@astrale-os/kernel-client 0.5.1 → 0.6.0-beta.2

package/dist/auth/auth.d.ts

@@ -0,0 +1,19 @@
+import type { Identity, IdentityId, MintedCredential, ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
+import type { PathLike } from '@astrale-os/kernel-core/path';
+import type { Input } from '@astrale-os/kernel-ports/functions';
+import type { RequestOptions } from '../transport/index.js';
+import type { PolicyDecisionInput } from './authorization.js';
+import type { DelegateOptions, MintOptions } from './credential.js';
+import type { WhoisInput } from './identity.js';
+export type AuthCall = (target: PathLike, input: Input, options?: RequestOptions) => Promise<Input>;
+export interface AuthApi {
+    provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
+    whoami(options?: RequestOptions): Promise<Identity>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
+    delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
+}
+/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
+export declare function createAuth(call: AuthCall): AuthApi;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oCAAoC,CAAA;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAO/C,MAAM,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;AAEnG,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACtF,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC5E,GAAG,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3E,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC7E,QAAQ,CACN,QAAQ,EAAE,UAAU,EACpB,KAAK,EAAE,eAAe,EACtB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC7B;AAED,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAQlD"}

package/dist/auth/auth.js

@@ -0,0 +1,16 @@
+import { authorizationApi } from './authorization.js';
+import { credentialApi } from './credential.js';
+import { identityApi } from './identity.js';
+import { provisionApi } from './provision.js';
+/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
+export function createAuth(call) {
+    if (typeof call !== 'function')
+        throw new TypeError('Auth call capability is invalid.');
+    return Object.freeze({
+        ...provisionApi(call),
+        ...identityApi(call),
+        ...authorizationApi(call),
+        ...credentialApi(call),
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../auth/auth.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAiB7C,0FAA0F;AAC1F,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACvF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,WAAW,CAAC,IAAI,CAAC;QACpB,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,GAAG,aAAa,CAAC,IAAI,CAAC;KACvB,CAAC,CAAA;AACJ,CAAC"}

package/dist/auth/authorization.d.ts

@@ -0,0 +1,14 @@
+import type { NodeId } from '@astrale-os/kernel-core/graph/node';
+import type { NodePath, PathLike } from '@astrale-os/kernel-core/path';
+import type { schema } from '@astrale-os/kernel-dsl/v1';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface PolicyDecisionInput {
+    readonly policy: PathLike | schema.PolicyRef;
+    readonly object: NodeId;
+}
+export declare const IDENTITY_CAN_PATH: NodePath;
+export declare function authorizationApi(call: AuthCall): Readonly<{
+    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+}>;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/auth/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../auth/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAKvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAID,eAAO,MAAM,iBAAiB,EAAE,QAG3B,CAAA;AAEL,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ;eAE1B,mBAAmB,YAAY,cAAc;GASjE"}

package/dist/auth/authorization.js

@@ -0,0 +1,18 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { syscalls } from '@astrale-os/kernel-core/schema';
+const identityOwner = Path.project(syscalls.identity.whoami.ref.owner);
+export const IDENTITY_CAN_PATH = Path.staticMethod(identityOwner, syscalls.identity.can.ref.name).raw;
+export function authorizationApi(call) {
+    return Object.freeze({
+        async can(input, options) {
+            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ policy: policyPath(input.policy), object: input.object }), options));
+            return output.allowed;
+        },
+    });
+}
+function policyPath(input) {
+    return input instanceof Path || typeof input === 'string'
+        ? Path.from(input).raw
+        : Path.project(input).raw;
+}
+//# sourceMappingURL=authorization.js.map

package/dist/auth/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../auth/authorization.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAUzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,CAAC,MAAM,iBAAiB,GAAa,IAAI,CAAC,YAAY,CAC1D,aAAa,EACb,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAC/B,CAAC,GAAG,CAAA;AAEL,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,KAA0B,EAAE,OAAwB;YAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CACxB,iBAAiB,EACjB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EACzE,OAAO,CACR,CAAkC,CAAA;YACnC,OAAO,MAAM,CAAC,OAAO,CAAA;QACvB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAkC;IACpD,OAAO,KAAK,YAAY,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG;QACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAA;AAC7B,CAAC"}

package/dist/auth/credential.d.ts

@@ -0,0 +1,20 @@
+import type { IdentityId, MintedCredential, UnresolvedGrant, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface MintOptions {
+    readonly audience?: string;
+    readonly ttlSeconds: number;
+    readonly grant?: UnresolvedGrant;
+}
+export interface DelegateOptions {
+    readonly audience: string;
+    readonly ttlSeconds: number;
+    readonly attenuation: UnresolvedIdentityExpr;
+}
+export declare const IDENTITY_MINT_PATH: NodePath;
+export declare function credentialApi(call: AuthCall): Readonly<{
+    mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
+    delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
+}>;
+//# sourceMappingURL=credential.d.ts.map

package/dist/auth/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../auth/credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACvB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAM5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAA;CAC7C;AAID,eAAO,MAAM,kBAAkB,EAAE,QAG5B,CAAA;AAEL,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ;gBAEtB,WAAW,YAAY,cAAc;uBAG9B,UAAU,SAAS,eAAe,YAAY,cAAc;GAKxF"}

package/dist/auth/credential.js

@@ -0,0 +1,22 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { syscalls } from '@astrale-os/kernel-core/schema';
+const identityOwner = Path.project(syscalls.identity.whoami.ref.owner);
+export const IDENTITY_MINT_PATH = Path.staticMethod(identityOwner, syscalls.identity.mint.ref.name).raw;
+export function credentialApi(call) {
+    return Object.freeze({
+        async mint(input, options) {
+            return credential(await call(IDENTITY_MINT_PATH, input, options));
+        },
+        async delegate(identity, input, options) {
+            const target = Path.instanceMethod(Path.id(identity), syscalls.identity.delegate.ref.name).raw;
+            return credential(await call(target, input, options));
+        },
+    });
+}
+function credential(input) {
+    if (typeof input !== 'string' || input.length === 0) {
+        throw new TypeError('Identity syscall returned an invalid credential.');
+    }
+    return input;
+}
+//# sourceMappingURL=credential.js.map

package/dist/auth/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../auth/credential.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAiBzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,CAAC,MAAM,kBAAkB,GAAa,IAAI,CAAC,YAAY,CAC3D,aAAa,EACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChC,CAAC,GAAG,CAAA;AAEL,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,KAAkB,EAAE,OAAwB;YACrD,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,KAAyB,EAAE,OAAO,CAAC,CAAC,CAAA;QACvF,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,QAAoB,EAAE,KAAsB,EAAE,OAAwB;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAA;YAC9F,OAAO,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,KAAyB,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3E,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAY;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,KAAyB,CAAA;AAClC,CAAC"}

package/dist/auth/identity.d.ts

@@ -0,0 +1,15 @@
+import type { Identity, IdentitySubject, IssuerId } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export interface WhoisInput {
+    readonly issuer: IssuerId;
+    readonly subject: IdentitySubject;
+}
+export declare const IDENTITY_WHOAMI_PATH: NodePath;
+export declare const IDENTITY_WHOIS_PATH: NodePath;
+export declare function identityApi(call: AuthCall): Readonly<{
+    whoami(options?: RequestOptions): Promise<Identity>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+}>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/auth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../auth/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAM5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAClC;AAID,eAAO,MAAM,oBAAoB,EAAE,QAG9B,CAAA;AACL,eAAO,MAAM,mBAAmB,EAAE,QAG7B,CAAA;AAEL,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ;qBAEf,cAAc;iBAGlB,UAAU,YAAY,cAAc;GAQ1D"}

package/dist/auth/identity.js

@@ -0,0 +1,16 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { syscalls } from '@astrale-os/kernel-core/schema';
+const identityOwner = Path.project(syscalls.identity.whoami.ref.owner);
+export const IDENTITY_WHOAMI_PATH = Path.staticMethod(identityOwner, syscalls.identity.whoami.ref.name).raw;
+export const IDENTITY_WHOIS_PATH = Path.staticMethod(identityOwner, syscalls.identity.whois.ref.name).raw;
+export function identityApi(call) {
+    return Object.freeze({
+        async whoami(options) {
+            return (await call(IDENTITY_WHOAMI_PATH, Object.freeze({}), options));
+        },
+        async whois(input, options) {
+            return (await call(IDENTITY_WHOIS_PATH, input, options));
+        },
+    });
+}
+//# sourceMappingURL=identity.js.map

package/dist/auth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../auth/identity.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAUzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,CAAC,MAAM,oBAAoB,GAAa,IAAI,CAAC,YAAY,CAC7D,aAAa,EACb,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClC,CAAC,GAAG,CAAA;AACL,MAAM,CAAC,MAAM,mBAAmB,GAAa,IAAI,CAAC,YAAY,CAC5D,aAAa,EACb,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CACjC,CAAC,GAAG,CAAA;AAEL,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,OAAwB;YACnC,OAAO,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAwB,CAAA;QAC9F,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAiB,EAAE,OAAwB;YACrD,OAAO,CAAC,MAAM,IAAI,CAChB,mBAAmB,EACnB,KAAyB,EACzB,OAAO,CACR,CAA+B,CAAA;QAClC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -1,16 +1,7 @@
-/**
- * The auth surface — control plane of a bound session view (`view.auth`), pure
- * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
- * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
- * flow imports from one place.
- */
-export { createAuth } from './api.js';
-export { makeAuthShorthands } from './shorthands.js';
-export type { AuthApi } from './api.js';
-export type { Composition } from './composition.js';
-export type { DelegateOpts, MintOpts } from './minting.js';
-export type { CheckInput, GrantInput, Perms, RevokeInput } from './permissions.js';
-export type { AuthShorthands, RequireInput } from './shorthands.js';
-export { cred, self } from '@astrale-os/kernel-core/expression';
-export type { Expr } from '@astrale-os/kernel-core/expression';
+export { createAuth, type AuthApi, type AuthCall } from './auth.js';
+export { IDENTITY_CAN_PATH, type PolicyDecisionInput } from './authorization.js';
+export { IDENTITY_MINT_PATH, type DelegateOptions, type MintOptions } from './credential.js';
+export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH, type WhoisInput } from './identity.js';
+export { IDENTITY_PROVISION_PATH } from './provision.js';
+export type { Identity, IdentityId, IdentitySubject, IssuerId, MintedCredential, ProvisionRequest, ProvisionResult, UnresolvedGrant, UnresolvedIdentityExpr, } from '@astrale-os/kernel-core/auth';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AACvC,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC1D,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAClF,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA;AAC/D,YAAY,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC5F,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAExD,YAAY,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,sBAAsB,GACvB,MAAM,8BAA8B,CAAA"}

package/dist/auth/index.js

@@ -1,10 +1,6 @@
-/**
- * The auth surface — control plane of a bound session view (`view.auth`), pure
- * over a `GraphCall` capability. Re-exports the expression leaves (`self`,
- * `cred`) and builder type (`Expr`) from kernel-core so the composed-authority
- * flow imports from one place.
- */
-export { createAuth } from './api.js';
-export { makeAuthShorthands } from './shorthands.js';
-export { cred, self } from '@astrale-os/kernel-core/expression';
+export { createAuth } from './auth.js';
+export { IDENTITY_CAN_PATH } from './authorization.js';
+export { IDENTITY_MINT_PATH } from './credential.js';
+export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH } from './identity.js';
+export { IDENTITY_PROVISION_PATH } from './provision.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAOpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA+B,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAA4B,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAA0C,MAAM,iBAAiB,CAAA;AAC5F,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAmB,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/provision.d.ts

@@ -0,0 +1,9 @@
+import type { ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export declare const IDENTITY_PROVISION_PATH: NodePath;
+export declare function provisionApi(call: AuthCall): Readonly<{
+    provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
+}>;
+//# sourceMappingURL=provision.d.ts.map

package/dist/auth/provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../auth/provision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAM5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzC,eAAO,MAAM,uBAAuB,EAAE,QAAmD,CAAA;AAEzF,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ;qBAEhB,gBAAgB,YAAY,cAAc;GAQpE"}

package/dist/auth/provision.js

@@ -0,0 +1,11 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { syscalls } from '@astrale-os/kernel-core/schema';
+export const IDENTITY_PROVISION_PATH = Path.project(syscalls.provision.ref).raw;
+export function provisionApi(call) {
+    return Object.freeze({
+        async provision(input, options) {
+            return (await call(IDENTITY_PROVISION_PATH, input, options));
+        },
+    });
+}
+//# sourceMappingURL=provision.js.map

package/dist/auth/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../auth/provision.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAKzD,MAAM,CAAC,MAAM,uBAAuB,GAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;AAEzF,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,SAAS,CAAC,KAAuB,EAAE,OAAwB;YAC/D,OAAO,CAAC,MAAM,IAAI,CAChB,uBAAuB,EACvB,KAAyB,EACzB,OAAO,CACR,CAA+B,CAAA;QAClC,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/client/admission.d.ts

@@ -0,0 +1,5 @@
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { Call } from './request.js';
+/** Parent-private Call acceptance shared by Client and Client Session. */
+export declare function acceptCall(input: Call): protocol.Call;
+//# sourceMappingURL=admission.d.ts.map

package/dist/client/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../../client/admission.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAKzE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAExC,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,CAKrD"}

package/dist/client/admission.js

@@ -0,0 +1,35 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import * as portable from '@astrale-os/kernel-dsl/value';
+/** Parent-private Call acceptance shared by Client and Client Session. */
+export function acceptCall(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError('Client call must be an object.');
+    }
+    return Object.freeze({ target: admitPath(input.target), input: admitInput(input.input) });
+}
+function admitPath(input) {
+    try {
+        // Path is a pure value and may arrive through another package graph or JavaScript realm.
+        return Path.parse(typeof input === 'string' ? input : input.raw).raw;
+    }
+    catch (cause) {
+        throw new TypeError('Client call path must be a NodePath.', { cause });
+    }
+}
+function admitInput(input) {
+    try {
+        return freezeValue(portable.accept(input));
+    }
+    catch (cause) {
+        throw new TypeError('Client input must be a portable Value.', { cause });
+    }
+}
+function freezeValue(input) {
+    if (input !== null && typeof input === 'object' && !Object.isFrozen(input)) {
+        for (const value of Object.values(input))
+            freezeValue(value);
+        Object.freeze(input);
+    }
+    return input;
+}
+//# sourceMappingURL=admission.js.map

package/dist/client/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../client/admission.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAA;AACnD,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAA;AAIxD,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,KAAW;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,IAAI,CAAC;QACH,yFAAyF;QACzF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAA2B,KAAQ;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,WAAW,CAAC,KAAK,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/client/client.d.ts

@@ -1,110 +1,26 @@
-import type { CredentialInput } from '@astrale-os/kernel-core';
-import type { Schema } from '@astrale-os/kernel-dsl';
-import type { SchemaTypedClient } from '../schema/proxy-types.js';
-import type { FunctionSchema } from '../schema/types.js';
-import type { BatchResults, TypedBatchRequest } from './batch.js';
-import type { BoundClientView } from './bound.js';
-import type { CallOptions, ClientConfig } from './config.js';
-import type { BinaryFns, CallFns, FnMap, SendBinaryResult, SendResult, SendStreamResult, SignalFns, StreamFns } from './fn-map.js';
-/**
- * KernelClient — one URL, one kernel. Discriminated `Send*Result`s,
- * no auto-follow, no cross-host pool, no transport fallback. Identity
- * is opaque — the client forwards credentials onto the wire and never
- * inspects, compares, or rotates them.
- *
- * Four facets:
- *  - Lean primitives: `send` / `sendStream` / `sendBinary` / `signal` /
- *    `batch` — surface transport outcomes as-is, no orchestration.
- *  - Identity views: `as(credential)` returns a `BoundClientView` that
- *    curries the credential into every call. A value, not a class.
- *  - Schema proxy: `withSchema(schema)` returns a schema-typed proxy
- *    that throws `UNHANDLED_REDIRECT` on redirect (use `send` for
- *    redirect-aware calls).
- *  - Lifecycle: `disconnect()` releases held resources (open WS).
- */
-export declare class KernelClient<M extends FnMap = FnMap> {
-    readonly url: string;
-    private readonly defaultTimeout;
-    private readonly defaultTransport;
-    private readonly defaultProtocol;
-    private readonly hooks;
-    private readonly codec;
-    private readonly schema;
-    private readonly httpEnvelope;
-    private readonly httpRouted;
-    private readonly wsFactory;
-    private readonly logger;
-    private ws;
-    private wsState;
-    constructor(config: ClientConfig);
-    send<K extends CallFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendResult<M[K]['result']>>;
-    sendStream<K extends StreamFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendStreamResult<M[K]['result']>>;
-    sendBinary<K extends BinaryFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): Promise<SendBinaryResult>;
-    signal<K extends SignalFns<M>>(method: K, params: M[K]['params'], credential: CredentialInput, opts?: CallOptions): void;
-    batch<const Reqs extends readonly TypedBatchRequest<M>[]>(requests: [...Reqs], credential: CredentialInput, opts?: CallOptions): Promise<BatchResults<M, Reqs>>;
-    as(credential: CredentialInput | (() => CredentialInput)): BoundClientView<M>;
-    /**
-     * Return a schema-typed proxy. `defaultCredential` — used by
-     * `BoundClientView.withSchema` — supplies a credential when the
-     * per-call `ProxyCallOptions.credential` is absent. Unbound callers
-     * that provide neither send a no-auth request; the server decides
-     * whether that's valid (per §9.0.1 the client treats credentials as
-     * opaque and never pre-judges them).
-     */
-    withSchema<S extends Schema>(schema: S, defaultCredential?: () => CredentialInput): SchemaTypedClient<S>;
-    describe(method: string): FunctionSchema | undefined;
-    /**
-     * Release any held resources (open WebSocket). Idempotent. The client
-     * stays reusable — a subsequent `send(...)` lazily re-opens a fresh
-     * WebSocket if the default or per-call transport selects `'ws'`. Resets
-     * the `'auto'` probe state so the next call re-probes.
-     */
-    disconnect(): void;
-    private lookupSchema;
-    /**
-     * Resolve the transport instance + request shape for this call.
-     * `canFallback` signals to `dispatchUnary` that a WS `ConnectionError`
-     * on this attempt should retry on HTTP (auto-mode probe only).
-     */
-    private selectTransport;
-    /**
-     * Resolve `CallTransport` to a concrete envelope pipe. Binary is always
-     * HTTP (server-side WS binary unimplemented). In `'auto'+unknown`, signal
-     * stays on HTTP — fire-and-forget can't communicate fallback.
-     */
-    private resolveEnvelopePipe;
-    private envelopeWs;
-    private buildEnvelopeRequest;
-    private buildRoutedRequest;
-    /**
-     * Unary dispatch (call / stream / binary). Selects transport, fires
-     * `onBeforeSend`, awaits the transport, freezes the result (deeply,
-     * including `meta.wire`), wraps streams in the observability
-     * iterator, fires `onAfterReceive`, and decorates errors with
-     * `ClientErrorDetails` if the transport didn't already.
-     */
-    private dispatchUnary;
-    /**
-     * One dispatch attempt: hooks + wire + freeze. `fireErrorHook = false`
-     * suppresses `onError` so a recovered auto-mode WS probe failure doesn't
-     * surface as a phantom error when the fallback HTTP call succeeds.
-     */
-    private dispatchOnce;
-    private beforeCtx;
-    /**
-     * Wrap a stream iterable so each chunk fires `onStreamFrame`. Errors
-     * during hook evaluation are swallowed per the hook contract (pure
-     * observation); a hook that misbehaves never aborts the stream.
-     */
-    private instrumentStream;
-    private runHooks;
-    /**
-     * Log a hook-layer failure. Only the error's name + message are
-     * surfaced — the error may chain a `cause` that captured a credential
-     * or other sensitive ref by closure, and the client never leaks those
-     * per §9.0.1. Consumers who need full diagnostics provide a
-     * `logger` with their own redaction policy.
-     */
-    private logHookError;
+import type { Binary, Input, Result, Stream } from '@astrale-os/kernel-ports/functions';
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { Transport } from '../transport/index.js';
+import type { AuthenticatedClient, RemoteCredential } from './credential.js';
+import type { Call, ClientDispatchOptions } from './request.js';
+import { type HttpTransportOptions } from '../transport/http/index.js';
+export type ClientOptions = HttpTransportOptions | {
+    readonly transport: Transport;
+};
+/** Package-private redirect continuation path; intentionally absent from the public Client facade. */
+export declare function dispatchTrace(client: Client, credential: RemoteCredential | undefined, call: Call, options: ClientDispatchOptions | undefined, trace: protocol.Trace): Promise<Result>;
+/** Pure client for the universal remote Function invocation boundary. */
+export declare class Client implements AuthenticatedClient {
+    private readonly transport;
+    private readonly lifecycle;
+    private closed;
+    constructor(options: ClientOptions);
+    dispatch(call: Call, options?: ClientDispatchOptions): Promise<Result>;
+    call(call: Call, options?: ClientDispatchOptions): Promise<Input>;
+    stream(call: Call, options?: ClientDispatchOptions): Promise<Stream>;
+    binary(call: Call, options?: ClientDispatchOptions): Promise<Binary>;
+    as(credential: RemoteCredential): AuthenticatedClient;
+    close(): void;
+    private dispatchWith;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAIpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAyC,MAAM,aAAa,CAAA;AACnG,OAAO,KAAK,EACV,SAAS,EACT,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,SAAS,EACV,MAAM,aAAa,CAAA;AAwBpB;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,YAAY,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAe;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,EAAE,CAAmC;IAC7C,OAAO,CAAC,OAAO,CAAkD;IAEjE,YAAY,MAAM,EAAE,YAAY,EAsC/B;IAIK,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAC7B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAIrC;IAEK,UAAU,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EACrC,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAI3C;IAEK,UAAU,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EACrC,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;IAED,MAAM,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAC3B,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACtB,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,IAAI,CAcN;IAEK,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,SAAS,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAC5D,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,EACnB,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CA0BhC;IAID,EAAE,CAAC,UAAU,EAAE,eAAe,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAE5E;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,SAAS,MAAM,EACzB,MAAM,EAAE,CAAC,EACT,iBAAiB,CAAC,EAAE,MAAM,eAAe,GACxC,iBAAiB,CAAC,CAAC,CAAC,CA+BtB;IAED,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEnD;IAID;;;;;OAKG;IACH,UAAU,IAAI,IAAI,CAMjB;IAID,OAAO,CAAC,YAAY;IAIpB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAuCvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,oBAAoB;IA0B5B,OAAO,CAAC,kBAAkB;IAoB1B;;;;;;OAMG;YACW,aAAa;IA6B3B;;;;OAIG;YACW,YAAY;IAiE1B,OAAO,CAAC,SAAS;IAkBjB;;;;OAIG;YACY,gBAAgB;YAmBjB,QAAQ;IAatB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;CAIrB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../client/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAA;AACvF,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAG/D,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAMrF,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAA;AAYpF,sGAAsG;AACtG,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,gBAAgB,GAAG,SAAS,EACxC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,KAAK,EAAE,QAAQ,CAAC,KAAK,GACpB,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,yEAAyE;AACzE,qBAAa,MAAO,YAAW,mBAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,MAAM,CAAQ;IAEtB,YAAY,OAAO,EAAE,aAAa,EAUjC;IAED,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAErE;IAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,CAEhE;IAED,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;IAED,EAAE,CAAC,UAAU,EAAE,gBAAgB,GAAG,mBAAmB,CAKpD;IAED,KAAK,IAAI,IAAI,CAMZ;YAEa,YAAY;CAqB3B"}