@astrale-os/kernel-client 0.5.1 → 0.6.0-beta.10

package/dist/auth/auth.d.ts

@@ -0,0 +1,18 @@
+import type { Identity, IdentityId, MintedCredential, ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
+import type { PathLike } from '@astrale-os/kernel-core/path';
+import type { Input } from '../client/index.js';
+import type { RequestOptions } from '../transport/index.js';
+import type { PolicyDecisionInput } from './authorization.js';
+import type { DelegateOptions, MintOptions } from './credential.js';
+import type { WhoisInput } from './identity.js';
+export type AuthCall = (target: PathLike, input: Input, options?: RequestOptions) => Promise<Input>;
+export interface AuthApi {
+    provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
+    whoami(options?: RequestOptions): Promise<Identity>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
+    delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
+}
+/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
+export declare function createAuth(call: AuthCall): AuthApi;

package/dist/auth/auth.js

@@ -0,0 +1,15 @@
+import { authorizationApi } from './authorization.js';
+import { credentialApi } from './credential.js';
+import { identityApi } from './identity.js';
+import { provisionApi } from './provision.js';
+/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
+export function createAuth(call) {
+    if (typeof call !== 'function')
+        throw new TypeError('Auth call capability is invalid.');
+    return Object.freeze({
+        ...provisionApi(call),
+        ...identityApi(call),
+        ...authorizationApi(call),
+        ...credentialApi(call),
+    });
+}

package/dist/auth/authorization.d.ts

@@ -0,0 +1,13 @@
+import type { NodeId } from '@astrale-os/kernel-core/graph/node';
+import type { NodePath, PathLike } from '@astrale-os/kernel-core/path';
+import type { PolicyRef } from '@astrale-os/kernel-dsl/v1';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface PolicyDecisionInput {
+    readonly policy: PathLike | PolicyRef;
+    readonly object: NodeId;
+}
+export declare const IDENTITY_CAN_PATH: NodePath;
+export declare function authorizationApi(call: AuthCall): Readonly<{
+    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+}>;

package/dist/auth/authorization.js

@@ -0,0 +1,17 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+const identityOwner = Path.project(identity.whoami.owner);
+export const IDENTITY_CAN_PATH = Path.staticMethod(identityOwner, identity.can.name).raw;
+export function authorizationApi(call) {
+    return Object.freeze({
+        async can(input, options) {
+            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ policy: policyPath(input.policy), object: input.object }), options));
+            return output.allowed;
+        },
+    });
+}
+function policyPath(input) {
+    return input instanceof Path || typeof input === 'string'
+        ? Path.from(input).raw
+        : Path.project(input).raw;
+}

package/dist/auth/credential.d.ts

@@ -0,0 +1,19 @@
+import type { IdentityId, MintedCredential, UnresolvedGrant, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface MintOptions {
+    readonly audience?: string;
+    readonly ttlSeconds: number;
+    readonly grant?: UnresolvedGrant;
+}
+export interface DelegateOptions {
+    readonly audience: string;
+    readonly ttlSeconds: number;
+    readonly attenuation: UnresolvedIdentityExpr;
+}
+export declare const IDENTITY_MINT_PATH: NodePath;
+export declare function credentialApi(call: AuthCall): Readonly<{
+    mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
+    delegate(principal: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
+}>;

package/dist/auth/credential.js

@@ -0,0 +1,21 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+const identityOwner = Path.project(identity.whoami.owner);
+export const IDENTITY_MINT_PATH = Path.staticMethod(identityOwner, identity.mint.name).raw;
+export function credentialApi(call) {
+    return Object.freeze({
+        async mint(input, options) {
+            return credential(await call(IDENTITY_MINT_PATH, input, options));
+        },
+        async delegate(principal, input, options) {
+            const target = Path.instanceMethod(Path.id(principal), identity.delegate.name).raw;
+            return credential(await call(target, input, options));
+        },
+    });
+}
+function credential(input) {
+    if (typeof input !== 'string' || input.length === 0) {
+        throw new TypeError('Identity syscall returned an invalid credential.');
+    }
+    return input;
+}

package/dist/auth/identity.d.ts

@@ -0,0 +1,14 @@
+import type { Identity, IssuerId, Subject } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface WhoisInput {
+    readonly issuer: IssuerId;
+    readonly subject: Subject;
+}
+export declare const IDENTITY_WHOAMI_PATH: NodePath;
+export declare const IDENTITY_WHOIS_PATH: NodePath;
+export declare function identityApi(call: AuthCall): Readonly<{
+    whoami(options?: RequestOptions): Promise<Identity>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+}>;

package/dist/auth/identity.js

@@ -0,0 +1,15 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+const identityOwner = Path.project(identity.whoami.owner);
+export const IDENTITY_WHOAMI_PATH = Path.staticMethod(identityOwner, identity.whoami.name).raw;
+export const IDENTITY_WHOIS_PATH = Path.staticMethod(identityOwner, identity.whois.name).raw;
+export function identityApi(call) {
+    return Object.freeze({
+        async whoami(options) {
+            return (await call(IDENTITY_WHOAMI_PATH, Object.freeze({}), options));
+        },
+        async whois(input, options) {
+            return (await call(IDENTITY_WHOIS_PATH, input, options));
+        },
+    });
+}

package/dist/auth/index.d.ts

@@ -1,16 +1,6 @@
-/**
- * The auth surface — control plane of a bound session view (`view.auth`), pure
- * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
- * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
- * flow imports from one place.
- */
-export { createAuth } from './api.js';
-export { makeAuthShorthands } from './shorthands.js';
-export type { AuthApi } from './api.js';
-export type { Composition } from './composition.js';
-export type { DelegateOpts, MintOpts } from './minting.js';
-export type { CheckInput, GrantInput, Perms, RevokeInput } from './permissions.js';
-export type { AuthShorthands, RequireInput } from './shorthands.js';
-export { cred, self } from '@astrale-os/kernel-core/expression';
-export type { Expr } from '@astrale-os/kernel-core/expression';
-//# sourceMappingURL=index.d.ts.map
+export { createAuth, type AuthApi, type AuthCall } from './auth.js';
+export { IDENTITY_CAN_PATH, type PolicyDecisionInput } from './authorization.js';
+export { IDENTITY_MINT_PATH, type DelegateOptions, type MintOptions } from './credential.js';
+export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH, type WhoisInput } from './identity.js';
+export { IDENTITY_PROVISION_PATH } from './provision.js';
+export type { Identity, IdentityId, Subject, IssuerId, MintedCredential, ProvisionRequest, ProvisionResult, UnresolvedGrant, UnresolvedIdentityExpr, } from '@astrale-os/kernel-core/auth';

package/dist/auth/index.js

@@ -1,10 +1,5 @@
-/**
- * The auth surface — control plane of a bound session view (`view.auth`), pure
- * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
- * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
- * flow imports from one place.
- */
-export { createAuth } from './api.js';
-export { makeAuthShorthands } from './shorthands.js';
-export { cred, self } from '@astrale-os/kernel-core/expression';
-//# sourceMappingURL=index.js.map
+export { createAuth } from './auth.js';
+export { IDENTITY_CAN_PATH } from './authorization.js';
+export { IDENTITY_MINT_PATH } from './credential.js';
+export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH } from './identity.js';
+export { IDENTITY_PROVISION_PATH } from './provision.js';

package/dist/auth/provision.d.ts

@@ -0,0 +1,8 @@
+import type { ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export declare const IDENTITY_PROVISION_PATH: NodePath;
+export declare function provisionApi(call: AuthCall): Readonly<{
+    provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
+}>;

package/dist/auth/provision.js

@@ -0,0 +1,10 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { provision } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+export const IDENTITY_PROVISION_PATH = Path.project(provision).raw;
+export function provisionApi(call) {
+    return Object.freeze({
+        async provision(input, options) {
+            return (await call(IDENTITY_PROVISION_PATH, input, options));
+        },
+    });
+}

package/dist/client/admission.d.ts

@@ -0,0 +1,4 @@
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { Call } from './request.js';
+/** Parent-private Call acceptance shared by Client and Client Session. */
+export declare function acceptCall(input: Call): protocol.Call;

package/dist/client/admission.js

@@ -0,0 +1,34 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import * as portable from '@astrale-os/kernel-dsl/value';
+/** Parent-private Call acceptance shared by Client and Client Session. */
+export function acceptCall(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError('Client call must be an object.');
+    }
+    return Object.freeze({ target: admitPath(input.target), input: admitInput(input.input) });
+}
+function admitPath(input) {
+    try {
+        // Path is a pure value and may arrive through another package graph or JavaScript realm.
+        return Path.parse(typeof input === 'string' ? input : input.raw).raw;
+    }
+    catch (cause) {
+        throw new TypeError('Client call path must be a NodePath.', { cause });
+    }
+}
+function admitInput(input) {
+    try {
+        return freezeValue(portable.accept(input));
+    }
+    catch (cause) {
+        throw new TypeError('Client input must be a portable Value.', { cause });
+    }
+}
+function freezeValue(input) {
+    if (input !== null && typeof input === 'object' && !Object.isFrozen(input)) {
+        for (const value of Object.values(input))
+            freezeValue(value);
+        Object.freeze(input);
+    }
+    return input;
+}

package/dist/client/client.d.ts

@@ -1,110 +1,25 @@
-import type { CredentialInput } from '@astrale-os/kernel-core';
-import type { Schema } from '@astrale-os/kernel-dsl';
-import type { SchemaTypedClient } from '../schema/proxy-types.js';
-import type { FunctionSchema } from '../schema/types.js';
-import type { BatchResults, TypedBatchRequest } from './batch.js';
-import type { BoundClientView } from './bound.js';
-import type { CallOptions, ClientConfig } from './config.js';
-import type { BinaryFns, CallFns, FnMap, SendBinaryResult, SendResult, SendStreamResult, SignalFns, StreamFns } from './fn-map.js';
-/**
- * KernelClient — one URL, one kernel. Discriminated `Send*Result`s,
- * no auto-follow, no cross-host pool, no transport fallback. Identity
- * is opaque — the client forwards credentials onto the wire and never
- * inspects, compares, or rotates them.
- *
- * Four facets:
- *  - Lean primitives: `send` / `sendStream` / `sendBinary` / `signal` /
- *    `batch` — surface transport outcomes as-is, no orchestration.
- *  - Identity views: `as(credential)` returns a `BoundClientView` that
- *    curries the credential into every call. A value, not a class.
- *  - Schema proxy: `withSchema(schema)` returns a schema-typed proxy
- *    that throws `UNHANDLED_REDIRECT` on redirect (use `send` for
- *    redirect-aware calls).
- *  - Lifecycle: `disconnect()` releases held resources (open WS).
- */
-export declare class KernelClient<M extends FnMap = FnMap> {
-    readonly url: string;
-    private readonly defaultTimeout;
-    private readonly defaultTransport;
-    private readonly defaultProtocol;
-    private readonly hooks;
-    private readonly codec;
-    private readonly schema;
-    private readonly httpEnvelope;
-    private readonly httpRouted;
-    private readonly wsFactory;
-    private readonly logger;
-    private ws;
-    private wsState;
-    constructor(config: ClientConfig);
-    send<K extends CallFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendResult<M[K]['result']>>;
-    sendStream<K extends StreamFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendStreamResult<M[K]['result']>>;
-    sendBinary<K extends BinaryFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendBinaryResult>;
-    signal<K extends SignalFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): void;
-    batch<const Reqs extends readonly TypedBatchRequest<M>[]>(requests: [...Reqs], credential: CredentialInput, opts?: CallOptions): Promise<BatchResults<M, Reqs>>;
-    as(credential: CredentialInput | (() => CredentialInput)): BoundClientView<M>;
-    /**
-     * Return a schema-typed proxy. `defaultCredential` — used by
-     * `BoundClientView.withSchema` — supplies a credential when the
-     * per-call `ProxyCallOptions.credential` is absent. Unbound callers
-     * that provide neither send a no-auth request; the server decides
-     * whether that's valid (per §9.0.1 the client treats credentials as
-     * opaque and never pre-judges them).
-     */
-    withSchema<S extends Schema>(schema: S, defaultCredential?: () => CredentialInput): SchemaTypedClient<S>;
-    describe(method: string): FunctionSchema | undefined;
-    /**
-     * Release any held resources (open WebSocket). Idempotent. The client
-     * stays reusable — a subsequent `send(...)` lazily re-opens a fresh
-     * WebSocket if the default or per-call transport selects `'ws'`. Resets
-     * the `'auto'` probe state so the next call re-probes.
-     */
-    disconnect(): void;
-    private lookupSchema;
-    /**
-     * Resolve the transport instance + request shape for this call.
-     * `canFallback` signals to `dispatchUnary` that a WS `ConnectionError`
-     * on this attempt should retry on HTTP (auto-mode probe only).
-     */
-    private selectTransport;
-    /**
-     * Resolve `CallTransport` to a concrete envelope pipe. Binary is always
-     * HTTP (server-side WS binary unimplemented). In `'auto'+unknown`, signal
-     * stays on HTTP — fire-and-forget can't communicate fallback.
-     */
-    private resolveEnvelopePipe;
-    private envelopeWs;
-    private buildEnvelopeRequest;
-    private buildRoutedRequest;
-    /**
-     * Unary dispatch (call / stream / binary). Selects transport, fires
-     * `onBeforeSend`, awaits the transport, freezes the result (deeply,
-     * including `meta.wire`), wraps streams in the observability
-     * iterator, fires `onAfterReceive`, and decorates errors with
-     * `ClientErrorDetails` if the transport didn't already.
-     */
-    private dispatchUnary;
-    /**
-     * One dispatch attempt: hooks + wire + freeze. `fireErrorHook = false`
-     * suppresses `onError` so a recovered auto-mode WS probe failure doesn't
-     * surface as a phantom error when the fallback HTTP call succeeds.
-     */
-    private dispatchOnce;
-    private beforeCtx;
-    /**
-     * Wrap a stream iterable so each chunk fires `onStreamFrame`. Errors
-     * during hook evaluation are swallowed per the hook contract (pure
-     * observation); a hook that misbehaves never aborts the stream.
-     */
-    private instrumentStream;
-    private runHooks;
-    /**
-     * Log a hook-layer failure. Only the error's name + message are
-     * surfaced — the error may chain a `cause` that captured a credential
-     * or other sensitive ref by closure, and the client never leaks those
-     * per §9.0.1. Consumers who need full diagnostics provide a
-     * `logger` with their own redaction policy.
-     */
-    private logHookError;
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { Transport } from '../transport/index.js';
+import type { AuthenticatedClient, RemoteCredential } from './credential.js';
+import type { Call, ClientDispatchOptions } from './request.js';
+import type { BinaryResponse, Result, StreamResult, ValueResult } from './result.js';
+import { type HttpTransportOptions } from '../transport/http/index.js';
+export type ClientOptions = HttpTransportOptions | {
+    readonly transport: Transport;
+};
+/** Package-private redirect continuation path; intentionally absent from the public Client facade. */
+export declare function dispatchTrace(client: Client, credential: RemoteCredential | undefined, call: Call, options: ClientDispatchOptions | undefined, trace: protocol.Trace): Promise<Result>;
+/** Pure client for the universal remote Function invocation boundary. */
+export declare class Client implements AuthenticatedClient {
+    private readonly transport;
+    private readonly lifecycle;
+    private closed;
+    constructor(options: ClientOptions);
+    dispatch(call: Call, options?: ClientDispatchOptions): Promise<Result>;
+    call(call: Call, options?: ClientDispatchOptions): Promise<ValueResult>;
+    stream(call: Call, options?: ClientDispatchOptions): Promise<StreamResult>;
+    binary(call: Call, options?: ClientDispatchOptions): Promise<BinaryResponse>;
+    as(credential: RemoteCredential): AuthenticatedClient;
+    close(): void;
+    private dispatchWith;
 }
-//# sourceMappingURL=client.d.ts.map