@plitzi/sdk-server 0.32.25 → 0.33.1

package/dist/adapters/authAdapters.d.ts

@@ -0,0 +1,21 @@
+import { SSRAdapters, SSRRequest, SSRSession, SSRUser } from '@plitzi/sdk-shared';
+/**
+ * The three adapters a page server asks about WHO a request carries, for a deployment that answers them itself.
+ *
+ * Separate from the space adapters on purpose: what a request renders and who is looking at it are two different
+ * integrations, and a deployment routinely swaps one without touching the other. Composing them is a spread.
+ *
+ * A deployment running the auth kernel does not need this at all — `createAuth(...).ssrAdapters` answers the same
+ * three, from the flows that mint and revoke the sessions. This is for the case with no kernel: a fixed user in a
+ * test, a proxy that has already authenticated the request, or a store reached directly.
+ */
+export type AuthAdaptersConfig = {
+    /** Who this request carries. A value for every request, or a function that reads the credential off one. */
+    user?: SSRUser | ((req: SSRRequest) => SSRUser | undefined | Promise<SSRUser | undefined>);
+    /** Verify credentials and mint a session. Return undefined to refuse; never throw for a wrong password. */
+    authenticate?: (credentials: Record<string, string>, req: SSRRequest) => Promise<SSRSession | undefined>;
+    /** Revoke the session this request carries, at the source. The cookies are the server's to clear. */
+    endSession?: (req: SSRRequest) => Promise<void>;
+};
+export type AuthAdapters = Pick<SSRAdapters, 'getUser' | 'authenticate' | 'endSession'>;
+export declare const createAuthAdapters: (config: AuthAdaptersConfig) => AuthAdapters;

package/dist/adapters/authAdapters.js

@@ -0,0 +1,12 @@
+//#region src/adapters/authAdapters.ts
+var createAuthAdapters = (config) => {
+	const { user, authenticate, endSession } = config;
+	const getUser = user ? (req) => Promise.resolve(typeof user === "function" ? user(req) : user) : void 0;
+	return {
+		...getUser ? { getUser } : {},
+		...authenticate ? { authenticate } : {},
+		...endSession ? { endSession } : {}
+	};
+};
+//#endregion
+export { createAuthAdapters };

package/dist/adapters/jsonAdapters.d.ts

@@ -0,0 +1,15 @@
+import { OfflineDataRaw, SSRPageAdapters, SSRSpaceDeployment } from '@plitzi/sdk-shared';
+/**
+ * Where a space comes from, and nothing else. Who is looking at it is `createAuthAdapters` (or the auth kernel's
+ * own `ssrAdapters`) — a deployment composes the two with a spread, and swaps either without disturbing the other.
+ */
+export type JsonAdaptersConfig = {
+    /**
+     * The space: a path to a `{ schema, style }` JSON, a function returning one per request, or the data itself for a
+     * consumer that already holds it (composed at startup, fetched once, built in a test). Only a path can be written
+     * back to, so `saveOfflineData` is offered only when one was given.
+     */
+    offlineData: OfflineDataRaw | string | ((spaceId: number, environment: string, revision?: number) => string);
+    deployment?: string | SSRSpaceDeployment | Record<string, SSRSpaceDeployment>;
+};
+export declare const createJsonAdapters: (config: JsonAdaptersConfig) => SSRPageAdapters;

package/dist/adapters/jsonAdapters.js

@@ -3,9 +3,14 @@ import { readFileSync, writeFileSync } from "node:fs";
 var isDeploymentObject = (v) => typeof v === "object" && ("spaceId" in v || "environment" in v || "error" in v);
 var readJson = (filePath) => JSON.parse(readFileSync(filePath, "utf-8"));
 var createJsonAdapters = (config) => {
+	const pathFor = (spaceId, environment, revision) => {
+		if (typeof config.offlineData === "function") return config.offlineData(spaceId, environment, revision);
+		return typeof config.offlineData === "string" ? config.offlineData : void 0;
+	};
 	const getOfflineData = (spaceId, environment, revision) => {
 		try {
-			const filePath = typeof config.offlineData === "function" ? config.offlineData(spaceId, environment, revision) : config.offlineData;
+			const filePath = pathFor(spaceId, environment, revision);
+			if (!filePath) return Promise.resolve(config.offlineData);
 			return Promise.resolve(readJson(filePath));
 		} catch (err) {
 			console.error("[JsonAdapters] Failed to read offlineData:", err.message);
@@ -13,7 +18,8 @@ var createJsonAdapters = (config) => {
 		}
 	};
 	const saveOfflineData = (spaceId, environment, data) => {
-		const filePath = typeof config.offlineData === "function" ? config.offlineData(spaceId, environment) : config.offlineData;
+		const filePath = pathFor(spaceId, environment);
+		if (!filePath) return Promise.resolve();
 		writeFileSync(filePath, JSON.stringify(data, null, 2));
 		return Promise.resolve();
 	};
@@ -43,9 +49,8 @@ var createJsonAdapters = (config) => {
 	};
 	return {
 		getOfflineData,
-		saveOfflineData,
 		getSpaceDeployment,
-		getUser: config.user ? (req) => Promise.resolve(typeof config.user === "function" ? config.user(req) : config.user) : void 0
+		...typeof config.offlineData !== "object" ? { saveOfflineData } : {}
 	};
 };
 //#endregion

package/dist/core/auth/api.d.ts

@@ -0,0 +1,148 @@
+import { CredentialCarrier } from './credentials';
+import { Actor, Identity } from './identity';
+import { Tokens } from './tokens';
+import { SSRSession } from '@plitzi/sdk-shared';
+/**
+ * An account, as whatever stores accounts reports one. Deliberately not a user model: these are the only fields any
+ * decision here is made on, and a deployment maps its own row onto them.
+ */
+export interface AccountRecord {
+    id: number;
+    username: string;
+    email: string;
+    /** Suspended, deactivated, whatever the deployment calls it — an inactive account never gets a session. */
+    active: boolean;
+    /** Confirmed their address. An unverified account may still sign in; what it may *do* is a matter for RBAC. */
+    verified: boolean;
+    /** Absent for accounts that have no password — one created through an identity provider, for instance. */
+    passwordHash?: string;
+    /** Unix seconds, for the refresh credential this account currently holds. */
+    refreshExpiresAt?: number;
+}
+export interface AccountAccess {
+    roles: string[];
+    permissions: string[];
+}
+/**
+ * The account store, as auth needs to see it. Every method is optional except the three the session cycle cannot do
+ * without, and **what is absent decides what this server offers**: a deployment with no `createAccount` has no
+ * signup, and its route answers 404 rather than failing at runtime. That rule is what lets one server serve a
+ * deployment with its own user table and one that signs everybody in through an external provider.
+ */
+export interface AccountAdapters {
+    /** Persist a freshly minted pair. Storing it is what retires the previous one — the whole of rotation. */
+    saveSession: (userId: number, session: SSRSession) => Promise<void>;
+    /** Clear the pair, by whichever half the caller holds, or by account. */
+    clearSession: (target: {
+        accessToken?: string;
+        refreshToken?: string;
+        userId?: number;
+    }) => Promise<void>;
+    /** Global roles and permissions, for the body a grant answers with. */
+    loadAccess: (userId: number) => Promise<AccountAccess>;
+    findByUsername?: (username: string) => Promise<AccountRecord | undefined>;
+    findByRefreshToken?: (token: string) => Promise<AccountRecord | undefined>;
+    createAccount?: (account: {
+        username: string;
+        email: string;
+        passwordHash: string;
+    }) => Promise<AccountRecord>;
+    findByEmail?: (email: string) => Promise<AccountRecord | undefined>;
+    setPassword?: (userId: number, passwordHash: string) => Promise<void>;
+    setResetToken?: (userId: number, token: string) => Promise<void>;
+    findByResetToken?: (token: string) => Promise<AccountRecord | undefined>;
+    setValidationToken?: (userId: number, token: string) => Promise<void>;
+    findByValidationToken?: (token: string) => Promise<AccountRecord | undefined>;
+    markVerified?: (userId: number) => Promise<void>;
+    /** Called for validation and password-reset mail. Without it neither flow is offered. */
+    sendMail?: (message: {
+        to: string;
+        template: string;
+        data: Record<string, string>;
+    }) => Promise<void>;
+    /**
+     * Turn a credential the browser obtained from an identity provider into an account here. Everything that decides
+     * whether the credential is any good — which providers this deployment trusts, and that the token was minted for
+     * *this* application — lives in the implementation, because only it knows.
+     */
+    exchangeCredential?: (provider: string, token: string, carrier: CredentialCarrier) => Promise<AccountRecord | {
+        error: string;
+        status?: number;
+    } | undefined>;
+}
+export interface AuthApiConfig {
+    /** Compare a password against a stored hash. A deployment picks its own algorithm; nothing here assumes one. */
+    verifyPassword?: (plain: string, hash: string) => Promise<boolean>;
+    hashPassword?: (plain: string) => Promise<string>;
+    /** Opaque, single-use strings for validation and reset links. */
+    generateToken?: () => string;
+    /** Whether a new account may sign in immediately or has to confirm its address first. */
+    verifyOnSignup?: boolean;
+}
+/** What a handler answers: a body, and optionally what should happen to the session cookies. */
+export type AuthOutcome = {
+    ok: true;
+    status?: number;
+    body: object;
+    session?: SSRSession;
+    endSession?: boolean;
+} | {
+    ok: false;
+    status: number;
+    body: object;
+};
+/**
+ * The HTTP surface of authentication, as functions rather than routes.
+ *
+ * Nothing here knows about Express, or about this server's own pipeline: a handler is given what the request
+ * carried and answers what should be sent, including whether the session cookies should be written or cleared. The
+ * binding does the rest, which is what lets the same login live behind an API endpoint and behind a rendered page's
+ * form without either owning it.
+ */
+export declare const createAuthApi: ({ tokens, identity, adapters, config }: {
+    tokens: Tokens;
+    identity: Identity;
+    adapters: AccountAdapters;
+    config?: AuthApiConfig;
+}) => {
+    capabilities: {
+        passwordLogin: boolean;
+        refresh: boolean;
+        signup: boolean;
+        passwordReset: boolean;
+        emailVerification: boolean;
+        exchange: boolean;
+    };
+    /** What a client reads to know which of the flows below actually exist here. */
+    describe: () => AuthOutcome;
+    /**
+     * Who the caller is, and until when. Reaching a resolved actor at all is the answer to "is the session alive" —
+     * the guard refuses with a `reason` when it could not, so a client learns whether to renew or to drop to
+     * signed-out from the refusal itself. It costs no query: the actor was resolved before routing.
+     */
+    session: (actor?: Actor) => AuthOutcome;
+    login: (credentials: Record<string, unknown>) => Promise<AuthOutcome>;
+    refresh: (refreshToken?: string) => Promise<AuthOutcome>;
+    /** Reachable with an expired access token on purpose, or a live refresh token could never be revoked. */
+    logout: (credentials: {
+        accessToken?: string;
+        refreshToken?: string;
+    }) => Promise<AuthOutcome>;
+    /**
+     * Ends this account's session everywhere, for the case where one leaked. Unlike logout it is authenticated and
+     * works by account id, so it can be used from a device that still has a good session while the stolen copy is
+     * somewhere else entirely.
+     */
+    revokeSessions: (userId?: number) => Promise<AuthOutcome>;
+    exchange: (provider: string, token: string, carrier: CredentialCarrier) => Promise<AuthOutcome>;
+    signup: (fields: Record<string, unknown>) => Promise<AuthOutcome>;
+    /** Answers the same either way: whether an address has an account here is not something a stranger may probe. */
+    forgotPassword: (email: string) => Promise<AuthOutcome>;
+    resetPassword: (token: string, password: string) => Promise<AuthOutcome>;
+    validateAccount: (token: string) => Promise<AuthOutcome>;
+    resendVerification: (email: string) => Promise<AuthOutcome>;
+    /** Exposed so a deployment can mint a session outside the flows above — a rendered page's login form. */
+    issueSession: (userId: number) => Promise<SSRSession>;
+    resolveActor: (carrier: CredentialCarrier) => Promise<import('./identity').ActorResult>;
+};
+export type AuthApi = ReturnType<typeof createAuthApi>;

package/dist/core/auth/api.js

@@ -0,0 +1,286 @@
+//#region src/core/auth/api.ts
+var refuse = (status, error, reason) => ({
+	ok: false,
+	status,
+	body: reason ? {
+		error,
+		reason
+	} : { error }
+});
+var NOT_OFFERED = refuse(404, "Not found");
+/**
+* A field from a request body, as a string. Numbers count: JSON carries an all-digits password as a number, and a
+* client that sends one has supplied a password — refusing it as "credentials are required" is a lie about what
+* arrived. Objects and arrays do not, since `[object Object]` is not a value anybody sent.
+*/
+var asText = (value) => {
+	if (typeof value === "string") return value;
+	return typeof value === "number" && Number.isFinite(value) ? String(value) : "";
+};
+var asString = (value) => asText(value).trim();
+/**
+* The HTTP surface of authentication, as functions rather than routes.
+*
+* Nothing here knows about Express, or about this server's own pipeline: a handler is given what the request
+* carried and answers what should be sent, including whether the session cookies should be written or cleared. The
+* binding does the rest, which is what lets the same login live behind an API endpoint and behind a rendered page's
+* form without either owning it.
+*/
+var createAuthApi = ({ tokens, identity, adapters, config = {} }) => {
+	const { verifyPassword, hashPassword, generateToken, verifyOnSignup = false } = config;
+	/**
+	* What this deployment offers, decided by what it supplied and nothing else.
+	*
+	* There used to be a parallel set of `features` switches. They were redundant in every case — each flow reads
+	* adapters that no other flow reads, so leaving one out is already how you decline it — and two ways of saying
+	* the same thing invite the state where they disagree: an adapter wired up, the flag forgotten, and an endpoint
+	* that answers 404 for no reason anyone can see. Declining a flow is now one act: do not implement it.
+	*/
+	const capabilities = {
+		passwordLogin: !!adapters.findByUsername && !!verifyPassword,
+		refresh: !!adapters.findByRefreshToken,
+		signup: !!adapters.createAccount && !!hashPassword,
+		passwordReset: !!adapters.findByEmail && !!adapters.setResetToken && !!hashPassword,
+		emailVerification: !!adapters.findByValidationToken && !!adapters.markVerified,
+		exchange: !!adapters.exchangeCredential
+	};
+	const issue = async (userId) => {
+		const now = Math.floor(Date.now() / 1e3);
+		const session = {
+			token: tokens.generateUserToken(userId),
+			expiresAt: now + tokens.lifetimes.access,
+			refreshToken: tokens.generateRefreshToken(userId),
+			refreshExpiresAt: now + tokens.lifetimes.refresh
+		};
+		await adapters.saveSession(userId, session);
+		return session;
+	};
+	/**
+	* The body a grant answers with. `details` is the same object the session endpoint returns, deliberately: it makes
+	* a grant an identity, so a client that has just signed in or renewed knows who it is without a second request.
+	*/
+	const grantBody = async (account, session) => {
+		const access = await adapters.loadAccess(account.id);
+		const now = Math.floor(Date.now() / 1e3);
+		return {
+			success: true,
+			details: {
+				id: account.id,
+				username: account.username,
+				email: account.email,
+				verified: account.verified,
+				roles: access.roles,
+				permissions: access.permissions
+			},
+			access_token: session.token,
+			expire_in: Math.max(0, session.expiresAt - now),
+			expire_at: session.expiresAt,
+			refresh_token: session.refreshToken,
+			refresh_expire_in: Math.max(0, (session.refreshExpiresAt ?? 0) - now),
+			refresh_expire_at: session.refreshExpiresAt
+		};
+	};
+	return {
+		capabilities,
+		/** What a client reads to know which of the flows below actually exist here. */
+		describe: () => ({
+			ok: true,
+			body: { features: capabilities }
+		}),
+		/**
+		* Who the caller is, and until when. Reaching a resolved actor at all is the answer to "is the session alive" —
+		* the guard refuses with a `reason` when it could not, so a client learns whether to renew or to drop to
+		* signed-out from the refusal itself. It costs no query: the actor was resolved before routing.
+		*/
+		session: (actor) => {
+			if (!actor) return refuse(401, "Not authenticated", "missing");
+			const now = Math.floor(Date.now() / 1e3);
+			return {
+				ok: true,
+				body: {
+					success: true,
+					details: {
+						id: actor.id,
+						username: actor.username,
+						email: actor.email,
+						verified: actor.verified,
+						roles: actor.roles,
+						permissions: actor.permissions
+					},
+					access_token: actor.token,
+					expire_in: Math.max(0, actor.expiresAt - now),
+					expire_at: actor.expiresAt
+				}
+			};
+		},
+		login: async (credentials) => {
+			if (!capabilities.passwordLogin) return NOT_OFFERED;
+			const username = asString(credentials.username);
+			const password = asText(credentials.password);
+			if (!username || !password) return refuse(400, "A username and a password are required");
+			const account = await adapters.findByUsername?.(username);
+			if (!account) return refuse(401, "Invalid credentials");
+			if (!account.active) return refuse(401, "Account is not active");
+			if (!account.passwordHash || !await verifyPassword?.(password, account.passwordHash)) return refuse(401, "Invalid credentials");
+			const session = await issue(account.id);
+			return {
+				ok: true,
+				body: await grantBody(account, session),
+				session
+			};
+		},
+		refresh: async (refreshToken) => {
+			if (!capabilities.refresh) return NOT_OFFERED;
+			if (!refreshToken) return refuse(400, "Refresh token is required");
+			const account = await adapters.findByRefreshToken?.(refreshToken);
+			if (!account || !account.refreshExpiresAt || account.refreshExpiresAt < Math.floor(Date.now() / 1e3)) return refuse(401, "Invalid or expired refresh token", "expired");
+			if (!account.active) return refuse(401, "Account is not active", "inactive");
+			const session = await issue(account.id);
+			return {
+				ok: true,
+				body: await grantBody(account, session),
+				session
+			};
+		},
+		/** Reachable with an expired access token on purpose, or a live refresh token could never be revoked. */
+		logout: async (credentials) => {
+			if (credentials.accessToken || credentials.refreshToken) await adapters.clearSession(credentials);
+			return {
+				ok: true,
+				body: { message: "Logged out successfully" },
+				endSession: true
+			};
+		},
+		/**
+		* Ends this account's session everywhere, for the case where one leaked. Unlike logout it is authenticated and
+		* works by account id, so it can be used from a device that still has a good session while the stolen copy is
+		* somewhere else entirely.
+		*/
+		revokeSessions: async (userId) => {
+			if (!userId) return refuse(401, "Not authenticated", "missing");
+			await adapters.clearSession({ userId });
+			return {
+				ok: true,
+				body: { message: "All sessions revoked" },
+				endSession: true
+			};
+		},
+		exchange: async (provider, token, carrier) => {
+			if (!capabilities.exchange) return NOT_OFFERED;
+			if (!provider || !token) return refuse(400, "A provider and a token are required");
+			const result = await adapters.exchangeCredential?.(provider, token, carrier);
+			if (!result) return refuse(401, "Token Invalid", "revoked");
+			if ("error" in result) return refuse(result.status ?? 400, result.error, "revoked");
+			const session = await issue(result.id);
+			return {
+				ok: true,
+				body: await grantBody(result, session),
+				session
+			};
+		},
+		signup: async (fields) => {
+			if (!capabilities.signup) return NOT_OFFERED;
+			const username = asString(fields.username);
+			const email = asString(fields.email);
+			const password = asText(fields.password);
+			if (!username || !email || !password) return refuse(400, "A username, an email and a password are required");
+			if (await adapters.findByUsername?.(username) ?? await adapters.findByEmail?.(email)) return refuse(400, "User already exists");
+			if (!adapters.createAccount || !hashPassword) return NOT_OFFERED;
+			const account = await adapters.createAccount({
+				username,
+				email,
+				passwordHash: await hashPassword(password)
+			});
+			if (!verifyOnSignup && capabilities.emailVerification && generateToken && adapters.setValidationToken) {
+				const validationToken = generateToken();
+				await adapters.setValidationToken(account.id, validationToken);
+				await adapters.sendMail?.({
+					to: email,
+					template: "validation",
+					data: {
+						username,
+						validationToken
+					}
+				});
+			}
+			return {
+				ok: true,
+				status: 201,
+				body: {
+					message: "User created successfully",
+					userId: account.id
+				}
+			};
+		},
+		/** Answers the same either way: whether an address has an account here is not something a stranger may probe. */
+		forgotPassword: async (email) => {
+			if (!capabilities.passwordReset || !generateToken) return NOT_OFFERED;
+			const account = await adapters.findByEmail?.(asString(email));
+			if (account) {
+				const resetToken = generateToken();
+				await adapters.setResetToken?.(account.id, resetToken);
+				await adapters.sendMail?.({
+					to: account.email,
+					template: "password-reset",
+					data: {
+						username: account.username,
+						resetToken
+					}
+				});
+			}
+			return {
+				ok: true,
+				body: { message: "Password reset email sent" }
+			};
+		},
+		resetPassword: async (token, password) => {
+			if (!capabilities.passwordReset || !hashPassword) return NOT_OFFERED;
+			if (!token || !password) return refuse(400, "A token and a password are required");
+			const account = await adapters.findByResetToken?.(token);
+			if (!account) return refuse(400, "Invalid or expired token");
+			await adapters.setPassword?.(account.id, await hashPassword(password));
+			await adapters.setResetToken?.(account.id, "");
+			await adapters.clearSession({ userId: account.id });
+			return {
+				ok: true,
+				body: { message: "Password reset successfully" },
+				endSession: true
+			};
+		},
+		validateAccount: async (token) => {
+			if (!capabilities.emailVerification) return NOT_OFFERED;
+			const account = await adapters.findByValidationToken?.(token);
+			if (!account) return refuse(400, "Invalid or expired token");
+			await adapters.markVerified?.(account.id);
+			return {
+				ok: true,
+				body: { message: "Account validated successfully" }
+			};
+		},
+		resendVerification: async (email) => {
+			if (!capabilities.emailVerification || !generateToken) return NOT_OFFERED;
+			const account = await adapters.findByEmail?.(asString(email));
+			if (account && !account.verified) {
+				const validationToken = generateToken();
+				await adapters.setValidationToken?.(account.id, validationToken);
+				await adapters.sendMail?.({
+					to: account.email,
+					template: "validation",
+					data: {
+						username: account.username,
+						validationToken
+					}
+				});
+			}
+			return {
+				ok: true,
+				body: { message: "Verification email resent" }
+			};
+		},
+		/** Exposed so a deployment can mint a session outside the flows above — a rendered page's login form. */
+		issueSession: issue,
+		resolveActor: identity.resolveActor
+	};
+};
+//#endregion
+export { createAuthApi };

package/dist/core/auth/authorize.d.ts

@@ -0,0 +1,96 @@
+import { CredentialCarrier } from './credentials';
+import { Actor, Grant, Identity } from './identity';
+import { AuthFailure } from './tokens';
+/**
+ * Strings match exactly — a prefix test would make '/' match every route and silently expose everything under it.
+ * Regexes and predicates cover the cases that genuinely need to look at sub-paths (a predicate so social-auth routes
+ * can resolve a provider registry rather than trusting the shape of a URL).
+ */
+export type PathMatcher = string | RegExp | ((path: string) => boolean);
+/**
+ * Both credentials are resolved for every non-public request; the requirement only says which must be there.
+ * Resolving the one that is absent is nearly free — a token of the wrong kind fails on its `scope` claim before any
+ * database lookup.
+ */
+export type Requirement = 
+/** No credential is read and nothing is checked. */
+'public'
+/**
+ * Neither is required. Authorization happens deeper in (GraphQL guards each operation), so the transport must let
+ * anonymous requests through to be refused there properly rather than with a bare 401.
+ */
+ | 'optional'
+/** A valid space grant. Says which space — never that the caller may change it. */
+ | 'grant'
+/** A verified account. */
+ | 'actor'
+/**
+ * Both: the space is named by the token, the authority comes from the session. What anything that writes on
+ * behalf of a person needs.
+ */
+ | 'grant+actor';
+export interface AuthPolicy {
+    rules: {
+        match: PathMatcher[];
+        requirement: Requirement;
+    }[];
+    fallback: Requirement;
+}
+export type AuthorizeResult = {
+    ok: true;
+    actor?: Actor;
+    grant?: Grant;
+} | {
+    ok: false;
+    status: number;
+    reason: AuthFailure;
+};
+export declare const requirementFor: (policy: AuthPolicy, path: string) => Requirement;
+/**
+ * Decides whether a request may proceed, and with what identity — the same decision on every transport, which is
+ * the point of it living here rather than inside one framework's middleware. Callers bind it to their own: Express
+ * puts the result on `req` and answers 401 itself, this server's pipeline does the same with its own response.
+ */
+export declare const createAuthorizer: (identity: Identity, policy: AuthPolicy) => (carrier: CredentialCarrier, path: string) => Promise<AuthorizeResult>;
+export type Authorizer = ReturnType<typeof createAuthorizer>;
+export type PermissionCheck = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/**
+ * A global capability, checked off the actor the guard already resolved — no query. This is the whole of RBAC that
+ * applies outside a space: platform-wide routes rather than "may you touch this space", which is `identity.can()` and
+ * needs the membership half too.
+ *
+ * An answer rather than a middleware, so it reads the same from any host. The distinction it exists to make is 401
+ * against 403: "nobody is here" and "you are here and this is not yours" are different facts, and collapsing them
+ * tells a signed-in caller to sign in again.
+ */
+export declare const checkPermission: (actor: Actor | undefined, permission: string) => PermissionCheck;
+/** What a membership row has to say for the check below. A deployment's own row will carry far more. */
+export interface MembershipFacts {
+    isOwner: boolean;
+}
+export type SpaceAccessCheck = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+/**
+ * The space half: may this actor act on this space at all, and is being its owner required?
+ *
+ * The answer that matters is the middle one. A non-member gets **404, not 403** — telling a stranger "you may not
+ * touch this space" confirms the space exists, and whether a given slug belongs to somebody is not a fact an
+ * outsider gets to establish by asking. Owners and members are told apart afterwards, because by then the caller has
+ * already proved they belong there and 403 gives away nothing.
+ *
+ * Resolving the membership is the deployment's — its tables, and whether a route names a space by id or by slug.
+ */
+export declare const checkSpaceAccess: (actor: Actor | undefined, membership: MembershipFacts | undefined, { owner }?: {
+    owner?: boolean;
+}) => SpaceAccessCheck;