@astrale-os/kernel-core 0.4.1

package/dist/auth/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA"}

package/dist/auth/credentials/index.js

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './envelope';
+export * from './errors';
+export * from './decode';
+export * from './verify';
+//# sourceMappingURL=index.js.map

package/dist/auth/credentials/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA"}

package/dist/auth/credentials/types.d.ts

@@ -0,0 +1,19 @@
+import type { IssuerId } from '#auth/issuers';
+export type CredentialInput = string | Uint8Array;
+export type Credential = {
+    iss: IssuerId;
+    sub: string;
+    aud?: string | string[];
+    claims: Record<string, unknown>;
+};
+export type MintedCredential = string & {
+    readonly __minted: true;
+};
+export type VerifiedCredential = Credential;
+export type DecodedCredentialClaims = {
+    iss?: IssuerId | undefined;
+    sub?: string;
+    aud?: string | string[];
+    claims: Record<string, unknown>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/credentials/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAA;AAEjD,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,QAAQ,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAA;AACnE,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAE3C,MAAM,MAAM,uBAAuB,GAAG;IACpC,GAAG,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA"}

package/dist/auth/credentials/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/credentials/types.ts"],"names":[],"mappings":""}

package/dist/auth/credentials/verify.d.ts

@@ -0,0 +1,16 @@
+import type { FlattenedJWSInput, JWSHeaderParameters, GetKeyFunction } from 'jose';
+import type { IssuerId } from '#auth/issuers';
+import type { PublicKey } from '#auth/jwks';
+import type { AuthenticationMethod } from '#auth/methods/registry';
+import type { CredentialMethodResolver } from '#auth/methods/resolver';
+import type { CredentialInput, VerifiedCredential } from './types';
+/** jose-compatible key resolver returned by createLocalJWKSet / createRemoteJWKSet. */
+export type JWKSResolver = GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
+export type ResolveKeys = (issuer: IssuerId, method: AuthenticationMethod, kid?: string) => Promise<JWKSResolver>;
+export interface VerifyCredentialDeps {
+    methodResolver: CredentialMethodResolver;
+    resolveKeys: ResolveKeys;
+}
+export declare function verifyCredential(deps: VerifyCredentialDeps, credential: CredentialInput): Promise<VerifiedCredential>;
+export declare function verifyPublicCredential(methodResolver: CredentialMethodResolver, credential: CredentialInput, publicKey: PublicKey): Promise<VerifiedCredential>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/auth/credentials/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../auth/credentials/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,MAAM,CAAA;AAElF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAIlE,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAA;AAEjF,MAAM,MAAM,WAAW,GAAG,CACxB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,oBAAoB,EAC5B,GAAG,CAAC,EAAE,MAAM,KACT,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1B,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,wBAAwB,CAAA;IACxC,WAAW,EAAE,WAAW,CAAA;CACzB;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,oBAAoB,EAC1B,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAI7B;AAED,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,wBAAwB,EACxC,UAAU,EAAE,eAAe,EAC3B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAI7B"}

package/dist/auth/credentials/verify.js

@@ -0,0 +1,12 @@
+import { CredentialEnvelope } from './envelope';
+export async function verifyCredential(deps, credential) {
+    const envelope = new CredentialEnvelope(credential);
+    const method = deps.methodResolver.resolve(envelope);
+    return method.verify(envelope, (issuer, kid) => deps.resolveKeys(issuer, method.kind, kid));
+}
+export async function verifyPublicCredential(methodResolver, credential, publicKey) {
+    const envelope = new CredentialEnvelope(credential);
+    const method = methodResolver.resolve(envelope);
+    return method.verifyWithKey(envelope, publicKey);
+}
+//# sourceMappingURL=verify.js.map

package/dist/auth/credentials/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../auth/credentials/verify.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAgB/C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAA0B,EAC1B,UAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,cAAwC,EACxC,UAA2B,EAC3B,SAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AAClD,CAAC"}

package/dist/auth/delegation/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/delegation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/delegation/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/auth/delegation/index.js

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.js.map

package/dist/auth/delegation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/delegation/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/auth/delegation/types.d.ts

@@ -0,0 +1,6 @@
+import type { CredentialInput } from '#auth/credentials';
+export type DelegationCredential = CredentialInput;
+export type Delegation = {
+    credential: DelegationCredential;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/delegation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/delegation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAElD,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAA"}

package/dist/auth/delegation/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/delegation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/delegation/types.ts"],"names":[],"mappings":""}

package/dist/auth/expression/buffer.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Generic binary buffer utilities for varint-based encoding.
+ *
+ * Zero-dependency reader/writer with chunked allocation and LEB128 varint support.
+ */
+export declare class BufferWriter {
+    private chunks;
+    private current;
+    private offset;
+    private static readonly encoder;
+    constructor(initialSize?: number);
+    private ensureCapacity;
+    writeByte(value: number): void;
+    writeVarint(value: number): void;
+    writeString(str: string): void;
+    toUint8Array(): Uint8Array;
+}
+export declare class BufferReader {
+    private buffer;
+    private offset;
+    private static readonly decoder;
+    constructor(buffer: Uint8Array);
+    get remaining(): number;
+    readByte(): number;
+    readVarint(): number;
+    readString(): string;
+}
+//# sourceMappingURL=buffer.d.ts.map

package/dist/auth/expression/buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../auth/expression/buffer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,OAAO,CAAY;IAC3B,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAEnD,YAAY,WAAW,GAAE,MAAY,EAEpC;IAED,OAAO,CAAC,cAAc;IAUtB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7B;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAM/B;IAED,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM7B;IAED,YAAY,IAAI,UAAU,CAWzB;CACF;AAMD,qBAAa,YAAY;IAIX,OAAO,CAAC,MAAM;IAH1B,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAEnD,YAAoB,MAAM,EAAE,UAAU,EAAI;IAE1C,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,QAAQ,IAAI,MAAM,CAKjB;IAED,UAAU,IAAI,MAAM,CAenB;IAED,UAAU,IAAI,MAAM,CASnB;CACF"}

package/dist/auth/expression/buffer.js

@@ -0,0 +1,101 @@
+/**
+ * Generic binary buffer utilities for varint-based encoding.
+ *
+ * Zero-dependency reader/writer with chunked allocation and LEB128 varint support.
+ */
+// =============================================================================
+// BUFFER WRITER
+// =============================================================================
+export class BufferWriter {
+    chunks = [];
+    current;
+    offset = 0;
+    static encoder = new TextEncoder();
+    constructor(initialSize = 256) {
+        this.current = new Uint8Array(initialSize);
+    }
+    ensureCapacity(needed) {
+        if (this.offset + needed <= this.current.length)
+            return;
+        // Save current chunk and allocate new one
+        this.chunks.push(this.current.subarray(0, this.offset));
+        const newSize = Math.max(this.current.length * 2, needed);
+        this.current = new Uint8Array(newSize);
+        this.offset = 0;
+    }
+    writeByte(value) {
+        this.ensureCapacity(1);
+        this.current[this.offset++] = value & 0xff;
+    }
+    writeVarint(value) {
+        while (value >= 0x80) {
+            this.writeByte((value & 0x7f) | 0x80);
+            value >>>= 7;
+        }
+        this.writeByte(value);
+    }
+    writeString(str) {
+        const bytes = BufferWriter.encoder.encode(str);
+        this.writeVarint(bytes.length);
+        this.ensureCapacity(bytes.length);
+        this.current.set(bytes, this.offset);
+        this.offset += bytes.length;
+    }
+    toUint8Array() {
+        // Combine all chunks
+        const totalLength = this.chunks.reduce((sum, c) => sum + c.length, 0) + this.offset;
+        const result = new Uint8Array(totalLength);
+        let pos = 0;
+        for (const chunk of this.chunks) {
+            result.set(chunk, pos);
+            pos += chunk.length;
+        }
+        result.set(this.current.subarray(0, this.offset), pos);
+        return result;
+    }
+}
+// =============================================================================
+// BUFFER READER
+// =============================================================================
+export class BufferReader {
+    buffer;
+    offset = 0;
+    static decoder = new TextDecoder();
+    constructor(buffer) {
+        this.buffer = buffer;
+    }
+    get remaining() {
+        return this.buffer.length - this.offset;
+    }
+    readByte() {
+        if (this.offset >= this.buffer.length) {
+            throw new Error('Unexpected end of buffer');
+        }
+        return this.buffer[this.offset++];
+    }
+    readVarint() {
+        let result = 0;
+        let shift = 0;
+        let byte;
+        do {
+            if (shift >= 35) {
+                throw new Error('Varint too long, possible data corruption');
+            }
+            byte = this.readByte();
+            result |= (byte & 0x7f) << shift;
+            shift += 7;
+        } while (byte >= 0x80);
+        return result >>> 0; // Ensure unsigned
+    }
+    readString() {
+        const length = this.readVarint();
+        // Use subtraction to avoid potential overflow with addition
+        if (length > this.buffer.length - this.offset) {
+            throw new Error('String length exceeds buffer');
+        }
+        const bytes = this.buffer.subarray(this.offset, this.offset + length);
+        this.offset += length;
+        return BufferReader.decoder.decode(bytes);
+    }
+}
+//# sourceMappingURL=buffer.js.map

package/dist/auth/expression/buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../auth/expression/buffer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,OAAO,YAAY;IACf,MAAM,GAAiB,EAAE,CAAA;IACzB,OAAO,CAAY;IACnB,MAAM,GAAW,CAAC,CAAA;IAClB,MAAM,CAAU,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IAEnD,YAAY,WAAW,GAAW,GAAG;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;IAC5C,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAM;QAEvD,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACjB,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;YACrC,KAAK,MAAM,CAAC,CAAA;QACd,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC;IAED,WAAW,CAAC,GAAW;QACrB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;IAC7B,CAAC;IAED,YAAY;QACV,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;QACnF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAA;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAA;QACX,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACtB,GAAG,IAAI,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;QACtD,OAAO,MAAM,CAAA;IACf,CAAC;CACF;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,OAAO,YAAY;IAIH,MAAM;IAHlB,MAAM,GAAW,CAAC,CAAA;IAClB,MAAM,CAAU,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IAEnD,YAAoB,MAAkB;sBAAlB,MAAM;IAAe,CAAC;IAE1C,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACzC,CAAC;IAED,QAAQ;QACN,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAE,CAAA;IACpC,CAAC;IAED,UAAU;QACR,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,IAAY,CAAA;QAEhB,GAAG,CAAC;YACF,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;YACtB,MAAM,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAA;YAChC,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAC;QAEtB,OAAO,MAAM,KAAK,CAAC,CAAA,CAAC,kBAAkB;IACxC,CAAC;IAED,UAAU;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAChC,4DAA4D;QAC5D,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAA;QACrB,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;CACF"}

package/dist/auth/expression/builder.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Fluent SDK for Identity Expression Composition
+ *
+ * Provides a builder pattern for composing identity expressions with
+ * union, intersect, exclude, and scope operations. Supports method chaining
+ * and factory functions for flexible expression building.
+ *
+ * @example
+ * ```typescript
+ * // Factory functions
+ * const expr = union(
+ *   identity("X").scope({ nodes: ["node-A"] }),
+ *   identity("Y")
+ * )
+ *
+ * // Method chaining
+ * const expr2 = identity("A")
+ *   .union(identity("B"))
+ *   .intersect(identity("C"))
+ *   .exclude(identity("D"))
+ *
+ * // Build to raw IdentityExpr
+ * const rawExpr = expr.build()
+ * ```
+ */
+import type { Grant } from '#auth/grants';
+import type { IdentityId } from '#ids';
+import type { IdentityExpr, Scope } from './types';
+/**
+ * Interface for expression builders.
+ * Used to distinguish builders from raw IdentityExpr in evalExpr.
+ */
+export interface ExprBuilder {
+    build(): IdentityExpr;
+}
+/**
+ * Type guard to check if value is an ExprBuilder.
+ */
+export declare function isExprBuilder(value: unknown): value is ExprBuilder;
+/**
+ * Base class for all expression builders.
+ * Provides composition methods (union, intersect, exclude, scope) available on all expressions.
+ */
+export declare abstract class Expr implements ExprBuilder {
+    abstract build(): IdentityExpr;
+    /**
+     * Create a union of this expression with another.
+     * A ∪ B: grants access if either A or B grants access.
+     * Flattens nested unions: (A ∪ B) ∪ C → union([A, B, C])
+     */
+    union(other: Expr): Expr;
+    /**
+     * Create an intersection of this expression with another.
+     * A ∩ B: grants access only if both A and B grant access.
+     * Flattens nested intersects: (A ∩ B) ∩ C → intersect([A, B, C])
+     */
+    intersect(other: Expr): Expr;
+    /**
+     * Exclude another expression from this one.
+     * A \ B: grants access if A grants but B does not.
+     * Flattens chained excludes: (A \ B) \ C → exclude(A, [B, C])
+     */
+    exclude(other: Expr): Expr;
+    /**
+     * Wrap this expression with a scope restriction.
+     * Returns a ScopeExpr. Chaining .scope() accumulates scopes (OR'd).
+     */
+    scope(s: Scope): ScopeExpr;
+}
+/**
+ * Builder for identity leaf expressions.
+ * Represents a single identity.
+ */
+export declare class IdentityExprBuilder extends Expr {
+    private readonly id;
+    constructor(id: IdentityId);
+    build(): IdentityExpr;
+}
+/**
+ * Builder for scope-wrapped expressions.
+ * Wraps an inner expression with scope restrictions (OR'd).
+ */
+export declare class ScopeExpr extends Expr {
+    readonly scopes: Scope[];
+    private readonly inner;
+    constructor(scopes: Scope[], inner: Expr);
+    /**
+     * Add another scope (OR'd with existing scopes).
+     * Returns a new ScopeExpr (immutable).
+     */
+    scope(s: Scope): ScopeExpr;
+    build(): IdentityExpr;
+}
+/**
+ * Wrapper for raw IdentityExpr values.
+ * Allows mixing raw expressions (e.g., from evalIdentity) with builders.
+ */
+export declare class RawExpr extends Expr {
+    private readonly expr;
+    constructor(expr: IdentityExpr);
+    build(): IdentityExpr;
+}
+/**
+ * Builder for n-ary expressions (union, intersect).
+ */
+export declare class NaryExpr extends Expr {
+    readonly kind: 'union' | 'intersect';
+    readonly operands: Expr[];
+    constructor(kind: 'union' | 'intersect', operands: Expr[]);
+    build(): IdentityExpr;
+}
+/**
+ * Builder for exclude expressions (base \ excluded[]).
+ */
+export declare class ExcludeExpr extends Expr {
+    readonly base: Expr;
+    readonly excluded: Expr[];
+    constructor(base: Expr, excluded: Expr[]);
+    build(): IdentityExpr;
+}
+/**
+ * Create an identity leaf expression.
+ *
+ * @param id - The identity ID
+ * @param scopes - Optional scope restriction(s). If provided, wraps in a scope node.
+ *
+ * @example
+ * ```typescript
+ * identity("USER1")
+ * identity("USER1", { nodes: ["ws1"] })
+ * identity("USER1", [{ nodes: ["ws1"] }, { perms: 1 }])
+ * ```
+ */
+export declare function identity(id: IdentityId, scopes?: Scope | Scope[]): Expr;
+/**
+ * Alias for identity() - shorter form.
+ */
+export declare const id: typeof identity;
+/**
+ * Wrap a raw IdentityExpr in an Expr builder.
+ * Useful for mixing resolved expressions with builders.
+ *
+ * @param expr - A raw IdentityExpr (e.g., from evalIdentity or evalExpr)
+ */
+export declare function raw(expr: IdentityExpr): Expr;
+/**
+ * Create a union of multiple expressions.
+ * Variadic: union(a, b, c) = union([a, b, c])
+ *
+ * @throws Error if fewer than 2 expressions provided
+ */
+export declare function union(...exprs: Expr[]): Expr;
+/**
+ * Create an intersection of multiple expressions.
+ * Variadic: intersect(a, b, c) = intersect([a, b, c])
+ *
+ * @throws Error if fewer than 2 expressions provided
+ */
+export declare function intersect(...exprs: Expr[]): Expr;
+/**
+ * Create an exclude expression.
+ * exclude(base, excluded) = base \ excluded
+ */
+export declare function exclude(base: Expr, excluded: Expr): Expr;
+/**
+ * Builder for creating Grant objects with a single expression.
+ */
+export declare class GrantBuilder {
+    private readonly expr;
+    constructor(expr: Expr);
+    build(): Grant;
+}
+/**
+ * Create a GrantBuilder for composing a grant expression.
+ */
+export declare function grant(expr: Expr): GrantBuilder;
+//# sourceMappingURL=builder.d.ts.map

package/dist/auth/expression/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../auth/expression/builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAMlD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,IAAI,YAAY,CAAA;CACtB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAMD;;;GAGG;AACH,8BAAsB,IAAK,YAAW,WAAW;IAC/C,QAAQ,CAAC,KAAK,IAAI,YAAY,CAAA;IAE9B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAKvB;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAK3B;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAKzB;IAED;;;OAGG;IACH,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,CAEzB;CACF;AAMD;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,IAAI;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,UAAU,EAE1C;IAED,KAAK,IAAI,YAAY,CAEpB;CACF;AAMD;;;GAGG;AACH,qBAAa,SAAU,SAAQ,IAAI;IAE/B,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACW,MAAM,EAAE,KAAK,EAAE,EACP,KAAK,EAAE,IAAI,EAG7B;IAED;;;OAGG;IACM,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,CAElC;IAED,KAAK,IAAI,YAAY,CAEpB;CACF;AAMD;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,IAAI;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,YAAY,EAE9C;IAED,KAAK,IAAI,YAAY,CAEpB;CACF;AAMD;;GAEG;AACH,qBAAa,QAAS,SAAQ,IAAI;IAE9B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE;IAF3B,YACW,IAAI,EAAE,OAAO,GAAG,WAAW,EAC3B,QAAQ,EAAE,IAAI,EAAE,EAG1B;IAED,KAAK,IAAI,YAAY,CAKpB;CACF;AAMD;;GAEG;AACH,qBAAa,WAAY,SAAQ,IAAI;IAEjC,QAAQ,CAAC,IAAI,EAAE,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE;IAF3B,YACW,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,IAAI,EAAE,EAG1B;IAED,KAAK,IAAI,YAAY,CAMpB;CACF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,IAAI,CAYvE;AAED;;GAEG;AACH,eAAO,MAAM,EAAE,iBAAW,CAAA;AAE1B;;;;;GAKG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAQ5C;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAK5C;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAKhD;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,IAAI,CAExD;AAMD;;GAEG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,IAAI,EAAI;IAE3C,KAAK,IAAI,KAAK,CAEb;CACF;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,CAE9C"}