@astrale-os/kernel-client 0.5.1 → 0.6.0-beta.1

package/dist/session/delegation/errors.d.ts

@@ -1,44 +0,0 @@
-import type { SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
-import { ClientSessionError } from '../../errors/session-error.js';
-/**
- * Delegation policy refused to mint for an audience.
- *
- * Thrown by ClientSession's dispatch loop when `DelegationPolicy.decide` returns
- * `{ allow: false, reason }`. The `audience`, `delegation`, and
- * `attestation` the call was about to mint for are preserved so a UI can
- * re-prompt with the full context of what was being proposed. The values
- * are **pre-refine** — if the policy conceptually considered a refined
- * shape before refusing, the pre-refine shape is what's reported here
- * (that's what was proposed to `decide`). Spec §9.3.1 / §10.3.
- */
-export declare class DelegationRefusedError extends ClientSessionError {
-    readonly audience: string;
-    readonly delegation: UnresolvedIdentityExpr;
-    readonly attestation: SelfIdentityExpr | undefined;
-    readonly reason: string;
-    constructor(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, reason: string, options?: ErrorOptions);
-}
-/**
- * `DelegationCache.get` dispatched a mint that threw.
- *
- * Wraps the underlying error (kernel auth error, network failure, etc.)
- * as `cause`. The cache does NOT retain a failed mint — subsequent
- * calls re-attempt minting. Spec §9.2 "don't cache rejection" + §10.3.
- */
-export declare class DelegationMintError extends ClientSessionError {
-    readonly audience: string;
-    readonly delegation: UnresolvedIdentityExpr;
-    readonly attestation: SelfIdentityExpr | undefined;
-    constructor(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, options?: ErrorOptions);
-}
-/**
- * A `DelegationPolicy.decide` implementation itself threw.
- *
- * Programmer error at the policy layer. Wraps the thrown error as
- * `cause`. Consumers treating this as "refused" is safe. Spec §10.3.
- */
-export declare class DelegationPolicyError extends ClientSessionError {
-    readonly audience: string | undefined;
-    constructor(audience: string | undefined, options?: ErrorOptions);
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/session/delegation/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/session/delegation/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAElG,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE;;;;;;;;;;GAUG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;aAE1C,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,sBAAsB;aAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS;aACzC,MAAM,EAAE,MAAM;IAJhC,YACkB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,MAAM,EAAE,MAAM,EAC9B,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,kBAAkB;aAEvC,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,sBAAsB;aAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS;IAH3D,YACkB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzD,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,kBAAkB;aAEzC,QAAQ,EAAE,MAAM,GAAG,SAAS;IAD9C,YACkB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5C,OAAO,CAAC,EAAE,YAAY,EAUvB;CACF"}

package/dist/session/delegation/errors.js

@@ -1,62 +0,0 @@
-import { ClientSessionError } from '../../errors/session-error.js';
-/**
- * Delegation policy refused to mint for an audience.
- *
- * Thrown by ClientSession's dispatch loop when `DelegationPolicy.decide` returns
- * `{ allow: false, reason }`. The `audience`, `delegation`, and
- * `attestation` the call was about to mint for are preserved so a UI can
- * re-prompt with the full context of what was being proposed. The values
- * are **pre-refine** — if the policy conceptually considered a refined
- * shape before refusing, the pre-refine shape is what's reported here
- * (that's what was proposed to `decide`). Spec §9.3.1 / §10.3.
- */
-export class DelegationRefusedError extends ClientSessionError {
-    audience;
-    delegation;
-    attestation;
-    reason;
-    constructor(audience, delegation, attestation, reason, options) {
-        super(`Delegation refused for "${audience}": ${reason}`, 'DELEGATION_REFUSED', options);
-        this.audience = audience;
-        this.delegation = delegation;
-        this.attestation = attestation;
-        this.reason = reason;
-        this.name = 'DelegationRefusedError';
-    }
-}
-/**
- * `DelegationCache.get` dispatched a mint that threw.
- *
- * Wraps the underlying error (kernel auth error, network failure, etc.)
- * as `cause`. The cache does NOT retain a failed mint — subsequent
- * calls re-attempt minting. Spec §9.2 "don't cache rejection" + §10.3.
- */
-export class DelegationMintError extends ClientSessionError {
-    audience;
-    delegation;
-    attestation;
-    constructor(audience, delegation, attestation, options) {
-        super(`Delegation mint failed for "${audience}"`, 'DELEGATION_MINT_FAILED', options);
-        this.audience = audience;
-        this.delegation = delegation;
-        this.attestation = attestation;
-        this.name = 'DelegationMintError';
-    }
-}
-/**
- * A `DelegationPolicy.decide` implementation itself threw.
- *
- * Programmer error at the policy layer. Wraps the thrown error as
- * `cause`. Consumers treating this as "refused" is safe. Spec §10.3.
- */
-export class DelegationPolicyError extends ClientSessionError {
-    audience;
-    constructor(audience, options) {
-        super(audience === undefined
-            ? 'Delegation policy threw during audience derivation'
-            : `Delegation policy threw for audience "${audience}"`, 'DELEGATION_POLICY_THREW', options);
-        this.audience = audience;
-        this.name = 'DelegationPolicyError';
-    }
-}
-//# sourceMappingURL=errors.js.map

package/dist/session/delegation/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/session/delegation/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAE1C,QAAQ;IACR,UAAU;IACV,WAAW;IACX,MAAM;IAJxB,YACkB,QAAgB,EAChB,UAAkC,EAClC,WAAyC,EACzC,MAAc,EAC9B,OAAsB;QAEtB,KAAK,CAAC,2BAA2B,QAAQ,MAAM,MAAM,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAA;wBANvE,QAAQ;0BACR,UAAU;2BACV,WAAW;sBACX,MAAM;QAItB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,kBAAkB;IAEvC,QAAQ;IACR,UAAU;IACV,WAAW;IAH7B,YACkB,QAAgB,EAChB,UAAkC,EAClC,WAAyC,EACzD,OAAsB;QAEtB,KAAK,CAAC,+BAA+B,QAAQ,GAAG,EAAE,wBAAwB,EAAE,OAAO,CAAC,CAAA;wBALpE,QAAQ;0BACR,UAAU;2BACV,WAAW;QAI3B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,kBAAkB;IAEzC,QAAQ;IAD1B,YACkB,QAA4B,EAC5C,OAAsB;QAEtB,KAAK,CACH,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,yCAAyC,QAAQ,GAAG,EACxD,yBAAyB,EACzB,OAAO,CACR,CAAA;wBATe,QAAQ;QAUxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF"}

package/dist/session/delegation/policy.d.ts

@@ -1,183 +0,0 @@
-import type { Scope, SelfIdentityExpr, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/expression';
-/**
- * Context passed to every `DelegationPolicy` method. Carries hop history
- * and correlation id so policies can branch on "are we on a redirect
- * hop?" or thread the correlation id into an external audit stream
- * without closure tracking.
- */
-export type DelegationContext = {
-    /** URL the call is about to dispatch to. */
-    target: string;
-    /** Method name being dispatched. */
-    method: string;
-    /** Params the call carries. */
-    params: unknown;
-    /** Correlation id of the top-level `session.call`. */
-    correlationId: string;
-    /**
-     * Hop chain so far. `hops[0]` is the initial target; the last entry is
-     * the *current* hop being dispatched. On the first iteration of the
-     * dispatch loop the array has one element; each followed redirect
-     * appends one more before the next iteration re-runs the policy.
-     */
-    hops: ReadonlyArray<{
-        url: string;
-        at: number;
-    }>;
-    /**
-     * Authoritative audience the kernel attached to the redirect that led to
-     * this hop (`CallRedirection.iss` — the target worker's `Identity.iss`).
-     * Present only on redirect hops (≥ 1) of a remote-bound call; absent on
-     * hop 0 and when the target node carries no identity. The default
-     * `audienceFor` prefers it over the URL-origin heuristic when set.
-     */
-    iss?: string;
-};
-/**
- * Consent decision for a single mint.
- *
- * - `{ allow: true }` — accept the pre-computed `(delegation, attestation)` as-is.
- * - `{ allow: true, delegation?, attestation? }` — accept with refinement:
- *   substitute the provided field(s) before `DelegationCache.get`. The
- *   post-refine values become the cache key and what `onDelegationMint`
- *   reports. Either field is optional; the unrefined fields stay
- *   pre-computed. Refinement is one-shot — ClientSession does not re-invoke
- *   `decide` on the refined shape.
- * - `{ allow: false, reason }` — causes ClientSession to throw
- *   `DelegationRefusedError`. The error carries the pre-refine shape.
- *
- * Spec §9.3 / §9.3.1. A single-branch `allow: true` with optional
- * refinement fields is what TypeScript narrows cleanly — a two-branch
- * union of `{ allow: true }` and `{ allow: true, delegation?, attestation? }`
- * would be indistinguishable to the narrower and forces `as` casts at
- * every read site.
- */
-export type DelegationDecision = {
-    allow: true;
-    delegation?: UnresolvedIdentityExpr;
-    attestation?: SelfIdentityExpr;
-} | {
-    allow: false;
-    reason: string;
-};
-/**
- * Audience + delegation + attestation + consent surface. Spec §9.3.
- *
- * Mirrors the server-side `MintDelegationParams` triple in
- * `kernel/ports/authentication/authentication.port.ts` one-for-one. Owns
- * ONLY decision-layer concerns. Does NOT own the cache (that's
- * `DelegationCache`), the mint itself (injected via cache config),
- * credential-chaining resolution (kernel-side at mint/auth time), or
- * iterated negotiation (`decide` is one-shot).
- */
-export interface DelegationPolicy {
-    /**
-     * Map a target to an audience. Returning `undefined` skips delegation
-     * — the dispatch uses the base credential directly. Sync, cheap, pure
-     * (runs on every wire dispatch).
-     *
-     * `ctx` carries hop history and correlation id — the first three args
-     * are duplicated into `ctx` so a 3-arg policy still type-checks (the
-     * fourth arg is additive, not a breaking rename).
-     */
-    audienceFor(target: string, method: string, params: unknown, ctx: DelegationContext): string | undefined;
-    /**
-     * Derive the `UnresolvedIdentityExpr` this mint should carry. Return
-     * `undefined` to use ClientSession's default `{ kind: 'identity', self: true }`.
-     * Invoked only when `audienceFor` returned a non-undefined audience.
-     *
-     * The full expression tree the kernel accepts — `union`, `intersect`,
-     * `exclude`, `scope`-wrapped sub-expressions, `Cred(...)` leaves. For
-     * the common "narrow self-delegation by scope" case use `scopedSelf`.
-     *
-     * Sync — delegation shape is a rule, not an I/O lookup. Consumers who
-     * need async derivation compute outside and pass
-     * `ClientSessionCallOptions.delegation`; `decide` can also refine the shape
-     * asynchronously (§9.3.1).
-     */
-    delegationFor?(target: string, method: string, params: unknown, ctx: DelegationContext): UnresolvedIdentityExpr | undefined;
-    /**
-     * Derive the `SelfIdentityExpr` attestation for the mint's outer
-     * envelope. Return `undefined` to omit the attestation param (kernel
-     * adapter defaults it to `{ kind: 'identity', self: true }`). Invoked
-     * only when `audienceFor` returned a non-undefined audience.
-     *
-     * Attestation asserts something about the delegator; it is signed into
-     * the outer envelope as metadata and is NOT enforced at authentication.
-     * Most consumers leave this absent.
-     */
-    attestationFor?(target: string, method: string, params: unknown, ctx: DelegationContext): SelfIdentityExpr | undefined;
-    /**
-     * Consent hook. Called AFTER `audienceFor` / `delegationFor` /
-     * `attestationFor` resolved and BEFORE `DelegationCache.get` issues the
-     * mint. Default when absent: implicit allow.
-     *
-     * `signal` propagates from the caller's `ClientSessionCallOptions.signal` —
-     * implementations that await UI input MUST race against it.
-     *
-     * May refine the mint shape (§9.3.1): returning
-     * `{ allow: true, delegation?, attestation? }` substitutes the
-     * provided field(s) before cache lookup. Plain `{ allow: true }` uses
-     * the pre-computed shape unchanged.
-     */
-    decide?(audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, ctx: DelegationContext, signal: AbortSignal | undefined): DelegationDecision | Promise<DelegationDecision>;
-}
-/**
- * Default policy: mint for any target whose origin differs from the
- * default kernel's origin, allow implicitly.
- *
- * `default` is the `ClientSessionConfig.default` URL; same-origin targets skip
- * delegation (the base credential is valid). Used when `ClientSessionConfig`
- * omits `delegationPolicy`.
- */
-export declare function allowAllDelegations(opts: {
-    default: string;
-}): DelegationPolicy;
-/**
- * Allowlist: only mint for audiences `allow` returns true for. Matches
- * `RedirectPolicy`'s `allowlistPolicy` shape for symmetry.
- *
- * `delegation`, when supplied, is the expression applied to every mint
- * this policy produces; per-call overrides via `ClientSessionCallOptions.delegation`
- * still win. Same for `attestation`.
- */
-export declare function allowlistDelegations(opts: {
-    default: string;
-    allow: (audience: string) => boolean;
-    delegation?: UnresolvedIdentityExpr;
-    attestation?: SelfIdentityExpr;
-}): DelegationPolicy;
-/**
- * UI prompt: ask the consumer for each new audience. Races `onPrompt`
- * against the caller's `signal` so aborting the top-level call cancels
- * the prompt.
- *
- * `allow` is a fast-path predicate (pre-approved audiences). Returning
- * `false` from `allow` falls through to `onPrompt`.
- *
- * `onPrompt` receives the full mint shape (audience + delegation +
- * attestation + ctx) so the UI can render what's actually being minted,
- * not just the audience. This matters when the policy narrows by method:
- * the user should see "write to partner kernel as self with READ | WRITE
- * on nodes [X, Y]," not just "trust partner kernel."
- */
-export declare function promptDelegations(opts: {
-    default: string;
-    onPrompt: (audience: string, delegation: UnresolvedIdentityExpr, attestation: SelfIdentityExpr | undefined, ctx: DelegationContext) => Promise<boolean>;
-    allow?: (audience: string) => boolean;
-    delegation?: UnresolvedIdentityExpr;
-    attestation?: SelfIdentityExpr;
-}): DelegationPolicy;
-/**
- * Build `{ kind: 'scope', scopes, expr: { kind: 'identity', self: true } }`
- * — a self-delegation narrowed to the given scope set. This is the shape
- * that was the *entire* delegation surface in an earlier draft of the
- * spec, now expressible as one case of the full `UnresolvedIdentityExpr`
- * algebra.
- *
- * Use for the common "vary perms by method" pattern. Reach for the raw
- * `UnresolvedIdentityExpr` constructors when composing identities
- * (union/intersect/exclude) or chaining credentials.
- */
-export declare function scopedSelf(scopes: readonly Scope[]): UnresolvedIdentityExpr;
-//# sourceMappingURL=policy.d.ts.map

package/dist/session/delegation/policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/session/delegation/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,oCAAoC,CAAA;AAI3C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,IAAI,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChD;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;IAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAAE,GACpF;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;OAQG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,MAAM,GAAG,SAAS,CAAA;IAErB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,CACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,sBAAsB,GAAG,SAAS,CAAA;IAErC;;;;;;;;;OASG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,iBAAiB,GACrB,gBAAgB,GAAG,SAAS,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,CACL,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACpD;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACpC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC/B,GAAG,gBAAgB,CAUnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,CACR,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,gBAAgB,GAAG,SAAS,EACzC,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,OAAO,CAAC,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAA;IACrC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAC/B,GAAG,gBAAgB,CAmBnB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,sBAAsB,CAM3E"}

package/dist/session/delegation/policy.js

@@ -1,114 +0,0 @@
-import { raceAgainstSignal } from '../../util/race-signal.js';
-// ─── Factories ───────────────────────────────────────────────────────────────
-/**
- * Default policy: mint for any target whose origin differs from the
- * default kernel's origin, allow implicitly.
- *
- * `default` is the `ClientSessionConfig.default` URL; same-origin targets skip
- * delegation (the base credential is valid). Used when `ClientSessionConfig`
- * omits `delegationPolicy`.
- */
-export function allowAllDelegations(opts) {
-    return { audienceFor: originAudienceFor(opts.default) };
-}
-/**
- * Allowlist: only mint for audiences `allow` returns true for. Matches
- * `RedirectPolicy`'s `allowlistPolicy` shape for symmetry.
- *
- * `delegation`, when supplied, is the expression applied to every mint
- * this policy produces; per-call overrides via `ClientSessionCallOptions.delegation`
- * still win. Same for `attestation`.
- */
-export function allowlistDelegations(opts) {
-    return {
-        audienceFor: originAudienceFor(opts.default),
-        ...(opts.delegation !== undefined ? { delegationFor: () => opts.delegation } : {}),
-        ...(opts.attestation !== undefined ? { attestationFor: () => opts.attestation } : {}),
-        decide: (audience) => {
-            if (opts.allow(audience))
-                return { allow: true };
-            return { allow: false, reason: `audience not in allowlist: ${audience}` };
-        },
-    };
-}
-/**
- * UI prompt: ask the consumer for each new audience. Races `onPrompt`
- * against the caller's `signal` so aborting the top-level call cancels
- * the prompt.
- *
- * `allow` is a fast-path predicate (pre-approved audiences). Returning
- * `false` from `allow` falls through to `onPrompt`.
- *
- * `onPrompt` receives the full mint shape (audience + delegation +
- * attestation + ctx) so the UI can render what's actually being minted,
- * not just the audience. This matters when the policy narrows by method:
- * the user should see "write to partner kernel as self with READ | WRITE
- * on nodes [X, Y]," not just "trust partner kernel."
- */
-export function promptDelegations(opts) {
-    return {
-        audienceFor: originAudienceFor(opts.default),
-        ...(opts.delegation !== undefined ? { delegationFor: () => opts.delegation } : {}),
-        ...(opts.attestation !== undefined ? { attestationFor: () => opts.attestation } : {}),
-        decide: async (audience, delegation, attestation, ctx, signal) => {
-            if (opts.allow?.(audience))
-                return { allow: true };
-            // Short-circuit a pre-aborted signal before opening the prompt —
-            // otherwise the consumer's UI flashes for a call the caller already cancelled.
-            if (signal?.aborted)
-                throw signal.reason instanceof Error ? signal.reason : new Error('aborted');
-            const accepted = await raceAgainstSignal(opts.onPrompt(audience, delegation, attestation, ctx), signal);
-            if (accepted)
-                return { allow: true };
-            return { allow: false, reason: `consumer declined delegation for "${audience}"` };
-        },
-    };
-}
-// ─── Sugar — no new capability, just the common self+scope shape ─────────────
-/**
- * Build `{ kind: 'scope', scopes, expr: { kind: 'identity', self: true } }`
- * — a self-delegation narrowed to the given scope set. This is the shape
- * that was the *entire* delegation surface in an earlier draft of the
- * spec, now expressible as one case of the full `UnresolvedIdentityExpr`
- * algebra.
- *
- * Use for the common "vary perms by method" pattern. Reach for the raw
- * `UnresolvedIdentityExpr` constructors when composing identities
- * (union/intersect/exclude) or chaining credentials.
- */
-export function scopedSelf(scopes) {
-    return {
-        kind: 'scope',
-        scopes: [...scopes],
-        expr: { kind: 'identity', self: true },
-    };
-}
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-/**
- * Build an `audienceFor` function. When the dispatch loop supplies the
- * redirect-carried `ctx.iss` (the target worker's authoritative identity), it
- * wins — that's the audience the worker actually verifies. Otherwise (hop 0, or
- * a legacy node without identity) fall back to the origin heuristic: the
- * target's origin when it differs from the default kernel's, `undefined`
- * otherwise. Shared across every factory.
- */
-function originAudienceFor(defaultUrl) {
-    const defaultOrigin = safeOrigin(defaultUrl);
-    return (target, _method, _params, ctx) => {
-        if (ctx?.iss !== undefined)
-            return ctx.iss;
-        const origin = safeOrigin(target);
-        if (origin === undefined || origin === defaultOrigin)
-            return undefined;
-        return origin;
-    };
-}
-function safeOrigin(url) {
-    try {
-        return new URL(url).origin;
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=policy.js.map

package/dist/session/delegation/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/session/delegation/policy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAgJ7D,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;YACnB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,QAAQ,EAAE,EAAE,CAAA;QAC3E,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAWjC;IACC,OAAO;QACL,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;YAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAClD,iEAAiE;YACjE,+EAA+E;YAC/E,IAAI,MAAM,EAAE,OAAO;gBACjB,MAAM,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAA;YAC7E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,EACrD,MAAM,CACP,CAAA;YACD,IAAI,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,QAAQ,GAAG,EAAE,CAAA;QACnF,CAAC;KACF,CAAA;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;QACnB,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;KACvC,CAAA;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IAC5C,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,GAAG,EAAE,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,GAAG,CAAA;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,SAAS,CAAA;QACtE,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/session/delegation/utils.d.ts

@@ -1,4 +0,0 @@
-import type { CredentialInput } from '@astrale-os/kernel-core';
-export declare function credentialKey(credential: CredentialInput): string;
-export declare function bytesToHex(bytes: Uint8Array): string;
-//# sourceMappingURL=utils.d.ts.map

package/dist/session/delegation/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/session/delegation/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,wBAAgB,aAAa,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAGjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD"}

package/dist/session/delegation/utils.js

@@ -1,12 +0,0 @@
-export function credentialKey(credential) {
-    if (credential instanceof Uint8Array)
-        return `bytes:${bytesToHex(credential)}`;
-    return `string:${credential}`;
-}
-export function bytesToHex(bytes) {
-    let s = '';
-    for (let i = 0; i < bytes.length; i++)
-        s += bytes[i].toString(16).padStart(2, '0');
-    return s;
-}
-//# sourceMappingURL=utils.js.map

package/dist/session/delegation/utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/session/delegation/utils.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,aAAa,CAAC,UAA2B;IACvD,IAAI,UAAU,YAAY,UAAU;QAAE,OAAO,SAAS,UAAU,CAAC,UAAU,CAAC,EAAE,CAAA;IAC9E,OAAO,UAAU,UAAU,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAClF,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/session/delegation-mint.d.ts

@@ -1,13 +0,0 @@
-import type { CredentialInput } from '@astrale-os/kernel-core';
-import type { FnMap } from '../client/fn-map.js';
-import type { ClientSession } from './client-session.js';
-import type { DelegationMintFn } from './delegation/cache.js';
-/**
- * The standard delegation mint as one `DelegationMintFn` for `ClientSession`'s
- * `delegation.mint`: dispatches `mintDelegationCredential` as the current
- * authority credential; `skipDelegation` guards
- * the mint's own whoami/mint from re-entering the delegation block. Pass a thunk
- * — `delegationMintVia(() => session)` — to defer resolving `session`.
- */
-export declare function delegationMintVia<M extends FnMap>(session: ClientSession<M> | (() => ClientSession<M>), credential?: CredentialInput | (() => CredentialInput)): DelegationMintFn;
-//# sourceMappingURL=delegation-mint.d.ts.map

package/dist/session/delegation-mint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegation-mint.d.ts","sourceRoot":"","sources":["../../src/session/delegation-mint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAG9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,KAAK,EAAyB,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAKpF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,EAC/C,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,EACpD,UAAU,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,GACrD,gBAAgB,CA+BlB"}

package/dist/session/delegation-mint.js

@@ -1,39 +0,0 @@
-import { createAuth } from '../auth/index.js';
-import { credentialKey } from './delegation/utils.js';
-/**
- * The standard delegation mint as one `DelegationMintFn` for `ClientSession`'s
- * `delegation.mint`: dispatches `mintDelegationCredential` as the current
- * authority credential; `skipDelegation` guards
- * the mint's own whoami/mint from re-entering the delegation block. Pass a thunk
- * — `delegationMintVia(() => session)` — to defer resolving `session`.
- */
-export function delegationMintVia(session, credential) {
-    const pinned = () => typeof credential === 'function' ? credential() : credential;
-    const authByAuthority = new Map();
-    const resolve = (context) => {
-        const authority = context?.authority ?? pinned();
-        if (authority === undefined) {
-            throw new Error('delegationMintVia requires a credential authority');
-        }
-        const key = credentialKey(authority);
-        let auth = authByAuthority.get(key);
-        if (auth)
-            return auth;
-        const s = typeof session === 'function' ? session() : session;
-        const call = (method, params) => s.call(method, params, {
-            credential: authority,
-            skipDelegation: true,
-        });
-        auth = createAuth(call, { credential: () => authority });
-        authByAuthority.set(key, auth);
-        return auth;
-    };
-    return async (audience, delegation, attestation, context) => ({
-        credential: await resolve(context).delegate({
-            audience,
-            delegation,
-            ...(attestation !== undefined ? { attestation } : {}),
-        }),
-    });
-}
-//# sourceMappingURL=delegation-mint.js.map

package/dist/session/delegation-mint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegation-mint.js","sourceRoot":"","sources":["../../src/session/delegation-mint.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAoD,EACpD,UAAsD;IAEtD,MAAM,MAAM,GAAG,GAAgC,EAAE,CAC/C,OAAO,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAmB,CAAA;IAClD,MAAM,OAAO,GAAG,CAAC,OAA0C,EAAW,EAAE;QACtE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,EAAE,CAAA;QAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAErB,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QAC7D,MAAM,IAAI,GAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CACzC,CAAC,CAAC,IAAI,CAAC,MAAe,EAAE,MAAe,EAAE;YACvC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAA;QACJ,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;QACxD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5D,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;YAC1C,QAAQ;YACR,UAAU;YACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;KACH,CAAC,CAAA;AACJ,CAAC"}

package/dist/session/dispatch-routes.d.ts

@@ -1,27 +0,0 @@
-import type { CallRedirection } from '@astrale-os/kernel-api';
-import type { SchemaRegistry } from '../schema/registry.js';
-import type { FunctionSchema } from '../schema/types.js';
-import type { ClientSessionCallOptions } from './config.js';
-export type DispatchRoute = {
-    method: string;
-    url: string;
-    iss?: string;
-    self?: string;
-    schema?: FunctionSchema;
-};
-export type DispatchRouteStore = {
-    get(key: string): DispatchRoute | undefined | Promise<DispatchRoute | undefined>;
-    set(key: string, route: DispatchRoute): void | Promise<void>;
-};
-export declare class MemoryDispatchRouteStore implements DispatchRouteStore {
-    #private;
-    get(key: string): DispatchRoute | undefined;
-    set(key: string, route: DispatchRoute): void;
-}
-export declare class DispatchRouteCache {
-    #private;
-    constructor(store?: DispatchRouteStore);
-    resolve(method: string, params: unknown, opts: ClientSessionCallOptions | undefined, registry: SchemaRegistry): Promise<DispatchRoute | undefined>;
-    remember(method: string, classHint: string | undefined, redirection: CallRedirection, registry: SchemaRegistry): Promise<void>;
-}
-//# sourceMappingURL=dispatch-routes.d.ts.map

package/dist/session/dispatch-routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch-routes.d.ts","sourceRoot":"","sources":["../../src/session/dispatch-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,wBAAwB,CAAA;AAM9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IAChF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D,CAAA;AAED,qBAAa,wBAAyB,YAAW,kBAAkB;;IAGjE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1C;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAE3C;CACF;AAED,qBAAa,kBAAkB;;IAG7B,YAAY,KAAK,GAAE,kBAAmD,EAErE;IAEK,OAAO,CACX,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAC1C,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAkBpC;IAEK,QAAQ,CACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,WAAW,EAAE,eAAe,EAC5B,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC,CAWf;CACF"}

package/dist/session/dispatch-routes.js

@@ -1,77 +0,0 @@
-import { substituteTemplate } from '@astrale-os/kernel-api';
-import { Path } from '@astrale-os/kernel-core';
-import { InstanceMethodPath } from '@astrale-os/kernel-core/domain';
-export class MemoryDispatchRouteStore {
-    #routes = new Map();
-    get(key) {
-        return this.#routes.get(key);
-    }
-    set(key, route) {
-        this.#routes.set(key, route);
-    }
-}
-export class DispatchRouteCache {
-    #store;
-    constructor(store = new MemoryDispatchRouteStore()) {
-        this.#store = store;
-    }
-    async resolve(method, params, opts, registry) {
-        if (opts?.url !== undefined)
-            return undefined;
-        const schema = registry.resolve(method, opts?.class) ?? registry.get(method);
-        for (const key of routeKeys(method, opts?.class, schema)) {
-            const route = await this.#store.get(key);
-            if (route)
-                return materializeRoute(route, params, method, opts?.self);
-        }
-        const binding = schema?.binding;
-        if (!binding?.remoteUrl)
-            return undefined;
-        const self = opts?.self ?? instanceSelf(method);
-        return {
-            method,
-            url: substituteUrl(binding.remoteUrl, params),
-            ...(self !== undefined ? { self } : {}),
-            ...(schema !== undefined ? { schema } : {}),
-        };
-    }
-    async remember(method, classHint, redirection, registry) {
-        const schema = redirection.schema ?? registry.resolve(method, classHint);
-        const route = {
-            method: redirection.path,
-            url: redirection.url,
-            ...(redirection.iss !== undefined ? { iss: redirection.iss } : {}),
-            ...(redirection.self !== undefined ? { self: redirection.self } : {}),
-            ...(schema !== undefined ? { schema } : {}),
-        };
-        for (const key of routeKeys(method, classHint, schema))
-            await this.#store.set(key, route);
-        await this.#store.set(redirection.path, route);
-    }
-}
-function routeKeys(method, classHint, schema) {
-    const keys = new Set([method]);
-    if (classHint !== undefined)
-        keys.add(`${method}|class=${classHint}`);
-    if (schema?.ref)
-        keys.add(schema.ref);
-    return [...keys];
-}
-function materializeRoute(route, params, method, explicitSelf) {
-    const self = explicitSelf ?? instanceSelf(method) ?? route.self;
-    return {
-        ...route,
-        url: substituteUrl(route.url, params),
-        ...(self !== undefined ? { self } : {}),
-    };
-}
-function substituteUrl(url, params) {
-    return params && typeof params === 'object'
-        ? substituteTemplate(url, params)
-        : url;
-}
-function instanceSelf(method) {
-    const path = Path.tryParse(method);
-    return path instanceof InstanceMethodPath ? path.source.raw : undefined;
-}
-//# sourceMappingURL=dispatch-routes.js.map

package/dist/session/dispatch-routes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch-routes.js","sourceRoot":"","sources":["../../src/session/dispatch-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAmBnE,MAAM,OAAO,wBAAwB;IAC1B,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IAEnD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAoB;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAoB;IAEnC,YAAY,KAAK,GAAuB,IAAI,wBAAwB,EAAE;QACpE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,MAAe,EACf,IAA0C,EAC1C,QAAwB;QAExB,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAE7C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5E,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,KAAK;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,EAAE,OAAsC,CAAA;QAC9D,IAAI,CAAC,OAAO,EAAE,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/C,OAAO;YACL,MAAM;YACN,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;YAC7C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,SAA6B,EAC7B,WAA4B,EAC5B,QAAwB;QAExB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACxE,MAAM,KAAK,GAAkB;YAC3B,MAAM,EAAE,WAAW,CAAC,IAAI;YACxB,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzF,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,SAA6B,EAC7B,MAAkC;IAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IACtC,IAAI,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,SAAS,EAAE,CAAC,CAAA;IACrE,IAAI,MAAM,EAAE,GAAG;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAoB,EACpB,MAAe,EACf,MAAc,EACd,YAAgC;IAEhC,MAAM,IAAI,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAA;IAC/D,OAAO;QACL,GAAG,KAAK;QACR,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;QACrC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,MAAe;IACjD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QACzC,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAiC,CAAC;QAC5D,CAAC,CAAC,GAAG,CAAA;AACT,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClC,OAAO,IAAI,YAAY,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC"}

package/dist/session/errors/index.d.ts

@@ -1,6 +0,0 @@
-export { IdentityPickerError, PersistenceLoadFailedError, RegistryWriteFailedError, SchemaOwnershipConflictError, UnresolvedIdentityError, } from './session-errors.js';
-export { ClientSessionError } from '../../errors/session-error.js';
-export { DelegationMintError, DelegationPolicyError, DelegationRefusedError, } from '../delegation/errors.js';
-export { PoolClosedError } from '../../pool/errors.js';
-export { HopLimitExceededError, RedirectPolicyError, RedirectRefusedError, } from '../redirect/errors.js';
-//# sourceMappingURL=index.d.ts.map