@consciousclouds/access

The thin, policy-free client for the Control Plane's operator identity + Access surface — the SDK half of "central authority, local enforcement" (control-plane-doctrine §5).

The Control Plane decides; this SDK only asks the five operating questions and enforces the answers, fail-closed:

Who is the current operator? What project is being entered? What permissions does this operator have here? Can this action be performed? What capabilities are granted?

No policy logic. Types + thin HTTP wrappers + React/server wiring only. There is no role→capability mapping, no grant cache, no second permission vocabulary — it reuses the Capability <primitive>.<verb> type from @consciousclouds/capability-sdk and the operator-shell's allowed|denied|unknown decision union (unknown ⇒ denied).

Exports

| Subpath | What | Runs | |---|---|---| | . | Types only — OperatorIdentity, ProjectScope, Grant, AccessDecision, AccessIntent, AccessSession, PermissionResolver | anywhere | | ./client | createAccessClient({ baseUrl }) → login · refresh · logout · whoami · session · can. Isomorphic, every call cache: 'no-store', holds no grant cache | where the token is readable | | ./server | createAccess({ baseUrl, cookieName, scope, capabilities }) → request-bound identity · scope · session · can. Fail-closed (deny / unreachable / throw ⇒ denied) | server (BFF / RSC) | | ./react | AccessProvider + useOperator · useProjectScope · useGrants · useCapabilities · useCan · useOperatorPermissionResolver | client |

The grant-resolution note

GET /access/session returns the operator's role assignments, not resolved <primitive>.<verb> capabilities. The only path to a capability decision is POST /access/authorize. So AccessSession.grants (the capability set the UI gates on) is assembled by asking the Control Plane's authorize decision for a candidate capability set — a policy-free aggregation (the Control Plane decides each one). The candidate set is the capabilities a surface gates its nav on (e.g. factory.observe).

The load-bearing rule

access.can(scope, action) server-side, uncached, fail-closed — before any admin read or token-spending turn is forwarded. A hidden nav item is never the enforcement; the server call is.

Adopting it for a second surface

Two adapters from the standard template — an identity adapter (its cookie name, login endpoint, issuer/audience) and an access adapter (its scope, its BFF routes) — plus the product's Brand + Flavor. No shell fork, no SDK fork.