@astrale-domains/shell-schema 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/dist/application.d.ts +1758 -0
  2. package/dist/application.d.ts.map +1 -0
  3. package/dist/application.js +200 -0
  4. package/dist/application.js.map +1 -0
  5. package/dist/icons.d.ts +11 -0
  6. package/dist/icons.d.ts.map +1 -0
  7. package/dist/icons.js +21 -0
  8. package/dist/icons.js.map +1 -0
  9. package/dist/identity.d.ts +2581 -0
  10. package/dist/identity.d.ts.map +1 -0
  11. package/dist/identity.js +134 -0
  12. package/dist/identity.js.map +1 -0
  13. package/dist/index.d.ts +4477 -0
  14. package/dist/index.d.ts.map +1 -0
  15. package/dist/index.js +57 -0
  16. package/dist/index.js.map +1 -0
  17. package/dist/space.d.ts +458 -0
  18. package/dist/space.d.ts.map +1 -0
  19. package/dist/space.js +95 -0
  20. package/dist/space.js.map +1 -0
  21. package/package.json +46 -0
package/dist/application.d.ts ADDED
@@ -0,0 +1,1758 @@
1
+ /**
2
+ * Application context — an installed application, modeled as an Identity installed IN a
3
+ * Space.
4
+ *
5
+ * - Class `Application` an application principal. Implements the kernel `Identity`
6
+ * interface so it carries `(iss, sub, frozen)` and can be the
7
+ * subject of a credential — `open` mints tokens AS the app.
8
+ * `install` is the creation entry; `origin` records the app's
9
+ * source domain.
10
+ * - Edge `installed_in` Application → Space (the Space an app instance is installed in).
11
+ * - `iRole`/`Role` a role identity declared by a domain (scoped via
12
+ * `of_domain`); assigned to USERS (`assign` = `has_role` +
13
+ * identity extension) — app capabilities are decoupled from
14
+ * the space and attributed per user through roles.
15
+ * - Edge `of_domain` Application|Role → Domain (the domain an app targets / a role
16
+ * belongs to).
17
+ * - Edge `has_role` User → Role (semantic, queryable role membership; the
18
+ * permission composition is the `extends_with` edge written
19
+ * by `extendIdentity`).
20
+ * - Edge `entrypoint` Application → View (the app's entry surface).
21
+ *
22
+ * Installation is PER-SPACE (`Application.install(target, space)`) — the caller needs
23
+ * EDIT on the space — and only for a domain already installed on the instance.
24
+ * There are NO per-user grants on the app node: space permissions propagate to
25
+ * the apps inside, so space access is app access.
26
+ */
27
+ import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
28
+ import { z } from 'zod';
29
+ /**
30
+ * The user-mintable delegation expression `app::open` / `app::getAccessToken`
31
+ * hand back — typed precisely as the kernel's `UnresolvedIdentityExpr` (so the
32
+ * `*Result` types infer it directly) and validated structurally as an object
33
+ * (the exact kernel validator isn't reachable from a worker bundle).
34
+ */
35
+ export declare const delegationExpr: z.ZodCustom<UnresolvedIdentityExpr, UnresolvedIdentityExpr>;
36
+ /** An installed application — an Identity living inside the Space it serves. */
37
+ export declare const Application: import("@astrale-os/kernel-dsl").NodeClassDef<Omit<{
38
+ readonly implements: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
39
+ readonly props: {
40
+ iss: import("zod").ZodString;
41
+ sub: import("zod").ZodString;
42
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
43
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
44
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
45
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
46
+ }, import("zod/v4/core").$strip>>;
47
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
48
+ claim: import("zod").ZodString;
49
+ op: import("zod").ZodLiteral<"eq">;
50
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
51
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
52
+ claim: import("zod").ZodString;
53
+ op: import("zod").ZodLiteral<"contains">;
54
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
55
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
56
+ claim: import("zod").ZodString;
57
+ op: import("zod").ZodLiteral<"exists">;
58
+ }, import("zod/v4/core").$strip>], "op">>>;
59
+ };
60
+ readonly methods: {
61
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
62
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
63
+ }, import("zod").ZodVoid, "sealed", boolean>;
64
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
65
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
66
+ }, import("zod").ZodVoid, "sealed", boolean>;
67
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
68
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
69
+ }, import("zod").ZodVoid, "sealed", boolean>;
70
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
71
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
72
+ }, import("zod").ZodVoid, "sealed", boolean>;
73
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
74
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
75
+ }, import("zod").ZodVoid, "sealed", boolean>;
76
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
77
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
78
+ }, import("zod").ZodVoid, "sealed", boolean>;
79
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
80
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
81
+ readonly perms: import("zod").ZodNumber;
82
+ }, import("zod").ZodVoid, "sealed", boolean>;
83
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
84
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
85
+ readonly perms: import("zod").ZodNumber;
86
+ }, import("zod").ZodVoid, "sealed", boolean>;
87
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
88
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
89
+ readonly perms: import("zod").ZodNumber;
90
+ }, import("zod").ZodBoolean, "sealed", boolean>;
91
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
92
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
93
+ publicKey: import("zod").ZodObject<{
94
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
95
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
96
+ }, import("zod/v4/core").$strip>;
97
+ credential: import("zod").ZodString;
98
+ }, import("zod/v4/core").$strip>>;
99
+ }, import("zod").ZodObject<{
100
+ iss: import("zod").ZodString;
101
+ sub: import("zod").ZodString;
102
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
103
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
104
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
105
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
106
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
107
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
108
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
109
+ }, import("zod").ZodString, "sealed", boolean>;
110
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
111
+ readonly issuer: import("zod").ZodString;
112
+ readonly subject: import("zod").ZodString;
113
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
114
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
115
+ };
116
+ }, "props"> & {
117
+ readonly properties: {
118
+ iss: import("zod").ZodString;
119
+ sub: import("zod").ZodString;
120
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
121
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
122
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
123
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
124
+ }, import("zod/v4/core").$strip>>;
125
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
126
+ claim: import("zod").ZodString;
127
+ op: import("zod").ZodLiteral<"eq">;
128
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
129
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
130
+ claim: import("zod").ZodString;
131
+ op: import("zod").ZodLiteral<"contains">;
132
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
133
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
134
+ claim: import("zod").ZodString;
135
+ op: import("zod").ZodLiteral<"exists">;
136
+ }, import("zod/v4/core").$strip>], "op">>>;
137
+ };
138
+ } & {
139
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
140
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
141
+ readonly properties: {
142
+ createdAt: import("zod").ZodISODateTime;
143
+ updatedAt: import("zod").ZodISODateTime;
144
+ };
145
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
146
+ readonly properties: {
147
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
148
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
149
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
150
+ defaults: "defaults";
151
+ error: "error";
152
+ merge: "merge";
153
+ replace: "replace";
154
+ skip: "skip";
155
+ }>>;
156
+ };
157
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
158
+ readonly properties: {
159
+ name: import("zod").ZodString;
160
+ };
161
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
162
+ readonly properties: {
163
+ description: import("zod").ZodOptional<import("zod").ZodString>;
164
+ };
165
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
166
+ readonly properties: {
167
+ status: import("zod").ZodEnum<{
168
+ active: "active";
169
+ creating: "creating";
170
+ deleting: "deleting";
171
+ error: "error";
172
+ updating: "updating";
173
+ }>;
174
+ };
175
+ }>];
176
+ readonly methods: {
177
+ move: import("@astrale-os/kernel-dsl").FnDef<{
178
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
179
+ }, import("zod").ZodVoid, "sealed", boolean>;
180
+ };
181
+ }>];
182
+ }>];
183
+ readonly icon: string;
184
+ readonly props: {
185
+ /** The app's source — the origin of the domain it was installed from. */
186
+ origin: z.ZodString;
187
+ /** The app's logo — an inline SVG string or a `data:` URL, lifted from the
188
+ * target domain's `/meta` manifest at install time. Optional (a domain need
189
+ * not declare one). */
190
+ logo: z.ZodOptional<z.ZodString>;
191
+ };
192
+ readonly methods: {
193
+ /**
194
+ * `Application.install(target, space)` — install an application INTO a space.
195
+ * `target` is the app's source — either a serving worker url (`https://…`,
196
+ * resolved to its declared origin via `/meta`) OR a bare origin. The target
197
+ * MUST be among the domains installed on this instance; otherwise the
198
+ * install is refused. The CALLER must hold EDIT on the space.
199
+ *
200
+ * Idempotent: re-installing the same origin into the same space adopts the
201
+ * existing app. Registers the target domain's declared ROLES (manifest
202
+ * `roles`) + the per-domain roles umbrella on first install, materializes
203
+ * the Application identity in the space's default `apps` folder (resolved via the
204
+ * `default_location` edge), links `installed_in` → space and `of_domain` →
205
+ * Domain, pins the `entrypoint` view when the manifest declares one, and
206
+ * assigns the caller the domain's DEFAULT roles.
207
+ */
208
+ install: import("@astrale-os/kernel-dsl").FnDef<{
209
+ readonly target: z.ZodString;
210
+ readonly space: z.ZodString;
211
+ }, z.ZodObject<{
212
+ id: z.ZodString;
213
+ path: z.ZodString;
214
+ origin: z.ZodString;
215
+ }, z.core.$strip>, import("@astrale-os/kernel-dsl").MethodInheritance, true>;
216
+ /**
217
+ * `Application.available()` — the domains installed on this instance, enriched with
218
+ * each one's `/meta` manifest `logo` where reachable. The catalog a user picks
219
+ * from to `install` an app (labelled by `origin`). A domain whose `/meta` fails
220
+ * still appears (without `logo`).
221
+ */
222
+ available: import("@astrale-os/kernel-dsl").FnDef<{}, z.ZodArray<z.ZodObject<{
223
+ origin: z.ZodString;
224
+ url: z.ZodOptional<z.ZodString>;
225
+ logo: z.ZodOptional<z.ZodString>;
226
+ }, z.core.$strip>>, import("@astrale-os/kernel-dsl").MethodInheritance, true>;
227
+ /**
228
+ * `app::entrypoint()` — the app's entry View, resolved by walking the SEMANTIC
229
+ * `entrypoint` edge (Application → View), never by reconstructing a path. Returns the
230
+ * View ref (filtered by the caller's READ), or `null` when none is pinned.
231
+ */
232
+ entrypoint: import("@astrale-os/kernel-dsl").FnDef<import("@astrale-os/kernel-dsl").ParamShape, z.ZodNullable<z.ZodObject<{
233
+ id: z.ZodString;
234
+ path: z.ZodString;
235
+ }, z.core.$strip>>, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
236
+ /**
237
+ * `app::open()` — step 1 of the three-call app-opening protocol (caller
238
+ * gate: USE on the app). Resolves the entry view, mints the app's
239
+ * kernel-issued self bearer (`appCredential` — the app holds NO capability
240
+ * beyond its explicit node grants), and returns the READY-TO-MINT
241
+ * `delegation` expression:
242
+ *
243
+ * union( scope(self, {nodes: [installed domains]}),
244
+ * intersect( scope(self, {nodes: [/spaces]}),
245
+ * credential(appCredential) ) )
246
+ *
247
+ * The USER mints it verbatim (step 2 — the kernel's delegation mint is
248
+ * self-only): `@you::mintDelegationCredential({ delegation })`, then hands
249
+ * the envelope to `getAccessToken` (step 3) for the app token; refreshes
250
+ * loop on steps 2–3 (each `getAccessToken` returns the next expression).
251
+ */
252
+ open: import("@astrale-os/kernel-dsl").FnDef<import("@astrale-os/kernel-dsl").ParamShape, z.ZodObject<{
253
+ view: z.ZodNullable<z.ZodObject<{
254
+ id: z.ZodString;
255
+ path: z.ZodString;
256
+ url: z.ZodOptional<z.ZodString>;
257
+ handshake: z.ZodOptional<z.ZodString>;
258
+ }, z.core.$strip>>;
259
+ appCredential: z.ZodString;
260
+ delegation: z.ZodCustom<UnresolvedIdentityExpr, UnresolvedIdentityExpr>;
261
+ expiresAt: z.ZodNumber;
262
+ }, z.core.$strip>, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
263
+ /**
264
+ * `app::getAccessToken(delegation)` — exchange the USER-MINTED envelope
265
+ * (step 2) for the APP TOKEN, minted AS the app:
266
+ * `union(selfApp, delegatedUserToken)` — the app's own explicit grants
267
+ * plus the user-signed, pre-attenuated authority, nothing more (the
268
+ * attenuation lives inside the user's signature). Sub = the app; audience
269
+ * = the app's backend. Refused when the envelope's subject isn't the
270
+ * caller. REFRESH-CAPABLE: the result carries the NEXT ready-to-mint
271
+ * `delegation` expression (armed with the fresh `appCredential`), so
272
+ * refreshing loops on the user mint + this call alone — `open` is only
273
+ * needed once, for the view.
274
+ */
275
+ getAccessToken: import("@astrale-os/kernel-dsl").FnDef<{
276
+ readonly delegation: z.ZodString;
277
+ }, z.ZodObject<{
278
+ credential: z.ZodString;
279
+ expiresAt: z.ZodNumber;
280
+ delegation: z.ZodCustom<UnresolvedIdentityExpr, UnresolvedIdentityExpr>;
281
+ appCredential: z.ZodString;
282
+ }, z.core.$strip>, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
283
+ };
284
+ }, "props"> & {
285
+ readonly properties: {
286
+ /** The app's source — the origin of the domain it was installed from. */
287
+ readonly origin: z.ZodString;
288
+ /** The app's logo — an inline SVG string or a `data:` URL, lifted from the
289
+ * target domain's `/meta` manifest at install time. Optional (a domain need
290
+ * not declare one). */
291
+ readonly logo: z.ZodOptional<z.ZodString>;
292
+ };
293
+ } & {
294
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
295
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
296
+ readonly properties: {
297
+ createdAt: z.ZodISODateTime;
298
+ updatedAt: z.ZodISODateTime;
299
+ };
300
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
301
+ readonly properties: {
302
+ externalId: z.ZodOptional<z.ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
303
+ updatedAt: z.ZodOptional<z.ZodISODateTime>;
304
+ onConflict: z.ZodOptional<z.ZodEnum<{
305
+ defaults: "defaults";
306
+ error: "error";
307
+ merge: "merge";
308
+ replace: "replace";
309
+ skip: "skip";
310
+ }>>;
311
+ };
312
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
313
+ readonly properties: {
314
+ name: z.ZodString;
315
+ };
316
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
317
+ readonly properties: {
318
+ description: z.ZodOptional<z.ZodString>;
319
+ };
320
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
321
+ readonly properties: {
322
+ status: z.ZodEnum<{
323
+ active: "active";
324
+ creating: "creating";
325
+ deleting: "deleting";
326
+ error: "error";
327
+ updating: "updating";
328
+ }>;
329
+ };
330
+ }>];
331
+ readonly methods: {
332
+ move: import("@astrale-os/kernel-dsl").FnDef<{
333
+ readonly to: z.ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, z.core.$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
334
+ }, z.ZodVoid, "sealed", boolean>;
335
+ };
336
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
337
+ readonly props: {
338
+ iss: import("zod").ZodString;
339
+ sub: import("zod").ZodString;
340
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
341
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
342
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
343
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
344
+ }, import("zod/v4/core").$strip>>;
345
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
346
+ claim: import("zod").ZodString;
347
+ op: import("zod").ZodLiteral<"eq">;
348
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
349
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
350
+ claim: import("zod").ZodString;
351
+ op: import("zod").ZodLiteral<"contains">;
352
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
353
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
354
+ claim: import("zod").ZodString;
355
+ op: import("zod").ZodLiteral<"exists">;
356
+ }, import("zod/v4/core").$strip>], "op">>>;
357
+ };
358
+ readonly methods: {
359
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
360
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
361
+ }, import("zod").ZodVoid, "sealed", boolean>;
362
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
363
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
364
+ }, import("zod").ZodVoid, "sealed", boolean>;
365
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
366
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
367
+ }, import("zod").ZodVoid, "sealed", boolean>;
368
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
369
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
370
+ }, import("zod").ZodVoid, "sealed", boolean>;
371
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
372
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
373
+ }, import("zod").ZodVoid, "sealed", boolean>;
374
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
375
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
376
+ }, import("zod").ZodVoid, "sealed", boolean>;
377
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
378
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
379
+ readonly perms: import("zod").ZodNumber;
380
+ }, import("zod").ZodVoid, "sealed", boolean>;
381
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
382
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
383
+ readonly perms: import("zod").ZodNumber;
384
+ }, import("zod").ZodVoid, "sealed", boolean>;
385
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
386
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
387
+ readonly perms: import("zod").ZodNumber;
388
+ }, import("zod").ZodBoolean, "sealed", boolean>;
389
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
390
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
391
+ publicKey: import("zod").ZodObject<{
392
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
393
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
394
+ }, import("zod/v4/core").$strip>;
395
+ credential: import("zod").ZodString;
396
+ }, import("zod/v4/core").$strip>>;
397
+ }, import("zod").ZodObject<{
398
+ iss: import("zod").ZodString;
399
+ sub: import("zod").ZodString;
400
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
401
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
402
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
403
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
404
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
405
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
406
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
407
+ }, import("zod").ZodString, "sealed", boolean>;
408
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
409
+ readonly issuer: import("zod").ZodString;
410
+ readonly subject: import("zod").ZodString;
411
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
412
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
413
+ };
414
+ }, "props"> & {
415
+ readonly properties: {
416
+ iss: import("zod").ZodString;
417
+ sub: import("zod").ZodString;
418
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
419
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
420
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
421
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
422
+ }, import("zod/v4/core").$strip>>;
423
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
424
+ claim: import("zod").ZodString;
425
+ op: import("zod").ZodLiteral<"eq">;
426
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
427
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
428
+ claim: import("zod").ZodString;
429
+ op: import("zod").ZodLiteral<"contains">;
430
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
431
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
432
+ claim: import("zod").ZodString;
433
+ op: import("zod").ZodLiteral<"exists">;
434
+ }, import("zod/v4/core").$strip>], "op">>>;
435
+ };
436
+ } & {
437
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
438
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
439
+ readonly properties: {
440
+ createdAt: import("zod").ZodISODateTime;
441
+ updatedAt: import("zod").ZodISODateTime;
442
+ };
443
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
444
+ readonly properties: {
445
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
446
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
447
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
448
+ defaults: "defaults";
449
+ error: "error";
450
+ merge: "merge";
451
+ replace: "replace";
452
+ skip: "skip";
453
+ }>>;
454
+ };
455
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
456
+ readonly properties: {
457
+ name: import("zod").ZodString;
458
+ };
459
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
460
+ readonly properties: {
461
+ description: import("zod").ZodOptional<import("zod").ZodString>;
462
+ };
463
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
464
+ readonly properties: {
465
+ status: import("zod").ZodEnum<{
466
+ active: "active";
467
+ creating: "creating";
468
+ deleting: "deleting";
469
+ error: "error";
470
+ updating: "updating";
471
+ }>;
472
+ };
473
+ }>];
474
+ readonly methods: {
475
+ move: import("@astrale-os/kernel-dsl").FnDef<{
476
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
477
+ }, import("zod").ZodVoid, "sealed", boolean>;
478
+ };
479
+ }>];
480
+ }>];
481
+ }>;
482
+ /**
483
+ * `Role` (interface) — a capability identity a DOMAIN declares (manifest
484
+ * `roles`) and a USER is assigned (`assign`). Holding a role composes its
485
+ * permissions onto the user via `extendIdentity` — the same mechanism as Group
486
+ * membership. The domain itself grants each role its resource permissions.
487
+ */
488
+ export declare const iRole: import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
489
+ readonly extends: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
490
+ readonly props: {
491
+ iss: import("zod").ZodString;
492
+ sub: import("zod").ZodString;
493
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
494
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
495
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
496
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
497
+ }, import("zod/v4/core").$strip>>;
498
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
499
+ claim: import("zod").ZodString;
500
+ op: import("zod").ZodLiteral<"eq">;
501
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
502
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
503
+ claim: import("zod").ZodString;
504
+ op: import("zod").ZodLiteral<"contains">;
505
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
506
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
507
+ claim: import("zod").ZodString;
508
+ op: import("zod").ZodLiteral<"exists">;
509
+ }, import("zod/v4/core").$strip>], "op">>>;
510
+ };
511
+ readonly methods: {
512
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
513
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
514
+ }, import("zod").ZodVoid, "sealed", boolean>;
515
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
516
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
517
+ }, import("zod").ZodVoid, "sealed", boolean>;
518
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
519
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
520
+ }, import("zod").ZodVoid, "sealed", boolean>;
521
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
522
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
523
+ }, import("zod").ZodVoid, "sealed", boolean>;
524
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
525
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
526
+ }, import("zod").ZodVoid, "sealed", boolean>;
527
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
528
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
529
+ }, import("zod").ZodVoid, "sealed", boolean>;
530
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
531
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
532
+ readonly perms: import("zod").ZodNumber;
533
+ }, import("zod").ZodVoid, "sealed", boolean>;
534
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
535
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
536
+ readonly perms: import("zod").ZodNumber;
537
+ }, import("zod").ZodVoid, "sealed", boolean>;
538
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
539
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
540
+ readonly perms: import("zod").ZodNumber;
541
+ }, import("zod").ZodBoolean, "sealed", boolean>;
542
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
543
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
544
+ publicKey: import("zod").ZodObject<{
545
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
546
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
547
+ }, import("zod/v4/core").$strip>;
548
+ credential: import("zod").ZodString;
549
+ }, import("zod/v4/core").$strip>>;
550
+ }, import("zod").ZodObject<{
551
+ iss: import("zod").ZodString;
552
+ sub: import("zod").ZodString;
553
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
554
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
555
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
556
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
557
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
558
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
559
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
560
+ }, import("zod").ZodString, "sealed", boolean>;
561
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
562
+ readonly issuer: import("zod").ZodString;
563
+ readonly subject: import("zod").ZodString;
564
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
565
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
566
+ };
567
+ }, "props"> & {
568
+ readonly properties: {
569
+ iss: import("zod").ZodString;
570
+ sub: import("zod").ZodString;
571
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
572
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
573
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
574
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
575
+ }, import("zod/v4/core").$strip>>;
576
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
577
+ claim: import("zod").ZodString;
578
+ op: import("zod").ZodLiteral<"eq">;
579
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
580
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
581
+ claim: import("zod").ZodString;
582
+ op: import("zod").ZodLiteral<"contains">;
583
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
584
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
585
+ claim: import("zod").ZodString;
586
+ op: import("zod").ZodLiteral<"exists">;
587
+ }, import("zod/v4/core").$strip>], "op">>>;
588
+ };
589
+ } & {
590
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
591
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
592
+ readonly properties: {
593
+ createdAt: import("zod").ZodISODateTime;
594
+ updatedAt: import("zod").ZodISODateTime;
595
+ };
596
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
597
+ readonly properties: {
598
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
599
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
600
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
601
+ defaults: "defaults";
602
+ error: "error";
603
+ merge: "merge";
604
+ replace: "replace";
605
+ skip: "skip";
606
+ }>>;
607
+ };
608
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
609
+ readonly properties: {
610
+ name: import("zod").ZodString;
611
+ };
612
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
613
+ readonly properties: {
614
+ description: import("zod").ZodOptional<import("zod").ZodString>;
615
+ };
616
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
617
+ readonly properties: {
618
+ status: import("zod").ZodEnum<{
619
+ active: "active";
620
+ creating: "creating";
621
+ deleting: "deleting";
622
+ error: "error";
623
+ updating: "updating";
624
+ }>;
625
+ };
626
+ }>];
627
+ readonly methods: {
628
+ move: import("@astrale-os/kernel-dsl").FnDef<{
629
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
630
+ }, import("zod").ZodVoid, "sealed", boolean>;
631
+ };
632
+ }>];
633
+ }>];
634
+ readonly methods: {
635
+ /**
636
+ * `role::assign(user)` — assign this role to a user: records the semantic
637
+ * `has_role` edge AND extends the user's identity with the role
638
+ * (`extendIdentity`), so the role's permissions genuinely compose onto the
639
+ * user. Kernel-gated: the caller needs EDIT on the user and SHARE on the
640
+ * role (default roles carry a users-group SHARE grant — self-assignable).
641
+ * Idempotent.
642
+ */
643
+ assign: import("@astrale-os/kernel-dsl").FnDef<{
644
+ readonly user: z.ZodString;
645
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
646
+ /**
647
+ * `role::unassign(user)` — the idempotent inverse of `assign`: removes the
648
+ * `has_role` edge AND reverses the identity composition (`removeExtension`),
649
+ * so the role's permissions no longer compose onto the user. Same gate as
650
+ * `assign` (SHARE on the role + EDIT on the user unless self). Not assigned
651
+ * already ⇒ no-op.
652
+ */
653
+ unassign: import("@astrale-os/kernel-dsl").FnDef<{
654
+ readonly user: z.ZodString;
655
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
656
+ };
657
+ }, "props"> & {
658
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
659
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
660
+ readonly properties: {
661
+ createdAt: z.ZodISODateTime;
662
+ updatedAt: z.ZodISODateTime;
663
+ };
664
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
665
+ readonly properties: {
666
+ externalId: z.ZodOptional<z.ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
667
+ updatedAt: z.ZodOptional<z.ZodISODateTime>;
668
+ onConflict: z.ZodOptional<z.ZodEnum<{
669
+ defaults: "defaults";
670
+ error: "error";
671
+ merge: "merge";
672
+ replace: "replace";
673
+ skip: "skip";
674
+ }>>;
675
+ };
676
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
677
+ readonly properties: {
678
+ name: z.ZodString;
679
+ };
680
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
681
+ readonly properties: {
682
+ description: z.ZodOptional<z.ZodString>;
683
+ };
684
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
685
+ readonly properties: {
686
+ status: z.ZodEnum<{
687
+ active: "active";
688
+ creating: "creating";
689
+ deleting: "deleting";
690
+ error: "error";
691
+ updating: "updating";
692
+ }>;
693
+ };
694
+ }>];
695
+ readonly methods: {
696
+ move: import("@astrale-os/kernel-dsl").FnDef<{
697
+ readonly to: z.ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, z.core.$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
698
+ }, z.ZodVoid, "sealed", boolean>;
699
+ };
700
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
701
+ readonly props: {
702
+ iss: import("zod").ZodString;
703
+ sub: import("zod").ZodString;
704
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
705
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
706
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
707
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
708
+ }, import("zod/v4/core").$strip>>;
709
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
710
+ claim: import("zod").ZodString;
711
+ op: import("zod").ZodLiteral<"eq">;
712
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
713
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
714
+ claim: import("zod").ZodString;
715
+ op: import("zod").ZodLiteral<"contains">;
716
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
717
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
718
+ claim: import("zod").ZodString;
719
+ op: import("zod").ZodLiteral<"exists">;
720
+ }, import("zod/v4/core").$strip>], "op">>>;
721
+ };
722
+ readonly methods: {
723
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
724
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
725
+ }, import("zod").ZodVoid, "sealed", boolean>;
726
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
727
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
728
+ }, import("zod").ZodVoid, "sealed", boolean>;
729
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
730
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
731
+ }, import("zod").ZodVoid, "sealed", boolean>;
732
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
733
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
734
+ }, import("zod").ZodVoid, "sealed", boolean>;
735
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
736
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
737
+ }, import("zod").ZodVoid, "sealed", boolean>;
738
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
739
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
740
+ }, import("zod").ZodVoid, "sealed", boolean>;
741
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
742
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
743
+ readonly perms: import("zod").ZodNumber;
744
+ }, import("zod").ZodVoid, "sealed", boolean>;
745
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
746
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
747
+ readonly perms: import("zod").ZodNumber;
748
+ }, import("zod").ZodVoid, "sealed", boolean>;
749
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
750
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
751
+ readonly perms: import("zod").ZodNumber;
752
+ }, import("zod").ZodBoolean, "sealed", boolean>;
753
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
754
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
755
+ publicKey: import("zod").ZodObject<{
756
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
757
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
758
+ }, import("zod/v4/core").$strip>;
759
+ credential: import("zod").ZodString;
760
+ }, import("zod/v4/core").$strip>>;
761
+ }, import("zod").ZodObject<{
762
+ iss: import("zod").ZodString;
763
+ sub: import("zod").ZodString;
764
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
765
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
766
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
767
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
768
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
769
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
770
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
771
+ }, import("zod").ZodString, "sealed", boolean>;
772
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
773
+ readonly issuer: import("zod").ZodString;
774
+ readonly subject: import("zod").ZodString;
775
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
776
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
777
+ };
778
+ }, "props"> & {
779
+ readonly properties: {
780
+ iss: import("zod").ZodString;
781
+ sub: import("zod").ZodString;
782
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
783
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
784
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
785
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
786
+ }, import("zod/v4/core").$strip>>;
787
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
788
+ claim: import("zod").ZodString;
789
+ op: import("zod").ZodLiteral<"eq">;
790
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
791
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
792
+ claim: import("zod").ZodString;
793
+ op: import("zod").ZodLiteral<"contains">;
794
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
795
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
796
+ claim: import("zod").ZodString;
797
+ op: import("zod").ZodLiteral<"exists">;
798
+ }, import("zod/v4/core").$strip>], "op">>>;
799
+ };
800
+ } & {
801
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
802
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
803
+ readonly properties: {
804
+ createdAt: import("zod").ZodISODateTime;
805
+ updatedAt: import("zod").ZodISODateTime;
806
+ };
807
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
808
+ readonly properties: {
809
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
810
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
811
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
812
+ defaults: "defaults";
813
+ error: "error";
814
+ merge: "merge";
815
+ replace: "replace";
816
+ skip: "skip";
817
+ }>>;
818
+ };
819
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
820
+ readonly properties: {
821
+ name: import("zod").ZodString;
822
+ };
823
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
824
+ readonly properties: {
825
+ description: import("zod").ZodOptional<import("zod").ZodString>;
826
+ };
827
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
828
+ readonly properties: {
829
+ status: import("zod").ZodEnum<{
830
+ active: "active";
831
+ creating: "creating";
832
+ deleting: "deleting";
833
+ error: "error";
834
+ updating: "updating";
835
+ }>;
836
+ };
837
+ }>];
838
+ readonly methods: {
839
+ move: import("@astrale-os/kernel-dsl").FnDef<{
840
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
841
+ }, import("zod").ZodVoid, "sealed", boolean>;
842
+ };
843
+ }>];
844
+ }>];
845
+ }>;
846
+ /** The DEFAULT `Role` — implements the `Role` interface. Role nodes live under
847
+ * `/domains/<origin-slug>/roles`; the parent node of a domain's roles is
848
+ * itself a Role — the ROLES UMBRELLA (`RolesIdentity`), extended with every
849
+ * role of the domain so it embodies their union at authorization time. */
850
+ export declare const Role: import("@astrale-os/kernel-dsl").NodeClassDef<Omit<{
851
+ readonly implements: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
852
+ readonly extends: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
853
+ readonly props: {
854
+ iss: import("zod").ZodString;
855
+ sub: import("zod").ZodString;
856
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
857
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
858
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
859
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
860
+ }, import("zod/v4/core").$strip>>;
861
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
862
+ claim: import("zod").ZodString;
863
+ op: import("zod").ZodLiteral<"eq">;
864
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
865
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
866
+ claim: import("zod").ZodString;
867
+ op: import("zod").ZodLiteral<"contains">;
868
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
869
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
870
+ claim: import("zod").ZodString;
871
+ op: import("zod").ZodLiteral<"exists">;
872
+ }, import("zod/v4/core").$strip>], "op">>>;
873
+ };
874
+ readonly methods: {
875
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
876
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
877
+ }, import("zod").ZodVoid, "sealed", boolean>;
878
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
879
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
880
+ }, import("zod").ZodVoid, "sealed", boolean>;
881
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
882
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
883
+ }, import("zod").ZodVoid, "sealed", boolean>;
884
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
885
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
886
+ }, import("zod").ZodVoid, "sealed", boolean>;
887
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
888
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
889
+ }, import("zod").ZodVoid, "sealed", boolean>;
890
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
891
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
892
+ }, import("zod").ZodVoid, "sealed", boolean>;
893
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
894
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
895
+ readonly perms: import("zod").ZodNumber;
896
+ }, import("zod").ZodVoid, "sealed", boolean>;
897
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
898
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
899
+ readonly perms: import("zod").ZodNumber;
900
+ }, import("zod").ZodVoid, "sealed", boolean>;
901
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
902
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
903
+ readonly perms: import("zod").ZodNumber;
904
+ }, import("zod").ZodBoolean, "sealed", boolean>;
905
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
906
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
907
+ publicKey: import("zod").ZodObject<{
908
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
909
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
910
+ }, import("zod/v4/core").$strip>;
911
+ credential: import("zod").ZodString;
912
+ }, import("zod/v4/core").$strip>>;
913
+ }, import("zod").ZodObject<{
914
+ iss: import("zod").ZodString;
915
+ sub: import("zod").ZodString;
916
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
917
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
918
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
919
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
920
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
921
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
922
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
923
+ }, import("zod").ZodString, "sealed", boolean>;
924
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
925
+ readonly issuer: import("zod").ZodString;
926
+ readonly subject: import("zod").ZodString;
927
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
928
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
929
+ };
930
+ }, "props"> & {
931
+ readonly properties: {
932
+ iss: import("zod").ZodString;
933
+ sub: import("zod").ZodString;
934
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
935
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
936
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
937
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
938
+ }, import("zod/v4/core").$strip>>;
939
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
940
+ claim: import("zod").ZodString;
941
+ op: import("zod").ZodLiteral<"eq">;
942
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
943
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
944
+ claim: import("zod").ZodString;
945
+ op: import("zod").ZodLiteral<"contains">;
946
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
947
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
948
+ claim: import("zod").ZodString;
949
+ op: import("zod").ZodLiteral<"exists">;
950
+ }, import("zod/v4/core").$strip>], "op">>>;
951
+ };
952
+ } & {
953
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
954
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
955
+ readonly properties: {
956
+ createdAt: import("zod").ZodISODateTime;
957
+ updatedAt: import("zod").ZodISODateTime;
958
+ };
959
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
960
+ readonly properties: {
961
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
962
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
963
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
964
+ defaults: "defaults";
965
+ error: "error";
966
+ merge: "merge";
967
+ replace: "replace";
968
+ skip: "skip";
969
+ }>>;
970
+ };
971
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
972
+ readonly properties: {
973
+ name: import("zod").ZodString;
974
+ };
975
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
976
+ readonly properties: {
977
+ description: import("zod").ZodOptional<import("zod").ZodString>;
978
+ };
979
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
980
+ readonly properties: {
981
+ status: import("zod").ZodEnum<{
982
+ active: "active";
983
+ creating: "creating";
984
+ deleting: "deleting";
985
+ error: "error";
986
+ updating: "updating";
987
+ }>;
988
+ };
989
+ }>];
990
+ readonly methods: {
991
+ move: import("@astrale-os/kernel-dsl").FnDef<{
992
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
993
+ }, import("zod").ZodVoid, "sealed", boolean>;
994
+ };
995
+ }>];
996
+ }>];
997
+ readonly methods: {
998
+ /**
999
+ * `role::assign(user)` — assign this role to a user: records the semantic
1000
+ * `has_role` edge AND extends the user's identity with the role
1001
+ * (`extendIdentity`), so the role's permissions genuinely compose onto the
1002
+ * user. Kernel-gated: the caller needs EDIT on the user and SHARE on the
1003
+ * role (default roles carry a users-group SHARE grant — self-assignable).
1004
+ * Idempotent.
1005
+ */
1006
+ assign: import("@astrale-os/kernel-dsl").FnDef<{
1007
+ readonly user: z.ZodString;
1008
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
1009
+ /**
1010
+ * `role::unassign(user)` — the idempotent inverse of `assign`: removes the
1011
+ * `has_role` edge AND reverses the identity composition (`removeExtension`),
1012
+ * so the role's permissions no longer compose onto the user. Same gate as
1013
+ * `assign` (SHARE on the role + EDIT on the user unless self). Not assigned
1014
+ * already ⇒ no-op.
1015
+ */
1016
+ unassign: import("@astrale-os/kernel-dsl").FnDef<{
1017
+ readonly user: z.ZodString;
1018
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
1019
+ };
1020
+ }, "props"> & {
1021
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1022
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1023
+ readonly properties: {
1024
+ createdAt: z.ZodISODateTime;
1025
+ updatedAt: z.ZodISODateTime;
1026
+ };
1027
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1028
+ readonly properties: {
1029
+ externalId: z.ZodOptional<z.ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1030
+ updatedAt: z.ZodOptional<z.ZodISODateTime>;
1031
+ onConflict: z.ZodOptional<z.ZodEnum<{
1032
+ defaults: "defaults";
1033
+ error: "error";
1034
+ merge: "merge";
1035
+ replace: "replace";
1036
+ skip: "skip";
1037
+ }>>;
1038
+ };
1039
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1040
+ readonly properties: {
1041
+ name: z.ZodString;
1042
+ };
1043
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1044
+ readonly properties: {
1045
+ description: z.ZodOptional<z.ZodString>;
1046
+ };
1047
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1048
+ readonly properties: {
1049
+ status: z.ZodEnum<{
1050
+ active: "active";
1051
+ creating: "creating";
1052
+ deleting: "deleting";
1053
+ error: "error";
1054
+ updating: "updating";
1055
+ }>;
1056
+ };
1057
+ }>];
1058
+ readonly methods: {
1059
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1060
+ readonly to: z.ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, z.core.$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1061
+ }, z.ZodVoid, "sealed", boolean>;
1062
+ };
1063
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
1064
+ readonly props: {
1065
+ iss: import("zod").ZodString;
1066
+ sub: import("zod").ZodString;
1067
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1068
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1069
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1070
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1071
+ }, import("zod/v4/core").$strip>>;
1072
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1073
+ claim: import("zod").ZodString;
1074
+ op: import("zod").ZodLiteral<"eq">;
1075
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1076
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1077
+ claim: import("zod").ZodString;
1078
+ op: import("zod").ZodLiteral<"contains">;
1079
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1080
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1081
+ claim: import("zod").ZodString;
1082
+ op: import("zod").ZodLiteral<"exists">;
1083
+ }, import("zod/v4/core").$strip>], "op">>>;
1084
+ };
1085
+ readonly methods: {
1086
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1087
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1088
+ }, import("zod").ZodVoid, "sealed", boolean>;
1089
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1090
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1091
+ }, import("zod").ZodVoid, "sealed", boolean>;
1092
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1093
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1094
+ }, import("zod").ZodVoid, "sealed", boolean>;
1095
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
1096
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1097
+ }, import("zod").ZodVoid, "sealed", boolean>;
1098
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
1099
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1100
+ }, import("zod").ZodVoid, "sealed", boolean>;
1101
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
1102
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1103
+ }, import("zod").ZodVoid, "sealed", boolean>;
1104
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
1105
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1106
+ readonly perms: import("zod").ZodNumber;
1107
+ }, import("zod").ZodVoid, "sealed", boolean>;
1108
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
1109
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1110
+ readonly perms: import("zod").ZodNumber;
1111
+ }, import("zod").ZodVoid, "sealed", boolean>;
1112
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
1113
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1114
+ readonly perms: import("zod").ZodNumber;
1115
+ }, import("zod").ZodBoolean, "sealed", boolean>;
1116
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1117
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
1118
+ publicKey: import("zod").ZodObject<{
1119
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1120
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1121
+ }, import("zod/v4/core").$strip>;
1122
+ credential: import("zod").ZodString;
1123
+ }, import("zod/v4/core").$strip>>;
1124
+ }, import("zod").ZodObject<{
1125
+ iss: import("zod").ZodString;
1126
+ sub: import("zod").ZodString;
1127
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
1128
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
1129
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
1130
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
1131
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
1132
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
1133
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
1134
+ }, import("zod").ZodString, "sealed", boolean>;
1135
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1136
+ readonly issuer: import("zod").ZodString;
1137
+ readonly subject: import("zod").ZodString;
1138
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
1139
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
1140
+ };
1141
+ }, "props"> & {
1142
+ readonly properties: {
1143
+ iss: import("zod").ZodString;
1144
+ sub: import("zod").ZodString;
1145
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1146
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1147
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1148
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1149
+ }, import("zod/v4/core").$strip>>;
1150
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1151
+ claim: import("zod").ZodString;
1152
+ op: import("zod").ZodLiteral<"eq">;
1153
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1154
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1155
+ claim: import("zod").ZodString;
1156
+ op: import("zod").ZodLiteral<"contains">;
1157
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1158
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1159
+ claim: import("zod").ZodString;
1160
+ op: import("zod").ZodLiteral<"exists">;
1161
+ }, import("zod/v4/core").$strip>], "op">>>;
1162
+ };
1163
+ } & {
1164
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1165
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1166
+ readonly properties: {
1167
+ createdAt: import("zod").ZodISODateTime;
1168
+ updatedAt: import("zod").ZodISODateTime;
1169
+ };
1170
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1171
+ readonly properties: {
1172
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1173
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1174
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1175
+ defaults: "defaults";
1176
+ error: "error";
1177
+ merge: "merge";
1178
+ replace: "replace";
1179
+ skip: "skip";
1180
+ }>>;
1181
+ };
1182
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1183
+ readonly properties: {
1184
+ name: import("zod").ZodString;
1185
+ };
1186
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1187
+ readonly properties: {
1188
+ description: import("zod").ZodOptional<import("zod").ZodString>;
1189
+ };
1190
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1191
+ readonly properties: {
1192
+ status: import("zod").ZodEnum<{
1193
+ active: "active";
1194
+ creating: "creating";
1195
+ deleting: "deleting";
1196
+ error: "error";
1197
+ updating: "updating";
1198
+ }>;
1199
+ };
1200
+ }>];
1201
+ readonly methods: {
1202
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1203
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1204
+ }, import("zod").ZodVoid, "sealed", boolean>;
1205
+ };
1206
+ }>];
1207
+ }>];
1208
+ }>];
1209
+ readonly icon: string;
1210
+ readonly props: {
1211
+ /** Declared `default: true` — auto-assigned to the installing user; carries
1212
+ * a users-group SHARE grant (self-assignable). Registered from the
1213
+ * domain's manifest at first app install. */
1214
+ default: z.ZodOptional<z.ZodBoolean>;
1215
+ /** What holding this role means — from the domain's manifest declaration. */
1216
+ description: z.ZodOptional<z.ZodString>;
1217
+ };
1218
+ }, "props"> & {
1219
+ readonly properties: {
1220
+ /** Declared `default: true` — auto-assigned to the installing user; carries
1221
+ * a users-group SHARE grant (self-assignable). Registered from the
1222
+ * domain's manifest at first app install. */
1223
+ readonly default: z.ZodOptional<z.ZodBoolean>;
1224
+ /** What holding this role means — from the domain's manifest declaration. */
1225
+ readonly description: z.ZodOptional<z.ZodString>;
1226
+ };
1227
+ } & {
1228
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1229
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1230
+ readonly properties: {
1231
+ createdAt: z.ZodISODateTime;
1232
+ updatedAt: z.ZodISODateTime;
1233
+ };
1234
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1235
+ readonly properties: {
1236
+ externalId: z.ZodOptional<z.ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1237
+ updatedAt: z.ZodOptional<z.ZodISODateTime>;
1238
+ onConflict: z.ZodOptional<z.ZodEnum<{
1239
+ defaults: "defaults";
1240
+ error: "error";
1241
+ merge: "merge";
1242
+ replace: "replace";
1243
+ skip: "skip";
1244
+ }>>;
1245
+ };
1246
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1247
+ readonly properties: {
1248
+ name: z.ZodString;
1249
+ };
1250
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1251
+ readonly properties: {
1252
+ description: z.ZodOptional<z.ZodString>;
1253
+ };
1254
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1255
+ readonly properties: {
1256
+ status: z.ZodEnum<{
1257
+ active: "active";
1258
+ creating: "creating";
1259
+ deleting: "deleting";
1260
+ error: "error";
1261
+ updating: "updating";
1262
+ }>;
1263
+ };
1264
+ }>];
1265
+ readonly methods: {
1266
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1267
+ readonly to: z.ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, z.core.$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1268
+ }, z.ZodVoid, "sealed", boolean>;
1269
+ };
1270
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
1271
+ readonly extends: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
1272
+ readonly props: {
1273
+ iss: import("zod").ZodString;
1274
+ sub: import("zod").ZodString;
1275
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1276
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1277
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1278
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1279
+ }, import("zod/v4/core").$strip>>;
1280
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1281
+ claim: import("zod").ZodString;
1282
+ op: import("zod").ZodLiteral<"eq">;
1283
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1284
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1285
+ claim: import("zod").ZodString;
1286
+ op: import("zod").ZodLiteral<"contains">;
1287
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1288
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1289
+ claim: import("zod").ZodString;
1290
+ op: import("zod").ZodLiteral<"exists">;
1291
+ }, import("zod/v4/core").$strip>], "op">>>;
1292
+ };
1293
+ readonly methods: {
1294
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1295
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1296
+ }, import("zod").ZodVoid, "sealed", boolean>;
1297
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1298
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1299
+ }, import("zod").ZodVoid, "sealed", boolean>;
1300
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1301
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1302
+ }, import("zod").ZodVoid, "sealed", boolean>;
1303
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
1304
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1305
+ }, import("zod").ZodVoid, "sealed", boolean>;
1306
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
1307
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1308
+ }, import("zod").ZodVoid, "sealed", boolean>;
1309
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
1310
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1311
+ }, import("zod").ZodVoid, "sealed", boolean>;
1312
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
1313
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1314
+ readonly perms: import("zod").ZodNumber;
1315
+ }, import("zod").ZodVoid, "sealed", boolean>;
1316
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
1317
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1318
+ readonly perms: import("zod").ZodNumber;
1319
+ }, import("zod").ZodVoid, "sealed", boolean>;
1320
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
1321
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1322
+ readonly perms: import("zod").ZodNumber;
1323
+ }, import("zod").ZodBoolean, "sealed", boolean>;
1324
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1325
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
1326
+ publicKey: import("zod").ZodObject<{
1327
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1328
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1329
+ }, import("zod/v4/core").$strip>;
1330
+ credential: import("zod").ZodString;
1331
+ }, import("zod/v4/core").$strip>>;
1332
+ }, import("zod").ZodObject<{
1333
+ iss: import("zod").ZodString;
1334
+ sub: import("zod").ZodString;
1335
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
1336
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
1337
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
1338
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
1339
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
1340
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
1341
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
1342
+ }, import("zod").ZodString, "sealed", boolean>;
1343
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1344
+ readonly issuer: import("zod").ZodString;
1345
+ readonly subject: import("zod").ZodString;
1346
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
1347
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
1348
+ };
1349
+ }, "props"> & {
1350
+ readonly properties: {
1351
+ iss: import("zod").ZodString;
1352
+ sub: import("zod").ZodString;
1353
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1354
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1355
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1356
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1357
+ }, import("zod/v4/core").$strip>>;
1358
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1359
+ claim: import("zod").ZodString;
1360
+ op: import("zod").ZodLiteral<"eq">;
1361
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1362
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1363
+ claim: import("zod").ZodString;
1364
+ op: import("zod").ZodLiteral<"contains">;
1365
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1366
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1367
+ claim: import("zod").ZodString;
1368
+ op: import("zod").ZodLiteral<"exists">;
1369
+ }, import("zod/v4/core").$strip>], "op">>>;
1370
+ };
1371
+ } & {
1372
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1373
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1374
+ readonly properties: {
1375
+ createdAt: import("zod").ZodISODateTime;
1376
+ updatedAt: import("zod").ZodISODateTime;
1377
+ };
1378
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1379
+ readonly properties: {
1380
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1381
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1382
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1383
+ defaults: "defaults";
1384
+ error: "error";
1385
+ merge: "merge";
1386
+ replace: "replace";
1387
+ skip: "skip";
1388
+ }>>;
1389
+ };
1390
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1391
+ readonly properties: {
1392
+ name: import("zod").ZodString;
1393
+ };
1394
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1395
+ readonly properties: {
1396
+ description: import("zod").ZodOptional<import("zod").ZodString>;
1397
+ };
1398
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1399
+ readonly properties: {
1400
+ status: import("zod").ZodEnum<{
1401
+ active: "active";
1402
+ creating: "creating";
1403
+ deleting: "deleting";
1404
+ error: "error";
1405
+ updating: "updating";
1406
+ }>;
1407
+ };
1408
+ }>];
1409
+ readonly methods: {
1410
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1411
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1412
+ }, import("zod").ZodVoid, "sealed", boolean>;
1413
+ };
1414
+ }>];
1415
+ }>];
1416
+ readonly methods: {
1417
+ /**
1418
+ * `role::assign(user)` — assign this role to a user: records the semantic
1419
+ * `has_role` edge AND extends the user's identity with the role
1420
+ * (`extendIdentity`), so the role's permissions genuinely compose onto the
1421
+ * user. Kernel-gated: the caller needs EDIT on the user and SHARE on the
1422
+ * role (default roles carry a users-group SHARE grant — self-assignable).
1423
+ * Idempotent.
1424
+ */
1425
+ assign: import("@astrale-os/kernel-dsl").FnDef<{
1426
+ readonly user: z.ZodString;
1427
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
1428
+ /**
1429
+ * `role::unassign(user)` — the idempotent inverse of `assign`: removes the
1430
+ * `has_role` edge AND reverses the identity composition (`removeExtension`),
1431
+ * so the role's permissions no longer compose onto the user. Same gate as
1432
+ * `assign` (SHARE on the role + EDIT on the user unless self). Not assigned
1433
+ * already ⇒ no-op.
1434
+ */
1435
+ unassign: import("@astrale-os/kernel-dsl").FnDef<{
1436
+ readonly user: z.ZodString;
1437
+ }, z.ZodVoid, import("@astrale-os/kernel-dsl").MethodInheritance, boolean>;
1438
+ };
1439
+ }, "props"> & {
1440
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1441
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1442
+ readonly properties: {
1443
+ createdAt: z.ZodISODateTime;
1444
+ updatedAt: z.ZodISODateTime;
1445
+ };
1446
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1447
+ readonly properties: {
1448
+ externalId: z.ZodOptional<z.ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1449
+ updatedAt: z.ZodOptional<z.ZodISODateTime>;
1450
+ onConflict: z.ZodOptional<z.ZodEnum<{
1451
+ defaults: "defaults";
1452
+ error: "error";
1453
+ merge: "merge";
1454
+ replace: "replace";
1455
+ skip: "skip";
1456
+ }>>;
1457
+ };
1458
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1459
+ readonly properties: {
1460
+ name: z.ZodString;
1461
+ };
1462
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1463
+ readonly properties: {
1464
+ description: z.ZodOptional<z.ZodString>;
1465
+ };
1466
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1467
+ readonly properties: {
1468
+ status: z.ZodEnum<{
1469
+ active: "active";
1470
+ creating: "creating";
1471
+ deleting: "deleting";
1472
+ error: "error";
1473
+ updating: "updating";
1474
+ }>;
1475
+ };
1476
+ }>];
1477
+ readonly methods: {
1478
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1479
+ readonly to: z.ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, z.core.$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1480
+ }, z.ZodVoid, "sealed", boolean>;
1481
+ };
1482
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<Omit<{
1483
+ readonly props: {
1484
+ iss: import("zod").ZodString;
1485
+ sub: import("zod").ZodString;
1486
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1487
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1488
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1489
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1490
+ }, import("zod/v4/core").$strip>>;
1491
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1492
+ claim: import("zod").ZodString;
1493
+ op: import("zod").ZodLiteral<"eq">;
1494
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1495
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1496
+ claim: import("zod").ZodString;
1497
+ op: import("zod").ZodLiteral<"contains">;
1498
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1499
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1500
+ claim: import("zod").ZodString;
1501
+ op: import("zod").ZodLiteral<"exists">;
1502
+ }, import("zod/v4/core").$strip>], "op">>>;
1503
+ };
1504
+ readonly methods: {
1505
+ extendIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1506
+ readonly with: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1507
+ }, import("zod").ZodVoid, "sealed", boolean>;
1508
+ constrainIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1509
+ readonly by: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1510
+ }, import("zod").ZodVoid, "sealed", boolean>;
1511
+ excludeIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1512
+ readonly without: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1513
+ }, import("zod").ZodVoid, "sealed", boolean>;
1514
+ removeExtension: import("@astrale-os/kernel-dsl").FnDef<{
1515
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1516
+ }, import("zod").ZodVoid, "sealed", boolean>;
1517
+ removeConstraint: import("@astrale-os/kernel-dsl").FnDef<{
1518
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1519
+ }, import("zod").ZodVoid, "sealed", boolean>;
1520
+ removeExclusion: import("@astrale-os/kernel-dsl").FnDef<{
1521
+ readonly identity: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1522
+ }, import("zod").ZodVoid, "sealed", boolean>;
1523
+ grantPerm: import("@astrale-os/kernel-dsl").FnDef<{
1524
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1525
+ readonly perms: import("zod").ZodNumber;
1526
+ }, import("zod").ZodVoid, "sealed", boolean>;
1527
+ revokePerm: import("@astrale-os/kernel-dsl").FnDef<{
1528
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1529
+ readonly perms: import("zod").ZodNumber;
1530
+ }, import("zod").ZodVoid, "sealed", boolean>;
1531
+ checkPerm: import("@astrale-os/kernel-dsl").FnDef<{
1532
+ readonly node: import("zod").ZodType<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").Path, string | import("@astrale-os/kernel-core").Path>>;
1533
+ readonly perms: import("zod").ZodNumber;
1534
+ }, import("zod").ZodBoolean, "sealed", boolean>;
1535
+ registerIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1536
+ readonly signingKey: import("zod").ZodOptional<import("zod").ZodObject<{
1537
+ publicKey: import("zod").ZodObject<{
1538
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1539
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1540
+ }, import("zod/v4/core").$strip>;
1541
+ credential: import("zod").ZodString;
1542
+ }, import("zod/v4/core").$strip>>;
1543
+ }, import("zod").ZodObject<{
1544
+ iss: import("zod").ZodString;
1545
+ sub: import("zod").ZodString;
1546
+ }, import("zod/v4/core").$strip>, "sealed", boolean>;
1547
+ mintIdentityCredential: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodString, "sealed", boolean>;
1548
+ mintDelegationCredential: import("@astrale-os/kernel-dsl").FnDef<{
1549
+ readonly audience: import("zod").ZodOptional<import("zod").ZodString>;
1550
+ readonly delegation: import("zod").ZodCustom<import("@astrale-os/kernel-core").UnresolvedIdentityExpr, import("@astrale-os/kernel-core").UnresolvedIdentityExpr>;
1551
+ readonly attestation: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").SelfIdentityExpr, import("@astrale-os/kernel-core").SelfIdentityExpr>>;
1552
+ readonly ttl: import("zod").ZodOptional<import("zod").ZodNumber>;
1553
+ }, import("zod").ZodString, "sealed", boolean>;
1554
+ findIdentity: import("@astrale-os/kernel-dsl").FnDef<{
1555
+ readonly issuer: import("zod").ZodString;
1556
+ readonly subject: import("zod").ZodString;
1557
+ }, import("zod").ZodNullable<import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>>, "sealed", true>;
1558
+ whoami: import("@astrale-os/kernel-dsl").FnDef<{}, import("zod").ZodCustom<import("@astrale-os/kernel-core").Node, import("@astrale-os/kernel-core").Node>, "sealed", true>;
1559
+ };
1560
+ }, "props"> & {
1561
+ readonly properties: {
1562
+ iss: import("zod").ZodString;
1563
+ sub: import("zod").ZodString;
1564
+ frozen: import("zod").ZodOptional<import("zod").ZodBoolean>;
1565
+ publicKey: import("zod").ZodOptional<import("zod").ZodObject<{
1566
+ jwk: import("zod").ZodOptional<import("zod").ZodCustom<import("jose").JWK, import("jose").JWK>>;
1567
+ jwksUri: import("zod").ZodOptional<import("zod").ZodURL>;
1568
+ }, import("zod/v4/core").$strip>>;
1569
+ requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
1570
+ claim: import("zod").ZodString;
1571
+ op: import("zod").ZodLiteral<"eq">;
1572
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1573
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1574
+ claim: import("zod").ZodString;
1575
+ op: import("zod").ZodLiteral<"contains">;
1576
+ value: import("zod").ZodType<import("@astrale-os/kernel-core").JsonValue, unknown, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").JsonValue, unknown>>;
1577
+ }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
1578
+ claim: import("zod").ZodString;
1579
+ op: import("zod").ZodLiteral<"exists">;
1580
+ }, import("zod/v4/core").$strip>], "op">>>;
1581
+ };
1582
+ } & {
1583
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1584
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1585
+ readonly properties: {
1586
+ createdAt: import("zod").ZodISODateTime;
1587
+ updatedAt: import("zod").ZodISODateTime;
1588
+ };
1589
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1590
+ readonly properties: {
1591
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1592
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1593
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1594
+ defaults: "defaults";
1595
+ error: "error";
1596
+ merge: "merge";
1597
+ replace: "replace";
1598
+ skip: "skip";
1599
+ }>>;
1600
+ };
1601
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1602
+ readonly properties: {
1603
+ name: import("zod").ZodString;
1604
+ };
1605
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1606
+ readonly properties: {
1607
+ description: import("zod").ZodOptional<import("zod").ZodString>;
1608
+ };
1609
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1610
+ readonly properties: {
1611
+ status: import("zod").ZodEnum<{
1612
+ active: "active";
1613
+ creating: "creating";
1614
+ deleting: "deleting";
1615
+ error: "error";
1616
+ updating: "updating";
1617
+ }>;
1618
+ };
1619
+ }>];
1620
+ readonly methods: {
1621
+ move: import("@astrale-os/kernel-dsl").FnDef<{
1622
+ readonly to: import("zod").ZodType<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath, import("zod/v4/core").$ZodTypeInternals<import("@astrale-os/kernel-core").AbsolutePath, string | import("@astrale-os/kernel-core").AbsolutePath>>;
1623
+ }, import("zod").ZodVoid, "sealed", boolean>;
1624
+ };
1625
+ }>];
1626
+ }>];
1627
+ }>];
1628
+ }>;
1629
+ /**
1630
+ * Where an app is installed: an Application instance lives in a SINGLE Space (at most one
1631
+ * `installed_in` per app — you can't install one app instance in two spaces). A
1632
+ * Space holds many apps; we mint a distinct Application instance per space even when two
1633
+ * installs point at the same origin.
1634
+ */
1635
+ export declare const installed_in: import("@astrale-os/kernel-dsl").EdgeClassDef<import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, Omit<Record<never, never>, "props"> & {
1636
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1637
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1638
+ readonly properties: {
1639
+ slug: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<import("@astrale-os/kernel-core").Slug, string>>>;
1640
+ };
1641
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1642
+ readonly properties: {
1643
+ createdAt: import("zod").ZodISODateTime;
1644
+ updatedAt: import("zod").ZodISODateTime;
1645
+ };
1646
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1647
+ readonly properties: {
1648
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1649
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1650
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1651
+ defaults: "defaults";
1652
+ error: "error";
1653
+ merge: "merge";
1654
+ replace: "replace";
1655
+ skip: "skip";
1656
+ }>>;
1657
+ };
1658
+ }>];
1659
+ }>];
1660
+ }>;
1661
+ /**
1662
+ * The domain an Application or Role belongs to: an Application targets exactly one domain (a
1663
+ * domain can back many apps); a Role is declared by exactly one domain. `0..1`
1664
+ * is the safe write-time bound. For an Application it's MANDATORY —
1665
+ * `Application.install` resolves the target origin's Domain node (which must exist, since
1666
+ * the target is an installed domain) and links it.
1667
+ */
1668
+ export declare const of_domain: import("@astrale-os/kernel-dsl").EdgeClassDef<import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, Omit<Record<never, never>, "props"> & {
1669
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1670
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1671
+ readonly properties: {
1672
+ slug: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<import("@astrale-os/kernel-core").Slug, string>>>;
1673
+ };
1674
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1675
+ readonly properties: {
1676
+ createdAt: import("zod").ZodISODateTime;
1677
+ updatedAt: import("zod").ZodISODateTime;
1678
+ };
1679
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1680
+ readonly properties: {
1681
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1682
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1683
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1684
+ defaults: "defaults";
1685
+ error: "error";
1686
+ merge: "merge";
1687
+ replace: "replace";
1688
+ skip: "skip";
1689
+ }>>;
1690
+ };
1691
+ }>];
1692
+ }>];
1693
+ }>;
1694
+ /**
1695
+ * A user's role membership — the semantic, queryable side of role assignment
1696
+ * (the permission composition is done via `extendIdentity`). Typed on the
1697
+ * INTERFACES so any implementer (a foreign `Agent` as user, a specialized role
1698
+ * class) participates.
1699
+ */
1700
+ export declare const has_role: import("@astrale-os/kernel-dsl").EdgeClassDef<import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, Omit<Record<never, never>, "props"> & {
1701
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1702
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1703
+ readonly properties: {
1704
+ slug: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<import("@astrale-os/kernel-core").Slug, string>>>;
1705
+ };
1706
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1707
+ readonly properties: {
1708
+ createdAt: import("zod").ZodISODateTime;
1709
+ updatedAt: import("zod").ZodISODateTime;
1710
+ };
1711
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1712
+ readonly properties: {
1713
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1714
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1715
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1716
+ defaults: "defaults";
1717
+ error: "error";
1718
+ merge: "merge";
1719
+ replace: "replace";
1720
+ skip: "skip";
1721
+ }>>;
1722
+ };
1723
+ }>];
1724
+ }>];
1725
+ }>;
1726
+ /**
1727
+ * An app's entry surface — the View shown when the app opens, specific per app.
1728
+ * At most one. Set by `Application.install` when the target domain's `/meta` manifest
1729
+ * declares an `entrypoint` slug (resolved as `/:<origin>:view.<slug>`, then
1730
+ * pinned to the resolved View node).
1731
+ */
1732
+ export declare const entrypoint: import("@astrale-os/kernel-dsl").EdgeClassDef<import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, import("@astrale-os/kernel-dsl").EndpointConfig<string, readonly any[], import("@astrale-os/kernel-dsl").Cardinality>, Omit<Record<never, never>, "props"> & {
1733
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1734
+ readonly inherits: readonly [import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1735
+ readonly properties: {
1736
+ slug: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<import("@astrale-os/kernel-core").Slug, string>>>;
1737
+ };
1738
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1739
+ readonly properties: {
1740
+ createdAt: import("zod").ZodISODateTime;
1741
+ updatedAt: import("zod").ZodISODateTime;
1742
+ };
1743
+ }>, import("@astrale-os/kernel-dsl").NodeInterfaceDef<{
1744
+ readonly properties: {
1745
+ externalId: import("zod").ZodOptional<import("zod").ZodCustom<import("@astrale-os/kernel-core").ExternalId, import("@astrale-os/kernel-core").ExternalId>>;
1746
+ updatedAt: import("zod").ZodOptional<import("zod").ZodISODateTime>;
1747
+ onConflict: import("zod").ZodOptional<import("zod").ZodEnum<{
1748
+ defaults: "defaults";
1749
+ error: "error";
1750
+ merge: "merge";
1751
+ replace: "replace";
1752
+ skip: "skip";
1753
+ }>>;
1754
+ };
1755
+ }>];
1756
+ }>];
1757
+ }>;
1758
+ //# sourceMappingURL=application.d.ts.map