@rebasepro/server 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/auth/api-keys/index.d.ts

@@ -1,17 +1,17 @@
 /**
- * Service API Keys module.
+ * API keys module.
  *
- * Re-exports types, store, middleware, permission guard, and routes
- * for the API key authentication system.
+ * Re-exports types, store, middleware and routes for API key authentication.
  *
  * @module
  */
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types.js";
+export type { ApiKey, ApiKeyKind, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, CreatePersonalKeyRequest, UpdateApiKeyRequest } from "./api-key-types.js";
 export { createApiKeyStore } from "./api-key-store.js";
-export type { ApiKeyStore } from "./api-key-store.js";
-export { isApiKeyToken, validateApiKey, createApiKeyPreAuth, createFunctionApiKeyGuard, createStorageApiKeyGuard } from "./api-key-middleware.js";
-export type { ApiKeyAuthOptions } from "./api-key-middleware.js";
-export { httpMethodToOperation, isOperationAllowed, isFunctionAllowed, isStorageAllowed } from "./api-key-permission-guard.js";
-export type { ApiKeyOperation } from "./api-key-permission-guard.js";
-export { createApiKeyRoutes } from "./api-key-routes.js";
-export type { ApiKeyRouteOptions } from "./api-key-routes.js";
+export type { ApiKeyStore, ApiKeyFilter, NewApiKey } from "./api-key-store.js";
+export { isApiKeyToken, resolveApiKey, validateApiKey, createApiKeyPreAuth, createFunctionScopeGuard, createTusScopeGuard } from "./api-key-middleware.js";
+export type { ApiKeyAuthOptions, ApiKeyIdentity, ApiKeyRefusal } from "./api-key-middleware.js";
+export { httpMethodToOperation } from "./http-operation.js";
+export type { DataOperation } from "./http-operation.js";
+export { createApiKeyRoutes, createPersonalKeyRoutes } from "./api-key-routes.js";
+export type { ApiKeyRouteOptions, PersonalKeyRouteOptions } from "./api-key-routes.js";
+export type { KeyTargets } from "./key-grant.js";

package/dist/auth/api-keys/key-grant.d.ts

@@ -0,0 +1,41 @@
+/**
+ * What a new or changed key may hold, decided against whoever asked for it.
+ *
+ * One rule for every door that mints a credential: **nothing is minted with
+ * more than its minter holds.** A key's scopes must be within the creator's
+ * own; a service key's RLS roles must be roles the creator holds, unless the
+ * creator is an admin; and `keys:*` never goes on a key at all.
+ *
+ * @module
+ */
+import { type AccessModel } from "@rebasepro/types";
+/**
+ * The targets this backend serves, for refusing a key narrowed to something
+ * that does not exist — a typo there is a key that silently reaches nothing.
+ * Each list is read when a key is minted, so it reflects what is loaded then.
+ */
+export interface KeyTargets {
+    collections(): readonly string[];
+    functions(): readonly string[];
+    buckets(): readonly string[];
+}
+/** Read a `scopes` body field: a non-empty array of strings, deduplicated. */
+export declare function readScopesField(value: unknown): string[];
+/** Read a `roles` body field: an array of non-empty strings, deduplicated, without `service`. */
+export declare function readRolesField(value: unknown): string[];
+/**
+ * Refuse scopes that are malformed, unknown, aimed at a target that does not
+ * exist, for key management, or beyond what `minterScopes` covers.
+ */
+export declare function assertScopesGrantable(requested: readonly string[], minterScopes: readonly string[], model: AccessModel, targets?: KeyTargets): void;
+/**
+ * Refuse RLS roles the minter does not hold. An admin may give any role — they
+ * already read every row — and anyone else only their own.
+ */
+export declare function assertRolesGrantable(requested: readonly string[], minterRoles: readonly string[]): void;
+/** Read an optional `expires_at`: absent, null, or a future ISO-8601 instant. */
+export declare function readExpiresAt(value: unknown, requireFuture: boolean): string | null | undefined;
+/** Read an optional `rate_limit`: absent, null, or a positive integer. */
+export declare function readRateLimit(value: unknown): number | null | undefined;
+/** Read a key name: a non-empty string, trimmed. */
+export declare function readName(value: unknown): string;

package/dist/auth/api-keys/legacy-permissions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The scopes a key stored before scopes existed is read as.
+ *
+ * Such a row carries `permissions` — `[{ collection, operations }]`, with
+ * `"*"`, `"storage"`, `"functions"` and `"functions/<name>"` overloading the
+ * collection field — and an `admin` flag. This turns it into the scopes and
+ * RLS roles it now holds, once, when the store backfills the row.
+ *
+ * The rule is that nothing widens. Where a stored grant has no exact
+ * equivalent, it narrows:
+ *
+ * - A function grant without `write` becomes nothing. Functions were checked
+ *   by HTTP method, so a read-only grant let a key call GET functions; a
+ *   function is code, and `functions:invoke` is not a read.
+ * - `admin: true` becomes the `admin` RLS role and the admin surfaces such a
+ *   key could reach (users, schema, backups, cron, logs) — not `database:*`,
+ *   which lived on the realtime socket where no key could authenticate, and
+ *   not `keys:*`, which no key may hold.
+ *
+ * @module
+ */
+/** One stored permission entry, as the old column held it. */
+export interface StoredPermission {
+    collection: string;
+    operations: string[];
+}
+/** Read a stored `permissions` value — JSON text or already-parsed — into entries. */
+export declare function parseStoredPermissions(value: unknown): StoredPermission[];
+/** The scopes and RLS roles a stored key now holds. Never more than it did. */
+export declare function scopesFromStoredPermissions(permissions: readonly StoredPermission[], admin: boolean): {
+    scopes: string[];
+    roles: string[];
+};

package/dist/auth/auth-hooks.d.ts

@@ -37,6 +37,7 @@
  * ```
  */
 import type { PasswordValidationResult } from "./password.js";
+import { ApiError } from "../api/errors.js";
 import type { AuthRepository, UserData, CreateUserData } from "./interfaces.js";
 import type { EmailService, EmailConfig } from "../email/index.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
@@ -93,8 +94,12 @@ export interface AuthHooks {
      */
     verifyCredentials?(email: string, password: string, repo: AuthRepository): Promise<UserData | null>;
     /**
-     * Called after any successful authentication event (login, register,
-     * OAuth, token refresh, password reset).
+     * Called after any successful authentication event: password login
+     * (`login`), registration (`register`), an OAuth sign-in (`oauth`), a
+     * token refresh (`refresh`), a password reset (`password-reset`), a
+     * guest session (`anonymous`), a magic link (`magic-link`), an email code
+     * (`otp`) and a second factor (`mfa`). Every value of {@link AuthMethod}
+     * is passed by some route.
      *
      * Use for audit logging, syncing external state, updating
      * last-login timestamps, etc.
@@ -103,7 +108,11 @@ export interface AuthHooks {
      */
     onAuthenticated?(user: UserData, method: AuthMethod): Promise<void>;
     /**
-     * Called before a new user is created (registration or admin creation).
+     * Called before a new user is created: registration, an OAuth sign-in
+     * that creates the account, a guest, and admin creation.
+     *
+     * Throw to refuse: the caller gets 400 `HOOK_REJECTED` with your message,
+     * or the status your error carries (`ApiError`, or a 4xx `status`).
      *
      * Also called when a guest becomes an account through
      * `POST /auth/anonymous/link`, with the email and password hash it is
@@ -125,10 +134,14 @@ export interface AuthHooks {
      */
     afterUserCreate?(user: UserData): Promise<void>;
     /**
-     * Pre-login validation. Called before credential verification.
-     *
-     * Throw an error to reject the login attempt (e.g. for account lockout,
-     * IP-based restrictions, etc.).
+     * Pre-login validation. Called before credential verification on every
+     * sign-in: password (`login`), OAuth (`oauth`, with the provider's
+     * address), and the requests for a magic link (`magic-link`) or an email
+     * code (`otp`). Not on a token refresh, which is not a sign-in: to stop a
+     * signed-in account, disable it (`PUT /admin/users/:uid { disabled: true }`).
+     *
+     * Throw to refuse: 400 `HOOK_REJECTED` with your message, or the status
+     * your error carries.
      */
     beforeLogin?(email: string, method: AuthMethod): Promise<void>;
     /**
@@ -209,6 +222,19 @@ export interface AuthHooks {
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
     afterUserDelete?(uid: string): Promise<void>;
+    /**
+     * Called when a signed-in user asks to move their account to `newEmail`
+     * (`POST /auth/change-email`), before anything is mailed. The address is
+     * normalized, free and deliverable by then.
+     *
+     * The address rule `beforeUserCreate` enforces at sign-up — only your own
+     * domain, say — belongs here too, or a member can sign up with an allowed
+     * address and then move to any other.
+     *
+     * Throw to refuse: 400 `HOOK_REJECTED` with your message, or the status
+     * your error carries.
+     */
+    beforeEmailChange?(user: UserData, newEmail: string): Promise<void>;
     /**
      * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
      * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
@@ -258,4 +284,17 @@ export type ResolvedAuthHooks = Required<Pick<AuthHooks, "hashPassword" | "verif
  * This is the single point where defaults are applied — all consumers
  * call this once and use the resolved hooks throughout.
  */
+/**
+ * What a hook's thrown error answers.
+ *
+ * The hooks that refuse (`beforeUserCreate`, `beforeLogin`,
+ * `beforeUserDelete`, `beforeEmailChange`) are documented as "throw to reject", and a plain
+ * `Error` is what people throw. It reached the error handler as a 500
+ * "Internal Server Error", so a deployment that limits sign-ups to its own
+ * domain answered an outsider with a server fault. A refusal is the caller's
+ * answer: 400 `HOOK_REJECTED` with the hook's message — or the status an
+ * error carries, when the hook chose one (`ApiError`, or any error with a 4xx
+ * `status`/`statusCode`).
+ */
+export declare function hookRefusal(error: unknown, hook: string): ApiError;
 export declare function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthHooks;

package/dist/auth/builtin-auth-adapter.d.ts

@@ -70,6 +70,14 @@ export interface BuiltinAuthAdapterConfig {
     enableEmailOtp?: boolean;
     /** Opt-in httpOnly cookie mode for refresh tokens. */
     cookieAuth?: import("./routes.js").CookieAuthConfig;
+    /** Refuse password sign-in until the address is verified; confirm-first registration. */
+    requireEmailVerification?: boolean;
+    /** Seconds a rotated-away refresh token still mints a sibling. Default 10. */
+    refreshTokenReuseIntervalSeconds?: number;
+    /** What a refresh token replayed after that window does to its session. Default `"reject"`. */
+    refreshTokenReuse?: import("./routes.js").RefreshTokenReusePolicy;
+    /** A magic-link or email-code request for an unknown address creates its account, while registration is open. */
+    magicLinkCreatesUsers?: boolean;
 }
 /**
  * Create the built-in Rebase auth adapter.

package/dist/auth/cookie-utils.d.ts

@@ -22,6 +22,13 @@ export declare function setRefreshCookie(c: Context<HonoEnv>, refreshToken: stri
 export declare function clearRefreshCookie(c: Context<HonoEnv>, config: CookieAuthConfig | undefined): void;
 /**
  * Read the refresh token from the request — cookie first, then body fallback.
+ *
+ * An empty string is no token, wherever it comes from. In cookie mode every
+ * response this server sends carries `refreshToken: ""` (see
+ * `redactRefreshToken`), and a client that echoes it back — `@rebasepro/client`
+ * did, on every refresh from a live tab — is presenting nothing. Taking the
+ * body's `""` as the token, or refusing it at the schema, kept the cookie
+ * beside it from ever being read.
  */
 export declare function readRefreshToken(c: Context<HonoEnv>, body: {
     refreshToken?: string;

package/dist/auth/deliverable-address.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Addresses no mail can reach: the synthetic ones a guest and an X (Twitter)
+ * account are given, because `email` is NOT NULL. Nothing is mailed to them,
+ * and no account may move onto one.
+ */
+export declare function isDeliverableAddress(email: string): boolean;

package/dist/auth/email-change-routes.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A signed-in user changes their own email address.
+ *
+ * `POST /auth/change-email { newEmail }` records the change and mails a link to
+ * the new address, and a notice without a link to the old one.
+ * `POST /auth/confirm-email-change { token }` — the link's landing screen calls
+ * it — moves the account onto the new address.
+ *
+ * The address moves only when its inbox answers, so the account is never
+ * pointed at an address nobody proved, and nothing is reserved meanwhile: a
+ * pending change that held the address would let any account keep a stranger
+ * from signing up with their own address. Whoever has the address when the link
+ * is followed keeps it, and the link answers 409.
+ *
+ * On confirmation the address is the account's, verified. The identities whose
+ * provider vouched for the old address are detached: the old address may be
+ * the reason for the change — a job left, an inbox lost — and whoever controls
+ * it now would otherwise sign in through that provider. The sessions stay: the
+ * change was asked for from one, and the link proves the new inbox, not
+ * anything about the others.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import { z } from "zod";
+import type { HonoEnv } from "../api/types.js";
+import type { MiddlewareHandler } from "hono";
+import type { resolveAuthHooks } from "./auth-hooks.js";
+import type { AuthModuleConfig } from "./routes.js";
+/** How long an address-change link stays usable. */
+export declare const EMAIL_CHANGE_TTL_MS: number;
+interface EmailChangeRoutesConfig {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ReturnType<typeof resolveAuthHooks>;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    /** A signed-in user, with the revocation watermark consulted. */
+    requireLiveSession: MiddlewareHandler<HonoEnv>;
+}
+export declare function mountEmailChangeRoutes(opts: EmailChangeRoutesConfig): void;
+export {};

package/dist/auth/expired-token-sweep.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Deleting the auth tokens nobody can use any more, on a schedule.
+ *
+ * `TokenRepository.deleteExpiredTokens` was declared, implemented and never
+ * called. Every expired reset link, magic link, email code, abandoned refresh
+ * token and stale MFA challenge stayed in the database for good: the tables
+ * grew by a row per sign-in attempt and nothing took one away.
+ *
+ * Runs on the process that owns the timers (`ownership.cronScheduler`), once
+ * an hour, and across instances once per hour in all: each tick claims its
+ * hour's slot in `rebase.cron_claims` — the claim the cron scheduler takes for
+ * a job's run — and only the instance that wins it sweeps. A store that cannot
+ * answer the claim means no sweep this hour rather than every instance at
+ * once; the tokens are already refused when presented, so a late sweep costs
+ * space, not safety.
+ *
+ * @module
+ */
+import type { DataDriver } from "@rebasepro/types";
+import type { TokenRepository } from "./interfaces.js";
+/** The slot key in `rebase.cron_claims`. Namespaced so no job file can take it. */
+export declare const EXPIRED_TOKEN_SWEEP_JOB_ID = "rebase:auth:expired-tokens";
+/** One sweep an hour, fleet-wide. */
+export declare const EXPIRED_TOKEN_SWEEP_INTERVAL_MS: number;
+export interface ExpiredTokenSweepOptions {
+    authRepo: Pick<TokenRepository, "deleteExpiredTokens">;
+    /**
+     * Claim `slot` for `jobId` across every instance: `true` for the one that
+     * wins it. Throws when the store cannot tell. Without it — a driver with
+     * no SQL, cron persistence switched off — every instance sweeps, which is
+     * wasted work but harmless: deleting what has expired is idempotent.
+     */
+    claimSlot?: (jobId: string, slot: string) => Promise<boolean>;
+    intervalMs?: number;
+    /** Clock, for tests. */
+    now?: () => number;
+}
+/** What one tick did. */
+export type ExpiredTokenSweepOutcome = "swept" | "claimed-elsewhere" | "unclaimed" | "failed";
+export interface ExpiredTokenSweep {
+    /** Sweep now, then once per interval. */
+    start(): void;
+    /**
+     * No more ticks. Resolves once a tick already running has finished, so a
+     * caller about to close the pool can wait for the tick still using it.
+     */
+    stop(): Promise<void>;
+    /** One tick: claim this interval's slot and, if it is ours, sweep. */
+    runSlot(): Promise<ExpiredTokenSweepOutcome>;
+}
+export declare function createExpiredTokenSweep(options: ExpiredTokenSweepOptions): ExpiredTokenSweep;
+/** What {@link startExpiredTokenSweep} is given by the boot. */
+export interface ExpiredTokenSweepWiring {
+    /** The auth repository, when the backend has one. */
+    authRepo?: Partial<Pick<TokenRepository, "deleteExpiredTokens">>;
+    /** The default data driver: its SQL admin backs the slot claim. */
+    driver: DataDriver;
+    /** Whether this process owns the timers (`ownership.cronScheduler`). */
+    ownsTimers: boolean;
+    /** `cronPersistence: false` keeps the claims table out of the database, here too. */
+    persistClaims?: boolean;
+}
+/**
+ * Start the sweep where it belongs, or answer `undefined` where it does not:
+ * a process that does not own the timers, or a backend whose auth repository
+ * cannot delete expired tokens.
+ *
+ * The claim is the cron store's, made on the first tick rather than at boot so
+ * the boot does not wait on its tables.
+ */
+export declare function startExpiredTokenSweep(wiring: ExpiredTokenSweepWiring): ExpiredTokenSweep | undefined;

package/dist/auth/impersonation.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Running a request as another user: the `x-rebase-impersonate` header, and
+ * the `impersonate` field of the realtime socket's `AUTHENTICATE`.
+ *
+ * It exists for an administrator checking what one user can see and do — "can
+ * B read A's rows, can B write them?" — against the real policies, from
+ * Studio's API explorer and JS editor. A granted request runs as one of B's
+ * own would: B's uid, B's roles as they are now, B's guest flag and the claims
+ * a token minted for B now would carry reach `withAuth`, so the statement runs
+ * as `rebase_user` with B's identity and every policy is evaluated for B.
+ *
+ * Who may: a signed-in administrator, on their own session, judged on their
+ * roles as the database has them now rather than as their token claims. Never
+ * an API key — not a personal key whose owner is an administrator either — and
+ * never the service key. Impersonation is a person checking on another person,
+ * and the audit line has to name one.
+ *
+ * Where: the data API, custom functions and the realtime socket. Every other
+ * route refuses the header ({@link refuseUnhonouredImpersonation}).
+ *
+ * Fail closed: a request asking to act as someone either runs as the user it
+ * names or is refused. It never runs as its caller, because that is the
+ * failure this exists to end — a response showing the administrator's rows
+ * under a label saying they were B's.
+ *
+ * @module
+ */
+import type { Context, MiddlewareHandler } from "hono";
+import { type AuthenticatedUser, type DataDriver } from "@rebasepro/types";
+import type { HonoEnv } from "../api/types.js";
+import { ApiError } from "../api/errors.js";
+/** How the caller authenticated, as far as impersonation is concerned. */
+export type ImpersonationCredential = "session" | "api-key" | "service-key" | "none";
+/** How the auth in use turns a uid into a request identity — `AuthAdapter.resolveUser`. */
+export type ImpersonationUserResolver = (uid: string) => Promise<AuthenticatedUser | null>;
+export interface ImpersonationRequest {
+    /** The uid the request asked to act as, as sent. */
+    requestedUid: string;
+    /** What the caller presented. Only a `session` may impersonate. */
+    credential: ImpersonationCredential;
+    /** The caller, as their credential verified. */
+    caller?: {
+        uid: string;
+        roles: readonly string[];
+    };
+    /** Absent when the auth in use has no `resolveUser`: then nobody may. */
+    resolveUser?: ImpersonationUserResolver;
+    /**
+     * Where the request came in, for the security audit line — or absent to
+     * write none, for a decision that only re-confirms one already logged
+     * (the socket re-asks before every frame).
+     */
+    audit?: Record<string, unknown>;
+}
+/** The answer to a request to act as another user. */
+export type ImpersonationDecision = {
+    granted: AuthenticatedUser;
+    impersonator: string;
+} | {
+    refused: ApiError;
+};
+/**
+ * Decide whether this caller may act as the user they named, and who that
+ * user is now.
+ *
+ * The one decision both doors take — the HTTP data plane through
+ * {@link applyImpersonation}, the realtime socket at `AUTHENTICATE` and before
+ * every frame after it. The caller is judged before the named user is looked
+ * up, so the answer to a caller who may not impersonate says nothing about
+ * whether the uid exists.
+ *
+ * Throws when a lookup fails: that is not an answer about anyone, and each
+ * door refuses it its own way.
+ */
+export declare function decideImpersonation(request: ImpersonationRequest): Promise<ImpersonationDecision>;
+export interface ImpersonationOptions {
+    /** What the caller presented. Only a `session` may impersonate. */
+    credential: ImpersonationCredential;
+    /** The unscoped delegate the request's driver was scoped from. */
+    driver: DataDriver;
+    /** The auth adapter's `resolveUser`. Absent: the header is refused for everyone. */
+    resolveUser?: ImpersonationUserResolver;
+}
+/**
+ * Honour or refuse this request's {@link IMPERSONATE_HEADER}.
+ *
+ * Called by the data-plane auth middlewares once the caller is on the context
+ * and its driver is scoped. When the header names a user the caller may act
+ * as, the context's `user` and `driver` are replaced with that user's and
+ * `impersonator` names the caller.
+ *
+ * @returns The refusal to send, or `undefined` to carry on — as the caller
+ *          when the header is absent, as the named user when it was granted.
+ */
+export declare function applyImpersonation(c: Context<HonoEnv>, { credential, driver, resolveUser }: ImpersonationOptions): Promise<Response | undefined>;
+/**
+ * Refuse {@link IMPERSONATE_HEADER} on every route that does not honour it.
+ *
+ * Only the data API and custom functions run a request as another user; the
+ * rest — storage, auth, the admin surfaces — authenticate the caller and
+ * ignore the header. Ignored, a request asking to act as B would be answered
+ * as the administrator who sent it, which is the one outcome impersonation
+ * must never have. Mounted ahead of every route, so a surface added later is
+ * refused until it is listed here as honouring the header.
+ *
+ * @param honouredMounts - The mount points whose auth middleware applies the
+ *        header (`/api/data`, `/api/functions`). A path is under one when it
+ *        is the mount itself or continues it with a `/`.
+ */
+export declare function refuseUnhonouredImpersonation(honouredMounts: readonly string[]): MiddlewareHandler<HonoEnv>;

package/dist/auth/index.d.ts

@@ -49,8 +49,10 @@ export { createSqlRateLimitStore } from "./sql-rate-limit-store.js";
 export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store.js";
 export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store.js";
 export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store.js";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys/index.js";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys/index.js";
+export { createApiKeyStore, createApiKeyRoutes, createPersonalKeyRoutes, isApiKeyToken, resolveApiKey, validateApiKey, httpMethodToOperation } from "./api-keys/index.js";
+export type { ApiKey, ApiKeyKind, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, CreatePersonalKeyRequest, UpdateApiKeyRequest, ApiKeyStore, DataOperation, KeyTargets } from "./api-keys/index.js";
+export { requireScope, requireScopeByMethod, hasScope, callerScopes, getAccessModel, configureAccess, accessModelFromCollections, AccessModelError } from "./access.js";
+export type { KeyOwnerResolver } from "./access.js";
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter.js";
 export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter.js";
 export { createCustomAuthAdapter } from "./custom-auth-adapter.js";