@astrale-os/kernel-client 0.5.1 → 0.6.0-beta.1

package/dist/auth/batch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/auth/batch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AASpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAErE,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,KAAK;QAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;KACxF,CAAC,CAAC,CAAA;IAEH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA+B,CAAC,KAAK,CAAC,CAAA;AACnE,CAAC"}

package/dist/auth/composition.d.ts

@@ -1,27 +0,0 @@
-/**
- * Durable composition — `bind` / `unbind`, six syscalls behind two verbs over
- * one described edge delta, plus the delta shape and its flattening.
- */
-import type { GraphCall, Ref } from '../graph/index.js';
-import type { Caller } from './principal.js';
-/**
- * A described composition delta — the flat edge set on one identity node. Field
- * names are the edge classes (camelCased); each is optional, accepts one or many
- * counterparties, and fans out. An empty record is a resolved no-op.
- */
-export interface Composition {
-    /** The identity the edges hang off. Absent ⇒ the memoized principal. */
-    who?: Ref;
-    /** extends_with — `who` gains each counterparty's reach (union). */
-    extendsWith?: Ref | readonly Ref[];
-    /** constrained_by — `who` reaches only the overlap (intersect). */
-    constrainedBy?: Ref | readonly Ref[];
-    /** excluded_from — `who` loses each counterparty's reach (asymmetric). */
-    excludedFrom?: Ref | readonly Ref[];
-}
-/** Bind bind + unbind onto a call capability and the caller resolver. */
-export declare function createComposition(call: GraphCall, caller: Caller): {
-    bind(c: Composition): Promise<void>;
-    unbind(c: Composition): Promise<void>;
-};
-//# sourceMappingURL=composition.d.ts.map

package/dist/auth/composition.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../../src/auth/composition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAM5C;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,oEAAoE;IACpE,WAAW,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;IAClC,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;IACpC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,GAAG,GAAG,SAAS,GAAG,EAAE,CAAA;CACpC;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAwBhF"}

package/dist/auth/composition.js

@@ -1,83 +0,0 @@
-/**
- * Durable composition — `bind` / `unbind`, six syscalls behind two verbs over
- * one described edge delta, plus the delta shape and its flattening.
- */
-import { refRaw } from '../graph/mutate/index.js';
-import { IDENTITY_METHOD, instanceTarget } from './addressing.js';
-import { settleAll } from './batch.js';
-/** Bind bind + unbind onto a call capability and the caller resolver. */
-export function createComposition(call, caller) {
-    const compose = async (c, kind) => {
-        const fields = compositionFields(c, kind);
-        // Empty / all-absent record: a resolved no-op — no whoami, no dispatch.
-        if (fields.length === 0)
-            return;
-        const whoRaw = c.who !== undefined ? refRaw(c.who) : await caller.principal();
-        const entries = fields.map(({ ref, slug, paramKey, edge }) => {
-            const counterparty = refRaw(ref);
-            const target = instanceTarget(whoRaw, slug);
-            return {
-                input: { who: whoRaw, edge, counterparty },
-                run: async () => {
-                    await call(target, { [paramKey]: counterparty });
-                },
-            };
-        });
-        await settleAll(kind, entries);
-    };
-    const bind = (c) => compose(c, 'bind');
-    const unbind = (c) => compose(c, 'unbind');
-    return { bind, unbind };
-}
-/** Flatten a {@link Composition} into per-(field × counterparty) dispatch specs. */
-function compositionFields(c, kind) {
-    const specs = kind === 'bind'
-        ? [
-            {
-                refs: c.extendsWith,
-                slug: IDENTITY_METHOD.extend,
-                paramKey: 'with',
-                edge: 'extendsWith',
-            },
-            {
-                refs: c.constrainedBy,
-                slug: IDENTITY_METHOD.constrain,
-                paramKey: 'by',
-                edge: 'constrainedBy',
-            },
-            {
-                refs: c.excludedFrom,
-                slug: IDENTITY_METHOD.exclude,
-                paramKey: 'without',
-                edge: 'excludedFrom',
-            },
-        ]
-        : [
-            {
-                refs: c.extendsWith,
-                slug: IDENTITY_METHOD.removeExtension,
-                paramKey: 'identity',
-                edge: 'extendsWith',
-            },
-            {
-                refs: c.constrainedBy,
-                slug: IDENTITY_METHOD.removeConstraint,
-                paramKey: 'identity',
-                edge: 'constrainedBy',
-            },
-            {
-                refs: c.excludedFrom,
-                slug: IDENTITY_METHOD.removeExclusion,
-                paramKey: 'identity',
-                edge: 'excludedFrom',
-            },
-        ];
-    return specs.flatMap(({ refs, slug, paramKey, edge }) => toRefArray(refs).map((ref) => ({ ref, slug, paramKey, edge })));
-}
-/** Normalize `Ref | readonly Ref[] | undefined` to an array (single Ref → `[ref]`). */
-function toRefArray(v) {
-    if (v === undefined)
-        return [];
-    return Array.isArray(v) ? v : [v];
-}
-//# sourceMappingURL=composition.js.map

package/dist/auth/composition.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"composition.js","sourceRoot":"","sources":["../../src/auth/composition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAkBtC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,IAAe,EACf,MAAc;IAEd,MAAM,OAAO,GAAG,KAAK,EAAE,CAAc,EAAE,IAAuB,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACzC,wEAAwE;QACxE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QAC7E,MAAM,OAAO,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3C,OAAO;gBACL,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE;gBAC1C,GAAG,EAAE,KAAK,IAAI,EAAE;oBACd,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;gBAClD,CAAC;aACF,CAAA;QACH,CAAC,CAAC,CAAA;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,CAAc,EAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,CAAC,CAAc,EAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAYD,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,CAAc,EAAE,IAAuB;IAChE,MAAM,KAAK,GACT,IAAI,KAAK,MAAM;QACb,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,IAAI,EAAE,eAAe,CAAC,MAAM;gBAC5B,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,aAAa;aACpB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,aAAa;gBACrB,IAAI,EAAE,eAAe,CAAC,SAAS;gBAC/B,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,eAAe;aACtB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,IAAI,EAAE,eAAe,CAAC,OAAO;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,cAAc;aACrB;SACF;QACH,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,CAAC,CAAC,WAAW;gBACnB,IAAI,EAAE,eAAe,CAAC,eAAe;gBACrC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,aAAa;aACpB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,aAAa;gBACrB,IAAI,EAAE,eAAe,CAAC,gBAAgB;gBACtC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,eAAe;aACtB;YACD;gBACE,IAAI,EAAE,CAAC,CAAC,YAAY;gBACpB,IAAI,EAAE,eAAe,CAAC,eAAe;gBACrC,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,cAAc;aACrB;SACF,CAAA;IAEP,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACtD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,CAAmC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAoB,CAAC,CAAC,CAAC,CAAC,CAAQ,CAAC,CAAA;AAC9D,CAAC"}

package/dist/auth/defaults.d.ts

@@ -1,3 +0,0 @@
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
-export declare const SELF_DELEGATION: UnresolvedIdentityExpr;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/auth/defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/auth/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAIhF,eAAO,MAAM,eAAe,EAAE,sBAEH,CAAA"}

package/dist/auth/defaults.js

@@ -1,3 +0,0 @@
-import { unresolvedSelf } from '@astrale-os/kernel-core';
-export const SELF_DELEGATION = Object.freeze(unresolvedSelf());
-//# sourceMappingURL=defaults.js.map

package/dist/auth/defaults.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/auth/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,MAAM,CAAC,MAAM,eAAe,GAA2B,MAAM,CAAC,MAAM,CAClE,cAAc,EAAE,CACS,CAAA"}

package/dist/auth/minting.d.ts

@@ -1,35 +0,0 @@
-/**
- * Credential minting — `mint` (single-layer identity, for any subject) and
- * `delegate` (two-layer delegation, always as self), plus their option shapes.
- */
-import type { Expr, SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
-import type { GraphCall, Ref } from '../graph/index.js';
-import type { Caller } from './principal.js';
-/** Options for {@link AuthApi.mint}. */
-export interface MintOpts {
-    /**
-     * Identity to mint for. Absent ⇒ the memoized principal; pin it only to mint
-     * for a node you hold EDIT on.
-     */
-    subject?: Ref;
-}
-/** Options for {@link AuthApi.delegate} — mirrors `MintDelegationParams` one-for-one. */
-export interface DelegateOpts {
-    /** Intended `aud` of the minted credential. */
-    audience?: string;
-    /**
-     * Composed grant expression — a raw {@link UnresolvedIdentityExpr} or a builder
-     * (`self()`, `cred()`). Absent ⇒ `{ kind: 'identity', self: true }`.
-     */
-    delegation?: UnresolvedIdentityExpr | Expr<UnresolvedIdentityExpr>;
-    /** Self-asserted claims carried alongside the delegation. */
-    attestation?: SelfIdentityExpr;
-    /** Credential lifetime in seconds. */
-    ttl?: number;
-}
-/** Bind mint + delegate onto a call capability and the caller resolver. */
-export declare function createMinting(call: GraphCall, caller: Caller): {
-    mint(opts?: MintOpts): Promise<string>;
-    delegate(opts?: DelegateOpts): Promise<string>;
-};
-//# sourceMappingURL=minting.d.ts.map

package/dist/auth/minting.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"minting.d.ts","sourceRoot":"","sources":["../../src/auth/minting.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAI3C,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAK5C,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,CAAA;CACd;AAED,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClE,6DAA6D;IAC7D,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAUD,2EAA2E;AAC3E,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,CAgBA"}

package/dist/auth/minting.js

@@ -1,31 +0,0 @@
-/**
- * Credential minting — `mint` (single-layer identity, for any subject) and
- * `delegate` (two-layer delegation, always as self), plus their option shapes.
- */
-import { isExprBuilder } from '@astrale-os/kernel-core/expression';
-import { IDENTITY_METHOD, instanceTarget } from './addressing.js';
-import { SELF_DELEGATION } from './defaults.js';
-/** Bind mint + delegate onto a call capability and the caller resolver. */
-export function createMinting(call, caller) {
-    const mint = async (mintOpts) => (await call(await caller.targetFor(mintOpts?.subject, IDENTITY_METHOD.mint), {}));
-    const delegate = async (delegateOpts) => {
-        const target = instanceTarget(await caller.principal(), IDENTITY_METHOD.delegate);
-        const params = {
-            delegation: resolveDelegation(delegateOpts?.delegation),
-            ...(delegateOpts?.audience !== undefined ? { audience: delegateOpts.audience } : {}),
-            ...(delegateOpts?.attestation !== undefined ? { attestation: delegateOpts.attestation } : {}),
-            ...(delegateOpts?.ttl !== undefined ? { ttl: delegateOpts.ttl } : {}),
-        };
-        return (await call(target, params));
-    };
-    return { mint, delegate };
-}
-/** Resolve the `delegation` input to a raw tree — builder → `.build()`, raw as-is. */
-function resolveDelegation(input) {
-    if (input === undefined)
-        return SELF_DELEGATION;
-    if (isExprBuilder(input))
-        return input.build();
-    return input;
-}
-//# sourceMappingURL=minting.js.map

package/dist/auth/minting.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"minting.js","sourceRoot":"","sources":["../../src/auth/minting.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AAKlE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAkC/C,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,IAAe,EACf,MAAc;IAKd,MAAM,IAAI,GAAG,KAAK,EAAE,QAAmB,EAAmB,EAAE,CAC1D,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAW,CAAA;IAE7F,MAAM,QAAQ,GAAG,KAAK,EAAE,YAA2B,EAAmB,EAAE;QACtE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;QACjF,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC;YACvD,GAAG,CAAC,YAAY,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,YAAY,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAA;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAW,CAAA;IAC/C,CAAC,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC3B,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,KAAiC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,eAAe,CAAA;IAC/C,IAAI,aAAa,CAAyB,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAA;IACtE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/permissions.d.ts

@@ -1,55 +0,0 @@
-/**
- * Permission verbs — `check` / `grant` / `revoke`, each single-or-batch over one
- * dispatch per entry on the counterparty identity, plus their input shapes.
- */
-import type { PermissionMask } from '@astrale-os/kernel-core/permissions';
-import type { GraphCall, Ref } from '../graph/index.js';
-import type { Caller } from './principal.js';
-/** A permission bitmask (combined flags) — not the single-bit branded `Permission`. */
-export type Perms = PermissionMask;
-/**
- * Does `who` (default: self) hold `perms` on `on`, by its own grant edges? See
- * {@link AuthApi.check} for the standing-grants-not-current-token caveat.
- */
-export interface CheckInput {
-    /** Identity to interrogate. Absent ⇒ the memoized principal. */
-    who?: Ref;
-    on: Ref;
-    /** Permission bits required — all must be held. */
-    perms: Perms;
-}
-/** Grant `perms` to `to` on `on` (and its subtree). ⚠ SETS the bits — see {@link AuthApi.grant}. */
-export interface GrantInput {
-    to: Ref;
-    /** Node the grant covers (and its subtree). */
-    on: Ref;
-    perms: Perms;
-}
-/** Remove `perms` from `from` on `on`. */
-export interface RevokeInput {
-    from: Ref;
-    on: Ref;
-    perms: Perms;
-}
-/** {@link AuthApi.check} as a callable — single in → boolean, array in → aligned boolean[]. */
-export interface CheckFn {
-    (q: CheckInput): Promise<boolean>;
-    (q: readonly CheckInput[]): Promise<boolean[]>;
-}
-/** {@link AuthApi.grant} as a callable — single or batch (set semantics, not a transaction). */
-export interface GrantFn {
-    (g: GrantInput): Promise<void>;
-    (g: readonly GrantInput[]): Promise<void>;
-}
-/** {@link AuthApi.revoke} as a callable — the exact mirror of {@link GrantFn}. */
-export interface RevokeFn {
-    (r: RevokeInput): Promise<void>;
-    (r: readonly RevokeInput[]): Promise<void>;
-}
-/** Bind check/grant/revoke onto a call capability and the caller resolver. */
-export declare function createPermissions(call: GraphCall, caller: Caller): {
-    check: CheckFn;
-    grant: GrantFn;
-    revoke: RevokeFn;
-};
-//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAM5C,uFAAuF;AACvF,MAAM,MAAM,KAAK,GAAG,cAAc,CAAA;AAElC;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,EAAE,EAAE,GAAG,CAAA;IACP,mDAAmD;IACnD,KAAK,EAAE,KAAK,CAAA;CACb;AAED,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,GAAG,CAAA;IACP,+CAA+C;IAC/C,EAAE,EAAE,GAAG,CAAA;IACP,KAAK,EAAE,KAAK,CAAA;CACb;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,GAAG,CAAA;IACT,EAAE,EAAE,GAAG,CAAA;IACP,KAAK,EAAE,KAAK,CAAA;CACb;AAED,+FAA+F;AAC/F,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;CAC/C;AAED,gGAAgG;AAChG,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC,CAAC,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,kFAAkF;AAClF,MAAM,WAAW,QAAQ;IACvB,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CA2BtD"}

package/dist/auth/permissions.js

@@ -1,47 +0,0 @@
-/**
- * Permission verbs — `check` / `grant` / `revoke`, each single-or-batch over one
- * dispatch per entry on the counterparty identity, plus their input shapes.
- */
-import { refRaw } from '../graph/mutate/index.js';
-import { IDENTITY_METHOD } from './addressing.js';
-import { settleAll } from './batch.js';
-/** Bind check/grant/revoke onto a call capability and the caller resolver. */
-export function createPermissions(call, caller) {
-    // One dispatch per entry on the counterparty identity.
-    const checkOne = async (q) => (await call(await caller.targetFor(q.who, IDENTITY_METHOD.check), {
-        node: refRaw(q.on),
-        perms: q.perms,
-    }));
-    const grantOne = async (g) => {
-        await call(await caller.targetFor(g.to, IDENTITY_METHOD.grant), {
-            node: refRaw(g.on),
-            perms: g.perms,
-        });
-    };
-    const revokeOne = async (r) => {
-        await call(await caller.targetFor(r.from, IDENTITY_METHOD.revoke), {
-            node: refRaw(r.on),
-            perms: r.perms,
-        });
-    };
-    const check = oneOrMany('check', checkOne);
-    const grant = oneOrMany('grant', grantOne);
-    const revoke = oneOrMany('revoke', revokeOne);
-    return { check, grant, revoke };
-}
-/**
- * Fold a single-entry runner into a one-or-many verb: one entry runs directly,
- * an array fans out through `settleAll`. The call site casts back to the
- * verb's overloaded public shape.
- */
-function oneOrMany(op, runOne) {
-    return (arg) => {
-        // `Array.isArray` can't narrow a `readonly T[]` out of a union (readonly →
-        // mutable is unsound), so the array branch is cast to its concrete shape.
-        if (Array.isArray(arg)) {
-            return settleAll(op, arg.map((entry) => ({ input: entry, run: () => runOne(entry) })));
-        }
-        return runOne(arg);
-    };
-}
-//# sourceMappingURL=permissions.js.map

package/dist/auth/permissions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAkDtC,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAC/B,IAAe,EACf,MAAc;IAEd,uDAAuD;IACvD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAa,EAAoB,EAAE,CACzD,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAY,CAAA;IAEhB,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAa,EAAiB,EAAE;QACtD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE;YAC9D,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,KAAK,EAAE,CAAc,EAAiB,EAAE;QACxD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE;YACjE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAY,CAAA;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAY,CAAA;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAa,CAAA;IAEzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,EAAU,EACV,MAAgC;IAEhC,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CACd,EAAE,EACD,GAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CACnF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,GAAQ,CAAC,CAAA;IACzB,CAAC,CAAA;AACH,CAAC"}

package/dist/auth/principal.d.ts

@@ -1,19 +0,0 @@
-/**
- * Caller resolution for the auth surface — the live `whoami` verb, the memoized
- * principal id (one per bound view), and ref→dispatch-address resolution over
- * the shared {@link GraphCall} capability.
- */
-import type { Node } from '@astrale-os/kernel-core';
-import type { GraphCall, Ref } from '../graph/index.js';
-/** The resolved caller behind a bound view: identity resolution + verb addressing. */
-export interface Caller {
-    /** The authenticated caller's identity node. Always a live syscall — never cached. */
-    whoami(): Promise<Node>;
-    /** Memoized principal id — concurrent first callers dedup to ONE whoami; cleared on reject. */
-    principal(): Promise<string>;
-    /** Explicit `Ref` targets it directly (no whoami); else the memoized principal. */
-    targetFor(ref: Ref | undefined, slug: string): Promise<string>;
-}
-/** Bind the caller resolver onto a call capability — one principal memo per view. */
-export declare function createCaller(call: GraphCall): Caller;
-//# sourceMappingURL=principal.d.ts.map

package/dist/auth/principal.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAInD,OAAO,KAAK,EAAE,SAAS,EAAY,GAAG,EAAE,MAAM,mBAAmB,CAAA;AA0BjE,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB,sFAAsF;IACtF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,+FAA+F;IAC/F,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5B,mFAAmF;IACnF,SAAS,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/D;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CA0BpD"}

package/dist/auth/principal.js

@@ -1,46 +0,0 @@
-/**
- * Caller resolution for the auth surface — the live `whoami` verb, the memoized
- * principal id (one per bound view), and ref→dispatch-address resolution over
- * the shared {@link GraphCall} capability.
- */
-import { Graph } from '@astrale-os/kernel-core';
-import { refRaw } from '../graph/mutate/index.js';
-import { instanceTarget, WHOAMI_PATH } from './addressing.js';
-/** Assert the whoami dispatch produced a node record; throw loud otherwise. */
-function asWhoamiWire(raw) {
-    if (raw === null || typeof raw !== 'object' || typeof raw.id !== 'string') {
-        throw new Error('Identity.whoami returned an unexpected shape — expected a node record');
-    }
-    return raw;
-}
-/** Hydrate the single-node whoami wire record into kernel-core's Node value. */
-function adaptWhoami(node) {
-    const graph = Graph.fromWire({ nodes: [node], edges: [] });
-    const found = graph.nodes.byId(node.id);
-    if (found === undefined) {
-        throw new Error('Identity.whoami returned a node that could not be hydrated');
-    }
-    return found;
-}
-/** Bind the caller resolver onto a call capability — one principal memo per view. */
-export function createCaller(call) {
-    // Principal memo — id only, a PROMISE so concurrent first callers dedup to ONE
-    // whoami dispatch. Separate from the public `whoami()`, which is never cached.
-    let principalMemo;
-    const rawWhoami = async () => asWhoamiWire(await call(WHOAMI_PATH, {}));
-    const principal = () => {
-        if (principalMemo === undefined) {
-            principalMemo = rawWhoami().then((node) => node.id, (error) => {
-                principalMemo = undefined; // clear on rejection so the next call retries
-                throw error;
-            });
-        }
-        return principalMemo;
-    };
-    return {
-        whoami: async () => adaptWhoami(await rawWhoami()),
-        principal,
-        targetFor: async (ref, slug) => instanceTarget(ref !== undefined ? refRaw(ref) : await principal(), slug),
-    };
-}
-//# sourceMappingURL=principal.js.map

package/dist/auth/principal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/auth/principal.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAI/C,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAK7D,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAwB,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,GAAiB,CAAA;AAC1B,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAYD,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,+EAA+E;IAC/E,+EAA+E;IAC/E,IAAI,aAA0C,CAAA;IAE9C,MAAM,SAAS,GAAG,KAAK,IAAyB,EAAE,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;IAE5F,MAAM,SAAS,GAAG,GAAoB,EAAE;QACtC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,SAAS,EAAE,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EACjB,CAAC,KAAc,EAAE,EAAE;gBACjB,aAAa,GAAG,SAAS,CAAA,CAAC,8CAA8C;gBACxE,MAAM,KAAK,CAAA;YACb,CAAC,CACF,CAAA;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAA;IAED,OAAO;QACL,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC;QAClD,SAAS;QACT,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7B,cAAc,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,EAAE,IAAI,CAAC;KAC5E,CAAA;AACH,CAAC"}

package/dist/auth/shorthands.d.ts

@@ -1,19 +0,0 @@
-import type { CheckFn, CheckInput } from './permissions.js';
-/** Assert `check(input) === true`; false becomes a typed `PermissionDeniedError`. */
-export interface RequireInput extends CheckInput {
-    /** Optional operation label prepended to the thrown error message. */
-    context?: string;
-}
-/** Convenience helpers layered over the auth verbs. */
-export interface AuthShorthands {
-    /**
-     * Assert the same permission requirement as `check`. Single false result
-     * throws `PermissionDeniedError`; batch failures throw `AuthBatchError` with
-     * per-entry outcomes.
-     */
-    require(q: RequireInput): Promise<void>;
-    require(q: readonly RequireInput[]): Promise<void>;
-}
-/** Build auth shorthands over the public check callable. */
-export declare function makeAuthShorthands(check: CheckFn): AuthShorthands;
-//# sourceMappingURL=shorthands.d.ts.map

package/dist/auth/shorthands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"shorthands.d.ts","sourceRoot":"","sources":["../../src/auth/shorthands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAM3D,qFAAqF;AACrF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO,CAAC,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnD;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAmBjE"}

package/dist/auth/shorthands.js

@@ -1,27 +0,0 @@
-import { describePerms } from '@astrale-os/kernel-core/permissions';
-import { PermissionDeniedError } from '../errors/errors.js';
-import { refRaw } from '../graph/mutate/index.js';
-import { settleAll } from './batch.js';
-/** Build auth shorthands over the public check callable. */
-export function makeAuthShorthands(check) {
-    async function requireOne(q) {
-        if (!(await check(q)))
-            throw permissionDenied(q);
-    }
-    const require = ((arg) => {
-        if (Array.isArray(arg)) {
-            return settleAll('require', arg.map((entry) => ({
-                input: entry,
-                run: () => requireOne(entry),
-            }))).then(() => undefined);
-        }
-        return requireOne(arg);
-    });
-    return { require };
-}
-function permissionDenied(q) {
-    const who = q.who === undefined ? 'self' : refRaw(q.who);
-    const message = `permission denied (who=${who}, on=${refRaw(q.on)}, perms=${describePerms(q.perms)})`;
-    return new PermissionDeniedError(q.context === undefined ? message : `${q.context}: ${message}`);
-}
-//# sourceMappingURL=shorthands.js.map

package/dist/auth/shorthands.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shorthands.js","sourceRoot":"","sources":["../../src/auth/shorthands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAInE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAmBtC,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,KAAK,UAAU,UAAU,CAAC,CAAe;QACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAA2C,EAAE,EAAE;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CACd,SAAS,EACR,GAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/C,KAAK,EAAE,KAAK;gBACZ,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;aAC7B,CAAC,CAAC,CACJ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QACD,OAAO,UAAU,CAAC,GAAmB,CAAC,CAAA;IACxC,CAAC,CAA8B,CAAA;IAE/B,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAe;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,0BAA0B,GAAG,QAAQ,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;IACrG,OAAO,IAAI,qBAAqB,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC,CAAA;AAClG,CAAC"}

package/dist/client/batch.d.ts

@@ -1,26 +0,0 @@
-/**
- * Type-level helpers for the kernel envelope HTTP batch endpoint.
- *
- * Batches are envelope-only — the routed transport has no batching and
- * throws `UnsupportedTransportError`.
- */
-import type { CallFns, FnMap, SendResult } from './fn-map.js';
-/** A batch request entry constrained to known call functions in M. */
-export type TypedBatchRequest<M extends FnMap, K extends CallFns<M> = CallFns<M>> = {
-    [Path in K]: {
-        method: Path;
-        params: M[Path]['params'];
-    };
-}[K];
-/**
- * Map a tuple of batch requests to a tuple of per-item results. Each
- * entry is either a discriminated `SendResult<M[K]['result']>` (which
- * may be a value or a redirect) or a thrown `Error` — never a mix
- * inside a single position.
- */
-export type BatchResults<M extends FnMap, Reqs extends readonly TypedBatchRequest<M>[]> = {
-    [I in keyof Reqs]: Reqs[I] extends {
-        method: infer K extends string;
-    } ? K extends keyof M ? SendResult<M[K]['result']> | Error : SendResult<unknown> | Error : SendResult<unknown> | Error;
-};
-//# sourceMappingURL=batch.d.ts.map

package/dist/client/batch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../src/client/batch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7D,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI;KACjF,IAAI,IAAI,CAAC,GAAG;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;KAAE;CACzD,CAAC,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,SAAS,SAAS,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI;KACvF,CAAC,IAAI,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,GACjE,CAAC,SAAS,MAAM,CAAC,GACf,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,GAClC,UAAU,CAAC,OAAO,CAAC,GAAG,KAAK,GAC7B,UAAU,CAAC,OAAO,CAAC,GAAG,KAAK;CAChC,CAAA"}

package/dist/client/batch.js

@@ -1,8 +0,0 @@
-/**
- * Type-level helpers for the kernel envelope HTTP batch endpoint.
- *
- * Batches are envelope-only — the routed transport has no batching and
- * throws `UnsupportedTransportError`.
- */
-export {};
-//# sourceMappingURL=batch.js.map

package/dist/client/batch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/client/batch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/client/bound.d.ts

@@ -1,27 +0,0 @@
-import type { CredentialInput } from '@astrale-os/kernel-core';
-import type { Schema } from '@astrale-os/kernel-dsl';
-import type { SchemaTypedClient } from '../schema/proxy-types.js';
-import type { BatchResults, TypedBatchRequest } from './batch.js';
-import type { KernelClient } from './client.js';
-import type { CallOptions } from './config.js';
-import type { BinaryFns, CallFns, FnMap, SendBinaryResult, SendResult, SendStreamResult, SignalFns, StreamFns } from './fn-map.js';
-/**
- * Credential-bound view over a `KernelClient`. Plain value — not a class.
- * Created by `client.as(credential)`. Each method delegates to the
- * underlying client, currying the credential in.
- *
- * A credential supplier function is also accepted; it's invoked once per
- * call, so rotated credentials flow through without recreating the view.
- */
-export type BoundClientView<M extends FnMap> = {
-    readonly url: string;
-    send<K extends CallFns<M>>(method: K, params: M[K]['params'], opts?: CallOptions): Promise<SendResult<M[K]['result']>>;
-    sendStream<K extends StreamFns<M>>(method: K, params: M[K]['params'], opts?: CallOptions): Promise<SendStreamResult<M[K]['result']>>;
-    sendBinary<K extends BinaryFns<M>>(method: K, params: M[K]['params'], opts?: CallOptions): Promise<SendBinaryResult>;
-    signal<K extends SignalFns<M>>(method: K, params: M[K]['params'], opts?: CallOptions): void;
-    batch<const Reqs extends readonly TypedBatchRequest<M>[]>(requests: [...Reqs], opts?: CallOptions): Promise<BatchResults<M, Reqs>>;
-    withSchema<S extends Schema>(schema: S): SchemaTypedClient<S>;
-    as(credential: CredentialInput | (() => CredentialInput)): BoundClientView<M>;
-};
-export declare function createBoundClientView<M extends FnMap>(client: KernelClient<M>, credential: CredentialInput | (() => CredentialInput)): BoundClientView<M>;
-//# sourceMappingURL=bound.d.ts.map

package/dist/client/bound.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bound.d.ts","sourceRoot":"","sources":["../../src/client/bound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EACV,SAAS,EACT,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,SAAS,EACV,MAAM,aAAa,CAAA;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,KAAK,IAAI;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EACvB,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACtC,UAAU,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAC/B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC5C,UAAU,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAC/B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC5B,MAAM,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3F,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,SAAS,iBAAiB,CAAC,CAAC,CAAC,EAAE,EACtD,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,EACnB,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IACjC,UAAU,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAA;IAC7D,EAAE,CAAC,UAAU,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;CAC9E,CAAA;AAED,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,KAAK,EACnD,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,UAAU,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,GACpD,eAAe,CAAC,CAAC,CAAC,CAYpB"}

package/dist/client/bound.js

@@ -1,14 +0,0 @@
-export function createBoundClientView(client, credential) {
-    const cred = () => (typeof credential === 'function' ? credential() : credential);
-    return {
-        url: client.url,
-        send: (method, params, opts) => client.send(method, params, cred(), opts),
-        sendStream: (method, params, opts) => client.sendStream(method, params, cred(), opts),
-        sendBinary: (method, params, opts) => client.sendBinary(method, params, cred(), opts),
-        signal: (method, params, opts) => client.signal(method, params, cred(), opts),
-        batch: (requests, opts) => client.batch(requests, cred(), opts),
-        withSchema: (schema) => client.withSchema(schema, cred),
-        as: (next) => createBoundClientView(client, next),
-    };
-}
-//# sourceMappingURL=bound.js.map

package/dist/client/bound.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bound.js","sourceRoot":"","sources":["../../src/client/bound.ts"],"names":[],"mappings":"AAoDA,MAAM,UAAU,qBAAqB,CACnC,MAAuB,EACvB,UAAqD;IAErD,MAAM,IAAI,GAAG,GAAoB,EAAE,CAAC,CAAC,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAClG,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QACzE,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QACrF,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QACrF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QAC7E,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;QAC/D,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;QACvD,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC;KAClD,CAAA;AACH,CAAC"}