better-supabase 0.12.0 → 0.14.0

package/dist/jwks-cache-CRymV-Dr.js

@@ -0,0 +1,49 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err } from "./result-B3m7xtRY.js";
+import { a as jwksOf } from "./jws-DOgHJKHb.js";
+//#region src/core/jwks-cache.ts
+/** The most bytes read from a JWKS response. */
+const MAX_JWKS_BYTES = 262144;
+/**
+* A cached key set. A URL is fetched on first use and again after
+* `cacheSeconds`; a refresh for an unknown `kid` refetches at most once per
+* `refetchSeconds`, so a stream of forged `kid`s can't hammer the issuer.
+* Concurrent callers share one fetch.
+*/
+function jwksSource(input, options = {}) {
+	const parse = (value) => jwksOf(value, options.rsa === void 0 ? {} : { rsa: options.rsa });
+	if (!(input instanceof URL) && typeof input !== "function") {
+		const keys = parse(input);
+		return () => Promise.resolve(ok(keys));
+	}
+	const now = options.now ?? Date.now;
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const refetchMs = (options.refetchSeconds ?? 30) * 1e3;
+	let cached;
+	let pending;
+	const load = async () => {
+		if (typeof input === "function") return ok(parse(await input()));
+		const response = await (options.fetch ?? fetch)(input, { headers: { accept: "application/jwk-set+json, application/json" } });
+		if (!response.ok) return err(dbError("network", `The JWKS answered ${response.status}`, { code: "JWKS_FETCH_FAILED" }));
+		const text = await response.text();
+		if (text.length > MAX_JWKS_BYTES) return err(dbError("network", "The JWKS response is too large", { code: "JWKS_FETCH_FAILED" }));
+		return ok(parse(JSON.parse(text)));
+	};
+	return async (refresh) => {
+		const age = cached ? now() - cached.at : Number.POSITIVE_INFINITY;
+		if (cached && age < (refresh ? refetchMs : cacheMs)) return ok(cached.keys);
+		pending ??= load().catch((cause) => err(dbError("network", `The JWKS could not be loaded: ${cause instanceof Error ? cause.message : String(cause)}`, { code: "JWKS_FETCH_FAILED" }))).then((result) => {
+			if (result.ok) cached = {
+				keys: result.data,
+				at: now()
+			};
+			return result;
+		}).finally(() => {
+			pending = void 0;
+		});
+		const result = await pending;
+		return !result.ok && cached ? ok(cached.keys) : result;
+	};
+}
+//#endregion
+export { jwksSource as t };

package/dist/jws-D0toeQlA.d.ts

@@ -0,0 +1,66 @@
+//#region src/core/jws.d.ts
+/** The key types a signing key can have. */
+type SigningAlgorithm = "Ed25519" | "ES256";
+/**
+ * The JWS `alg` a key signs with: `ES256`, or for an Ed25519 key `EdDSA` (RFC 8037)
+ * or the fully specified `Ed25519` (RFC 9864). `RS256` and `PS256` (RSA, 2048
+ * bits or more) only verify, and only when a caller lists them in
+ * `algorithms`.
+ */
+type JwsAlgorithm = "EdDSA" | "Ed25519" | "ES256" | "PS256" | "RS256";
+/**
+ * A public or private JSON Web Key (RFC 7517): Ed25519, P-256, or a public RSA
+ * key.
+ */
+interface Jwk {
+  readonly kty: string;
+  readonly crv?: string;
+  readonly x?: string;
+  readonly y?: string;
+  readonly n?: string;
+  readonly e?: string;
+  readonly d?: string;
+  readonly kid?: string;
+  readonly alg?: string;
+  readonly use?: string;
+  readonly [member: string]: unknown;
+}
+/** A JWK Set (RFC 7517 section 5). */
+interface Jwks {
+  readonly keys: readonly Jwk[];
+}
+/** The RFC 7638 SHA-256 thumbprint of a key, base64url: a stable `kid`. */
+declare function jwkThumbprint(jwk: Jwk): Promise<string>;
+/** What `verifyCompact` returns for a valid token. */
+interface VerifiedJws {
+  readonly header: Readonly<Record<string, unknown>>;
+  readonly payload: Readonly<Record<string, unknown>>;
+}
+interface VerifyCompactOptions {
+  /** The `alg` values accepted. Default: `EdDSA`, `Ed25519` and `ES256`. */
+  readonly algorithms?: readonly JwsAlgorithm[];
+  /** The `typ` header the token must carry, compared case-insensitively. */
+  readonly typ?: string;
+}
+/** Why a token failed `verifyCompact`. */
+declare class JwsError extends Error {
+  readonly code: string;
+  constructor(code: string, message: string);
+}
+/**
+ * Verifies a compact JWS against `jwks`: the header's `kid` picks the key (or
+ * the only key of the matching type when there is no `kid`). Throws a
+ * `JwsError`; checks no claims, which are the caller's to read.
+ */
+declare function verifyCompact(token: string, jwks: Jwks, options?: VerifyCompactOptions): Promise<VerifiedJws>;
+interface JwksOfOptions {
+  /** Keep RSA keys of 2048 bits or more too, for `RS256` and `PS256`. */
+  readonly rsa?: boolean;
+}
+/**
+ * Parses a JWK Set, keeping only the Ed25519 and P-256 keys (and RSA keys with
+ * `rsa`).
+ */
+declare function jwksOf(value: unknown, options?: JwksOfOptions): Jwks;
+//#endregion
+export { JwsError as a, VerifyCompactOptions as c, verifyCompact as d, JwsAlgorithm as i, jwkThumbprint as l, Jwks as n, SigningAlgorithm as o, JwksOfOptions as r, VerifiedJws as s, Jwk as t, jwksOf as u };

package/dist/jws-DOgHJKHb.js

@@ -0,0 +1,205 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as toBase64Url, r as fromBase64 } from "./base64-B9Wlsdj7.js";
+//#region src/core/jws.ts
+let encoderInstance;
+let decoderInstance;
+const encoder = { encode: (text) => (encoderInstance ??= new TextEncoder()).encode(text) };
+const decoder = { decode: (bytes) => (decoderInstance ??= new TextDecoder()).decode(bytes) };
+const EC = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/** The members WebCrypto imports, without `kid`, `alg` and other extras. */
+function keyMaterial(jwk, alg, withPrivate) {
+	const key = publicJwk(jwk);
+	return {
+		kty: key.kty,
+		crv: String(key.crv),
+		x: String(key.x),
+		...alg === "ES256" ? { y: String(key.y) } : {},
+		...withPrivate ? { d: String(jwk.d) } : {}
+	};
+}
+const importParams = (alg) => alg === "Ed25519" ? { name: "Ed25519" } : EC;
+const signParams = (alg) => alg === "Ed25519" ? { name: "Ed25519" } : {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+/**
+* The key type behind a JWS `alg`, or undefined for one this module doesn't
+* verify.
+*/
+function keyAlgorithmOf(alg) {
+	if (alg === "ES256" || alg === "RS256" || alg === "PS256") return alg;
+	if (alg === "EdDSA" || alg === "Ed25519") return "Ed25519";
+}
+/** RFC 7518 section 3.3: an RSA key for RS256 or PS256 has at least 2048 bits. */
+const RSA_MIN_BYTES = 256;
+function isRsaKey(jwk) {
+	if (jwk.kty !== "RSA" || typeof jwk.n !== "string") return false;
+	try {
+		const modulus = fromBase64(jwk.n);
+		const leadingZero = modulus[0] === 0 ? 1 : 0;
+		return typeof jwk.e === "string" && modulus.length - leadingZero >= RSA_MIN_BYTES;
+	} catch {
+		return false;
+	}
+}
+/** Whether `jwk` can verify a JWS of key type `alg`. */
+function verifiesWith(jwk, alg, name) {
+	if (alg === "RS256" || alg === "PS256") return isRsaKey(jwk) && (jwk.alg === void 0 || jwk.alg === name);
+	return jwkAlgorithm(jwk) === alg;
+}
+const RSA_PARAMS = {
+	RS256: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	},
+	PS256: {
+		name: "RSA-PSS",
+		hash: "SHA-256"
+	}
+};
+const verifyParams = (alg) => {
+	switch (alg) {
+		case "RS256": return { name: "RSASSA-PKCS1-v1_5" };
+		case "PS256": return {
+			name: "RSA-PSS",
+			saltLength: 32
+		};
+		case "Ed25519":
+		case "ES256": return signParams(alg);
+		default: return alg;
+	}
+};
+/** The key type of a JWK: `OKP`/`Ed25519` or `EC`/`P-256`. */
+function jwkAlgorithm(jwk) {
+	if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "Ed25519";
+	if (jwk.kty === "EC" && jwk.crv === "P-256") return "ES256";
+}
+/** The public members of `jwk`, without `d` and other private parts. */
+function publicJwk(jwk) {
+	const alg = jwkAlgorithm(jwk);
+	if (alg === "Ed25519") return {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: String(jwk.x)
+	};
+	if (alg === "ES256") return {
+		kty: "EC",
+		crv: "P-256",
+		x: String(jwk.x),
+		y: String(jwk.y)
+	};
+	throw new TypeError("Only Ed25519 and P-256 keys are supported");
+}
+/** The RFC 7638 SHA-256 thumbprint of a key, base64url: a stable `kid`. */
+async function jwkThumbprint(jwk) {
+	const key = publicJwk(jwk);
+	const canonical = key.kty === "OKP" ? `{"crv":"${key.crv}","kty":"OKP","x":"${key.x}"}` : `{"crv":"${key.crv}","kty":"EC","x":"${key.x}","y":"${key.y}"}`;
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonical));
+	return toBase64Url(new Uint8Array(digest));
+}
+/** A new key pair as JWKs, with the RFC 7638 thumbprint as `kid`. */
+async function generateSigningKey(alg) {
+	const pair = await crypto.subtle.generateKey(importParams(alg), true, ["sign", "verify"]);
+	if (!("privateKey" in pair)) throw new TypeError("WebCrypto returned a single key, not a key pair");
+	const privateKey = await crypto.subtle.exportKey("jwk", pair.privateKey);
+	return {
+		kid: await jwkThumbprint(privateKey),
+		publicKey: publicJwk(privateKey),
+		privateKey
+	};
+}
+/** Imports the private JWK of an Ed25519 or P-256 key for signing. */
+function importSigningKey(jwk) {
+	const alg = jwkAlgorithm(jwk);
+	if (alg === void 0 || typeof jwk.d !== "string") throw new TypeError("A signing key is a private Ed25519 or P-256 JWK");
+	return crypto.subtle.importKey("jwk", keyMaterial(jwk, alg, true), importParams(alg), false, ["sign"]);
+}
+/**
+* Imports the public JWK of a key whose type `verifiesWith` already matched to
+* `alg`.
+*/
+function importVerifyKey(jwk, alg) {
+	if (alg === "RS256" || alg === "PS256") return crypto.subtle.importKey("jwk", {
+		kty: "RSA",
+		n: String(jwk.n),
+		e: String(jwk.e)
+	}, RSA_PARAMS[alg], false, ["verify"]);
+	return crypto.subtle.importKey("jwk", keyMaterial(jwk, alg, false), importParams(alg), false, ["verify"]);
+}
+/**
+* The raw signature of `data`: 64 bytes for Ed25519, `r || s` for ES256 (as JWS
+* needs).
+*/
+async function signBytes(key, alg, data) {
+	return new Uint8Array(await crypto.subtle.sign(signParams(alg), key, data.slice()));
+}
+/** A compact JWS (RFC 7515) over the JSON `payload`. */
+async function signCompact(key, alg, header, payload) {
+	const input = `${toBase64Url(JSON.stringify(header))}.${toBase64Url(JSON.stringify(payload))}`;
+	const signature = await signBytes(key, alg, encoder.encode(input));
+	return `${input}.${toBase64Url(signature)}`;
+}
+/** Why a token failed `verifyCompact`. */
+var JwsError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "JwsError";
+		this.code = code;
+	}
+};
+function part(text) {
+	if (text === void 0) throw new JwsError("JWS_MALFORMED", "Not a JWS");
+	let value;
+	try {
+		value = JSON.parse(decoder.decode(fromBase64(text)));
+	} catch {
+		throw new JwsError("JWS_MALFORMED", "A JWS part is not base64url JSON");
+	}
+	if (!isRecord(value)) throw new JwsError("JWS_MALFORMED", "A JWS part is not a JSON object");
+	return value;
+}
+/**
+* Verifies a compact JWS against `jwks`: the header's `kid` picks the key (or
+* the only key of the matching type when there is no `kid`). Throws a
+* `JwsError`; checks no claims, which are the caller's to read.
+*/
+async function verifyCompact(token, jwks, options = {}) {
+	const pieces = token.split(".");
+	if (pieces.length !== 3) throw new JwsError("JWS_MALFORMED", "A compact JWS has three parts");
+	const header = part(pieces[0]);
+	const payload = part(pieces[1]);
+	const alg = typeof header["alg"] === "string" ? header["alg"] : "";
+	const allowed = options.algorithms ?? [
+		"EdDSA",
+		"Ed25519",
+		"ES256"
+	];
+	const keyAlg = keyAlgorithmOf(alg);
+	if (keyAlg === void 0 || !allowed.some((name) => name === alg)) throw new JwsError("JWS_ALG", `The alg ${alg || "(none)"} is not accepted`);
+	if (options.typ !== void 0 && (typeof header["typ"] !== "string" || header["typ"].toLowerCase() !== options.typ.toLowerCase())) throw new JwsError("JWS_TYP", `The typ must be ${options.typ}`);
+	const kid = typeof header["kid"] === "string" ? header["kid"] : void 0;
+	const candidates = jwks.keys.filter((jwk) => verifiesWith(jwk, keyAlg, alg) && (kid === void 0 || jwk.kid === kid));
+	const jwk = candidates.length === 1 ? candidates[0] : void 0;
+	if (jwk === void 0) throw new JwsError("JWS_KEY", `No key matches kid ${kid ?? "(none)"}`);
+	if (!await crypto.subtle.verify(verifyParams(keyAlg), await importVerifyKey(jwk, keyAlg), fromBase64(pieces[2] ?? ""), encoder.encode(`${pieces[0]}.${pieces[1]}`))) throw new JwsError("JWS_SIGNATURE", "The signature is invalid");
+	return {
+		header,
+		payload
+	};
+}
+function isJwkCandidate(value) {
+	return isRecord(value) && typeof value["kty"] === "string";
+}
+/**
+* Parses a JWK Set, keeping only the Ed25519 and P-256 keys (and RSA keys with
+* `rsa`).
+*/
+function jwksOf(value, options = {}) {
+	return { keys: (isRecord(value) && Array.isArray(value["keys"]) ? value["keys"] : []).filter((key) => isJwkCandidate(key) && (jwkAlgorithm(key) !== void 0 || options.rsa === true && isRsaKey(key))) };
+}
+//#endregion
+export { jwksOf as a, verifyCompact as c, jwkThumbprint as i, generateSigningKey as n, signBytes as o, importSigningKey as r, signCompact as s, JwsError as t };

package/dist/kit-Ct4Z6GIO.js

@@ -0,0 +1,127 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { n as validate } from "./standard-DtkpFGkS.js";
+import { n as claimAt } from "./claims-Bp9My7XP.js";
+import { t as authContext } from "./context-CYquqpA6.js";
+import { n as toSession } from "./view-BtgqxQLM.js";
+import { o as settle, r as guard } from "./respond-z_yfyitp.js";
+import { n as checkPermission } from "./authorizer-DPTeL-7h.js";
+//#region src/server/kit.ts
+/** `FormData` as a plain object; repeated keys become arrays. */
+function formDataObject(form) {
+	const out = {};
+	for (const key of new Set(form.keys())) {
+		const values = form.getAll(key);
+		out[key] = values.length > 1 ? values : values[0];
+	}
+	return out;
+}
+/** A failed `ActionResult`. */
+function actionError(error) {
+	return {
+		ok: false,
+		data: null,
+		error
+	};
+}
+/** What a `permission` on an action or route is checked against. */
+function callerResource(input) {
+	if (input === void 0 || input instanceof Request) return { type: "route" };
+	if (typeof input !== "object" || input === null || Array.isArray(input) || input instanceof FormData) return { type: "action" };
+	return {
+		type: "action",
+		properties: input
+	};
+}
+/**
+* Runs a `resource` loader; any failure refuses, so a missing row never reads
+* as granted.
+*/
+async function loadResource(load) {
+	const unavailable = dbError("forbidden", "The resource this needs could not be loaded", { code: "RESOURCE_UNAVAILABLE" });
+	let settled;
+	try {
+		settled = await settle(load);
+	} catch {
+		return unavailable;
+	}
+	if (!settled.ok) return settled.error;
+	const { data } = settled;
+	if (typeof data !== "object" || data === null || !("type" in data) || typeof data.type !== "string") return unavailable;
+	return data;
+}
+/**
+* `requireTenant`, `roles`, `permission` and `authorize`, in that order: the
+* session and tenant, or why the caller is refused.
+*/
+async function authorizeCaller(auth, checks, input, tenant, authorizer, scope) {
+	const session = toSession(auth);
+	if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
+	if (checks.roles && !hasRole(auth, checks.roles, checks.roleClaim)) return dbError("forbidden", "You do not have the role this needs", { code: "MISSING_ROLE" });
+	if (checks.permission !== void 0) {
+		const resource = checks.resource ? await loadResource(() => checks.resource?.(input, {
+			...scope,
+			session,
+			tenant
+		})) : callerResource(input);
+		if ("kind" in resource) return resource;
+		const permitted = await checkPermission({
+			authorizer,
+			permission: checks.permission,
+			resource,
+			context: {
+				...authContext(auth),
+				...tenant === void 0 ? {} : { tenant }
+			}
+		});
+		if (!permitted.ok) return permitted.error;
+	}
+	if (checks.authorize && !await checks.authorize(session, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
+	return {
+		session,
+		tenant
+	};
+}
+/** `guard`, then `authorizeCaller`: the caller, or the refusal. */
+async function requireCaller(auth, options, tenant, authorizer, scope) {
+	return guard(auth, options.allow, options.aal, options.scopes) ?? authorizeCaller(auth, options, void 0, tenant, authorizer, scope);
+}
+/**
+* Runs an action body with the guard, input validation and authorize checks
+* every adapter shares, and settles it into an `ActionResult`: `Result`s
+* unwrap, thrown `DbException`s become errors, other throws propagate (so
+* framework redirects keep working).
+*/
+async function runAction(auth, options, input, tenant, body, authorizer, scope) {
+	const denied = guard(auth, options.allow, options.aal, options.scopes);
+	if (denied) return actionError(denied);
+	let parsed = input instanceof FormData ? formDataObject(input) : input;
+	if (options.input) {
+		const checked = await validate(options.input, parsed, "input");
+		if (!checked.ok) return actionError(checked.error);
+		parsed = checked.data;
+	}
+	const caller = await authorizeCaller(auth, options, parsed, tenant, authorizer, scope);
+	if ("kind" in caller) return actionError(caller);
+	const settled = await settle(() => body(parsed, caller));
+	return settled.ok ? {
+		ok: true,
+		data: settled.data,
+		error: null
+	} : actionError(settled.error);
+}
+/** The strings at a dotted claim path: one string, or every string in an array. */
+function rolesAt(claims, path) {
+	const single = claimAt(claims, path);
+	if (single !== void 0) return [single];
+	let value = claims;
+	for (const segment of path.split(".")) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
+function hasRole(auth, roles, path = "app_metadata.role") {
+	if (auth.kind !== "user") return false;
+	const held = rolesAt(auth.claims, path);
+	return roles.some((role) => held.includes(role));
+}
+//#endregion
+export { rolesAt as a, requireCaller as i, formDataObject as n, runAction as o, hasRole as r, authorizeCaller as t };

package/dist/kit-DKfbNTAA.d.ts

@@ -0,0 +1,94 @@
+import { b as DbError } from "./result-C6jDfedy.js";
+import { r as AuthState } from "./resolve-CzUKTIMq.js";
+import { i as AuthorizationResource } from "./authorizer-DFP3gHv8.js";
+import { t as AuthSession } from "./view-2_I-2ukO.js";
+import { r as GuardOptions } from "./respond-CZYibxUx.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/kit.d.ts
+/**
+ * What a server action returns: plain data, safe across any serialization
+ * boundary.
+ */
+type ActionResult<T> = {
+  readonly ok: true;
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly ok: false;
+  readonly data: null;
+  readonly error: DbError;
+};
+/**
+ * Checks after `allow`, `aal` and `scopes`. A caller who fails one gets
+ * `forbidden`: an `ActionResult` error, a 403, or the framework's refusal.
+ */
+interface AuthorizeOptions<I, C, P, R extends boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> {
+  /** Refuse callers without an active tenant, so `ctx.tenant` is a string. */
+  readonly requireTenant?: R;
+  /** Admit only users holding one of these roles at `roleClaim`. */
+  readonly roles?: readonly string[];
+  /**
+   * The dotted claim path `roles` reads: one string or an array. Defaults to
+   * `app_metadata.role`.
+   */
+  readonly roleClaim?: string;
+  /**
+   * The permission the server's `authorizer` must grant. Without an authorizer,
+   * or on any outcome but `granted`, the caller is refused; `approval-required`
+   * refuses with `code: "APPROVAL_REQUIRED"`.
+   */
+  readonly permission?: Ref;
+  /**
+   * The resource `permission` is checked against, loaded after the session and
+   * tenant checks, e.g. the project row with its owner and team. It gets the
+   * validated input and the request's context (`db`, `session`, `tenant`).
+   * Defaults to `{ type: "action" }` with the input as `properties`, or `{
+   * type: "route" }`. A thrown `DbException` refuses with its error (such as
+   * `not_found`); any other throw refuses with `forbidden` and `code:
+   * "RESOURCE_UNAVAILABLE"`.
+   */
+  readonly resource?: (input: I, ctx: X) => AuthorizationResource | Promise<AuthorizationResource>;
+  /**
+   * Return `false` to refuse the caller, e.g. `(session, input) =>
+   * input.ownerId === session.user.id`.
+   */
+  readonly authorize?: (session: AuthSession<C, P>, input: I) => boolean | Promise<boolean>;
+}
+/**
+ * What a `resource` loader gets besides the input, when the adapter has no
+ * context of its own.
+ */
+interface ResourceLoaderContext<C = unknown, P = unknown> {
+  readonly session: AuthSession<C, P>;
+  readonly tenant: string | undefined;
+}
+/** What `requireTenant` and `authorize` add to the context. */
+interface AuthorizedContext<C, P, R extends boolean> {
+  readonly session: AuthSession<C, P>;
+  /**
+   * The active tenant: the action's `tenant`, then the server's `tenant`
+   * option, then the tenant claim (`tenantOf(session)`).
+   */
+  readonly tenant: R extends true ? string : string | undefined;
+}
+type ActionInput<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> | FormData : unknown;
+type ActionParsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown;
+type Unwrapped<T> = T extends {
+  readonly ok: true;
+  readonly data: infer D;
+} ? D : T extends {
+  readonly ok: false;
+} ? never : T;
+/** Guard, authorize and validate options of a framework-neutral action. */
+interface BlockActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref, X> {
+  /** Validates the input (plain object or `FormData`) with any Standard Schema. */
+  readonly input?: S;
+}
+/** The guard and authorize checks of a loader, page or route. */
+interface BlockRequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref, X> {}
+/** The strings at a dotted claim path: one string, or every string in an array. */
+declare function rolesAt(claims: Readonly<Record<string, unknown>> | undefined, path: string): readonly string[];
+/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
+declare function hasRole(auth: AuthState, roles: readonly string[], path?: string): boolean;
+//#endregion
+export { AuthorizedContext as a, ResourceLoaderContext as c, rolesAt as d, AuthorizeOptions as i, Unwrapped as l, ActionParsed as n, BlockActionOptions as o, ActionResult as r, BlockRequireOptions as s, ActionInput as t, hasRole as u };