@plandesk/api 0.20.0 → 1.0.0-beta.2

package/dist/access-control.d.ts

@@ -0,0 +1,150 @@
+export declare const statement: {
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly project: readonly ["create", "delete"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+    readonly apiKey: readonly ["create", "read", "update", "delete"];
+};
+export declare const ac: {
+    newRole<const TRoleStatements extends import("better-auth/plugins/access").Statements>(statements: import("better-auth/plugins/access").RoleInput<{
+        readonly task: readonly ["read", "create", "update", "delete"];
+        readonly document: readonly ["read", "create", "update", "delete"];
+        readonly edge: readonly ["read", "create", "update", "delete"];
+        readonly goal: readonly ["read", "create", "update", "delete"];
+        readonly comment: readonly ["read", "create", "update", "delete"];
+        readonly agent_run: readonly ["read", "create", "update", "delete"];
+        readonly project: readonly ["create", "delete"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+    }, TRoleStatements>): import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<TRoleStatements>, {
+        readonly task: readonly ["read", "create", "update", "delete"];
+        readonly document: readonly ["read", "create", "update", "delete"];
+        readonly edge: readonly ["read", "create", "update", "delete"];
+        readonly goal: readonly ["read", "create", "update", "delete"];
+        readonly comment: readonly ["read", "create", "update", "delete"];
+        readonly agent_run: readonly ["read", "create", "update", "delete"];
+        readonly project: readonly ["create", "delete"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+    }>;
+    statements: {
+        readonly task: readonly ["read", "create", "update", "delete"];
+        readonly document: readonly ["read", "create", "update", "delete"];
+        readonly edge: readonly ["read", "create", "update", "delete"];
+        readonly goal: readonly ["read", "create", "update", "delete"];
+        readonly comment: readonly ["read", "create", "update", "delete"];
+        readonly agent_run: readonly ["read", "create", "update", "delete"];
+        readonly project: readonly ["create", "delete"];
+        readonly organization: readonly ["update", "delete"];
+        readonly member: readonly ["create", "update", "delete"];
+        readonly invitation: readonly ["create", "cancel"];
+        readonly team: readonly ["create", "update", "delete"];
+        readonly ac: readonly ["create", "read", "update", "delete"];
+        readonly apiKey: readonly ["create", "read", "update", "delete"];
+    };
+};
+export declare const member: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly project: readonly [];
+    readonly organization: readonly [];
+    readonly member: readonly [];
+    readonly invitation: readonly [];
+    readonly team: readonly [];
+    readonly ac: readonly [];
+    readonly apiKey: readonly [];
+}>, {
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly project: readonly ["create", "delete"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+    readonly apiKey: readonly ["create", "read", "update", "delete"];
+}>;
+export declare const admin: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly project: ["create", "delete"];
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly organization: readonly [];
+    readonly member: readonly [];
+    readonly invitation: readonly [];
+    readonly team: readonly [];
+    readonly ac: readonly [];
+    readonly apiKey: readonly [];
+}>, {
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly project: readonly ["create", "delete"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+    readonly apiKey: readonly ["create", "read", "update", "delete"];
+}>;
+export declare const owner: import("better-auth/plugins/access").Role<import("better-auth/plugins/access").ExactRoleStatements<{
+    readonly project: ["create", "delete"];
+    readonly organization: ["update", "delete"];
+    readonly member: ["create", "update", "delete"];
+    readonly invitation: ["create", "cancel"];
+    readonly team: ["create", "update", "delete"];
+    readonly ac: ["create", "read", "update", "delete"];
+    readonly apiKey: ["create", "read", "update", "delete"];
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+}>, {
+    readonly task: readonly ["read", "create", "update", "delete"];
+    readonly document: readonly ["read", "create", "update", "delete"];
+    readonly edge: readonly ["read", "create", "update", "delete"];
+    readonly goal: readonly ["read", "create", "update", "delete"];
+    readonly comment: readonly ["read", "create", "update", "delete"];
+    readonly agent_run: readonly ["read", "create", "update", "delete"];
+    readonly project: readonly ["create", "delete"];
+    readonly organization: readonly ["update", "delete"];
+    readonly member: readonly ["create", "update", "delete"];
+    readonly invitation: readonly ["create", "cancel"];
+    readonly team: readonly ["create", "update", "delete"];
+    readonly ac: readonly ["create", "read", "update", "delete"];
+    readonly apiKey: readonly ["create", "read", "update", "delete"];
+}>;
+export declare function intersectPermissions(a: Record<string, readonly string[]>, b: Record<string, readonly string[]>): Record<string, string[]>;
+//# sourceMappingURL=access-control.d.ts.map

package/dist/access-control.js

@@ -0,0 +1,63 @@
+import { createAccessControl } from 'better-auth/plugins/access';
+const workActions = ['read', 'create', 'update', 'delete'];
+export const statement = {
+    task: workActions,
+    document: workActions,
+    edge: workActions,
+    goal: workActions,
+    comment: workActions,
+    agent_run: workActions,
+    project: ['create', 'delete'],
+    organization: ['update', 'delete'],
+    member: ['create', 'update', 'delete'],
+    invitation: ['create', 'cancel'],
+    team: ['create', 'update', 'delete'],
+    ac: ['create', 'read', 'update', 'delete'],
+    apiKey: ['create', 'read', 'update', 'delete'],
+};
+export const ac = createAccessControl(statement);
+const memberPermissions = {
+    task: workActions,
+    document: workActions,
+    edge: workActions,
+    goal: workActions,
+    comment: workActions,
+    agent_run: workActions,
+    project: [],
+    organization: [],
+    member: [],
+    invitation: [],
+    team: [],
+    ac: [],
+    apiKey: [],
+};
+export const member = ac.newRole(memberPermissions);
+export const admin = ac.newRole({
+    ...memberPermissions,
+    project: ['create', 'delete'],
+});
+export const owner = ac.newRole({
+    ...memberPermissions,
+    project: ['create', 'delete'],
+    organization: ['update', 'delete'],
+    member: ['create', 'update', 'delete'],
+    invitation: ['create', 'cancel'],
+    team: ['create', 'update', 'delete'],
+    ac: ['create', 'read', 'update', 'delete'],
+    apiKey: ['create', 'read', 'update', 'delete'],
+});
+export function intersectPermissions(a, b) {
+    const intersection = {};
+    for (const [resource, actions] of Object.entries(a)) {
+        const otherActions = b[resource];
+        if (otherActions === undefined) {
+            continue;
+        }
+        const sharedActions = actions.filter((action) => otherActions.includes(action));
+        if (sharedActions.length > 0) {
+            intersection[resource] = sharedActions;
+        }
+    }
+    return intersection;
+}
+//# sourceMappingURL=access-control.js.map

package/dist/agent-keys.d.ts

@@ -0,0 +1,81 @@
+import type { OrgRole } from '@plandesk/db';
+import type { BetterAuthInstance } from './better-auth.js';
+import { type PermissionSet } from './permissions.js';
+/** Key profile stored in better-auth metadata. Absent/unknown → agent (BA4b-1). */
+export type ApiKeyKind = 'agent' | 'owner';
+/**
+ * Default agent grant: work resources full + project create.
+ * member / organization / apiKey are never granted at mint (escalation closed).
+ */
+export declare const DEFAULT_AGENT_KEY_PERMISSIONS: PermissionSet;
+/** Full owner permission set — default grant for org-wide owner keys (BA4b-1). */
+export declare const DEFAULT_OWNER_KEY_PERMISSIONS: PermissionSet;
+/** Always stripped from agent-key effective perms — a key must never mint keys. */
+export declare const AGENT_FORBIDDEN_RESOURCES: readonly ["apiKey"];
+/**
+ * Live-role ceiling at verify time (BA5 + BA4b-1):
+ * effective = intersect(keyPermissions, liveMemberRole);
+ * agent profile: then strip AGENT_FORBIDDEN_RESOURCES (apiKey).
+ * owner profile: retain apiKey if both key and live role still grant it.
+ * No live role (member removed) → empty set.
+ */
+export declare function applyAgentKeyPermissionCeiling(keyPermissions: Record<string, readonly string[]> | null | undefined, liveRole: OrgRole | undefined, kind?: ApiKeyKind): PermissionSet;
+export type VerifiedApiKey = {
+    valid: boolean;
+    referenceId: string;
+    permissions: Record<string, string[]> | null;
+    metadata: unknown;
+};
+/**
+ * Call better-auth verifyApiKey without relying on erased plugin types on Auth.
+ * Runtime-validates the result shape so TypeScript stays cast-free.
+ */
+export declare function verifyBetterAuthApiKey(auth: BetterAuthInstance, key: string): Promise<VerifiedApiKey | undefined>;
+export type CreateScopedAgentKeyInput = {
+    auth: BetterAuthInstance;
+    userId: string;
+    orgId: string;
+    projectId: string;
+    permissions?: PermissionSet;
+    name?: string;
+};
+export type CreatedScopedAgentKey = {
+    id: string;
+    key: string;
+    name: string | null;
+    permissions: Record<string, string[]> | null;
+    metadata: {
+        projectId: string;
+        orgId: string;
+    };
+};
+/**
+ * Server-side mint for a project-scoped agent key.
+ * Call only after the caller is a session-authenticated owner (route enforces).
+ * Metadata has no `kind` (or may omit it) — resolver treats absent as agent.
+ */
+export declare function createScopedAgentKey(input: CreateScopedAgentKeyInput): Promise<CreatedScopedAgentKey>;
+export type CreateOrgOwnerKeyInput = {
+    auth: BetterAuthInstance;
+    userId: string;
+    orgId: string;
+    permissions?: PermissionSet;
+    name?: string;
+};
+export type CreatedOrgOwnerKey = {
+    id: string;
+    key: string;
+    name: string | null;
+    permissions: Record<string, string[]> | null;
+    metadata: {
+        orgId: string;
+        kind: 'owner';
+    };
+};
+/**
+ * Server-side mint for an org-wide owner key (BA4b-1).
+ * No projectId in metadata → org-wide reach. kind: 'owner' retains apiKey
+ * after the live-role ceiling (still intersected with live role).
+ */
+export declare function createOrgOwnerKey(input: CreateOrgOwnerKeyInput): Promise<CreatedOrgOwnerKey>;
+//# sourceMappingURL=agent-keys.d.ts.map

package/dist/agent-keys.js

@@ -0,0 +1,181 @@
+import { intersectPermissions } from './access-control.js';
+import { orgRoleToPermissionSet } from './permissions.js';
+const workActions = ['read', 'create', 'update', 'delete'];
+/**
+ * Default agent grant: work resources full + project create.
+ * member / organization / apiKey are never granted at mint (escalation closed).
+ */
+export const DEFAULT_AGENT_KEY_PERMISSIONS = {
+    task: workActions,
+    document: workActions,
+    edge: workActions,
+    goal: workActions,
+    comment: workActions,
+    agent_run: workActions,
+    project: ['create'],
+    member: [],
+    organization: [],
+    apiKey: [],
+};
+/** Full owner permission set — default grant for org-wide owner keys (BA4b-1). */
+export const DEFAULT_OWNER_KEY_PERMISSIONS = orgRoleToPermissionSet('owner');
+/** Always stripped from agent-key effective perms — a key must never mint keys. */
+export const AGENT_FORBIDDEN_RESOURCES = ['apiKey'];
+/**
+ * Live-role ceiling at verify time (BA5 + BA4b-1):
+ * effective = intersect(keyPermissions, liveMemberRole);
+ * agent profile: then strip AGENT_FORBIDDEN_RESOURCES (apiKey).
+ * owner profile: retain apiKey if both key and live role still grant it.
+ * No live role (member removed) → empty set.
+ */
+export function applyAgentKeyPermissionCeiling(keyPermissions, liveRole, kind = 'agent') {
+    const keyPerms = keyPermissions ?? {};
+    const rolePerms = liveRole === undefined ? {} : orgRoleToPermissionSet(liveRole);
+    const effective = intersectPermissions(keyPerms, rolePerms);
+    if (kind === 'agent') {
+        for (const resource of AGENT_FORBIDDEN_RESOURCES) {
+            delete effective[resource];
+        }
+    }
+    return effective;
+}
+function compactPermissions(permissions) {
+    const out = {};
+    for (const [resource, actions] of Object.entries(permissions)) {
+        if (actions.length > 0) {
+            out[resource] = [...actions];
+        }
+    }
+    return out;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parsePermissions(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    if (!isRecord(value)) {
+        return null;
+    }
+    const out = {};
+    for (const [resource, actions] of Object.entries(value)) {
+        if (Array.isArray(actions) &&
+            actions.every((action) => typeof action === 'string')) {
+            out[resource] = actions;
+        }
+    }
+    return out;
+}
+/**
+ * Call better-auth verifyApiKey without relying on erased plugin types on Auth.
+ * Runtime-validates the result shape so TypeScript stays cast-free.
+ */
+export async function verifyBetterAuthApiKey(auth, key) {
+    const api = auth.api;
+    if (!('verifyApiKey' in api)) {
+        return undefined;
+    }
+    const verify = Reflect.get(api, 'verifyApiKey');
+    if (typeof verify !== 'function') {
+        return undefined;
+    }
+    let raw;
+    try {
+        raw = await verify.call(api, { body: { key } });
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(raw) || typeof raw.valid !== 'boolean') {
+        return undefined;
+    }
+    if (raw.valid !== true) {
+        return undefined;
+    }
+    const keyBody = raw.key;
+    if (!isRecord(keyBody) || typeof keyBody.referenceId !== 'string') {
+        return undefined;
+    }
+    return {
+        valid: true,
+        referenceId: keyBody.referenceId,
+        permissions: parsePermissions(keyBody.permissions),
+        metadata: keyBody.metadata ?? null,
+    };
+}
+/**
+ * Shared better-auth createApiKey call (agent + owner mint paths).
+ */
+async function mintBetterAuthApiKey(input) {
+    const api = input.auth.api;
+    if (!('createApiKey' in api)) {
+        throw new Error('better-auth api-key plugin is not mounted');
+    }
+    const create = Reflect.get(api, 'createApiKey');
+    if (typeof create !== 'function') {
+        throw new Error('better-auth createApiKey is not available');
+    }
+    const raw = await create.call(api, {
+        body: {
+            userId: input.userId,
+            name: input.name,
+            permissions: input.permissions,
+            metadata: input.metadata,
+            rateLimitEnabled: false,
+        },
+    });
+    if (!isRecord(raw) || typeof raw.id !== 'string' || typeof raw.key !== 'string') {
+        throw new Error('createApiKey did not return id/key');
+    }
+    if (raw.key.length === 0) {
+        throw new Error('createApiKey did not return a key');
+    }
+    return {
+        id: raw.id,
+        key: raw.key,
+        name: typeof raw.name === 'string' ? raw.name : null,
+        permissions: parsePermissions(raw.permissions),
+    };
+}
+/**
+ * Server-side mint for a project-scoped agent key.
+ * Call only after the caller is a session-authenticated owner (route enforces).
+ * Metadata has no `kind` (or may omit it) — resolver treats absent as agent.
+ */
+export async function createScopedAgentKey(input) {
+    const permissions = compactPermissions(input.permissions ?? DEFAULT_AGENT_KEY_PERMISSIONS);
+    const metadata = { projectId: input.projectId, orgId: input.orgId };
+    const minted = await mintBetterAuthApiKey({
+        auth: input.auth,
+        userId: input.userId,
+        name: input.name ?? 'agent',
+        permissions,
+        metadata,
+    });
+    return {
+        ...minted,
+        metadata,
+    };
+}
+/**
+ * Server-side mint for an org-wide owner key (BA4b-1).
+ * No projectId in metadata → org-wide reach. kind: 'owner' retains apiKey
+ * after the live-role ceiling (still intersected with live role).
+ */
+export async function createOrgOwnerKey(input) {
+    const permissions = compactPermissions(input.permissions ?? DEFAULT_OWNER_KEY_PERMISSIONS);
+    const metadata = { orgId: input.orgId, kind: 'owner' };
+    const minted = await mintBetterAuthApiKey({
+        auth: input.auth,
+        userId: input.userId,
+        name: input.name ?? 'owner',
+        permissions,
+        metadata,
+    });
+    return {
+        ...minted,
+        metadata,
+    };
+}
+//# sourceMappingURL=agent-keys.js.map

package/dist/auth-context.d.ts

@@ -0,0 +1,60 @@
+import type { OrgRole } from '@plandesk/db';
+import { type PermissionSet } from './permissions.js';
+/**
+ * Request-scoped auth. Middleware resolves org + effective permission once,
+ * whatever the transport; services read `orgId` and call requirePermission and
+ * must never branch on `kind`. Three transports, one identity model:
+ * browser session cookie, CLI/agent token (better-auth apiKey), and trusted loopback.
+ */
+export type AuthContext = {
+    kind: 'session';
+    orgId: string;
+    /** Stable identity, e.g. `github:<numeric id>` — never the login. */
+    userRef: string;
+    /** better-auth org role (owner/admin/member) for display. */
+    role: OrgRole;
+    /** Resolved permission set for resource:action checks. */
+    permission: PermissionSet;
+} | {
+    kind: 'loopback';
+    orgId: string;
+    /** REQ-21: local loopback single-org is always owner — no login. */
+    role: 'owner';
+    permission: PermissionSet;
+} | {
+    kind: 'apikey';
+    orgId: string;
+    /** better-auth user id that owns the key (referenceId). */
+    userId: string;
+    /** Optional project scope from key metadata; cross-project → 404. */
+    projectId?: string;
+    /**
+     * Live member role when present. Effective authority is always
+     * `permission` (key ∩ live role; agent profile also strips apiKey —
+     * owner profile retains it when live role allows).
+     */
+    role: OrgRole | undefined;
+    permission: PermissionSet;
+} | {
+    /** Portal participant after join — no org membership, one share only. */
+    kind: 'guest';
+    shareId: string;
+    projectId: string;
+    guestSessionId: string;
+};
+/** Org-bearing contexts (everything except portal guests). */
+export type OrgAuthContext = Exclude<AuthContext, {
+    kind: 'guest';
+}>;
+export declare function isOrgAuthContext(ctx: AuthContext): ctx is OrgAuthContext;
+export declare function runWithAuthContext<T>(ctx: AuthContext, fn: () => T): T;
+export declare function getAuthContext(): AuthContext;
+/** Org-bearing auth only — rejects portal guests (no org membership). */
+export declare function getOrgAuthContext(): OrgAuthContext;
+export declare function tryGetAuthContext(): AuthContext | undefined;
+export declare class ReadOnlyTokenError extends Error {
+    constructor();
+}
+/** Reject pure read-only callers (empty permission set). Guests never write. */
+export declare function assertWriteAccess(): void;
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/auth-context.js

@@ -0,0 +1,41 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { hasAnyWritePermission } from './permissions.js';
+export function isOrgAuthContext(ctx) {
+    return ctx.kind !== 'guest';
+}
+const storage = new AsyncLocalStorage();
+export function runWithAuthContext(ctx, fn) {
+    return storage.run(ctx, fn);
+}
+export function getAuthContext() {
+    const ctx = storage.getStore();
+    if (ctx === undefined) {
+        throw new Error('Auth context is not set — org auth middleware must run first');
+    }
+    return ctx;
+}
+/** Org-bearing auth only — rejects portal guests (no org membership). */
+export function getOrgAuthContext() {
+    const ctx = getAuthContext();
+    if (!isOrgAuthContext(ctx)) {
+        throw new Error('Guest context has no org membership');
+    }
+    return ctx;
+}
+export function tryGetAuthContext() {
+    return storage.getStore();
+}
+export class ReadOnlyTokenError extends Error {
+    constructor() {
+        super('read-only token cannot perform write operations');
+        this.name = 'ReadOnlyTokenError';
+    }
+}
+/** Reject pure read-only callers (empty permission set). Guests never write. */
+export function assertWriteAccess() {
+    const ctx = getAuthContext();
+    if (ctx.kind === 'guest' || !hasAnyWritePermission(ctx.permission)) {
+        throw new ReadOnlyTokenError();
+    }
+}
+//# sourceMappingURL=auth-context.js.map

package/dist/auth.d.ts

@@ -1,3 +1,36 @@
 import type { MiddlewareHandler } from 'hono';
+import { type Db } from '@plandesk/db';
+import type { BetterAuthInstance } from './better-auth.js';
+/** True when the server is bound only to loopback (trusted local network boundary). */
+export declare function isLoopbackBind(host: string): boolean;
+export type OrgAuthOptions = {
+    db: Db;
+    /** Server bind address. Loopback default-org only when this is loopback. */
+    bindHost: string;
+    /**
+     * better-auth instance when configured. Session cookies issued by better-auth
+     * are recognized here; omit and only apiKey / loopback / guest apply.
+     */
+    betterAuth?: BetterAuthInstance;
+};
+export declare function isInvitationAcceptPath(path: string): boolean;
+export declare function isPublicAuthPath(path: string): boolean;
+export declare function isPublicShareReadPath(path: string): boolean;
+export declare function isShareGuestViewPath(path: string): boolean;
+export declare function extractShareTokenFromViewPath(path: string): string | undefined;
+/**
+ * Always-on org resolver for every request:
+ * 1. Bearer → better-auth API key (BA5 live-role ceiling) when configured
+ * 2. else better-auth session cookie → active org + member role (when configured)
+ * 3. else loopback bind + single-org → default org as owner (local, zero friction)
+ * 4. else 401
+ *
+ * A stranger bearer that is not a better-auth key is always 401 (no mcp_token fallback).
+ * Every branch yields the same `{ orgId, permission }`, so services downstream
+ * are identical for a browser, the CLI, and an agent.
+ */
+export declare function createOrgAuthMiddleware(options: OrgAuthOptions): MiddlewareHandler;
+/** Optional Basic auth gate (PLANDESK_AUTH_PASSWORD). Skips MCP paths. */
 export declare function createAuthMiddleware(password: string): MiddlewareHandler;
+export declare function createWriteGuardMiddleware(): MiddlewareHandler;
 //# sourceMappingURL=auth.d.ts.map