@plitzi/sdk-server 0.37.1 → 0.37.3

package/dist/modules/mysql/schema.js

@@ -196,6 +196,23 @@ var step3 = (t) => {
 		...addIndex(account, "account_pending_email_token", "(pending_email_token)")
 	];
 };
+/**
+* What tells one device from another in the account's session list: the application holding it, when it is not a
+* browser (`Plitzi CLI on carlos-mbp`, software `plitzi-cli`), and when it was last used — see `sessionActivity`.
+*/
+var step4 = (t) => {
+	const session = unquote(t.session);
+	return [
+		...addColumn(session, "app_name", "VARCHAR(120) NULL AFTER ip"),
+		...addColumn(session, "app_id", "VARCHAR(64) NULL AFTER app_name"),
+		...addColumn(session, "last_active_at", "BIGINT NULL AFTER created_at")
+	];
+};
+/**
+* The time step of the last second-factor code accepted, so the same code cannot sign in twice within the window it
+* stays valid for (RFC 6238 §5.2) — see `MfaRecord.lastUsedStep`.
+*/
+var step5 = (t) => [...addColumn(unquote(t.mfa), "last_used_step", "BIGINT NULL AFTER recovery_codes")];
 /** Append only. A released version is never edited — the deployments that already ran it would never see the change. */
 var STEPS = [
 	{
@@ -209,6 +226,14 @@ var STEPS = [
 	{
 		version: 3,
 		statements: step3
+	},
+	{
+		version: 4,
+		statements: step4
+	},
+	{
+		version: 5,
+		statements: step5
 	}
 ];
 var SCHEMA_VERSION = STEPS[STEPS.length - 1].version;

package/dist/modules/mysql/sessions.d.ts

@@ -1,16 +1,6 @@
 import { Tables } from './config';
 import { Queryable } from './query';
-/** One signed-in device, as somebody looking at their own account should see it. Never the credential itself. */
-export interface SessionSummary {
-    id: number;
-    userAgent?: string;
-    ip?: string;
-    /** Unix seconds. */
-    createdAt: number;
-    expiresAt: number;
-    /** This is the session asking. A device list without it invites someone to revoke the one they are using. */
-    current: boolean;
-}
+import { SessionSummary } from '../../core/auth/api';
 /**
  * The sessions of one account, as a thing that can be looked at and taken away one at a time.
  *

package/dist/modules/mysql/sessions.js

@@ -9,14 +9,19 @@ import { execute, selectRows } from "./query.js";
 */
 var createSessionStore = (db, t) => {
 	const list = async (accountId, currentToken) => {
-		return (await selectRows(db, `SELECT id, token, user_agent, ip, created_at, expires_at
+		return (await selectRows(db, `SELECT id, token, user_agent, ip, app_name, app_id, created_at, last_active_at, expires_at
          FROM ${t.session}
         WHERE account_id = ?
         ORDER BY created_at DESC`, [accountId])).map((row) => ({
 			id: row.id,
 			...row.user_agent ? { userAgent: row.user_agent } : {},
 			...row.ip ? { ip: row.ip } : {},
+			...row.app_name ? { app: {
+				name: row.app_name,
+				...row.app_id ? { softwareId: row.app_id } : {}
+			} } : {},
 			createdAt: Math.floor(row.created_at.getTime() / 1e3),
+			...row.last_active_at ? { lastActiveAt: row.last_active_at } : {},
 			expiresAt: row.expires_at,
 			current: currentToken !== void 0 && row.token === currentToken
 		}));

package/dist/modules/realtime/declarations.d.ts

@@ -0,0 +1,11 @@
+import { ChannelDeclarations, OfflineDataRaw } from '@plitzi/sdk-shared';
+type GetOfflineData = (spaceId: number, environment: string, revision?: number) => Promise<OfflineDataRaw | undefined>;
+/**
+ * The channels a space declares, read from its schema and remembered for a few seconds.
+ *
+ * A publish is checked against them on every message; reading the space's documents for each one would cost more
+ * than the message. A space that changes its channels is heard within the TTL.
+ */
+export declare const createChannelResolver: (getOfflineData: GetOfflineData) => (spaceId: number, environment: string, revision?: number) => Promise<ChannelDeclarations | undefined>;
+export type ChannelResolver = ReturnType<typeof createChannelResolver>;
+export {};

package/dist/modules/realtime/declarations.js

@@ -0,0 +1,26 @@
+//#region src/modules/realtime/declarations.ts
+/** How long a space's channels are remembered: a publish is frequent, and a space's settings change rarely. */
+var TTL_MS = 5e3;
+/**
+* The channels a space declares, read from its schema and remembered for a few seconds.
+*
+* A publish is checked against them on every message; reading the space's documents for each one would cost more
+* than the message. A space that changes its channels is heard within the TTL.
+*/
+var createChannelResolver = (getOfflineData) => {
+	const cache = /* @__PURE__ */ new Map();
+	return (spaceId, environment, revision) => {
+		const key = `${spaceId}:${environment}:${revision ?? ""}`;
+		const hit = cache.get(key);
+		if (hit && Date.now() - hit.at < TTL_MS) return hit.channels;
+		const channels = getOfflineData(spaceId, environment, revision).then((data) => data?.schema.settings.channels);
+		cache.set(key, {
+			at: Date.now(),
+			channels
+		});
+		channels.catch(() => cache.delete(key));
+		return channels;
+	};
+};
+//#endregion
+export { createChannelResolver };

package/dist/modules/realtime/grants.d.ts

@@ -0,0 +1,23 @@
+import { RealtimeSpace } from './hub';
+import { ActionKvAdapter } from '../actions/types';
+/** How long a grant opens its topic when the flow does not say: a day, which outlives any one visit. */
+export declare const DEFAULT_GRANT_SECONDS = 86400;
+/** The longest a grant may last: thirty days. A page that stays open longer asks its action for a new one. */
+export declare const MAX_GRANT_SECONDS: number;
+export type RealtimeGrants = {
+    /** A grant for `topic`, good for `ttlSeconds` — what `realtime.grant` hands the page. */
+    issue: (space: RealtimeSpace, topic: string, ttlSeconds?: number) => Promise<string>;
+    /** Whether `grant` was issued for exactly `topic` of this space, and has neither run out nor been revoked. */
+    opens: (space: RealtimeSpace, topic: string, grant: string) => Promise<boolean>;
+    /** `grant` no longer opens `topic` — or, with none named, no grant issued for it until now does. */
+    revoke: (space: RealtimeSpace, topic: string, grant?: string) => Promise<void>;
+};
+export declare const grantSeconds: (ttlSeconds: number | undefined) => number;
+/**
+ * The grants a server has issued, kept in the store its actions' `kv` uses — so a grant one replica issued opens the
+ * topic on whichever replica the page connects to, and nothing new has to be configured for it. A random token rather
+ * than a signature: there is no secret to share between replicas, and a grant is only ever as old as its lifetime.
+ *
+ * Keyed under `realtime-grant:`, a prefix no key a flow writes can reach (theirs are `kv:action:<space>:…`).
+ */
+export declare const createRealtimeGrants: (store: ActionKvAdapter) => RealtimeGrants;

package/dist/modules/realtime/grants.js

@@ -0,0 +1,61 @@
+import { randomBytes } from "node:crypto";
+//#region src/modules/realtime/grants.ts
+/** How long a grant opens its topic when the flow does not say: a day, which outlives any one visit. */
+var DEFAULT_GRANT_SECONDS = 86400;
+/** The longest a grant may last: thirty days. A page that stays open longer asks its action for a new one. */
+var MAX_GRANT_SECONDS = 2592e3;
+/** What a grant looks like on the wire: long enough to be unguessable, and nothing a query string has to escape. */
+var TOKEN = /^[A-Za-z0-9_-]{24,64}$/;
+var parseGrant = (raw) => {
+	try {
+		const value = JSON.parse(raw ?? "");
+		return typeof value === "object" && value !== null && "topic" in value && typeof value.topic === "string" && "generation" in value && typeof value.generation === "number" ? {
+			topic: value.topic,
+			generation: value.generation
+		} : void 0;
+	} catch {
+		return;
+	}
+};
+var grantSeconds = (ttlSeconds) => ttlSeconds === void 0 || !Number.isFinite(ttlSeconds) ? DEFAULT_GRANT_SECONDS : Math.min(MAX_GRANT_SECONDS, Math.max(60, Math.floor(ttlSeconds)));
+/**
+* The grants a server has issued, kept in the store its actions' `kv` uses — so a grant one replica issued opens the
+* topic on whichever replica the page connects to, and nothing new has to be configured for it. A random token rather
+* than a signature: there is no secret to share between replicas, and a grant is only ever as old as its lifetime.
+*
+* Keyed under `realtime-grant:`, a prefix no key a flow writes can reach (theirs are `kv:action:<space>:…`).
+*/
+var createRealtimeGrants = (store) => {
+	const key = ({ spaceId, environment }, grant) => `realtime-grant:${String(spaceId)}:${environment}:${grant}`;
+	/**
+	* How many times every grant of a topic was revoked at once. A grant carries the number it was issued under, so
+	* raising it voids them all — the ones in use and the ones not used yet — without a list of them to walk.
+	*/
+	const generationKey = ({ spaceId, environment }, topic) => `realtime-grant-generation:${String(spaceId)}:${environment}:${topic}`;
+	const generationOf = async (space, topic) => Number(await store.get(generationKey(space, topic))) || 0;
+	return {
+		issue: async (space, topic, ttlSeconds) => {
+			const grant = randomBytes(18).toString("base64url");
+			const stored = {
+				topic,
+				generation: await generationOf(space, topic)
+			};
+			await store.set(key(space, grant), JSON.stringify(stored), grantSeconds(ttlSeconds));
+			return grant;
+		},
+		opens: async (space, topic, grant) => {
+			if (!TOKEN.test(grant)) return false;
+			const stored = parseGrant(await store.get(key(space, grant)));
+			return stored?.topic === topic && stored.generation === await generationOf(space, topic);
+		},
+		revoke: async (space, topic, grant) => {
+			if (grant === void 0) {
+				await store.increment(generationKey(space, topic), 1);
+				return;
+			}
+			if (TOKEN.test(grant) && parseGrant(await store.get(key(space, grant)))?.topic === topic) await store.delete(key(space, grant));
+		}
+	};
+};
+//#endregion
+export { DEFAULT_GRANT_SECONDS, MAX_GRANT_SECONDS, createRealtimeGrants, grantSeconds };

package/dist/modules/realtime/handlers.d.ts

@@ -0,0 +1,74 @@
+import { ChannelResolver } from './declarations';
+import { RealtimeGrants } from './grants';
+import { RealtimeConnection, RealtimeHub, RealtimeSpace } from './hub';
+import { RawResponse } from '../../helpers/buildResponseHelpers';
+import { ChannelDeclaration, RealtimeSender, SSRRequest, SSRResponseHelpers } from '@plitzi/sdk-shared';
+export type RealtimeRefusal = {
+    topic: string;
+    /** `ungranted`: the channel is declared `grant: true`, and no grant the page sent opens this topic. */
+    reason: 'undeclared' | 'unauthenticated' | 'forbidden' | 'ungranted';
+};
+/** An answer in HTTP terms, whichever transport carries it: a status, and what went wrong when something did. */
+export type RealtimeAnswer = {
+    status: number;
+    error?: string;
+    reason?: string;
+    refused?: RealtimeRefusal[];
+};
+export declare const answer: (res: SSRResponseHelpers, { status, ...payload }: RealtimeAnswer) => void;
+/** What a page may open, decided once for either transport. */
+export type Admission = {
+    ok: false;
+    answer: RealtimeAnswer;
+} | {
+    ok: true;
+    space: RealtimeSpace;
+    user?: RealtimeSender['user'];
+    accepted: Map<string, ChannelDeclaration>;
+    /** The grant each accepted topic of a `grant: true` channel was opened with. */
+    granted: Map<string, string>;
+    refused: RealtimeRefusal[];
+};
+/**
+ * Which of the topics a page asked for (`?topics=a,b`) it may open: each checked against the channels the space
+ * declares and against the visitor's access. One that fails is reported, not a reason to refuse the rest; all failing
+ * is a `403`.
+ */
+export declare const admit: (req: SSRRequest, resolveChannels: ChannelResolver, grants: RealtimeGrants) => Promise<Admission>;
+/** A new connection for what was admitted, speaking through `send`. */
+export declare const connectionFor: (admission: Extract<Admission, {
+    ok: true;
+}>, send: RealtimeConnection["send"], end: RealtimeConnection["end"]) => RealtimeConnection;
+/**
+ * A page publishing, whichever way it arrived: only on a topic its connection subscribed to, only on a channel pages
+ * may send on, within its size and its rate — and stamped by the server with who sent it and when, whatever the
+ * message said.
+ */
+export declare const publishFrom: (hub: RealtimeHub, connection: RealtimeConnection, { topic, type, data }: {
+    topic?: unknown;
+    type?: unknown;
+    data?: unknown;
+}) => Promise<RealtimeAnswer>;
+export type SubscribeDeps = {
+    req: SSRRequest;
+    res: SSRResponseHelpers;
+    raw: RawResponse;
+    signal: AbortSignal;
+    hub: RealtimeHub;
+    resolveChannels: ChannelResolver;
+    grants: RealtimeGrants;
+};
+/**
+ * `GET /_realtime?topics=a,b` (and `&grants=g1,g2` for the topics of a `grant: true` channel) — one Server-Sent Events connection for every topic a page listens to.
+ *
+ * The first event, `ready`, tells the page its public name (`from`) and the secret its publishes carry. Resolves when
+ * the page goes.
+ */
+export declare const handleRealtimeSubscribe: ({ req, res, raw, signal, hub, resolveChannels, grants }: SubscribeDeps) => Promise<void>;
+export type PublishDeps = {
+    req: SSRRequest;
+    res: SSRResponseHelpers;
+    hub: RealtimeHub;
+};
+/** `POST /_realtime` `{ token, topic, type, data }` — a page on a Server-Sent Events connection, publishing. */
+export declare const handleRealtimePublish: ({ req, res, hub }: PublishDeps) => Promise<void>;

package/dist/modules/realtime/handlers.js

@@ -0,0 +1,224 @@
+import onAbort from "../../helpers/onAbort.js";
+import { openEventStream } from "../../core/http/sse.js";
+import { accessRefusal } from "@plitzi/sdk-shared/actions";
+import { randomBytes, randomUUID } from "node:crypto";
+import { PRESENCE_TYPE, channelLimits, matchChannel } from "@plitzi/sdk-shared/realtime";
+//#region src/modules/realtime/handlers.ts
+/** Topics one connection may hold. A page shows a handful; past this it is somebody enumerating. */
+var MAX_TOPICS = 8;
+/** A type a page may send: its own vocabulary, never one of the channel's `$` types but `$presence`. */
+var TYPE = /^[A-Za-z0-9_.:-]{1,64}$/;
+/** How long a disconnected client waits before trying again — ours reconnects itself; this is for anyone else's. */
+var RETRY_MS = 3e3;
+var answer = (res, { status, ...payload }) => {
+	res.setStatus(status);
+	res.setHeader("Content-Type", "application/json; charset=utf-8");
+	res.setHeader("Cache-Control", "no-store");
+	res.send(JSON.stringify(payload));
+};
+var listOf = (query, name) => [...new Set((Object.hasOwn(query, name) ? query[name] : "").split(",").map((item) => item.trim()).filter(Boolean))];
+/** The one of the grants the page sent (`?grants=g1,g2`) that opens `topic` — or none. */
+var grantFor = async (grants, space, topic, offered) => {
+	for (const grant of offered) if (await grants.opens(space, topic, grant)) return grant;
+};
+/**
+* Which of the topics a page asked for (`?topics=a,b`) it may open: each checked against the channels the space
+* declares and against the visitor's access. One that fails is reported, not a reason to refuse the rest; all failing
+* is a `403`.
+*/
+var admit = async (req, resolveChannels, grants) => {
+	const { environment = "main", spaceId, revision } = req.ctx.spaceDeployment ?? {};
+	if (typeof spaceId !== "number") return {
+		ok: false,
+		answer: {
+			status: 404,
+			error: "No space is served here",
+			reason: "not_found"
+		}
+	};
+	const requested = listOf(req.query, "topics");
+	const offered = listOf(req.query, "grants").slice(0, MAX_TOPICS);
+	if (requested.length === 0 || requested.length > MAX_TOPICS) return {
+		ok: false,
+		answer: {
+			status: 422,
+			error: `Name between 1 and ${MAX_TOPICS} topics: ?topics=a,b`,
+			reason: "invalid_input"
+		}
+	};
+	const channels = await resolveChannels(spaceId, environment, revision);
+	const accepted = /* @__PURE__ */ new Map();
+	const granted = /* @__PURE__ */ new Map();
+	const refused = [];
+	const space = {
+		spaceId,
+		environment
+	};
+	for (const topic of requested) {
+		const match = matchChannel(topic, channels);
+		const refusal = match ? accessRefusal(match.declaration.access, req.ctx.user) : "undeclared";
+		const grant = match && !refusal && match.declaration.grant === true ? await grantFor(grants, space, topic, offered) : void 0;
+		if (!match || refusal) refused.push({
+			topic,
+			reason: refusal ?? "undeclared"
+		});
+		else if (match.declaration.grant === true && grant === void 0) refused.push({
+			topic,
+			reason: "ungranted"
+		});
+		else {
+			accepted.set(topic, match.declaration);
+			if (grant !== void 0) granted.set(topic, grant);
+		}
+	}
+	if (accepted.size === 0) return {
+		ok: false,
+		answer: {
+			status: 403,
+			error: "None of these topics may be opened here",
+			reason: "forbidden",
+			refused
+		}
+	};
+	const { user } = req.ctx;
+	return {
+		ok: true,
+		space,
+		...user ? { user: {
+			id: user.id,
+			name: user.username
+		} } : {},
+		accepted,
+		granted,
+		refused
+	};
+};
+/** A new connection for what was admitted, speaking through `send`. */
+var connectionFor = (admission, send, end) => ({
+	id: randomUUID(),
+	token: randomBytes(24).toString("base64url"),
+	space: admission.space,
+	...admission.user ? { user: admission.user } : {},
+	topics: admission.accepted,
+	grants: admission.granted,
+	announced: /* @__PURE__ */ new Set(),
+	sent: /* @__PURE__ */ new Map(),
+	send,
+	end
+});
+/** Whether this connection may send one more message on `topic` this second. */
+var withinRate = (connection, topic, perSecond) => {
+	const second = Math.floor(Date.now() / 1e3);
+	const sent = connection.sent.get(topic);
+	const count = sent?.second === second ? sent.count + 1 : 1;
+	connection.sent.set(topic, {
+		second,
+		count
+	});
+	return count <= perSecond;
+};
+/**
+* A page publishing, whichever way it arrived: only on a topic its connection subscribed to, only on a channel pages
+* may send on, within its size and its rate — and stamped by the server with who sent it and when, whatever the
+* message said.
+*/
+var publishFrom = async (hub, connection, { topic, type, data }) => {
+	const name = typeof topic === "string" ? topic : "";
+	const declaration = connection.topics.get(name);
+	if (!declaration) return {
+		status: 403,
+		error: `This connection did not subscribe to "${name}"`,
+		reason: "not_subscribed"
+	};
+	if (declaration.publish === "server") return {
+		status: 403,
+		error: `Only the server publishes on "${name}"`,
+		reason: "server_only"
+	};
+	const kind = typeof type === "string" ? type : "";
+	const presence = kind === PRESENCE_TYPE && declaration.presence === true;
+	if (!presence && !TYPE.test(kind)) return {
+		status: 422,
+		error: "A message type is 1-64 of A-Z a-z 0-9 _ . : -",
+		reason: "invalid_input"
+	};
+	const limits = channelLimits(declaration);
+	const value = data ?? null;
+	if (Buffer.byteLength(JSON.stringify(value)) > limits.maxMessageBytes) return {
+		status: 413,
+		error: `A message on "${name}" is at most ${limits.maxMessageBytes} bytes`,
+		reason: "too_large"
+	};
+	if (!withinRate(connection, name, limits.messagesPerSecond)) return {
+		status: 429,
+		error: `At most ${limits.messagesPerSecond} messages a second`,
+		reason: "rate_limited"
+	};
+	if (presence) connection.announced.add(name);
+	await hub.publish(connection.space, hub.from(connection, name, kind, value));
+	return { status: 204 };
+};
+/**
+* `GET /_realtime?topics=a,b` (and `&grants=g1,g2` for the topics of a `grant: true` channel) — one Server-Sent Events connection for every topic a page listens to.
+*
+* The first event, `ready`, tells the page its public name (`from`) and the secret its publishes carry. Resolves when
+* the page goes.
+*/
+var handleRealtimeSubscribe = async ({ req, res, raw, signal, hub, resolveChannels, grants }) => {
+	const admission = await admit(req, resolveChannels, grants);
+	if (!admission.ok) {
+		answer(res, admission.answer);
+		return;
+	}
+	let finish = () => void 0;
+	const gone = new Promise((resolve) => {
+		finish = resolve;
+	});
+	const stream = openEventStream(raw, {
+		onAbort: () => finish(),
+		retryMs: RETRY_MS
+	});
+	const connection = connectionFor(admission, stream.send, () => finish());
+	const release = onAbort(signal, () => finish());
+	stream.send("ready", {
+		connection: connection.id,
+		token: connection.token,
+		topics: [...admission.accepted.keys()],
+		refused: admission.refused
+	});
+	await hub.connect(connection);
+	await gone;
+	release();
+	stream.close();
+	await hub.disconnect(connection);
+};
+var parseBody = (body) => {
+	try {
+		const value = body ? JSON.parse(body) : void 0;
+		return typeof value === "object" && value !== null ? value : void 0;
+	} catch {
+		return;
+	}
+};
+/** `POST /_realtime` `{ token, topic, type, data }` — a page on a Server-Sent Events connection, publishing. */
+var handleRealtimePublish = async ({ req, res, hub }) => {
+	const body = parseBody(req.body);
+	const connection = typeof body?.token === "string" ? hub.find(body.token) : void 0;
+	if (!body || !connection) {
+		answer(res, {
+			status: 401,
+			error: "Not connected: open /_realtime first and publish with its token",
+			reason: "not_connected"
+		});
+		return;
+	}
+	const result = await publishFrom(hub, connection, body);
+	if (result.status === 204) {
+		res.setStatus(204);
+		res.send("");
+		return;
+	}
+	answer(res, result);
+};
+//#endregion
+export { admit, answer, connectionFor, handleRealtimePublish, handleRealtimeSubscribe, publishFrom };

package/dist/modules/realtime/hub.d.ts

@@ -0,0 +1,62 @@
+import { ChannelDeclaration, PubSubAdapter, RealtimeMessage, RealtimeSender } from '@plitzi/sdk-shared';
+/** The space a connection belongs to: its topics are that space's and no other's. */
+export type RealtimeSpace = {
+    spaceId: number;
+    environment: string;
+};
+/** One page, connected. */
+export type RealtimeConnection = {
+    /** Its public name — the `from` of everything it sends. */
+    id: string;
+    /** Its secret: what a publish proves it comes from this connection with. Never sent to anyone else. */
+    token: string;
+    space: RealtimeSpace;
+    user?: RealtimeSender['user'];
+    /** The topics it subscribed to, with the channel each falls under. */
+    topics: Map<string, ChannelDeclaration>;
+    /** The grant each topic of a `grant: true` channel was opened with — what a revoke names. */
+    grants: Map<string, string>;
+    /** The topics it announced itself on, which hear `$leave` when it goes. */
+    announced: Set<string>;
+    /** Messages sent this second, by topic — the rate a channel allows is per connection, and a connection is here. */
+    sent: Map<string, {
+        second: number;
+        count: number;
+    }>;
+    send: (event: string, data: unknown) => void;
+    /** Closes it from the server's side — the server is going away. Its own `close` then lets it go as any other. */
+    end: () => void;
+};
+/** A space's topic, as the adapter knows it: namespaced, so two spaces never hear each other. */
+export declare const adapterTopic: ({ spaceId, environment }: RealtimeSpace, topic: string) => string;
+export type RealtimeHub = ReturnType<typeof createRealtimeHub>;
+/**
+ * This process's connections, and the ONE adapter subscription per topic they share.
+ *
+ * A hundred pages on one board are a hundred connections here and a single subscription to the adapter: a message
+ * arrives once and is written to each of them. The last one to leave a topic unsubscribes it.
+ */
+export declare const createRealtimeHub: (pubsub: PubSubAdapter) => {
+    publish: (space: RealtimeSpace, message: RealtimeMessage) => Promise<void>;
+    from: (connection: RealtimeConnection, topic: string, type: string, data: unknown) => RealtimeMessage;
+    find: (token: string) => RealtimeConnection | undefined;
+    /**
+     * Lets go of `topic` every connection, on every replica, that opened it with `grant` — or with any grant, naming
+     * none. What stops a grant that is already in use; `grants.revoke` is what stops it being used again.
+     */
+    revoke: (space: RealtimeSpace, topic: string, grant?: string) => Promise<void>;
+    /** Subscribes a new connection to its topics, and tells the members of each presence channel it arrived. */
+    connect: (connection: RealtimeConnection) => Promise<void>;
+    /** Unsubscribes a connection that went away, and tells the channels it announced itself on. */
+    disconnect: (connection: RealtimeConnection) => Promise<void>;
+    /**
+     * Every connection closed from here: the server is shutting down. An open socket or event stream is a request that
+     * never ends, so a server waiting for them to finish waited for ever — each is told to go, and goes the way it
+     * goes when its page leaves.
+     */
+    closeAll: () => void;
+    /** How many connections this process holds — for tests and for a health endpoint. */
+    readonly connectionCount: number;
+    /** How many topics this process holds a subscription for — for tests and for a health endpoint. */
+    readonly topicCount: number;
+};