@plitzi/sdk-server 0.33.2 → 0.34.0

package/dist/core/auth/tokens.d.ts

@@ -18,11 +18,40 @@ export declare const SCOPES: {
     readonly widget: "widget";
     readonly spaceRender: "space:render";
     readonly spaceAgent: "space:agent";
+    /**
+     * A SERVER that renders this space as its own — self-hosting. Secret by construction, which is the whole reason it
+     * exists apart from `space:render`: see {@link SpaceScope}.
+     */
+    readonly spaceHost: "space:host";
+    /** A sign-in that got the password right and still owes a second factor. Carries no authority of its own. */
+    readonly mfa: "mfa";
 };
 export type TokenScope = (typeof SCOPES)[keyof typeof SCOPES];
-export type SpaceScope = 'render' | 'agent';
+/**
+ * What a space credential IS, and the distinction the other two are defined against.
+ *
+ * `render` is **public**: it ships in the clear inside every published page, so anybody who views source has it. The
+ * only thing that keeps a copied one from working is that a browser is made to state where it is presenting from and
+ * that statement is checked — a control that exists solely because browsers enforce it, and that means nothing to a
+ * client which simply does not send the header.
+ *
+ * `host` is that same read access for a server, and it is **secret**: shown once when it is issued, never embedded in
+ * a page, held only by the deployment operator. Self-hosting needs a credential that survives having no Origin to
+ * check, and a public one cannot be it — a render key lifted from someone else's page would otherwise be enough to
+ * serve a byte-identical clone of their site from anywhere.
+ *
+ * `agent` writes, on behalf of the member who consented.
+ */
+export type SpaceScope = 'render' | 'agent' | 'host';
+/** The scopes that are safe to present with no `Origin` header, because they are not public to begin with. */
+export declare const OFF_BROWSER_SPACE_SCOPES: readonly SpaceScope[];
 /** Why a credential was refused. A reason rather than a status, because each transport maps it onto its own. */
-export type AuthFailure = 'missing' | 'malformed' | 'expired' | 'outdated' | 'revoked' | 'wrong-type' | 'scope-mismatch' | 'issuer-not-allowed' | 'origin-not-allowed' | 'domain-not-allowed' | 'inactive';
+export type AuthFailure = 'missing' | 'malformed' | 'expired' | 'outdated' | 'revoked' | 'wrong-type' | 'scope-mismatch' | 'issuer-not-allowed' | 'origin-not-allowed' | 'domain-not-allowed' | 'inactive'
+/**
+ * The password was right and the address has never answered. Separate from `inactive` because it is the one
+ * refusal whose owner can clear it themselves, and a screen that cannot tell them apart has to guess.
+ */
+ | 'unverified';
 export declare const authFailureMessage: Record<AuthFailure, string>;
 /**
  * How long each credential lives. One rule, applied by how much damage the credential can do and whether something
@@ -40,8 +69,25 @@ export declare const DEFAULT_LIFETIMES: {
     readonly refresh: number;
     readonly agent: number;
     readonly widget: number;
+    /**
+     * Long enough to fetch a code out of an app, short enough that a stolen one is worthless. It authorises nothing
+     * on its own — only finishing the sign-in it belongs to, which still needs the code.
+     */
+    readonly mfaChallenge: 300;
+    /**
+     * The longest a session may live no matter how often it renews, counted from when it began. `0` means no cap,
+     * which is the default and what most deployments want: the renewal window is already an idle timeout, since a
+     * session nobody refreshes dies with its refresh token. This is the other half — the one that ends a session
+     * that has been renewing quietly for a year.
+     */
+    readonly session: 0;
 };
-export type TokenLifetimes = Partial<typeof DEFAULT_LIFETIMES>;
+/**
+ * Seconds, per credential. Written as a record of `number` rather than `Partial<typeof DEFAULT_LIFETIMES>`: the
+ * defaults are `as const`, so that shape narrowed every field to the literal it happens to default to and made
+ * `{ access: 3600 }` a type error. The option existed and could not be used.
+ */
+export type TokenLifetimes = Partial<Record<keyof typeof DEFAULT_LIFETIMES, number>>;
 export type TokenConfig = {
     secret: string;
     /** What this deployment mints under. Also accepted on the way back in, along with `alsoAccept`. */
@@ -70,13 +116,33 @@ interface BaseClaims {
 export interface UserTokenPayload extends BaseClaims {
     scope: typeof SCOPES.user;
     sub: string;
+    /**
+     * Who is really behind this credential, when it is not the subject: an administrator acting AS somebody. `act` is
+     * the registered claim for exactly that (RFC 8693 §4.1), so a log line, an audit trail or a downstream service can
+     * tell a session somebody was given from one they signed into — and nothing has to invent a claim to say it.
+     */
+    act?: {
+        sub: string;
+    };
+}
+/** What a session credential is, beyond who it is for. */
+export interface UserTokenOptions {
+    /** The id of whoever obtained this session on the subject's behalf. Becomes the `act` claim. */
+    actingAs?: number | string;
+    /** Overrides `lifetimes.access`. A borrowed session is worth keeping short. */
+    ttlSeconds?: number;
 }
 export interface RefreshTokenPayload extends BaseClaims {
     scope: typeof SCOPES.refresh;
     sub: string;
 }
+/** Half a sign-in: the password is proven, the second factor is not. Authorises finishing that login and nothing else. */
+export interface MfaChallengePayload extends BaseClaims {
+    scope: typeof SCOPES.mfa;
+    sub: string;
+}
 export interface SpaceTokenPayload extends BaseClaims {
-    scope: typeof SCOPES.spaceRender | typeof SCOPES.spaceAgent;
+    scope: typeof SCOPES.spaceRender | typeof SCOPES.spaceAgent | typeof SCOPES.spaceHost;
     sub: string;
     /** Web origins the space may be embedded on. No registered claim covers this. */
     origins: string[];
@@ -85,7 +151,7 @@ export interface SpaceTokenPayload extends BaseClaims {
 export interface WidgetTokenPayload extends BaseClaims {
     scope: typeof SCOPES.widget;
 }
-export type TokenPayload = UserTokenPayload | RefreshTokenPayload | SpaceTokenPayload | WidgetTokenPayload;
+export type TokenPayload = UserTokenPayload | RefreshTokenPayload | SpaceTokenPayload | WidgetTokenPayload | MfaChallengePayload;
 export type VerifyResult<T> = {
     ok: true;
     payload: T;
@@ -108,15 +174,14 @@ export interface SpaceTokenOptions {
  * server issues under their own and nothing they mint is worth anything here, or the other way round.
  */
 export declare const createTokens: (config: TokenConfig) => {
-    lifetimes: {
-        access: 86400;
-        refresh: number;
-        agent: number;
-        widget: number;
-    };
-    generateUserToken: (userId: number | string) => string;
+    lifetimes: Record<"session" | "refresh" | "widget" | "agent" | "access" | "mfaChallenge", number>;
+    /** What this deployment mints under. Read by anything that has to name the deployment — an enrolment URI, say. */
+    issuer: string;
+    generateUserToken: (userId: number | string, { actingAs, ttlSeconds }?: UserTokenOptions) => string;
     generateRefreshToken: (userId: number | string) => string;
     generateWidgetToken: () => string;
+    /** Says "this person proved their password"; nothing more, and only for a few minutes. */
+    generateMfaChallenge: (userId: number | string) => string;
     /**
      * A `render` token may live forever, and defaults to it, because it is embedded in a published site — often a
      * SPA deployed once and left alone — where an expiry is a scheduled outage: the site breaks weeks later with
@@ -127,10 +192,16 @@ export declare const createTokens: (config: TokenConfig) => {
      *
      * An `agent` grant is the opposite default and always carries a lifetime: it writes, and it is held by a
      * third-party host.
+     *
+     * A `host` grant follows `render`: it only reads, it is held by the space owner's own deployment, and an expiry
+     * there is the same scheduled outage — except the site goes quietly STALE rather than dark, because a
+     * self-hosted renderer keeps serving the last copy it fetched. Being secret, it is worth rotating; being
+     * revocable, it does not need a deadline to be withdrawn.
      */
     generateSpaceToken: (spaceId: number | string, origins: string[], scope?: SpaceScope, { expiresAt }?: SpaceTokenOptions) => string;
     verifyUserToken: (token: string) => VerifyResult<UserTokenPayload>;
     verifyRefreshToken: (token: string) => VerifyResult<RefreshTokenPayload>;
+    verifyMfaChallenge: (token: string) => VerifyResult<MfaChallengePayload>;
     verifyWidgetToken: (token: string) => VerifyResult<WidgetTokenPayload>;
     verifySpaceToken: (token: string) => VerifyResult<SpaceTokenPayload & {
         spaceId: number;

package/dist/core/auth/tokens.js

@@ -19,8 +19,17 @@ var SCOPES = {
 	refresh: "refresh",
 	widget: "widget",
 	spaceRender: "space:render",
-	spaceAgent: "space:agent"
+	spaceAgent: "space:agent",
+	/**
+	* A SERVER that renders this space as its own — self-hosting. Secret by construction, which is the whole reason it
+	* exists apart from `space:render`: see {@link SpaceScope}.
+	*/
+	spaceHost: "space:host",
+	/** A sign-in that got the password right and still owes a second factor. Carries no authority of its own. */
+	mfa: "mfa"
 };
+/** The scopes that are safe to present with no `Origin` header, because they are not public to begin with. */
+var OFF_BROWSER_SPACE_SCOPES = ["agent", "host"];
 var authFailureMessage = {
 	missing: "Authentication required",
 	malformed: "Token Invalid",
@@ -32,7 +41,8 @@ var authFailureMessage = {
 	"issuer-not-allowed": "Token was issued by another environment",
 	"origin-not-allowed": "Access Not Authorized",
 	"domain-not-allowed": "This token is not allowed on this domain",
-	inactive: "Account is not active"
+	inactive: "Account is not active",
+	unverified: "Account is not verified"
 };
 var DAY = 86400;
 /**
@@ -50,15 +60,29 @@ var DEFAULT_LIFETIMES = {
 	access: DAY,
 	refresh: 30 * DAY,
 	agent: 30 * DAY,
-	widget: 30 * DAY
+	widget: 30 * DAY,
+	/**
+	* Long enough to fetch a code out of an app, short enough that a stolen one is worthless. It authorises nothing
+	* on its own — only finishing the sign-in it belongs to, which still needs the code.
+	*/
+	mfaChallenge: 300,
+	/**
+	* The longest a session may live no matter how often it renews, counted from when it began. `0` means no cap,
+	* which is the default and what most deployments want: the renewal window is already an idle timeout, since a
+	* session nobody refreshes dies with its refresh token. This is the other half — the one that ends a session
+	* that has been renewing quietly for a year.
+	*/
+	session: 0
 };
 var spaceScopeToClaim = {
 	render: SCOPES.spaceRender,
-	agent: SCOPES.spaceAgent
+	agent: SCOPES.spaceAgent,
+	host: SCOPES.spaceHost
 };
 var claimToSpaceScope = {
 	[SCOPES.spaceRender]: "render",
-	[SCOPES.spaceAgent]: "agent"
+	[SCOPES.spaceAgent]: "agent",
+	[SCOPES.spaceHost]: "host"
 };
 var isLegacyShape = (payload) => "data" in payload || "version" in payload;
 var subjectId = (payload) => {
@@ -146,15 +170,23 @@ var createTokens = (config) => {
 	};
 	return {
 		lifetimes,
-		generateUserToken: (userId) => sign({
+		/** What this deployment mints under. Read by anything that has to name the deployment — an enrolment URI, say. */
+		issuer: config.issuer,
+		generateUserToken: (userId, { actingAs, ttlSeconds } = {}) => sign({
 			sub: String(userId),
-			...baseClaims(SCOPES.user, lifetimes.access)
+			...actingAs === void 0 ? {} : { act: { sub: String(actingAs) } },
+			...baseClaims(SCOPES.user, ttlSeconds ?? lifetimes.access)
 		}),
 		generateRefreshToken: (userId) => sign({
 			sub: String(userId),
 			...baseClaims(SCOPES.refresh, lifetimes.refresh)
 		}),
 		generateWidgetToken: () => sign(baseClaims(SCOPES.widget, lifetimes.widget)),
+		/** Says "this person proved their password"; nothing more, and only for a few minutes. */
+		generateMfaChallenge: (userId) => sign({
+			sub: String(userId),
+			...baseClaims(SCOPES.mfa, lifetimes.mfaChallenge)
+		}),
 		/**
 		* A `render` token may live forever, and defaults to it, because it is embedded in a published site — often a
 		* SPA deployed once and left alone — where an expiry is a scheduled outage: the site breaks weeks later with
@@ -165,6 +197,11 @@ var createTokens = (config) => {
 		*
 		* An `agent` grant is the opposite default and always carries a lifetime: it writes, and it is held by a
 		* third-party host.
+		*
+		* A `host` grant follows `render`: it only reads, it is held by the space owner's own deployment, and an expiry
+		* there is the same scheduled outage — except the site goes quietly STALE rather than dark, because a
+		* self-hosted renderer keeps serving the last copy it fetched. Being secret, it is worth rotating; being
+		* revocable, it does not need a deadline to be withdrawn.
 		*/
 		generateSpaceToken: (spaceId, origins, scope = "render", { expiresAt } = {}) => {
 			const defaultTtl = scope === "agent" ? lifetimes.agent : void 0;
@@ -177,9 +214,14 @@ var createTokens = (config) => {
 		},
 		verifyUserToken: (token) => withSubject(verifyScoped(token, [SCOPES.user])),
 		verifyRefreshToken: (token) => withSubject(verifyScoped(token, [SCOPES.refresh])),
+		verifyMfaChallenge: (token) => withSubject(verifyScoped(token, [SCOPES.mfa])),
 		verifyWidgetToken: (token) => verifyScoped(token, [SCOPES.widget]),
 		verifySpaceToken: (token) => {
-			const result = withSubject(verifyScoped(token, [SCOPES.spaceRender, SCOPES.spaceAgent]));
+			const result = withSubject(verifyScoped(token, [
+				SCOPES.spaceRender,
+				SCOPES.spaceAgent,
+				SCOPES.spaceHost
+			]));
 			if (!result.ok) return result;
 			const spaceId = subjectId(result.payload);
 			const spaceScope = claimToSpaceScope[result.payload.scope];
@@ -218,4 +260,4 @@ var createTokens = (config) => {
 /** The user id a session or refresh token is about. */
 var userIdOf = (payload) => Number(payload.sub);
 //#endregion
-export { DEFAULT_LIFETIMES, SCOPES, authFailureMessage, createTokens, userIdOf };
+export { DEFAULT_LIFETIMES, OFF_BROWSER_SPACE_SCOPES, SCOPES, authFailureMessage, createTokens, userIdOf };

package/dist/core/auth/totp.d.ts

@@ -0,0 +1,48 @@
+/** A 20-byte secret, which is what RFC 4226 recommends for HMAC-SHA1 and what apps are sized for. */
+export declare const generateTotpSecret: () => string;
+/** The code an app would be showing right now. Exported so a test does not have to reimplement the algorithm. */
+export declare const totpCode: (secret: string, at?: number) => string;
+/**
+ * Is this the code?
+ *
+ * `window` steps either side are accepted, one by default — thirty seconds of tolerance for a clock that drifts
+ * and for a person who starts typing at second twenty-nine. Wider is friendlier and weaker; this is the usual
+ * trade and the same one Google Authenticator's own guidance makes.
+ *
+ * Compared in constant time: a comparison that returns on the first differing digit leaks how much of a guess was
+ * right, which turns a million-guess space into ten guesses per position.
+ */
+export declare const verifyTotp: (secret: string, code: string, options?: {
+    window?: number;
+    at?: number;
+}) => boolean;
+/**
+ * The URI an authenticator app scans. `issuer` appears twice by convention — in the label and as a parameter —
+ * because different apps read different ones, and an entry that says only an email address is unidentifiable in a
+ * list of thirty.
+ */
+export declare const totpUri: ({ secret, account, issuer }: {
+    secret: string;
+    account: string;
+    issuer: string;
+}) => string;
+/**
+ * An unbiased random string over an alphabet.
+ *
+ * `randomInt` rejection-samples, which is the whole point: the obvious `byte % alphabet.length` over-represents the
+ * first `256 % length` characters, and a token that gates an account has to draw every character with equal
+ * probability. Hand-rolling that correctly is a known trap, so it is written once here.
+ *
+ * Default alphabet is Crockford-ish base32 — no `0`/`O`/`1`/`I`, so a code read aloud or off paper survives.
+ */
+export declare const randomCode: (length: number, alphabet?: string) => string;
+/**
+ * Recovery codes, for the phone that went in a river.
+ *
+ * Ten of them, each 40 bits of entropy in a shape somebody can read off paper. Generated once and shown once: they
+ * are stored hashed, so a deployment that loses them cannot print them again, which is the property that makes
+ * them worth having.
+ */
+export declare const generateRecoveryCodes: (count?: number) => string[];
+/** Normalised before hashing so that case and the hyphen a person types or omits do not decide whether it works. */
+export declare const normalizeRecoveryCode: (code: string) => string;

package/dist/core/auth/totp.js

@@ -0,0 +1,118 @@
+import { createHmac, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
+//#region src/core/auth/totp.ts
+/**
+* Time-based one-time passwords, RFC 6238, on the standard library.
+*
+* Six digits over HMAC-SHA1 in thirty-second steps, because that is what every authenticator app assumes and the
+* point of this is that Google Authenticator, 1Password and Aegis all work without being told anything. The RFC
+* allows SHA-256 and other digit counts; almost nothing in the wild reads them off the enrolment URI.
+*/
+var DIGITS = 6;
+var STEP_SECONDS = 30;
+/** RFC 4648 base32, which is the alphabet authenticator apps expect a secret in. No padding: apps dislike it. */
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var base32Encode = (bytes) => {
+	let bits = 0;
+	let value = 0;
+	let output = "";
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			output += ALPHABET[value >>> bits - 5 & 31];
+			bits -= 5;
+		}
+	}
+	if (bits > 0) output += ALPHABET[value << 5 - bits & 31];
+	return output;
+};
+var base32Decode = (secret) => {
+	const clean = secret.toUpperCase().replace(/[^A-Z2-7]/g, "");
+	const bytes = [];
+	let bits = 0;
+	let value = 0;
+	for (const character of clean) {
+		value = value << 5 | ALPHABET.indexOf(character);
+		bits += 5;
+		if (bits >= 8) {
+			bytes.push(value >>> bits - 8 & 255);
+			bits -= 8;
+		}
+	}
+	return Buffer.from(bytes);
+};
+/** A 20-byte secret, which is what RFC 4226 recommends for HMAC-SHA1 and what apps are sized for. */
+var generateTotpSecret = () => base32Encode(randomBytes(20));
+var codeAt = (secret, counter) => {
+	const buffer = Buffer.alloc(8);
+	buffer.writeUInt32BE(Math.floor(counter / 2 ** 32), 0);
+	buffer.writeUInt32BE(counter >>> 0, 4);
+	const digest = createHmac("sha1", base32Decode(secret)).update(buffer).digest();
+	const offset = digest[digest.length - 1] & 15;
+	const binary = (digest[offset] & 127) << 24 | (digest[offset + 1] & 255) << 16 | (digest[offset + 2] & 255) << 8 | digest[offset + 3] & 255;
+	return String(binary % 10 ** DIGITS).padStart(DIGITS, "0");
+};
+/** The code an app would be showing right now. Exported so a test does not have to reimplement the algorithm. */
+var totpCode = (secret, at = Date.now()) => codeAt(secret, Math.floor(at / 1e3 / STEP_SECONDS));
+/**
+* Is this the code?
+*
+* `window` steps either side are accepted, one by default — thirty seconds of tolerance for a clock that drifts
+* and for a person who starts typing at second twenty-nine. Wider is friendlier and weaker; this is the usual
+* trade and the same one Google Authenticator's own guidance makes.
+*
+* Compared in constant time: a comparison that returns on the first differing digit leaks how much of a guess was
+* right, which turns a million-guess space into ten guesses per position.
+*/
+var verifyTotp = (secret, code, options = {}) => {
+	const { window = 1, at = Date.now() } = options;
+	const candidate = code.trim();
+	if (!/^\d{6}$/.test(candidate)) return false;
+	const counter = Math.floor(at / 1e3 / STEP_SECONDS);
+	const supplied = Buffer.from(candidate);
+	let matched = false;
+	for (let drift = -window; drift <= window; drift++) {
+		const expected = Buffer.from(codeAt(secret, counter + drift));
+		matched = timingSafeEqual(expected, supplied) || matched;
+	}
+	return matched;
+};
+/**
+* The URI an authenticator app scans. `issuer` appears twice by convention — in the label and as a parameter —
+* because different apps read different ones, and an entry that says only an email address is unidentifiable in a
+* list of thirty.
+*/
+var totpUri = ({ secret, account, issuer }) => {
+	return `otpauth://totp/${encodeURIComponent(`${issuer}:${account}`)}?${new URLSearchParams({
+		secret,
+		issuer,
+		algorithm: "SHA1",
+		digits: String(DIGITS),
+		period: "30"
+	}).toString()}`;
+};
+/**
+* An unbiased random string over an alphabet.
+*
+* `randomInt` rejection-samples, which is the whole point: the obvious `byte % alphabet.length` over-represents the
+* first `256 % length` characters, and a token that gates an account has to draw every character with equal
+* probability. Hand-rolling that correctly is a known trap, so it is written once here.
+*
+* Default alphabet is Crockford-ish base32 — no `0`/`O`/`1`/`I`, so a code read aloud or off paper survives.
+*/
+var randomCode = (length, alphabet = ALPHABET) => Array.from({ length }, () => alphabet[randomInt(alphabet.length)]).join("");
+/**
+* Recovery codes, for the phone that went in a river.
+*
+* Ten of them, each 40 bits of entropy in a shape somebody can read off paper. Generated once and shown once: they
+* are stored hashed, so a deployment that loses them cannot print them again, which is the property that makes
+* them worth having.
+*/
+var generateRecoveryCodes = (count = 10) => Array.from({ length: count }, () => {
+	const digits = randomCode(10);
+	return `${digits.slice(0, 5)}-${digits.slice(5)}`;
+});
+/** Normalised before hashing so that case and the hyphen a person types or omits do not decide whether it works. */
+var normalizeRecoveryCode = (code) => code.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
+//#endregion
+export { generateRecoveryCodes, generateTotpSecret, normalizeRecoveryCode, randomCode, totpCode, totpUri, verifyTotp };

package/dist/core/auth/totp.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/createServer.d.ts

@@ -20,10 +20,4 @@ export type ServerConfig = Omit<SSRServerConfig, 'adapters'> & {
      */
     auth?: Auth;
 };
-/** The server this package makes: pages and RSC, mounting whatever the config enables, plus any stages a
- *  companion package contributes through `extensions`. The MCP endpoint, the widget proxy and draft-preview
- *  arrive that way from `@plitzi/sdk-mcp`, which a page-only deployment never installs.
- *
- *  A dedicated MCP server is `createServer` from `@plitzi/sdk-mcp` — it builds none of the render template,
- *  caches or plugin manager this one does. */
 export declare const createServer: ({ auth, ...config }: ServerConfig, extensions?: PipelineExtensions) => SSRServer;

package/dist/core/createServer.js

@@ -1,3 +1,5 @@
+import { actionsModuleFor } from "../modules/actions/moduleFor.js";
+import { connectorRscData } from "../modules/rsc/connectorRscData.js";
 import { createAuthApiStage } from "./http/stages/authApi.js";
 import { resolveServices } from "./services/resolve.js";
 import { createPageServer } from "./server/pageServer.js";
@@ -8,11 +10,41 @@ import { createPageServer } from "./server/pageServer.js";
 *
 *  A dedicated MCP server is `createServer` from `@plitzi/sdk-mcp` — it builds none of the render template,
 *  caches or plugin manager this one does. */
+/**
+* Fills in `getRscData` from whatever can produce a server element's data — `connectors`, `action.lookups`, or
+* both — when the deployment did not write one.
+*
+* The lookups are already here and the assembly is entirely this package's — a resolver over `resolveRscData`.
+* Leaving it out meant every deployment passed the same lookups twice: once as config, for the write endpoint,
+* and once folded by hand into an adapter, for the read.
+*
+* Actions count on their own: a space whose server elements name actions rather than connectors has nothing to
+* configure under `connectors`, and keying this on that alone left its `render` elements resolving to nothing
+* with no configuration missing anywhere.
+*/
+var withConnectorRsc = (config) => {
+	if (config.adapters.getRscData || !config.connectors && !config.action?.lookups) return config;
+	const module = actionsModuleFor(config);
+	const actions = module && config.action?.lookups ? {
+		lookups: config.action.lookups,
+		module
+	} : void 0;
+	return {
+		...config,
+		adapters: {
+			...config.adapters,
+			getRscData: connectorRscData(config.connectors, actions, config.rsc?.elementTimeoutMs)
+		}
+	};
+};
 var createServer = ({ auth, ...config }, extensions) => {
-	if (!auth) return createPageServer(config, resolveServices(config), extensions);
+	if (!auth) {
+		const resolvedConfig = withConnectorRsc(config);
+		return createPageServer(resolvedConfig, resolveServices(resolvedConfig), extensions);
+	}
 	const entries = Object.entries(config.adapters);
 	const supplied = Object.fromEntries(entries.filter(([, value]) => value !== void 0));
-	const resolved = {
+	const resolved = withConnectorRsc({
 		loginPath: false,
 		logoutPath: false,
 		exchangePath: false,
@@ -22,7 +54,7 @@ var createServer = ({ auth, ...config }, extensions) => {
 			...auth.ssrAdapters,
 			...supplied
 		}
-	};
+	});
 	const withAuthRoutes = {
 		...extensions,
 		preAuth: [...extensions?.preAuth ?? [], createAuthApiStage(auth, auth.basePath)]

package/dist/core/fontStore.d.ts

@@ -0,0 +1,33 @@
+import { SpaceFont } from '@plitzi/sdk-shared';
+/** One file in the store, as the caller needs to address it afterwards. */
+export type StoredFont = {
+    /** Store-relative, and exactly what goes into a `hosted` font's `files[].path`. */
+    path: string;
+    size: number;
+    format: 'woff2' | 'woff';
+};
+/**
+ * Where a deployment keeps the font files a space uploaded.
+ *
+ * Deliberately not a URL builder: addressing is `fontUrlResolver(baseUrl)`, which every render surface already
+ * shares, and a store that also decided URLs would put this deployment's origin inside a document that travels to
+ * other deployments (see `HostedFont`). Nor does it read bytes back — a local store's files are served off disk by
+ * `fontAssetsStage` and a cloud store's by its CDN, so nothing would ever call it.
+ */
+export type FontStore = {
+    list: (spaceId: number) => Promise<StoredFont[]>;
+    put: (spaceId: number, file: {
+        name: string;
+        body: Buffer;
+        format: 'woff2' | 'woff';
+    }) => Promise<StoredFont>;
+    remove: (storePath: string) => Promise<void>;
+};
+/**
+ * The store a self-hosted server gets for nothing: a directory on its own disk, served by this server at
+ * `/fonts/*`. No object storage, no credentials, no account — and it works with no network at all, which is the
+ * state a self-hosted deployment is allowed to be in.
+ */
+export declare const createLocalFontStore: (rootDir: string) => FontStore;
+/** Every store path a manifest names, so a deployment can tell what is still referenced from what is orphaned. */
+export declare const hostedPathsOf: (fonts: SpaceFont[]) => string[];

package/dist/core/fontStore.js

@@ -0,0 +1,53 @@
+import fs from "node:fs";
+import path from "node:path";
+//#region src/core/fontStore.ts
+/** `<spaceId>/<name>` — the space segment is what keeps one space's files out of another's. */
+var storePathOf = (spaceId, name) => `${spaceId}/${name}`;
+/**
+* A path that came from a document or a request, resolved inside the store and nowhere else.
+*
+* The manifest is data a user can write, so `..` and absolute paths reach here; without this check a font path
+* would be a way to read any file the process can.
+*/
+var resolveInside = (rootDir, storePath) => {
+	const resolvedRoot = path.resolve(rootDir);
+	const filePath = path.resolve(resolvedRoot, storePath);
+	return filePath.startsWith(resolvedRoot + path.sep) ? filePath : void 0;
+};
+/**
+* The store a self-hosted server gets for nothing: a directory on its own disk, served by this server at
+* `/fonts/*`. No object storage, no credentials, no account — and it works with no network at all, which is the
+* state a self-hosted deployment is allowed to be in.
+*/
+var createLocalFontStore = (rootDir) => ({
+	list: (spaceId) => {
+		const dir = path.resolve(rootDir, String(spaceId));
+		if (!fs.existsSync(dir)) return Promise.resolve([]);
+		return Promise.resolve(fs.readdirSync(dir).filter((name) => name.endsWith(".woff2") || name.endsWith(".woff")).map((name) => ({
+			path: storePathOf(spaceId, name),
+			size: fs.statSync(path.join(dir, name)).size,
+			format: name.endsWith(".woff2") ? "woff2" : "woff"
+		})));
+	},
+	put: (spaceId, file) => {
+		const dir = path.resolve(rootDir, String(spaceId));
+		fs.mkdirSync(dir, { recursive: true });
+		const filePath = resolveInside(rootDir, storePathOf(spaceId, file.name));
+		if (!filePath) return Promise.reject(/* @__PURE__ */ new Error("Font name escapes the store"));
+		fs.writeFileSync(filePath, file.body);
+		return Promise.resolve({
+			path: storePathOf(spaceId, file.name),
+			size: file.body.byteLength,
+			format: file.format
+		});
+	},
+	remove: (storePath) => {
+		const filePath = resolveInside(rootDir, storePath);
+		if (filePath && fs.existsSync(filePath)) fs.unlinkSync(filePath);
+		return Promise.resolve();
+	}
+});
+/** Every store path a manifest names, so a deployment can tell what is still referenced from what is orphaned. */
+var hostedPathsOf = (fonts) => fonts.flatMap((font) => font.source === "hosted" ? font.files.map((file) => file.path) : []);
+//#endregion
+export { createLocalFontStore, hostedPathsOf };

package/dist/core/fontStore.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/handlers/authMiddleware.js

@@ -1,5 +1,5 @@
-import { authFailureMessage } from "../auth/tokens.js";
 import { createAuthorizer } from "../auth/authorize.js";
+import { authFailureMessage } from "../auth/tokens.js";
 //#region src/core/handlers/authMiddleware.ts
 /**
 * The authorizer, as middleware: `(req, res, next)`.

package/dist/core/handlers/authRouteHandlers.d.ts

@@ -1,9 +1,17 @@
 import { HttpRoute, RouterLike } from './types';
 import { AuthApi } from '../auth/api';
+import { Csrf } from '../auth/csrf';
 import { SessionCookies } from '../auth/session';
 export interface AuthRouteHandlersOptions {
     api: AuthApi;
     cookies: SessionCookies;
+    /**
+     * Enforces the CSRF check on these flows, and re-issues the token when a session is granted. Pass `auth.csrf`.
+     *
+     * Omitting it leaves the `/auth` surface unprotected, which is why `createAuth` hands one over by default — a
+     * deployment that means to go without says so with `csrf: false` there rather than by forgetting here.
+     */
+    csrf?: Csrf;
     /** Reports a flow that threw. Without it the failure goes to `console.error`; the caller still gets a 500. */
     onError?: (error: unknown, context: {
         method: string;
@@ -33,7 +41,7 @@ export interface AuthRouteHandlersOptions {
  * Which flows actually answer is decided by the adapters, not here — no `createAccount`, no signup, and the route
  * reports 404 rather than failing at runtime. Mounting all of them is correct for a deployment that offers three.
  */
-export declare const createAuthRouteHandlers: ({ api, cookies, onError }: AuthRouteHandlersOptions) => HttpRoute[];
+export declare const createAuthRouteHandlers: ({ api, cookies, csrf, onError }: AuthRouteHandlersOptions) => HttpRoute[];
 /**
  * {@link createAuthRouteHandlers}, hung on anything with `get` and `post`.
  *

package/dist/core/handlers/authRouteHandlers.js

@@ -37,16 +37,17 @@ var carrier = (req) => ({
 * Which flows actually answer is decided by the adapters, not here — no `createAccount`, no signup, and the route
 * reports 404 rather than failing at runtime. Mounting all of them is correct for a deployment that offers three.
 */
-var createAuthRouteHandlers = ({ api, cookies, onError }) => authRoutes({
+var createAuthRouteHandlers = ({ api, cookies, csrf, onError }) => authRoutes({
 	api,
-	cookies
+	cookies,
+	csrf
 }).map(({ method, path, handler }) => ({
 	method,
 	path,
 	handle: async (req, res) => {
 		try {
 			const outcome = await handler(carrier(req));
-			applySessionOutcome(req, res, outcome, cookies);
+			applySessionOutcome(req, res, outcome, cookies, csrf);
 			res.status(outcome.ok ? outcome.status ?? 200 : outcome.status).json(outcome.body);
 		} catch (error) {
 			if (onError) onError(error, {