@astrale-os/kernel-core 0.4.1

package/dist/auth/frozen/errors.d.ts

@@ -0,0 +1,5 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export declare class FrozenIdentityError extends AuthenticationError {
+    constructor();
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/frozen/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/frozen/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,qBAAa,mBAAoB,SAAQ,mBAAmB;IAC1D,cAGC;CACF"}

package/dist/auth/frozen/errors.js

@@ -0,0 +1,8 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export class FrozenIdentityError extends AuthenticationError {
+    constructor() {
+        super('Identity is frozen', 'FROZEN_IDENTITY');
+        this.name = 'FrozenIdentityError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/frozen/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/frozen/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D;QACE,KAAK,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF"}

package/dist/auth/frozen/index.d.ts

@@ -0,0 +1,3 @@
+export * from './verify-frozen';
+export * from './errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/frozen/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/frozen/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,UAAU,CAAA"}

package/dist/auth/frozen/index.js

@@ -0,0 +1,3 @@
+export * from './verify-frozen';
+export * from './errors';
+//# sourceMappingURL=index.js.map

package/dist/auth/frozen/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/frozen/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,UAAU,CAAA"}

package/dist/auth/frozen/verify-frozen.d.ts

@@ -0,0 +1,9 @@
+import type { Identity } from '#auth/identity/types';
+/**
+ * Verify that an identity is not frozen.
+ *
+ * @param identity - The identity to verify.
+ * @throws FrozenIdentityError if the identity is frozen.
+ */
+export declare function verifyFrozen(identity: Identity): void;
+//# sourceMappingURL=verify-frozen.d.ts.map

package/dist/auth/frozen/verify-frozen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-frozen.d.ts","sourceRoot":"","sources":["../../../auth/frozen/verify-frozen.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAIpD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAIrD"}

package/dist/auth/frozen/verify-frozen.js

@@ -0,0 +1,13 @@
+import { FrozenIdentityError } from './errors';
+/**
+ * Verify that an identity is not frozen.
+ *
+ * @param identity - The identity to verify.
+ * @throws FrozenIdentityError if the identity is frozen.
+ */
+export function verifyFrozen(identity) {
+    if (identity.props.frozen) {
+        throw new FrozenIdentityError();
+    }
+}
+//# sourceMappingURL=verify-frozen.js.map

package/dist/auth/frozen/verify-frozen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-frozen.js","sourceRoot":"","sources":["../../../auth/frozen/verify-frozen.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,EAAE,CAAA;IACjC,CAAC;AACH,CAAC"}

package/dist/auth/grants/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const MAX_GRANT_EXPR_DEPTH = 32;
+export declare const MAX_GRANT_EXPR_OPERANDS = 64;
+export declare const MAX_CREDENTIAL_NESTING_DEPTH = 3;
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/grants/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../auth/grants/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,uBAAuB,KAAK,CAAA;AACzC,eAAO,MAAM,4BAA4B,IAAI,CAAA"}

package/dist/auth/grants/constants.js

@@ -0,0 +1,4 @@
+export const MAX_GRANT_EXPR_DEPTH = 32;
+export const MAX_GRANT_EXPR_OPERANDS = 64;
+export const MAX_CREDENTIAL_NESTING_DEPTH = 3;
+//# sourceMappingURL=constants.js.map

package/dist/auth/grants/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../auth/grants/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAA"}

package/dist/auth/grants/errors.d.ts

@@ -0,0 +1,57 @@
+import type { IssuerId } from '#auth/issuers';
+import { AuthenticationError } from '#auth/credentials/errors';
+export declare class UnknownGrantExpressionKindError extends AuthenticationError {
+    readonly kind: unknown;
+    readonly phase: 'decode' | 'primary_identity_extraction';
+    constructor(kind: unknown, phase: 'decode' | 'primary_identity_extraction');
+}
+export declare class InvalidGrantStructureError extends AuthenticationError {
+    constructor(message: string);
+}
+export declare class UnsupportedGrantVersionError extends AuthenticationError {
+    readonly version: unknown;
+    constructor(version: unknown);
+}
+/** Top-level credential has no `.grant` claim — not a valid kernel bearer. */
+export declare class MissingGrantClaimError extends AuthenticationError {
+    readonly principal: string;
+    readonly issuer: IssuerId;
+    constructor(principal: string, issuer: IssuerId);
+}
+export declare class CredentialNestingDepthExceededError extends AuthenticationError {
+    readonly depth: number;
+    readonly maxDepth: number;
+    constructor(depth: number, maxDepth: number);
+}
+export declare class NestedCredentialIssuerMismatchError extends AuthenticationError {
+    readonly actual: IssuerId;
+    readonly expected: IssuerId;
+    constructor(actual: IssuerId, expected: IssuerId);
+}
+export declare class NestedCredentialIdentityNotFoundError extends AuthenticationError {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    constructor(issuer: IssuerId, subject: string);
+}
+/** Nested `Cred(...)` leaf carried `.grant` (Kind A) instead of `.delegation` (Kind C). */
+export declare class NestedCredentialShapeMismatchError extends AuthenticationError {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    constructor(issuer: IssuerId, subject: string);
+}
+/**
+ * Thrown at MINT time when a `Cred(...)` leaf embedded in a mint params
+ * expression fails verification or is not kernel-signed.
+ *
+ * The resolver's `NestedCredentialIssuerMismatchError` covers the same
+ * condition at VERIFY time — this variant exists to fail fast when a
+ * caller tries to mint a credential that would be structurally unusable.
+ * Distinguishing the two at the error level keeps mint-time caller bugs
+ * separable from verify-time attacker traffic in logs and metrics.
+ */
+export declare class InvalidNestedCredentialAtMintError extends AuthenticationError {
+    readonly reason: string;
+    readonly actualIssuer?: IssuerId | undefined;
+    constructor(reason: string, actualIssuer?: IssuerId | undefined);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/grants/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/grants/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAM9D,qBAAa,+BAAgC,SAAQ,mBAAmB;IAEpE,QAAQ,CAAC,IAAI,EAAE,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,6BAA6B;IAF1D,YACW,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,QAAQ,GAAG,6BAA6B,EAOzD;CACF;AAED,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,4BAA6B,SAAQ,mBAAmB;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO;IAArC,YAAqB,OAAO,EAAE,OAAO,EAGpC;CACF;AAED,8EAA8E;AAC9E,qBAAa,sBAAuB,SAAQ,mBAAmB;IAE3D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ;IAF3B,YACW,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,QAAQ,EAO1B;CACF;AAMD,qBAAa,mCAAoC,SAAQ,mBAAmB;IAExE,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAO1B;CACF;AAED,qBAAa,mCAAoC,SAAQ,mBAAmB;IAExE,QAAQ,CAAC,MAAM,EAAE,QAAQ;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ;IAF7B,YACW,MAAM,EAAE,QAAQ,EAChB,QAAQ,EAAE,QAAQ,EAO5B;CACF;AAED,qBAAa,qCAAsC,SAAQ,mBAAmB;IAE1E,QAAQ,CAAC,MAAM,EAAE,QAAQ;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAF1B,YACW,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAOzB;CACF;AAED,2FAA2F;AAC3F,qBAAa,kCAAmC,SAAQ,mBAAmB;IAEvE,QAAQ,CAAC,MAAM,EAAE,QAAQ;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAF1B,YACW,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAQzB;CACF;AAED;;;;;;;;;GASG;AACH,qBAAa,kCAAmC,SAAQ,mBAAmB;IAEvE,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ;IAFlC,YACW,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,QAAQ,YAAA,EAQjC;CACF"}

package/dist/auth/grants/errors.js

@@ -0,0 +1,106 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+// =============================================================================
+// GRANT STRUCTURE ERRORS
+// =============================================================================
+export class UnknownGrantExpressionKindError extends AuthenticationError {
+    kind;
+    phase;
+    constructor(kind, phase) {
+        super(`Unknown grant expression kind during ${phase}: ${String(kind)}`, 'UNKNOWN_GRANT_EXPR_KIND');
+        this.kind = kind;
+        this.phase = phase;
+        this.name = 'UnknownGrantExpressionKindError';
+    }
+}
+export class InvalidGrantStructureError extends AuthenticationError {
+    constructor(message) {
+        super(message, 'INVALID_GRANT_STRUCTURE');
+        this.name = 'InvalidGrantStructureError';
+    }
+}
+export class UnsupportedGrantVersionError extends AuthenticationError {
+    version;
+    constructor(version) {
+        super(`Unsupported grant version: ${String(version)}`, 'UNSUPPORTED_GRANT_VERSION');
+        this.version = version;
+        this.name = 'UnsupportedGrantVersionError';
+    }
+}
+/** Top-level credential has no `.grant` claim — not a valid kernel bearer. */
+export class MissingGrantClaimError extends AuthenticationError {
+    principal;
+    issuer;
+    constructor(principal, issuer) {
+        super(`Credential is missing required ".grant" claim: principal="${principal}", issuer="${issuer}"`, 'MISSING_GRANT_CLAIM');
+        this.principal = principal;
+        this.issuer = issuer;
+        this.name = 'MissingGrantClaimError';
+    }
+}
+// =============================================================================
+// CREDENTIAL RESOLUTION ERRORS
+// =============================================================================
+export class CredentialNestingDepthExceededError extends AuthenticationError {
+    depth;
+    maxDepth;
+    constructor(depth, maxDepth) {
+        super(`Credential nesting depth ${depth} exceeds maximum ${maxDepth}`, 'CREDENTIAL_NESTING_DEPTH_EXCEEDED');
+        this.depth = depth;
+        this.maxDepth = maxDepth;
+        this.name = 'CredentialNestingDepthExceededError';
+    }
+}
+export class NestedCredentialIssuerMismatchError extends AuthenticationError {
+    actual;
+    expected;
+    constructor(actual, expected) {
+        super(`Nested credential issuer "${actual}" does not match kernel issuer "${expected}"`, 'NESTED_CREDENTIAL_ISSUER_MISMATCH');
+        this.actual = actual;
+        this.expected = expected;
+        this.name = 'NestedCredentialIssuerMismatchError';
+    }
+}
+export class NestedCredentialIdentityNotFoundError extends AuthenticationError {
+    issuer;
+    subject;
+    constructor(issuer, subject) {
+        super(`Identity not found for nested credential: issuer="${issuer}", subject="${subject}"`, 'NESTED_CREDENTIAL_IDENTITY_NOT_FOUND');
+        this.issuer = issuer;
+        this.subject = subject;
+        this.name = 'NestedCredentialIdentityNotFoundError';
+    }
+}
+/** Nested `Cred(...)` leaf carried `.grant` (Kind A) instead of `.delegation` (Kind C). */
+export class NestedCredentialShapeMismatchError extends AuthenticationError {
+    issuer;
+    subject;
+    constructor(issuer, subject) {
+        super(`Nested credential must carry "delegation" claim, not "grant": ` +
+            `issuer="${issuer}", subject="${subject}"`, 'NESTED_CREDENTIAL_SHAPE_MISMATCH');
+        this.issuer = issuer;
+        this.subject = subject;
+        this.name = 'NestedCredentialShapeMismatchError';
+    }
+}
+/**
+ * Thrown at MINT time when a `Cred(...)` leaf embedded in a mint params
+ * expression fails verification or is not kernel-signed.
+ *
+ * The resolver's `NestedCredentialIssuerMismatchError` covers the same
+ * condition at VERIFY time — this variant exists to fail fast when a
+ * caller tries to mint a credential that would be structurally unusable.
+ * Distinguishing the two at the error level keeps mint-time caller bugs
+ * separable from verify-time attacker traffic in logs and metrics.
+ */
+export class InvalidNestedCredentialAtMintError extends AuthenticationError {
+    reason;
+    actualIssuer;
+    constructor(reason, actualIssuer) {
+        super(`Invalid nested credential in mint params: ${reason}` +
+            (actualIssuer ? ` (issuer="${actualIssuer}")` : ''), 'INVALID_NESTED_CREDENTIAL_AT_MINT');
+        this.reason = reason;
+        this.actualIssuer = actualIssuer;
+        this.name = 'InvalidNestedCredentialAtMintError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/grants/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/grants/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,OAAO,+BAAgC,SAAQ,mBAAmB;IAE3D,IAAI;IACJ,KAAK;IAFhB,YACW,IAAa,EACb,KAA+C;QAExD,KAAK,CACH,wCAAwC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,EAChE,yBAAyB,CAC1B,CAAA;oBANQ,IAAI;qBACJ,KAAK;QAMd,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,mBAAmB;IAC9C,OAAO;IAA5B,YAAqB,OAAgB;QACnC,KAAK,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;uBADhE,OAAO;QAE1B,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAElD,SAAS;IACT,MAAM;IAFjB,YACW,SAAiB,EACjB,MAAgB;QAEzB,KAAK,CACH,6DAA6D,SAAS,cAAc,MAAM,GAAG,EAC7F,qBAAqB,CACtB,CAAA;yBANQ,SAAS;sBACT,MAAM;QAMf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,MAAM,OAAO,mCAAoC,SAAQ,mBAAmB;IAE/D,KAAK;IACL,QAAQ;IAFnB,YACW,KAAa,EACb,QAAgB;QAEzB,KAAK,CACH,4BAA4B,KAAK,oBAAoB,QAAQ,EAAE,EAC/D,mCAAmC,CACpC,CAAA;qBANQ,KAAK;wBACL,QAAQ;QAMjB,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAA;IACnD,CAAC;CACF;AAED,MAAM,OAAO,mCAAoC,SAAQ,mBAAmB;IAE/D,MAAM;IACN,QAAQ;IAFnB,YACW,MAAgB,EAChB,QAAkB;QAE3B,KAAK,CACH,6BAA6B,MAAM,mCAAmC,QAAQ,GAAG,EACjF,mCAAmC,CACpC,CAAA;sBANQ,MAAM;wBACN,QAAQ;QAMjB,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAA;IACnD,CAAC;CACF;AAED,MAAM,OAAO,qCAAsC,SAAQ,mBAAmB;IAEjE,MAAM;IACN,OAAO;IAFlB,YACW,MAAgB,EAChB,OAAe;QAExB,KAAK,CACH,qDAAqD,MAAM,eAAe,OAAO,GAAG,EACpF,sCAAsC,CACvC,CAAA;sBANQ,MAAM;uBACN,OAAO;QAMhB,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAA;IACrD,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,kCAAmC,SAAQ,mBAAmB;IAE9D,MAAM;IACN,OAAO;IAFlB,YACW,MAAgB,EAChB,OAAe;QAExB,KAAK,CACH,gEAAgE;YAC9D,WAAW,MAAM,eAAe,OAAO,GAAG,EAC5C,kCAAkC,CACnC,CAAA;sBAPQ,MAAM;uBACN,OAAO;QAOhB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAA;IAClD,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,kCAAmC,SAAQ,mBAAmB;IAE9D,MAAM;IACN,YAAY;IAFvB,YACW,MAAc,EACd,YAAuB;QAEhC,KAAK,CACH,6CAA6C,MAAM,EAAE;YACnD,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EACrD,mCAAmC,CACpC,CAAA;sBAPQ,MAAM;4BACN,YAAY;QAOrB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAA;IAClD,CAAC;CACF"}

package/dist/auth/grants/grant-decoder.d.ts

@@ -0,0 +1,40 @@
+/**
+ * AUTH_V2 Grant Decoder
+ *
+ * Decodes UnresolvedGrant → DecodedGrant (structural validation + codec decoding).
+ * Does NOT resolve self/credential leaves — that is handled by the runtime resolver.
+ *
+ * Pure, synchronous. No I/O.
+ */
+import type { PayloadCodec } from '#auth/expression/codec';
+import type { IdentityExpr, UnresolvedIdentityExpr } from '#auth/expression/types';
+import type { IssuerId } from '#auth/issuers';
+import type { IdentityId } from '#ids';
+import type { UnresolvedGrant } from './types';
+/**
+ * Decoded grant — structurally valid. `expr` is undefined only when the
+ * input was undefined (nested-leaf path with no `.delegation` claim).
+ */
+export type DecodedGrant = {
+    expr?: UnresolvedIdentityExpr;
+};
+export declare class GrantDecoder {
+    private codec?;
+    constructor(codec?: PayloadCodec | undefined);
+    decodeGrant(grant: UnresolvedGrant | undefined, issuer: IssuerId): DecodedGrant;
+    validateGrant(issuer: IssuerId, grant: UnresolvedGrant | undefined): void;
+    private decodeField;
+}
+/**
+ * Extract the primary (leftmost/first) identity from an expression.
+ * Used for the JWT 'sub' claim.
+ */
+export declare function extractPrimaryIdentity(expr: IdentityExpr): IdentityId;
+/** Validate an `UnresolvedGrant`. `expr` is required. */
+export declare function validateUnresolvedGrant(grant: unknown): asserts grant is UnresolvedGrant;
+/**
+ * Validate an UnresolvedIdentityExpr structure.
+ * Throws if invalid.
+ */
+export declare function validateUnresolvedExpr(expr: unknown, path: string, depth?: number): asserts expr is UnresolvedIdentityExpr;
+//# sourceMappingURL=grant-decoder.d.ts.map

package/dist/auth/grants/grant-decoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-decoder.d.ts","sourceRoot":"","sources":["../../../auth/grants/grant-decoder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAa9C;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,CAAC,EAAE,sBAAsB,CAAA;CAC9B,CAAA;AAMD,qBAAa,YAAY;IACX,OAAO,CAAC,KAAK,CAAC;IAA1B,YAAoB,KAAK,CAAC,EAAE,YAAY,YAAA,EAAI;IAE5C,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,GAAG,YAAY,CAI9E;IAEM,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAG/E;IAED,OAAO,CAAC,WAAW;CAMpB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,CAiBrE;AAMD,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAexF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,SAAI,GACR,OAAO,CAAC,IAAI,IAAI,sBAAsB,CAkFxC"}

package/dist/auth/grants/grant-decoder.js

@@ -0,0 +1,141 @@
+/**
+ * AUTH_V2 Grant Decoder
+ *
+ * Decodes UnresolvedGrant → DecodedGrant (structural validation + codec decoding).
+ * Does NOT resolve self/credential leaves — that is handled by the runtime resolver.
+ *
+ * Pure, synchronous. No I/O.
+ */
+import { MAX_GRANT_EXPR_DEPTH, MAX_GRANT_EXPR_OPERANDS } from './constants';
+import { InvalidGrantStructureError, UnknownGrantExpressionKindError, UnsupportedGrantVersionError, } from './errors';
+// =============================================================================
+// GRANT DECODER
+// =============================================================================
+export class GrantDecoder {
+    codec;
+    constructor(codec) {
+        this.codec = codec;
+    }
+    decodeGrant(grant, issuer) {
+        if (!grant)
+            return {};
+        this.validateGrant(issuer, grant);
+        return { expr: this.decodeField(grant.expr) };
+    }
+    validateGrant(issuer, grant) {
+        if (!issuer || !grant)
+            return;
+        validateUnresolvedGrant(grant);
+    }
+    decodeField(raw) {
+        if (this.codec) {
+            return this.codec.decodeExpr(raw);
+        }
+        return raw;
+    }
+}
+/**
+ * Extract the primary (leftmost/first) identity from an expression.
+ * Used for the JWT 'sub' claim.
+ */
+export function extractPrimaryIdentity(expr) {
+    switch (expr.kind) {
+        case 'identity':
+            return expr.id;
+        case 'scope':
+            return extractPrimaryIdentity(expr.expr);
+        case 'union':
+        case 'intersect':
+            return extractPrimaryIdentity(expr.operands[0]);
+        case 'exclude':
+            return extractPrimaryIdentity(expr.base);
+        default:
+            throw new UnknownGrantExpressionKindError(expr.kind, 'primary_identity_extraction');
+    }
+}
+// =============================================================================
+// STRUCTURAL VALIDATION
+// =============================================================================
+/** Validate an `UnresolvedGrant`. `expr` is required. */
+export function validateUnresolvedGrant(grant) {
+    if (typeof grant !== 'object' || grant === null) {
+        throw new InvalidGrantStructureError('Grant must be an object');
+    }
+    const g = grant;
+    if (g.v !== 1) {
+        throw new UnsupportedGrantVersionError(g.v);
+    }
+    if (g.expr === undefined) {
+        throw new InvalidGrantStructureError('Grant must carry an `expr` field');
+    }
+    validateUnresolvedExpr(g.expr, 'expr');
+}
+/**
+ * Validate an UnresolvedIdentityExpr structure.
+ * Throws if invalid.
+ */
+export function validateUnresolvedExpr(expr, path, depth = 0) {
+    if (depth > MAX_GRANT_EXPR_DEPTH) {
+        throw new InvalidGrantStructureError(`${path}: expression exceeds max depth (${MAX_GRANT_EXPR_DEPTH})`);
+    }
+    if (typeof expr !== 'object' || expr === null) {
+        throw new InvalidGrantStructureError(`${path}: expression must be an object`);
+    }
+    const e = expr;
+    switch (e.kind) {
+        case 'identity': {
+            const hasSelf = 'self' in e && e.self === true;
+            const hasCredential = 'credential' in e &&
+                (typeof e.credential === 'string' || e.credential instanceof Uint8Array);
+            if (!hasSelf && !hasCredential) {
+                throw new InvalidGrantStructureError(`${path}: identity must have { self: true } or { credential: CredentialInput }`);
+            }
+            if (hasSelf && hasCredential) {
+                throw new InvalidGrantStructureError(`${path}: identity cannot have both self and credential`);
+            }
+            break;
+        }
+        case 'scope': {
+            if (!Array.isArray(e.scopes) || e.scopes.length === 0) {
+                throw new InvalidGrantStructureError(`${path}: scope must have at least one scope`);
+            }
+            if (!('expr' in e)) {
+                throw new InvalidGrantStructureError(`${path}: scope must have expr`);
+            }
+            validateUnresolvedExpr(e.expr, `${path}.expr`, depth + 1);
+            break;
+        }
+        case 'union':
+        case 'intersect': {
+            if (!Array.isArray(e.operands) || e.operands.length < 2) {
+                throw new InvalidGrantStructureError(`${path}: ${e.kind} must have at least 2 operands`);
+            }
+            if (e.operands.length > MAX_GRANT_EXPR_OPERANDS) {
+                throw new InvalidGrantStructureError(`${path}: ${e.kind} exceeds max operands (${MAX_GRANT_EXPR_OPERANDS})`);
+            }
+            for (let i = 0; i < e.operands.length; i++) {
+                validateUnresolvedExpr(e.operands[i], `${path}.operands[${i}]`, depth + 1);
+            }
+            break;
+        }
+        case 'exclude': {
+            if (!('base' in e)) {
+                throw new InvalidGrantStructureError(`${path}: exclude must have base`);
+            }
+            validateUnresolvedExpr(e.base, `${path}.base`, depth + 1);
+            if (!Array.isArray(e.excluded) || e.excluded.length < 1) {
+                throw new InvalidGrantStructureError(`${path}: exclude must have at least 1 excluded operand`);
+            }
+            if (e.excluded.length > MAX_GRANT_EXPR_OPERANDS) {
+                throw new InvalidGrantStructureError(`${path}: exclude exceeds max operands (${MAX_GRANT_EXPR_OPERANDS})`);
+            }
+            for (let i = 0; i < e.excluded.length; i++) {
+                validateUnresolvedExpr(e.excluded[i], `${path}.excluded[${i}]`, depth + 1);
+            }
+            break;
+        }
+        default:
+            throw new InvalidGrantStructureError(`${path}: invalid kind: ${e.kind}`);
+    }
+}
+//# sourceMappingURL=grant-decoder.js.map

package/dist/auth/grants/grant-decoder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-decoder.js","sourceRoot":"","sources":["../../../auth/grants/grant-decoder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,UAAU,CAAA;AAcjB,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,OAAO,YAAY;IACH,KAAK;IAAzB,YAAoB,KAAoB;qBAApB,KAAK;IAAkB,CAAC;IAE5C,WAAW,CAAC,KAAkC,EAAE,MAAgB;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;QACrB,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACjC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;IAC/C,CAAC;IAEM,aAAa,CAAC,MAAgB,EAAE,KAAkC;QACvE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,OAAM;QAC7B,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAEO,WAAW,CAAC,GAAY;QAC9B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAA2B,CAAA;QAC7D,CAAC;QACD,OAAO,GAA6B,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAkB;IACvD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,EAAE,CAAA;QAChB,KAAK,OAAO;YACV,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,KAAK,OAAO,CAAC;QACb,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAA;QAClD,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C;YACE,MAAM,IAAI,+BAA+B,CACtC,IAA2B,CAAC,IAAI,EACjC,6BAA6B,CAC9B,CAAA;IACL,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,yDAAyD;AACzD,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,0BAA0B,CAAC,yBAAyB,CAAC,CAAA;IACjE,CAAC;IAED,MAAM,CAAC,GAAG,KAAgC,CAAA;IAE1C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,0BAA0B,CAAC,kCAAkC,CAAC,CAAA;IAC1E,CAAC;IACD,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAa,EACb,IAAY,EACZ,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,mCAAmC,oBAAoB,GAAG,CAClE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAA;IAC/E,CAAC;IAED,MAAM,CAAC,GAAG,IAA+B,CAAA;IAEzC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAA;YAC9C,MAAM,aAAa,GACjB,YAAY,IAAI,CAAC;gBACjB,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,YAAY,UAAU,CAAC,CAAA;YAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC/B,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,wEAAwE,CAChF,CAAA;YACH,CAAC;YACD,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;gBAC7B,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,iDAAiD,CACzD,CAAA;YACH,CAAC;YACD,MAAK;QACP,CAAC;QAED,KAAK,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAA;YACrF,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAA;YACvE,CAAC;YACD,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACzD,MAAK;QACP,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAA;YAC1F,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,0BAA0B,uBAAuB,GAAG,CACvE,CAAA;YACH,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC5E,CAAC;YACD,MAAK;QACP,CAAC;QAED,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAA;YACzE,CAAC;YACD,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,iDAAiD,CACzD,CAAA;YACH,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,GAAG,IAAI,mCAAmC,uBAAuB,GAAG,CACrE,CAAA;YACH,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC5E,CAAC;YACD,MAAK;QACP,CAAC;QAED;YACE,MAAM,IAAI,0BAA0B,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC5E,CAAC;AACH,CAAC"}

package/dist/auth/grants/grant-encoding.d.ts

@@ -0,0 +1,47 @@
+/**
+ * AUTH_V2 Grant Encoding
+ *
+ * Builders for constructing UnresolvedIdentityExpr and UnresolvedGrant.
+ * Used when constructing grant claims for JWT payloads.
+ */
+import type { CredentialInput } from '#auth/credentials';
+import type { IdentityExpr, Scope, UnresolvedIdentityExpr } from '#auth/expression/types';
+import type { IdentityId } from '#ids';
+import type { UnresolvedGrant } from './types';
+/**
+ * Create an unresolved identity leaf referencing the credential's own subject.
+ */
+export declare function unresolvedSelf(): UnresolvedIdentityExpr;
+/**
+ * Create an unresolved identity leaf referencing a nested credential.
+ */
+export declare function unresolvedCredential(credential: CredentialInput): UnresolvedIdentityExpr;
+/**
+ * Create an unresolved scope wrapper.
+ */
+export declare function unresolvedScope(scopes: Scope[], expr: UnresolvedIdentityExpr): UnresolvedIdentityExpr;
+/**
+ * Create an unresolved union expression.
+ */
+export declare function unresolvedUnion(...operands: UnresolvedIdentityExpr[]): UnresolvedIdentityExpr;
+/**
+ * Create an unresolved intersect expression.
+ */
+export declare function unresolvedIntersect(...operands: UnresolvedIdentityExpr[]): UnresolvedIdentityExpr;
+/**
+ * Create an unresolved exclude expression.
+ */
+export declare function unresolvedExclude(base: UnresolvedIdentityExpr, excl: UnresolvedIdentityExpr): UnresolvedIdentityExpr;
+/**
+ * Convert a resolved IdentityExpr to UnresolvedIdentityExpr.
+ *
+ * Identity leaves matching the principal are encoded as { self: true }.
+ * Non-self leaves require credential minting (not yet implemented) — throws.
+ *
+ * @param expr - The resolved expression tree
+ * @param principal - The principal identity (emitted as self: true)
+ */
+export declare function identityExprToUnresolved(expr: IdentityExpr, principal: IdentityId): UnresolvedIdentityExpr;
+/** Wrap an expression into an `UnresolvedGrant` payload. */
+export declare function createUnresolvedGrant(expr: UnresolvedIdentityExpr): UnresolvedGrant;
+//# sourceMappingURL=grant-encoding.d.ts.map

package/dist/auth/grants/grant-encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-encoding.d.ts","sourceRoot":"","sources":["../../../auth/grants/grant-encoding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAM9C;;GAEG;AACH,wBAAgB,cAAc,IAAI,sBAAsB,CAEvD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,eAAe,GAAG,sBAAsB,CAExF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,KAAK,EAAE,EACf,IAAI,EAAE,sBAAsB,GAC3B,sBAAsB,CAExB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,QAAQ,EAAE,sBAAsB,EAAE,GAAG,sBAAsB,CAE7F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,QAAQ,EAAE,sBAAsB,EAAE,GAAG,sBAAsB,CAEjG;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,sBAAsB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,sBAAsB,CAExB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,UAAU,GACpB,sBAAsB,CAoBxB;AAMD,4DAA4D;AAC5D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,eAAe,CAEnF"}

package/dist/auth/grants/grant-encoding.js

@@ -0,0 +1,85 @@
+/**
+ * AUTH_V2 Grant Encoding
+ *
+ * Builders for constructing UnresolvedIdentityExpr and UnresolvedGrant.
+ * Used when constructing grant claims for JWT payloads.
+ */
+// =============================================================================
+// UNRESOLVED EXPRESSION BUILDERS
+// =============================================================================
+/**
+ * Create an unresolved identity leaf referencing the credential's own subject.
+ */
+export function unresolvedSelf() {
+    return { kind: 'identity', self: true };
+}
+/**
+ * Create an unresolved identity leaf referencing a nested credential.
+ */
+export function unresolvedCredential(credential) {
+    return { kind: 'identity', credential };
+}
+/**
+ * Create an unresolved scope wrapper.
+ */
+export function unresolvedScope(scopes, expr) {
+    return { kind: 'scope', scopes, expr };
+}
+/**
+ * Create an unresolved union expression.
+ */
+export function unresolvedUnion(...operands) {
+    return { kind: 'union', operands };
+}
+/**
+ * Create an unresolved intersect expression.
+ */
+export function unresolvedIntersect(...operands) {
+    return { kind: 'intersect', operands };
+}
+/**
+ * Create an unresolved exclude expression.
+ */
+export function unresolvedExclude(base, excl) {
+    return { kind: 'exclude', base, excluded: [excl] };
+}
+// =============================================================================
+// RESOLVED → UNRESOLVED CONVERSION
+// =============================================================================
+/**
+ * Convert a resolved IdentityExpr to UnresolvedIdentityExpr.
+ *
+ * Identity leaves matching the principal are encoded as { self: true }.
+ * Non-self leaves require credential minting (not yet implemented) — throws.
+ *
+ * @param expr - The resolved expression tree
+ * @param principal - The principal identity (emitted as self: true)
+ */
+export function identityExprToUnresolved(expr, principal) {
+    const recurse = (e) => {
+        switch (e.kind) {
+            case 'identity':
+                if (e.id === principal)
+                    return { kind: 'identity', self: true };
+                throw new Error(`Cannot encode non-principal identity leaf (${e.id}) as unresolved. ` +
+                    `Only self-referential grants are supported without credential minting.`);
+            case 'scope':
+                return { kind: 'scope', scopes: e.scopes, expr: recurse(e.expr) };
+            case 'union':
+                return { kind: 'union', operands: e.operands.map(recurse) };
+            case 'intersect':
+                return { kind: 'intersect', operands: e.operands.map(recurse) };
+            case 'exclude':
+                return { kind: 'exclude', base: recurse(e.base), excluded: e.excluded.map(recurse) };
+        }
+    };
+    return recurse(expr);
+}
+// =============================================================================
+// GRANT FACTORY
+// =============================================================================
+/** Wrap an expression into an `UnresolvedGrant` payload. */
+export function createUnresolvedGrant(expr) {
+    return { v: 1, expr };
+}
+//# sourceMappingURL=grant-encoding.js.map

package/dist/auth/grants/grant-encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-encoding.js","sourceRoot":"","sources":["../../../auth/grants/grant-encoding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B;IAC9D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAe,EACf,IAA4B;IAE5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,QAAkC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,QAAkC;IACvE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAA4B,EAC5B,IAA4B;IAE5B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,gFAAgF;AAChF,mCAAmC;AACnC,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAkB,EAClB,SAAqB;IAErB,MAAM,OAAO,GAAG,CAAC,CAAe,EAA0B,EAAE;QAC1D,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;oBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBAC/D,MAAM,IAAI,KAAK,CACb,8CAA8C,CAAC,CAAC,EAAE,mBAAmB;oBACnE,wEAAwE,CAC3E,CAAA;YACH,KAAK,OAAO;gBACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;YACnE,KAAK,OAAO;gBACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAA;YAC7D,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAA;YACjE,KAAK,SAAS;gBACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAA;QACxF,CAAC;IACH,CAAC,CAAA;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;AACtB,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC"}

package/dist/auth/grants/index.d.ts

@@ -0,0 +1,6 @@
+export * from './constants';
+export * from './grant-decoder';
+export * from './grant-encoding';
+export * from './errors';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/grants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/grants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,UAAU,CAAA;AACxB,cAAc,SAAS,CAAA"}

package/dist/auth/grants/index.js

@@ -0,0 +1,6 @@
+export * from './constants';
+export * from './grant-decoder';
+export * from './grant-encoding';
+export * from './errors';
+export * from './types';
+//# sourceMappingURL=index.js.map

package/dist/auth/grants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/grants/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,UAAU,CAAA;AACxB,cAAc,SAAS,CAAA"}