const effect of ['create', 'read', 'update']) {
+                const own = field.access?.[effect];
+                answers[effect] = allowed[effect] && (!own || !!(await own({ user: actor })));
+            }
+            if (answers.create || answers.read || answers.update)
+                fields[field.name] = answers;
+        }
+        collections[kayan.name] = { ...allowed, fields, operations };
+    }
+    // The actor's own keys, so a screen can answer a provider action such as `user.ban` without trying it.
+    const held = actorPermissions(actor);
+    return {
+        canAccessAdmin,
+        collections,
+        screens: await permissions.screens(actor),
+        ...(held === undefined ? {} : { permissions: held === true ? '*' : [...held] }),
+    };
+};

package/dist/asas/build.d.ts

@@ -0,0 +1,231 @@
+import { type AuthStrategy, type AuthStrategyResult } from './actor.ts';
+import { betterAuthStrategy } from '../auth/better-auth/index.ts';
+import { type LocalAuthActor, type ProtectedLocalField } from '../auth/local/index.ts';
+import { type OperationEffect } from './runner/steps.ts';
+import { type Globals, type Procedures, type Row, type Writes } from './runner/write.ts';
+import { type ActorBoundAccess, type Kayan, type RuntimeField, type ServiceOf } from '../mithaq/types.ts';
+import { type Language } from '../mithaq/language.ts';
+import type { StandardSchemaV1 } from '../mithaq/standard-schema.ts';
+import type { BuiltTables } from '../drizzle/index.ts';
+import { type ScreenClient } from '../screen/index.ts';
+import { type MessageRegistry, type MessagesResolver } from '../mithaq/messages.ts';
+type UniqueNames<List extends readonly Kayan[], Seen = never> = List extends readonly [
+    infer Head extends Kayan,
+    ...infer Tail extends readonly Kayan[]
+] ? Head['name'] extends Seen ? false : UniqueNames<Tail, Seen | Head['name']> : true;
+type BetterAuthServer = Parameters<typeof betterAuthStrategy>[0]['server'];
+type ActorFor<L extends Language, KayanList extends readonly Kayan[]> = [Extract<AuthStrategies<L, KayanList>, AuthStrategy>] extends [never] ? unknown : Awaited<ReturnType<Extract<Extract<AuthStrategies<L, KayanList>, AuthStrategy>, AuthStrategy>['authenticate']>> extends AuthStrategyResult<infer Result> ? Result : never;
+type Equal<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => (T extends B ? 1 : 2) ? true : false;
+type FirstArg<Fn> = Fn extends (...args: infer Args) => unknown ? Args extends [] ? never : Args[0] : never;
+type UserFromArg<Arg> = Arg extends {
+    user: infer User;
+} ? NonNullable<User> : unknown;
+type IdFromArg<Arg> = Arg extends {
+    id?: infer Id;
+} ? Id : unknown;
+type DataFromArg<Arg> = Arg extends {
+    data?: infer Data;
+} ? Data : unknown;
+type DocFromArg<Arg> = Arg extends {
+    doc?: infer Doc;
+} ? Doc : unknown;
+type CallbackRequirement<Fn> = [FirstArg<Fn>] extends [never] ? never : {
+    actor: UserFromArg<FirstArg<Fn>>;
+    data: DataFromArg<FirstArg<Fn>>;
+    doc: DocFromArg<FirstArg<Fn>>;
+    id: IdFromArg<FirstArg<Fn>>;
+};
+type AccessRequirement<K> = K extends {
+    access?: infer Access;
+} ? NonNullable<Access> extends infer A ? '__mithaqAccessActor' extends keyof A ? A extends ActorBoundAccess<infer Actor> ? {
+    actor: Actor;
+    data: unknown;
+    doc: unknown;
+    id: unknown;
+} | CallbackRequirement<A extends {
+    create?: infer Fn;
+} ? NonNullable<Fn> : never> | CallbackRequirement<A extends {
+    read?: infer Fn;
+} ? NonNullable<Fn> : never> | CallbackRequirement<A extends {
+    update?: infer Fn;
+} ? NonNullable<Fn> : never> | CallbackRequirement<A extends {
+    delete?: infer Fn;
+} ? NonNullable<Fn> : never> : never : never : never : never;
+type FieldAccessRequirement<Fields> = Fields extends Record<string, RuntimeField> ? Fields[keyof Fields] extends infer Field ? Field extends {
+    access?: infer Access;
+} ? {} extends Pick<Field, 'access'> ? never : NonNullable<NonNullable<Access>[keyof NonNullable<Access>]> extends infer Fn ? '__mithaqAccessActor' extends keyof NonNullable<Fn> ? NonNullable<Fn> extends ActorBoundAccess<infer Actor> ? {
+    actor: Actor;
+    data: unknown;
+    doc: unknown;
+    id: unknown;
+} | CallbackRequirement<NonNullable<Fn>> | ('__mithaqFieldData' extends keyof NonNullable<Fn> ? NonNullable<Fn> extends {
+    __mithaqFieldData: infer Data;
+    __mithaqFieldId: infer Id;
+} ? {
+    actor: Actor;
+    data: unknown;
+    doc: Data;
+    id: Id;
+} : never : never) : never : never : never : never : never : never;
+type BroadRecord = Record<string, unknown>;
+type IsUnknown<T> = Equal<T, unknown>;
+type IsBroadRecord<T> = Equal<T, BroadRecord>;
+type MatchesDoc<Expected, Actual> = IsUnknown<Expected> extends true ? true : IsBroadRecord<Expected> extends true ? true : Equal<Expected, Actual>;
+type MatchesData<Expected, Actual> = IsUnknown<Expected> extends true ? true : IsBroadRecord<Expected> extends true ? true : [Partial<Actual>] extends [Expected] ? true : false;
+type MatchesId<Expected, Actual> = IsUnknown<Expected> extends true ? true : Equal<Expected, Actual>;
+type MismatchName<One, Required, Actor, L extends Language, KayanList extends readonly Kayan[]> = Required extends {
+    actor: infer Needed;
+    data: infer Data;
+    doc: infer Doc;
+    id: infer Id;
+} ? [Actor] extends [never] ? One extends {
+    name: infer Name;
+} ? Name : never : [Actor] extends [Needed] ? One extends Kayan ? MatchesDoc<Doc, Row<One['fields'], L, KayanList>> extends true ? MatchesData<Data, Row<One['fields'], L, KayanList>> extends true ? 'id' extends keyof Row<One['fields'], L, KayanList> ? MatchesId<Id, Row<One['fields'], L, KayanList>['id']> extends true ? never : One extends {
+    name: infer Name;
+} ? Name : never : One extends {
+    name: infer Name;
+} ? Name : never : One extends {
+    name: infer Name;
+} ? Name : never : One extends {
+    name: infer Name;
+} ? Name : never : never : One extends {
+    name: infer Name;
+} ? Name : never : never;
+type AccessActorMismatch<KayanList extends readonly Kayan[], L extends Language, Actor> = KayanList[number] extends infer One ? MismatchName<One, AccessRequirement<One> | (One extends {
+    fields: infer Fields;
+} ? FieldAccessRequirement<Fields> : never), Actor, L, KayanList> : never;
+type AdminAccessRequirement<Auth> = Auth extends {
+    admin?: infer Admin;
+} ? NonNullable<Admin> extends {
+    access?: infer Fn;
+} ? CallbackRequirement<NonNullable<Fn>> : never : never;
+type AdminAccessMismatch<Auth, Actor> = MismatchName<{
+    name: 'auth.admin.access';
+}, AdminAccessRequirement<Auth>, Actor, never, never>;
+type AdminAccessShapeMismatch<Auth> = Auth extends {
+    admin?: infer Admin;
+} ? NonNullable<Admin> extends {
+    access: infer Fn;
+} ? NonNullable<Fn> extends (...args: infer _Args) => infer Return ? Return extends boolean | Promise<boolean> ? never : 'auth.admin.access' : 'auth.admin.access' : never : never;
+/** The keys this project has, in the two shapes `buildAsas` publishes them in. */
+export type Vocabulary = {
+    catalog: readonly string[];
+    statements: Readonly<Record<string, readonly string[]>>;
+};
+/** The build's auth: the admin kayan whose actor passes default access, and where failures are reported. */
+export type AuthConfig = {
+    /** The admin kayan: whose actor passes default access. */
+    admin?: {
+        kayan: Kayan;
+        access?: unknown;
+    };
+    /** Handed a strategy that threw and an access target that could not answer, each as an `Error` with the cause. Required where any kayan carries auth. */
+    onError: (error: unknown) => void;
+};
+type PublicLocalUser<K extends Kayan, L extends Language, KayanList extends readonly Kayan[]> = Omit<Row<K['fields'], L, KayanList>, ProtectedLocalField>;
+/** One strategy per kayan carrying `auth`, typed by that provider's or that strategy's own actor. */
+type AuthStrategies<L extends Language, KayanList extends readonly Kayan[]> = KayanList[number] extends infer One ? One extends Kayan ? One['auth'] extends infer Declared ? Declared extends {
+    provider: 'local';
+} ? AuthStrategy<LocalAuthActor<One['name'], PublicLocalUser<One, L, KayanList>>> : Declared extends {
+    provider: 'better-auth';
+    server: (...args: never[]) => infer Server;
+} ? Server extends BetterAuthServer ? ReturnType<typeof betterAuthStrategy<Server, One['name']>> : never : Declared extends AuthStrategy ? Declared : never : never : never : never;
+/** One built operation in the flat table `buildAsas` publishes: one entry per operation of every kayan and global, in declared order. */
+export type Operation = {
+    /** The kayan or global the operation belongs to. */
+    kayan: string;
+    /** The operation's own name, which is also the action an access row grants. */
+    name: string;
+    effect: OperationEffect;
+    /** True for a global: its read takes no id and its update makes the row. */
+    single: boolean;
+    /** What a caller may send. A global's update publishes its update shape without the id, so a first update short of a required field is refused by the runner. */
+    input: StandardSchemaV1;
+    /** Runs the operation with the actor the request resolved and the context the plug's `context` function built. */
+    call: (input: unknown, options: ServedOptions) => Promise<unknown>;
+};
+/** What a plug hands a served call beside its input. */
+export type ServedOptions = {
+    actor: unknown;
+    context?: Record<string, unknown>;
+    /** `?draft=true` on a kayan that keeps drafts. Nothing else a client sends reaches a call as an option. */
+    draft?: boolean;
+    autosave?: boolean;
+    /** `?tenant=mine` or `?tenant=all` on a read. A write sent one is refused. */
+    tenant?: string;
+};
+/** The operation table: the flat array a plug iterates, and `procedures`, a type-only view keyed by kayan then operation. */
+export interface OperationTable<View = unknown> extends ReadonlyArray<Operation> {
+    /** Type only. There is no such property on the array at runtime. */
+    readonly procedures?: View;
+}
+/**
+ * What an HTTP plug hands back: `router`, which a typed client is built from, and `handle`,
+ * which answers `null` where no route of its own matched so the next plug is asked.
+ */
+export type HttpPlug = {
+    /** The plug's own name, unique in the list. */
+    name: string;
+    router: unknown;
+    /** `actor` is a thunk, so a request no route of this plug matches costs no session lookup. */
+    handle: (request: Request, actor: () => Promise<unknown>) => Promise<Response | null>;
+};
+/**
+ * Every declared thing of one build, kayan and global alike, which is the
+ * registry a relationship is resolved against.
+ */
+type Declared<KayanList extends readonly Kayan[], GlobalList extends readonly Kayan[]> = readonly (KayanList[number] | GlobalList[number])[];
+export declare const buildAsas: <const L extends Language, const KayanList extends readonly Kayan[], const GlobalList extends readonly Kayan[] = readonly [], Auth extends AuthConfig = AuthConfig, Http extends HttpPlug = HttpPlug>(language: L, { kayan, global, auth, http, messages, statements: declaredStatements, }: {
+    kayan: KayanList & (UniqueNames<KayanList> extends true ? unknown : {
+        duplicateKayanNames: never;
+    }) & (AccessActorMismatch<KayanList, L, ActorFor<L, KayanList>> | AdminAccessMismatch<Auth, ActorFor<L, KayanList>> | AdminAccessShapeMismatch<Auth> extends never ? unknown : {
+        authAccessActorMismatch: AccessActorMismatch<KayanList, L, ActorFor<L, KayanList>> | AdminAccessMismatch<Auth, ActorFor<L, KayanList>> | AdminAccessShapeMismatch<Auth>;
+    });
+    /** The globals, each a kayan of one row. They share the kayan namespace. */
+    global?: GlobalList;
+    auth?: Auth;
+    /**
+     * The HTTP plugs, asked in order, so the order decides who owns a prefix two claim. Required:
+     * `fetchHttp()` takes no dependency; `orpcHttp()` first gives `asas.router` its typed client.
+     */
+    http: readonly [(operations: OperationTable<Procedures<KayanList, GlobalList, Declared<KayanList, GlobalList>, L>>) => Http, ...((operations: OperationTable<Procedures<KayanList, GlobalList, Declared<KayanList, GlobalList>, L>>) => HttpPlug)[]];
+    /** The project's own copy for the labels mithaq ships, as one resolver whose return shape mithaq declares. */
+    messages?: MessagesResolver<L>;
+    /** Keys no declaration derives, such as an auth provider's own actions, added to the vocabulary under the resources they name. */
+    statements?: Readonly<Record<string, readonly string[]>>;
+}) => {
+    /** Every permission key this project has: one `<kayan>.<operation>` per operation, one `<kayan>.fields.<field>` per field, one `screen.<screen>` per screen. */
+    catalog: readonly string[];
+    /** Every scope of copy this project has. A getter: only the CLI reads it, and it calls the project's own resolver. */
+    readonly messages: MessageRegistry;
+    /** The same catalog in Better Auth's shape, for `createAccessControl(asas.statements)`. */
+    statements: Readonly<Record<string, readonly string[]>>;
+    /** Every built operation, flat. Its `procedures` view is a type, keyed by kayan then operation. */
+    operations: OperationTable<Procedures<KayanList, GlobalList, Declared<KayanList, GlobalList>, L>>;
+    /** The router the first plug built, which a typed client is built from; `undefined` for `fetchHttp()`. */
+    router: Http['router'];
+    /** Every target as the language passed it, so `asas.targets.drizzle.db` is drizzle. A screen also carries its projection under `client`. */
+    targets: { [Name in keyof L['targets']]: L['targets'][Name] extends {
+        tables: unknown;
+    } ? Omit<L['targets'][Name], 'tables'> & {
+        tables: BuiltTables<Declared<KayanList, GlobalList>, Name, ServiceOf<L>['store'], L['kinds']>;
+    } : L['targets'][Name] extends {
+        capability: 'screen';
+    } ? L['targets'][Name] & {
+        client: ScreenClient;
+    } : L['targets'][Name]; };
+    kayan: Writes<KayanList, Declared<KayanList, GlobalList>, L, ActorFor<L, KayanList>>;
+    /** One row per global, under `findOne` and `update`. */
+    global: Globals<GlobalList, Declared<KayanList, GlobalList>, L, ActorFor<L, KayanList>>;
+    /** The strategies in the order the loop tries them, and the loop itself. */
+    auth: {
+        strategies: Extract<AuthStrategies<L, KayanList>, AuthStrategy>[];
+        actor: (headers: Headers) => Promise<ActorFor<L, KayanList> | null>;
+    };
+    handler: (request: Request) => Promise<Response>;
+    connect: ({ readOnly }?: {
+        readOnly?: boolean;
+    }) => Promise<void>;
+    destroy: () => Promise<void>;
+};
+export {};