@astrale-os/kernel-client 0.2.4 → 0.3.1

package/dist/auth/addressing.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Addressing for the auth surface — the one place a syscall address is formed.
+ * Method slugs and the static `whoami` path derive from `K.Identity.*`
+ * accessors, so a kernel schema rename breaks at compile time (the property
+ * access) instead of failing silently at dispatch.
+ */
+/** AuthApi verb → the K-derived Identity method slug it dispatches. */
+export declare const IDENTITY_METHOD: {
+    readonly mint: string;
+    readonly delegate: string;
+    readonly check: string;
+    readonly grant: string;
+    readonly revoke: string;
+    readonly extend: string;
+    readonly constrain: string;
+    readonly exclude: string;
+    readonly removeExtension: string;
+    readonly removeConstraint: string;
+    readonly removeExclusion: string;
+};
+/**
+ * Static dispatch path of `Identity.whoami` — the layout-independent MethodPath
+ * (`/:kernel.astrale.ai:interface.Identity:whoami`). The one static syscall.
+ */
+export declare const WHOAMI_PATH: string;
+/**
+ * Format an `InstanceMethodPath` (`<base>::<slug>`) for a syscall dispatched at
+ * one identity node. `idOrPath` is already-raw; a leading `/` or `@` is used
+ * verbatim, a bare id gets the `@` prefix — never a double `@`.
+ */
+export declare function instanceTarget(idOrPath: string, slug: string): string;
+//# sourceMappingURL=addressing.d.ts.map

package/dist/auth/addressing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressing.d.ts","sourceRoot":"","sources":["../../src/auth/addressing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,uEAAuE;AACvE,eAAO,MAAM,eAAe;aAC1B,IAAI;aACJ,QAAQ;aACR,KAAK;aACL,KAAK;aACL,MAAM;aACN,MAAM;aACN,SAAS;aACT,OAAO;aACP,eAAe;aACf,gBAAgB;aAChB,eAAe;CACP,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAA0C,CAAA;AAEpE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrE"}

package/dist/auth/addressing.js

@@ -0,0 +1,36 @@
+/**
+ * Addressing for the auth surface — the one place a syscall address is formed.
+ * Method slugs and the static `whoami` path derive from `K.Identity.*`
+ * accessors, so a kernel schema rename breaks at compile time (the property
+ * access) instead of failing silently at dispatch.
+ */
+import { K } from '@astrale-os/kernel-core';
+/** AuthApi verb → the K-derived Identity method slug it dispatches. */
+export const IDENTITY_METHOD = {
+    mint: K.Identity.mintIdentityCredential.path.method.method,
+    delegate: K.Identity.mintDelegationCredential.path.method.method,
+    check: K.Identity.checkPerm.path.method.method,
+    grant: K.Identity.grantPerm.path.method.method,
+    revoke: K.Identity.revokePerm.path.method.method,
+    extend: K.Identity.extendIdentity.path.method.method,
+    constrain: K.Identity.constrainIdentity.path.method.method,
+    exclude: K.Identity.excludeIdentity.path.method.method,
+    removeExtension: K.Identity.removeExtension.path.method.method,
+    removeConstraint: K.Identity.removeConstraint.path.method.method,
+    removeExclusion: K.Identity.removeExclusion.path.method.method,
+};
+/**
+ * Static dispatch path of `Identity.whoami` — the layout-independent MethodPath
+ * (`/:kernel.astrale.ai:interface.Identity:whoami`). The one static syscall.
+ */
+export const WHOAMI_PATH = K.Identity.whoami.path.method.raw;
+/**
+ * Format an `InstanceMethodPath` (`<base>::<slug>`) for a syscall dispatched at
+ * one identity node. `idOrPath` is already-raw; a leading `/` or `@` is used
+ * verbatim, a bare id gets the `@` prefix — never a double `@`.
+ */
+export function instanceTarget(idOrPath, slug) {
+    const base = idOrPath.startsWith('/') || idOrPath.startsWith('@') ? idOrPath : `@${idOrPath}`;
+    return `${base}::${slug}`;
+}
+//# sourceMappingURL=addressing.js.map

package/dist/auth/addressing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressing.js","sourceRoot":"","sources":["../../src/auth/addressing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,yBAAyB,CAAA;AAE3C,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAC1D,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAChE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAC9C,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAC9C,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAChD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IACpD,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAC1D,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IACtD,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAC9D,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;IAChE,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;CACtD,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAA;AAEpE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAA;IAC7F,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,CAAA;AAC3B,CAAC"}

package/dist/auth/api.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The `AuthApi` surface and its one implementation, `createAuth` — the control
+ * plane of a bound session view, over the same {@link GraphCall} capability as
+ * `graph/`. Instance-dispatched verbs target the counterparty identity
+ * (`@<id>::<slug>`); `whoami` is the one static syscall. `createAuth` is thin:
+ * it wires the verb modules over one caller resolver.
+ */
+import type { CredentialInput, Node } from '@astrale-os/kernel-core';
+import type { GraphCall } from '../graph';
+import type { Composition } from './composition';
+import type { DelegateOpts, MintOpts } from './minting';
+import type { CheckInput, GrantInput, RevokeInput } from './permissions';
+/**
+ * Control-plane surface of a bound session view. All calls dispatch with the
+ * view's credential.
+ */
+export interface AuthApi {
+    /** The authenticated caller's identity node. Always a live syscall — never cached. */
+    whoami(): Promise<Node>;
+    /**
+     * The credential this view currently dispatches with — resolved fresh per
+     * call, so never cache the return.
+     */
+    credential(): CredentialInput;
+    /**
+     * Mint a single-layer identity credential for {@link MintOpts.subject}
+     * (default: the memoized principal). (syscall: mintIdentityCredential)
+     */
+    mint(opts?: MintOpts): Promise<string>;
+    /**
+     * Mint a two-layer delegation credential — always as self (no subject param).
+     * {@link DelegateOpts.delegation} defaults to `{ kind: 'identity', self: true }`.
+     * (syscall: mintDelegationCredential)
+     */
+    delegate(opts?: DelegateOpts): Promise<string>;
+    /**
+     * Does `who` (default: self) hold `perms` on `on` by its own STANDING grant
+     * edges — "does this identity hold X", not "would the current (maybe narrowed)
+     * token pass". Batch: array in → positionally-aligned `boolean[]`.
+     */
+    check(q: CheckInput): Promise<boolean>;
+    check(q: readonly CheckInput[]): Promise<boolean[]>;
+    /**
+     * Grant `perms` to `to` on `on` (and its subtree). ⚠ SETS the has_perm bits —
+     * does NOT OR; re-granting with fewer bits downgrades. Batch: set semantics,
+     * not a transaction — a failure throws `AuthBatchError` with per-entry outcomes.
+     */
+    grant(g: GrantInput): Promise<void>;
+    grant(g: readonly GrantInput[]): Promise<void>;
+    /** Remove `perms` from `from` on `on`. Batch semantics mirror {@link grant}. */
+    revoke(r: RevokeInput): Promise<void>;
+    revoke(r: readonly RevokeInput[]): Promise<void>;
+    /**
+     * Attach the described composition edges to `who` (default: self). Fields fan
+     * out; an empty record is a resolved no-op. On any entry failure throws
+     * `AuthBatchError` with per-entry outcomes.
+     */
+    bind(c: Composition): Promise<void>;
+    /** Detach the described composition edges — the exact mirror of {@link bind}. */
+    unbind(c: Composition): Promise<void>;
+}
+/**
+ * Bind the auth surface onto a call capability and a credential thunk. One caller
+ * resolver (whoami + principal memo) fans into the verb modules.
+ */
+export declare function createAuth(call: GraphCall, opts: {
+    credential: () => CredentialInput;
+}): AuthApi;
+//# sourceMappingURL=api.d.ts.map

package/dist/auth/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/auth/api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAOxE;;;GAGG;AACH,MAAM,WAAW,OAAO;IAEtB,sFAAsF;IACtF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAGvB;;;OAGG;IACH,UAAU,IAAI,eAAe,CAAA;IAC7B;;;OAGG;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAG9C;;;;OAIG;IACH,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtC,KAAK,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IACnD;;;;OAIG;IACH,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,KAAK,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,gFAAgF;IAChF,MAAM,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAGhD;;;;OAIG;IACH,IAAI,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,iFAAiF;IACjF,MAAM,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,eAAe,CAAA;CAAE,GAAG,OAAO,CAShG"}

package/dist/auth/api.js

@@ -0,0 +1,24 @@
+/**
+ * The `AuthApi` surface and its one implementation, `createAuth` — the control
+ * plane of a bound session view, over the same {@link GraphCall} capability as
+ * `graph/`. Instance-dispatched verbs target the counterparty identity
+ * (`@<id>::<slug>`); `whoami` is the one static syscall. `createAuth` is thin:
+ * it wires the verb modules over one caller resolver.
+ */
+import { createComposition } from './composition';
+import { createMinting } from './minting';
+import { createPermissions } from './permissions';
+import { createCaller } from './principal';
+/**
+ * Bind the auth surface onto a call capability and a credential thunk. One caller
+ * resolver (whoami + principal memo) fans into the verb modules.
+ */
+export function createAuth(call, opts) {
+    const caller = createCaller(call);
+    const { mint, delegate } = createMinting(call, caller);
+    const { check, grant, revoke } = createPermissions(call, caller);
+    const { bind, unbind } = createComposition(call, caller);
+    const credential = () => opts.credential();
+    return { whoami: caller.whoami, credential, mint, delegate, check, grant, revoke, bind, unbind };
+}
+//# sourceMappingURL=api.js.map

package/dist/auth/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/auth/api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA2D1C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,IAA2C;IACrF,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAChE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAExD,MAAM,UAAU,GAAG,GAAoB,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAA;IAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAClG,CAAC"}

package/dist/auth/batch.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Batch fan-out for the auth surface. Set semantics, not a transaction: entries
+ * dispatch in PARALLEL and partial application is possible, so a failure
+ * surfaces every entry's outcome through {@link AuthBatchError}.
+ */
+/** One unit of a fan-out: a summary of the entry plus the dispatch that runs it. */
+export interface BatchEntry<T> {
+    /** Caller-legible summary of this entry (goes into {@link AuthBatchOutcome.input}). */
+    readonly input: unknown;
+    run(): Promise<T>;
+}
+/**
+ * Run every entry in parallel; resolve to the results positionally aligned with
+ * `entries`, or throw {@link AuthBatchError} carrying all outcomes if any
+ * rejected. Zero entries ⇒ zero dispatches, resolves to `[]` (the no-op case).
+ */
+export declare function settleAll<T>(operation: string, entries: readonly BatchEntry<T>[]): Promise<T[]>;
+//# sourceMappingURL=batch.d.ts.map

package/dist/auth/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../src/auth/batch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,oFAAoF;AACpF,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAA;CAClB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,GAChC,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}

package/dist/auth/batch.js

@@ -0,0 +1,25 @@
+/**
+ * Batch fan-out for the auth surface. Set semantics, not a transaction: entries
+ * dispatch in PARALLEL and partial application is possible, so a failure
+ * surfaces every entry's outcome through {@link AuthBatchError}.
+ */
+import { AuthBatchError } from '../errors/errors';
+/**
+ * Run every entry in parallel; resolve to the results positionally aligned with
+ * `entries`, or throw {@link AuthBatchError} carrying all outcomes if any
+ * rejected. Zero entries ⇒ zero dispatches, resolves to `[]` (the no-op case).
+ */
+export async function settleAll(operation, entries) {
+    const settled = await Promise.allSettled(entries.map((e) => e.run()));
+    const outcomes = settled.map((result, index) => ({
+        index,
+        input: entries[index].input,
+        status: result.status,
+        ...(result.status === 'fulfilled' ? { value: result.value } : { error: result.reason }),
+    }));
+    if (outcomes.some((o) => o.status === 'rejected')) {
+        throw new AuthBatchError(operation, outcomes);
+    }
+    return settled.map((r) => r.value);
+}
+//# sourceMappingURL=batch.js.map

package/dist/auth/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/auth/batch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AASjD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAErE,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,KAAK;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;KACxF,CAAC,CAAC,CAAA;IAEH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA+B,CAAC,KAAK,CAAC,CAAA;AACnE,CAAC"}

package/dist/auth/composition.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Durable composition — `bind` / `unbind`, six syscalls behind two verbs over
+ * one described edge delta, plus the delta shape and its flattening.
+ */
+import type { GraphCall, Ref } from '../graph';
+import type { Caller } from './principal';
+/**
+ * A described composition delta — the flat edge set on one identity node. Field
+ * names are the edge classes (camelCased); each is optional, accepts one or many
+ * counterparties, and fans out. An empty record is a resolved no-op.
+ */
+export interface Composition {
+    /** The identity the edges hang off. Absent ⇒ the memoized principal. */
+    who?: Ref;
+    /** extends_with — `who` gains each counterparty's reach (union). */
+    extendsWith?: Ref | readonly Ref[];
+    /** constrained_by — `who` reaches only the overlap (intersect). */
+    constrainedBy?: Ref | readonly Ref[];
+    /** excluded_from — `who` loses each counterparty's reach (asymmetric). */
+    excludedFrom?: Ref | readonly Ref[];
+}
+/** Bind bind + unbind onto a call capability and the caller resolver. */
+export declare function createComposition(call: GraphCall, caller: Caller): {
+    bind(c: Composition): Promise<void>;
+    unbind(c: Composition): Promise<void>;
+};
+//# sourceMappingURL=composition.d.ts.map

package/dist/auth/composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../src/auth/composition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAE9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMzC;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,oEAAoE;IACpE,WAAW,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;IAClC,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;IACpC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;CACpC;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAwBhF"}

package/dist/auth/composition.js

@@ -0,0 +1,83 @@
+/**
+ * Durable composition — `bind` / `unbind`, six syscalls behind two verbs over
+ * one described edge delta, plus the delta shape and its flattening.
+ */
+import { refRaw } from '../graph/mutate';
+import { IDENTITY_METHOD, instanceTarget } from './addressing';
+import { settleAll } from './batch';
+/** Bind bind + unbind onto a call capability and the caller resolver. */
+export function createComposition(call, caller) {
+    const compose = async (c, kind) => {
+        const fields = compositionFields(c, kind);
+        // Empty / all-absent record: a resolved no-op — no whoami, no dispatch.
+        if (fields.length === 0)
+            return;
+        const whoRaw = c.who !== undefined ? refRaw(c.who) : await caller.principal();
+        const entries = fields.map(({ ref, slug, paramKey, edge }) => {
+            const counterparty = refRaw(ref);
+            const target = instanceTarget(whoRaw, slug);
+            return {
+                input: { who: whoRaw, edge, counterparty },
+                run: async () => {
+                    await call(target, { [paramKey]: counterparty });
+                },
+            };
+        });
+        await settleAll(kind, entries);
+    };
+    const bind = (c) => compose(c, 'bind');
+    const unbind = (c) => compose(c, 'unbind');
+    return { bind, unbind };
+}
+/** Flatten a {@link Composition} into per-(field × counterparty) dispatch specs. */
+function compositionFields(c, kind) {
+    const specs = kind === 'bind'
+        ? [
+            {
+                refs: c.extendsWith,
+                slug: IDENTITY_METHOD.extend,
+                paramKey: 'with',
+                edge: 'extendsWith',
+            },
+            {
+                refs: c.constrainedBy,
+                slug: IDENTITY_METHOD.constrain,
+                paramKey: 'by',
+                edge: 'constrainedBy',
+            },
+            {
+                refs: c.excludedFrom,
+                slug: IDENTITY_METHOD.exclude,
+                paramKey: 'without',
+                edge: 'excludedFrom',
+            },
+        ]
+        : [
+            {
+                refs: c.extendsWith,
+                slug: IDENTITY_METHOD.removeExtension,
+                paramKey: 'identity',
+                edge: 'extendsWith',
+            },
+            {
+                refs: c.constrainedBy,
+                slug: IDENTITY_METHOD.removeConstraint,
+                paramKey: 'identity',
+                edge: 'constrainedBy',
+            },
+            {
+                refs: c.excludedFrom,
+                slug: IDENTITY_METHOD.removeExclusion,
+                paramKey: 'identity',
+                edge: 'excludedFrom',
+            },
+        ];
+    return specs.flatMap(({ refs, slug, paramKey, edge }) => toRefArray(refs).map((ref) => ({ ref, slug, paramKey, edge })));
+}
+/** Normalize `Ref | readonly Ref[] | undefined` to an array (single Ref → `[ref]`). */
+function toRefArray(v) {
+    if (v === undefined)
+        return [];
+    return Array.isArray(v) ? v : [v];
+}
+//# sourceMappingURL=composition.js.map

package/dist/auth/composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.js","sourceRoot":"","sources":["../../src/auth/composition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAkBnC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,IAAe,EACf,MAAc;IAEd,MAAM,OAAO,GAAG,KAAK,EAAE,CAAc,EAAE,IAAuB,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACzC,wEAAwE;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QAC7E,MAAM,OAAO,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3C,OAAO;gBACL,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE;gBAC1C,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;gBAClD,CAAC;aACF,CAAA;QACH,CAAC,CAAC,CAAA;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,CAAc,EAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,CAAC,CAAc,EAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAYD,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,CAAc,EAAE,IAAuB;IAChE,MAAM,KAAK,GACT,IAAI,KAAK,MAAM;QACb,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,IAAI,EAAE,eAAe,CAAC,MAAM;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,aAAa;aACpB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,aAAa;gBACrB,IAAI,EAAE,eAAe,CAAC,SAAS;gBAC/B,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,eAAe;aACtB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,IAAI,EAAE,eAAe,CAAC,OAAO;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,cAAc;aACrB;SACF;QACH,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,IAAI,EAAE,eAAe,CAAC,eAAe;gBACrC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,aAAa;aACpB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,aAAa;gBACrB,IAAI,EAAE,eAAe,CAAC,gBAAgB;gBACtC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,eAAe;aACtB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,IAAI,EAAE,eAAe,CAAC,eAAe;gBACrC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,cAAc;aACrB;SACF,CAAA;IAEP,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACtD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,CAAmC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAoB,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAA;AAC9D,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The auth surface — control plane of a bound session view (`view.auth`), pure
+ * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
+ * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
+ * flow imports from one place.
+ */
+export { createAuth } from './api';
+export type { AuthApi } from './api';
+export type { Composition } from './composition';
+export type { DelegateOpts, MintOpts } from './minting';
+export type { CheckInput, GrantInput, Perms, RevokeInput } from './permissions';
+export { cred, self } from '@astrale-os/kernel-core/expression';
+export type { Expr } from '@astrale-os/kernel-core/expression';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAClC,YAAY,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA;AAC/D,YAAY,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,9 @@
+/**
+ * The auth surface — control plane of a bound session view (`view.auth`), pure
+ * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
+ * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
+ * flow imports from one place.
+ */
+export { createAuth } from './api';
+export { cred, self } from '@astrale-os/kernel-core/expression';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAMlC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA"}

package/dist/auth/minting.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Credential minting — `mint` (single-layer identity, for any subject) and
+ * `delegate` (two-layer delegation, always as self), plus their option shapes.
+ */
+import type { Expr, SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
+import type { GraphCall, Ref } from '../graph';
+import type { Caller } from './principal';
+/** Options for {@link AuthApi.mint}. */
+export interface MintOpts {
+    /**
+     * Identity to mint for. Absent ⇒ the memoized principal; pin it only to mint
+     * for a node you hold EDIT on.
+     */
+    subject?: Ref;
+}
+/** Options for {@link AuthApi.delegate} — mirrors `MintDelegationParams` one-for-one. */
+export interface DelegateOpts {
+    /** Intended `aud` of the minted credential. */
+    audience?: string;
+    /**
+     * Composed grant expression — a raw {@link UnresolvedIdentityExpr} or a builder
+     * (`self()`, `cred()`). Absent ⇒ `{ kind: 'identity', self: true }`.
+     */
+    delegation?: UnresolvedIdentityExpr | Expr<UnresolvedIdentityExpr>;
+    /** Self-asserted claims carried alongside the delegation. */
+    attestation?: SelfIdentityExpr;
+    /** Credential lifetime in seconds. */
+    ttl?: number;
+}
+/** Bind mint + delegate onto a call capability and the caller resolver. */
+export declare function createMinting(call: GraphCall, caller: Caller): {
+    mint(opts?: MintOpts): Promise<string>;
+    delegate(opts?: DelegateOpts): Promise<string>;
+};
+//# sourceMappingURL=minting.d.ts.map

package/dist/auth/minting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minting.d.ts","sourceRoot":"","sources":["../../src/auth/minting.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAI3C,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIzC,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,CAAA;CACd;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClE,6DAA6D;IAC7D,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAgBD,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,CAgBA"}

package/dist/auth/minting.js

@@ -0,0 +1,35 @@
+/**
+ * Credential minting — `mint` (single-layer identity, for any subject) and
+ * `delegate` (two-layer delegation, always as self), plus their option shapes.
+ */
+import { isExprBuilder } from '@astrale-os/kernel-core/expression';
+import { IDENTITY_METHOD, instanceTarget } from './addressing';
+/** Frozen — shared by reference into every default delegate call; mirrors DEFAULT_SELF_DELEGATION. */
+const DEFAULT_DELEGATION = Object.freeze({
+    kind: 'identity',
+    self: true,
+});
+/** Bind mint + delegate onto a call capability and the caller resolver. */
+export function createMinting(call, caller) {
+    const mint = async (mintOpts) => (await call(await caller.targetFor(mintOpts?.subject, IDENTITY_METHOD.mint), {}));
+    const delegate = async (delegateOpts) => {
+        const target = instanceTarget(await caller.principal(), IDENTITY_METHOD.delegate);
+        const params = {
+            delegation: resolveDelegation(delegateOpts?.delegation),
+            ...(delegateOpts?.audience !== undefined ? { audience: delegateOpts.audience } : {}),
+            ...(delegateOpts?.attestation !== undefined ? { attestation: delegateOpts.attestation } : {}),
+            ...(delegateOpts?.ttl !== undefined ? { ttl: delegateOpts.ttl } : {}),
+        };
+        return (await call(target, params));
+    };
+    return { mint, delegate };
+}
+/** Resolve the `delegation` input to a raw tree — builder → `.build()`, raw as-is. */
+function resolveDelegation(input) {
+    if (input === undefined)
+        return DEFAULT_DELEGATION;
+    if (isExprBuilder(input))
+        return input.build();
+    return input;
+}
+//# sourceMappingURL=minting.js.map

package/dist/auth/minting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minting.js","sourceRoot":"","sources":["../../src/auth/minting.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AAKlE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AA0B9D,sGAAsG;AACtG,MAAM,kBAAkB,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC/D,IAAI,EAAE,UAAmB;IACzB,IAAI,EAAE,IAAa;CACpB,CAAC,CAAA;AAUF,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,IAAe,EACf,MAAc;IAKd,MAAM,IAAI,GAAG,KAAK,EAAE,QAAmB,EAAmB,EAAE,CAC1D,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAW,CAAA;IAE7F,MAAM,QAAQ,GAAG,KAAK,EAAE,YAA2B,EAAmB,EAAE;QACtE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;QACjF,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC;YACvD,GAAG,CAAC,YAAY,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,YAAY,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAA;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAA;IAC/C,CAAC,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC3B,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAA;IAClD,IAAI,aAAa,CAAyB,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAA;IACtE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/permissions.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Permission verbs — `check` / `grant` / `revoke`, each single-or-batch over one
+ * dispatch per entry on the counterparty identity, plus their input shapes.
+ */
+import type { PermissionMask } from '@astrale-os/kernel-core/permissions';
+import type { GraphCall, Ref } from '../graph';
+import type { Caller } from './principal';
+/** A permission bitmask (combined flags) — not the single-bit branded `Permission`. */
+export type Perms = PermissionMask;
+/**
+ * Does `who` (default: self) hold `perms` on `on`, by its own grant edges? See
+ * {@link AuthApi.check} for the standing-grants-not-current-token caveat.
+ */
+export interface CheckInput {
+    /** Identity to interrogate. Absent ⇒ the memoized principal. */
+    who?: Ref;
+    on: Ref;
+    /** Permission bits required — all must be held. */
+    perms: Perms;
+}
+/** Grant `perms` to `to` on `on` (and its subtree). ⚠ SETS the bits — see {@link AuthApi.grant}. */
+export interface GrantInput {
+    to: Ref;
+    /** Node the grant covers (and its subtree). */
+    on: Ref;
+    perms: Perms;
+}
+/** Remove `perms` from `from` on `on`. */
+export interface RevokeInput {
+    from: Ref;
+    on: Ref;
+    perms: Perms;
+}
+/** {@link AuthApi.check} as a callable — single in → boolean, array in → aligned boolean[]. */
+export interface CheckFn {
+    (q: CheckInput): Promise<boolean>;
+    (q: readonly CheckInput[]): Promise<boolean[]>;
+}
+/** {@link AuthApi.grant} as a callable — single or batch (set semantics, not a transaction). */
+export interface GrantFn {
+    (g: GrantInput): Promise<void>;
+    (g: readonly GrantInput[]): Promise<void>;
+}
+/** {@link AuthApi.revoke} as a callable — the exact mirror of {@link GrantFn}. */
+export interface RevokeFn {
+    (r: RevokeInput): Promise<void>;
+    (r: readonly RevokeInput[]): Promise<void>;
+}
+/** Bind check/grant/revoke onto a call capability and the caller resolver. */
+export declare function createPermissions(call: GraphCall, caller: Caller): {
+    check: CheckFn;
+    grant: GrantFn;
+    revoke: RevokeFn;
+};
+//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMzC,uFAAuF;AACvF,MAAM,MAAM,KAAK,GAAG,cAAc,CAAA;AAElC;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,EAAE,EAAE,GAAG,CAAA;IACP,mDAAmD;IACnD,KAAK,EAAE,KAAK,CAAA;CACb;AAED,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,GAAG,CAAA;IACP,+CAA+C;IAC/C,EAAE,EAAE,GAAG,CAAA;IACP,KAAK,EAAE,KAAK,CAAA;CACb;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,GAAG,CAAA;IACT,EAAE,EAAE,GAAG,CAAA;IACP,KAAK,EAAE,KAAK,CAAA;CACb;AAED,+FAA+F;AAC/F,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;CAC/C;AAED,gGAAgG;AAChG,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,kFAAkF;AAClF,MAAM,WAAW,QAAQ;IACvB,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CA2BtD"}

package/dist/auth/permissions.js

@@ -0,0 +1,47 @@
+/**
+ * Permission verbs — `check` / `grant` / `revoke`, each single-or-batch over one
+ * dispatch per entry on the counterparty identity, plus their input shapes.
+ */
+import { refRaw } from '../graph/mutate';
+import { IDENTITY_METHOD } from './addressing';
+import { settleAll } from './batch';
+/** Bind check/grant/revoke onto a call capability and the caller resolver. */
+export function createPermissions(call, caller) {
+    // One dispatch per entry on the counterparty identity.
+    const checkOne = async (q) => (await call(await caller.targetFor(q.who, IDENTITY_METHOD.check), {
+        node: refRaw(q.on),
+        perms: q.perms,
+    }));
+    const grantOne = async (g) => {
+        await call(await caller.targetFor(g.to, IDENTITY_METHOD.grant), {
+            node: refRaw(g.on),
+            perms: g.perms,
+        });
+    };
+    const revokeOne = async (r) => {
+        await call(await caller.targetFor(r.from, IDENTITY_METHOD.revoke), {
+            node: refRaw(r.on),
+            perms: r.perms,
+        });
+    };
+    const check = oneOrMany('check', checkOne);
+    const grant = oneOrMany('grant', grantOne);
+    const revoke = oneOrMany('revoke', revokeOne);
+    return { check, grant, revoke };
+}
+/**
+ * Fold a single-entry runner into a one-or-many verb: one entry runs directly,
+ * an array fans out through `settleAll`. The call site casts back to the
+ * verb's overloaded public shape.
+ */
+function oneOrMany(op, runOne) {
+    return (arg) => {
+        // `Array.isArray` can't narrow a `readonly T[]` out of a union (readonly →
+        // mutable is unsound), so the array branch is cast to its concrete shape.
+        if (Array.isArray(arg)) {
+            return settleAll(op, arg.map((entry) => ({ input: entry, run: () => runOne(entry) })));
+        }
+        return runOne(arg);
+    };
+}
+//# sourceMappingURL=permissions.js.map

package/dist/auth/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAkDnC,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAC/B,IAAe,EACf,MAAc;IAEd,uDAAuD;IACvD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAa,EAAoB,EAAE,CACzD,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAY,CAAA;IAEhB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAa,EAAiB,EAAE;QACtD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,KAAK,EAAE,CAAc,EAAiB,EAAE;QACxD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE;YACjE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAY,CAAA;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAY,CAAA;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAa,CAAA;IAEzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,EAAU,EACV,MAAgC;IAEhC,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CACd,EAAE,EACD,GAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CACnF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,GAAQ,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC"}

package/dist/auth/principal.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Caller resolution for the auth surface — the live `whoami` verb, the memoized
+ * principal id (one per bound view), and ref→dispatch-address resolution over
+ * the shared {@link GraphCall} capability.
+ */
+import type { Node } from '@astrale-os/kernel-core';
+import type { GraphCall, Ref } from '../graph';
+/** The resolved caller behind a bound view: identity resolution + verb addressing. */
+export interface Caller {
+    /** The authenticated caller's identity node. Always a live syscall — never cached. */
+    whoami(): Promise<Node>;
+    /** Memoized principal id — concurrent first callers dedup to ONE whoami; cleared on reject. */
+    principal(): Promise<string>;
+    /** Explicit `Ref` targets it directly (no whoami); else the memoized principal. */
+    targetFor(ref: Ref | undefined, slug: string): Promise<string>;
+}
+/** Bind the caller resolver onto a call capability — one principal memo per view. */
+export declare function createCaller(call: GraphCall): Caller;
+//# sourceMappingURL=principal.d.ts.map

package/dist/auth/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAInD,OAAO,KAAK,EAAE,SAAS,EAAY,GAAG,EAAE,MAAM,UAAU,CAAA;AA0BxD,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB,sFAAsF;IACtF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,+FAA+F;IAC/F,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,mFAAmF;IACnF,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/D;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CA0BpD"}