@astrale-os/kernel-core 0.9.0-beta.3 → 0.9.0-beta.31

package/dist/auth/attestation/admission.d.ts

@@ -1,4 +1,3 @@
 import type { Attestation } from './attestation.js';
 /** Admit a self-relative Attestation claim without establishing signer trust. */
 export declare function accept(input: unknown): Attestation;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/attestation/admission.js

@@ -1,4 +1,4 @@
-import { AuthValueError } from '../error/index.js';
+import { AuthValueError } from '../error.js';
 /** Admit a self-relative Attestation claim without establishing signer trust. */
 export function accept(input) {
     try {
@@ -41,4 +41,3 @@ function exact(input, expected, path) {
 function invalid(path) {
     throw new AuthValueError('AUTH_ATTESTATION_INVALID', 'Expected a self Attestation', path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/attestation/attestation.d.ts

@@ -3,4 +3,3 @@ import type { SelfIdentityExpr } from '../expression/index.js';
 export interface Attestation {
     readonly expr: SelfIdentityExpr;
 }
-//# sourceMappingURL=attestation.d.ts.map

package/dist/auth/attestation/attestation.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=attestation.js.map

package/dist/auth/attestation/index.d.ts

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export type { Attestation } from './attestation.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/attestation/index.js

@@ -1,2 +1 @@
 export { accept } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/accept.d.ts

@@ -1,4 +1,3 @@
 import type { AuthorityPredicate } from './language/index.js';
 /** Re-admit one persisted or crossing canonical authority predicate. */
 export declare function accept(input: unknown): AuthorityPredicate;
-//# sourceMappingURL=accept.d.ts.map

package/dist/auth/authority/accept.js

@@ -1,5 +1,5 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { AuthValueError } from '../error/index.js';
+import { AuthValueError } from '../error.js';
 import { admitAuthorityExpr } from './admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
 import { canonicalizeAdmitted } from './normalization/index.js';
@@ -35,4 +35,3 @@ function compare(left, right) {
 function invalid(path, message) {
     throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
 }
-//# sourceMappingURL=accept.js.map

package/dist/auth/authority/admission/admission.d.ts

@@ -4,8 +4,8 @@ export declare const limits: {
     readonly expressionDepth: 64;
     readonly operandsPerExpression: 512;
     readonly localsPerExpression: 64;
+    readonly classesPerLocal: 1024;
     readonly repeatMaximum: 16;
 };
 export declare const MAX_BOOLEAN_OPERANDS: 512;
 export declare function admitAuthorityExpr(input: portable.Value): AuthorityExpr;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/authority/admission/admission.js

@@ -1,11 +1,12 @@
-import { schema } from '@astrale-os/kernel-dsl/v1';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isNodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { accept as acceptGrant } from '../../grant/index.js';
 export const limits = Object.freeze({
     expressionDepth: 64,
     operandsPerExpression: 512,
     localsPerExpression: 64,
+    classesPerLocal: 1024,
     repeatMaximum: 16,
 });
 export const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
@@ -94,13 +95,6 @@ function admit(input, path, locals, subjectBound, depth) {
                 class: classRef(value.class, `${path}/class`),
                 evidence: evidence(value.evidence, `${path}/evidence`),
             };
-        case 'domain-control':
-            exact(value, ['identity', 'op', 'origin'], path);
-            return {
-                op: 'domain-control',
-                identity: term(value.identity, `${path}/identity`, locals, subjectBound),
-                origin: domainOrigin(value.origin, `${path}/origin`),
-            };
         default:
             invalid(`${path}/op`, 'Unsupported authority operation');
     }
@@ -146,8 +140,21 @@ function term(input, path, locals, subjectBound) {
 }
 function localDeclaration(input, path) {
     const value = record(input, path);
-    exact(value, ['class', 'id'], path);
-    return { id: localId(value.id, `${path}/id`), class: nodeClassRef(value.class, `${path}/class`) };
+    const id = localId(value.id, `${path}/id`);
+    if (value.kind === 'any') {
+        exact(value, ['id', 'kind'], path);
+        return { id, kind: 'any' };
+    }
+    if (value.kind === 'classes') {
+        exact(value, ['classes', 'id', 'kind'], path);
+        const classes = array(value.classes, `${path}/classes`, 1, limits.classesPerLocal).map((entry, index) => nodeClassRef(entry, `${path}/classes/${index}`));
+        return {
+            id,
+            kind: 'classes',
+            classes: classes,
+        };
+    }
+    invalid(`${path}/kind`, 'Expected any or classes local selector');
 }
 function repeat(input, path) {
     const value = record(input, path);
@@ -193,19 +200,19 @@ function absoluteRef(input, path) {
     return { origin, kind: value.kind, name: value.name };
 }
 function definitionName(input, path) {
-    if (!schema.patterns.memberName.test(input))
+    if (!patterns.memberName.test(input))
         invalid(path, 'Expected a Definition member name');
 }
 function coreRef(input, path) {
     const value = absoluteRef(input, path);
     if (value.kind !== 'core')
         invalid(`${path}/kind`, 'Expected core');
-    if (!schema.patterns.coreSlug.test(value.name))
+    if (!patterns.coreSlug.test(value.name))
         invalid(`${path}/name`, 'Expected a Core slug');
     return value;
 }
 function domainOrigin(input, path) {
-    if (typeof input !== 'string' || !schema.patterns.origin.test(input)) {
+    if (typeof input !== 'string' || !patterns.origin.test(input)) {
         invalid(path, 'Expected a canonical Domain origin');
     }
     return input;
@@ -261,4 +268,3 @@ function compare(left, right) {
 function invalid(path, message) {
     throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/authority/admission/index.d.ts

@@ -1,2 +1 @@
 export { admitAuthorityExpr, limits } from './admission.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/admission/index.js

@@ -1,2 +1 @@
 export { admitAuthorityExpr, limits } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/index.d.ts

@@ -3,4 +3,3 @@ export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
 export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './language/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/index.js

@@ -2,4 +2,3 @@ export { accept } from './accept.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/language/index.d.ts

@@ -1,3 +1,2 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
 export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './predicate.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/language/index.js

@@ -1,2 +1 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/language/predicate.d.ts

@@ -1,10 +1,10 @@
-import type { Key, schema } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { NodeId } from '../../../graph/node/index.js';
 import type { Grant } from '../../grant/index.js';
-export declare const AUTHORITY_PREDICATE_VERSION: 5;
+export declare const AUTHORITY_PREDICATE_VERSION: 7;
 export type Operation = 'create' | 'read' | 'traverse' | 'update' | 'delete';
 export type Input = 'object' | 'source' | 'target';
-export type ClassRef = schema.ClassRef;
+export type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
 export type Term = {
     readonly kind: 'input';
     readonly input: Input;
@@ -19,7 +19,7 @@ export type Term = {
     readonly origin: Key.Origin;
 } | {
     readonly kind: 'core';
-    readonly ref: schema.CoreRef;
+    readonly ref: CoreRef;
 } | {
     readonly kind: 'local';
     readonly id: number;
@@ -30,21 +30,21 @@ export interface Repeat {
     readonly min: number;
     readonly max: number;
 }
-export interface LocalDeclaration {
+export type LocalDeclaration = {
     readonly id: number;
-    readonly class: schema.ClassRef;
-}
-export type Requirement = {
+    readonly kind: 'any';
+} | {
+    readonly id: number;
+    readonly kind: 'classes';
+    readonly classes: readonly [ClassRef, ...ClassRef[]];
+};
+export interface Requirement {
     readonly op: 'class-authority';
     readonly identity: Term;
     readonly operation: Operation;
     readonly class: ClassRef;
     readonly evidence: 'allowed' | 'owner';
-} | {
-    readonly op: 'domain-control';
-    readonly identity: Term;
-    readonly origin: Key.Origin;
-};
+}
 export type AuthorityExpr = {
     readonly op: 'true';
 } | {
@@ -65,7 +65,7 @@ export type AuthorityExpr = {
 } | {
     readonly op: 'related';
     readonly source: Term;
-    readonly class: schema.ClassRef;
+    readonly class: ClassRef;
     readonly target: Term;
     readonly repeat?: Repeat;
 } | {
@@ -75,13 +75,12 @@ export type AuthorityExpr = {
 } | {
     readonly op: 'instance-of';
     readonly node: Term;
-    readonly class: schema.ClassRef;
+    readonly class: ClassRef;
 } | {
     readonly op: 'edge-class';
-    readonly class: schema.ClassRef;
+    readonly class: ClassRef;
 } | Requirement;
 export interface AuthorityPredicate {
     readonly version: typeof AUTHORITY_PREDICATE_VERSION;
     readonly predicate: AuthorityExpr;
 }
-//# sourceMappingURL=predicate.d.ts.map

package/dist/auth/authority/language/predicate.js

@@ -1,2 +1 @@
-export const AUTHORITY_PREDICATE_VERSION = 5;
-//# sourceMappingURL=predicate.js.map
+export const AUTHORITY_PREDICATE_VERSION = 7;

package/dist/auth/authority/normalization/index.d.ts

@@ -1,2 +1 @@
 export { canonicalize, canonicalizeAdmitted } from './normalize.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/normalization/index.js

@@ -1,2 +1 @@
 export { canonicalize, canonicalizeAdmitted } from './normalize.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/normalization/normalize.d.ts

@@ -2,4 +2,3 @@ import type { AuthorityExpr, AuthorityPredicate } from '../language/index.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export declare function canonicalize(expr: AuthorityExpr): AuthorityPredicate;
 export declare function canonicalizeAdmitted(expr: AuthorityExpr): AuthorityPredicate;
-//# sourceMappingURL=normalize.d.ts.map

package/dist/auth/authority/normalization/normalize.js

@@ -1,6 +1,6 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
 import { NodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { canonicalize as canonicalizeGrant } from '../../grant/index.js';
 import { admitAuthorityExpr, limits } from '../admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from '../language/index.js';
@@ -71,12 +71,6 @@ function normalize(expr, path, locals, subjectBound) {
                 class: Object.freeze({ ...expr.class }),
                 evidence: expr.evidence,
             });
-        case 'domain-control':
-            return Object.freeze({
-                op: 'domain-control',
-                identity: normalizeTerm(expr.identity),
-                origin: expr.origin,
-            });
     }
 }
 function normalizeBoolean(op, input, path, locals, subjectBound) {
@@ -128,9 +122,18 @@ function normalizeTerm(term) {
     }
 }
 function normalizeLocal(local) {
-    return Object.freeze({ id: local.id, class: Object.freeze({ ...local.class }) });
+    if (local.kind === 'any')
+        return Object.freeze({ id: local.id, kind: 'any' });
+    const classes = new Map(local.classes.map((ref) => [classKey(ref), Object.freeze({ ...ref })]));
+    return Object.freeze({
+        id: local.id,
+        kind: 'classes',
+        classes: Object.freeze([...classes.entries()].sort(([left], [right]) => compare(left, right)).map(([, ref]) => ref)),
+    });
+}
+function classKey(ref) {
+    return `${ref.origin}:${ref.kind}.${ref.name}`;
 }
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=normalize.js.map

package/dist/auth/claims/admission/admission.d.ts

@@ -3,4 +3,3 @@ import type { ClaimConstraint } from '../language/index.js';
 export declare const MAX_REQUIRED_CLAIMS = 64;
 /** Admit one claim constraint within an owning boundary's error vocabulary. */
 export declare function admitConstraint(input: portable.Value, path: string, invalid: (path: string, message: string) => never): ClaimConstraint;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/claims/admission/admission.js

@@ -41,4 +41,3 @@ function freezeValue(input) {
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/claims/admission/index.d.ts

@@ -1,2 +1 @@
 export { admitConstraint, MAX_REQUIRED_CLAIMS } from './admission.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/admission/index.js

@@ -1,2 +1 @@
 export { admitConstraint, MAX_REQUIRED_CLAIMS } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/evaluation/index.d.ts

@@ -1,3 +1,2 @@
 export { matches } from './match.js';
 export { verifyRequired } from './verify-required.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/evaluation/index.js

@@ -1,3 +1,2 @@
 export { matches } from './match.js';
 export { verifyRequired } from './verify-required.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/evaluation/match.d.ts

@@ -2,4 +2,3 @@ import * as portable from '@astrale-os/kernel-dsl/value';
 import type { ClaimConstraint } from '../language/index.js';
 /** Evaluate one claim constraint over already-parsed claims. */
 export declare function matches(constraint: ClaimConstraint, claims: portable.Object): boolean;
-//# sourceMappingURL=match.d.ts.map

package/dist/auth/claims/evaluation/match.js

@@ -14,4 +14,3 @@ export function matches(constraint, claims) {
 function equal(left, right) {
     return portable.json.serialize(left) === portable.json.serialize(right);
 }
-//# sourceMappingURL=match.js.map

package/dist/auth/claims/evaluation/verify-required.d.ts

@@ -2,4 +2,3 @@ import type * as portable from '@astrale-os/kernel-dsl/value';
 import type { ClaimConstraint } from '../language/index.js';
 /** Assert every required constraint, reporting the first mismatch. */
 export declare function verifyRequired(constraints: readonly ClaimConstraint[], claims: portable.Object): void;
-//# sourceMappingURL=verify-required.d.ts.map

package/dist/auth/claims/evaluation/verify-required.js

@@ -7,4 +7,3 @@ export function verifyRequired(constraints, claims) {
         }
     }
 }
-//# sourceMappingURL=verify-required.js.map

package/dist/auth/claims/index.d.ts

@@ -1,4 +1,3 @@
 export { MAX_REQUIRED_CLAIMS } from './admission/index.js';
 export { matches, verifyRequired } from './evaluation/index.js';
 export type { ClaimConstraint } from './language/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/index.js

@@ -1,3 +1,2 @@
 export { MAX_REQUIRED_CLAIMS } from './admission/index.js';
 export { matches, verifyRequired } from './evaluation/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/language/constraint.d.ts

@@ -11,4 +11,3 @@ export type ClaimConstraint = {
     readonly claim: string;
     readonly op: 'exists';
 };
-//# sourceMappingURL=constraint.d.ts.map

package/dist/auth/claims/language/constraint.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=constraint.js.map

package/dist/auth/claims/language/index.d.ts

@@ -1,2 +1 @@
 export type { ClaimConstraint } from './constraint.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/language/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/context/context.d.ts

@@ -26,4 +26,3 @@ export interface AuthContext {
     readonly attestation?: Attestation;
     readonly delegation?: Delegation;
 }
-//# sourceMappingURL=context.d.ts.map

package/dist/auth/context/context.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=context.js.map

package/dist/auth/context/index.d.ts

@@ -1,2 +1 @@
 export type { AuthContext, Authenticated, CredentialContext } from './context.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/context/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/evidence/evidence.d.ts

@@ -1,5 +1,5 @@
 import type { CredentialContext } from '../../context/index.js';
-import type { IdentitySubject } from '../../identity/index.js';
+import type { Subject } from '../../identity/index.js';
 import type { IssuerId } from '../../issuer/index.js';
 import type { KeyId } from '../../jwk/index.js';
 import type { AuthenticationMethod } from '../inspection/index.js';
@@ -7,7 +7,7 @@ import type { AuthenticationMethod } from '../inspection/index.js';
 export interface AuthenticationEvidence {
     readonly method: AuthenticationMethod;
     readonly issuer: IssuerId;
-    readonly subject: IdentitySubject;
+    readonly subject: Subject;
     readonly audience?: readonly string[];
     readonly keyId?: KeyId;
     readonly issuedAt?: number;
@@ -16,4 +16,3 @@ export interface AuthenticationEvidence {
 }
 /** Project trusted credential state without retaining bearer material or arbitrary claims. */
 export declare function evidence(context: CredentialContext): AuthenticationEvidence;
-//# sourceMappingURL=evidence.d.ts.map

package/dist/auth/credential/evidence/evidence.js

@@ -15,4 +15,3 @@ export function evidence(context) {
         ...(credential.exp === undefined ? {} : { expiresAt: credential.exp }),
     });
 }
-//# sourceMappingURL=evidence.js.map

package/dist/auth/credential/evidence/index.d.ts

@@ -1,3 +1,2 @@
 export { evidence } from './evidence.js';
 export type { AuthenticationEvidence } from './evidence.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/evidence/index.js

@@ -1,2 +1 @@
 export { evidence } from './evidence.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/index.d.ts

@@ -7,4 +7,3 @@ export type { CredentialInput, MintedCredential } from './input/index.js';
 export { acceptVerified, verifyAudience } from './verified/index.js';
 export type { VerifiedCredential } from './verified/index.js';
 export type { AuthContext, Authenticated, CredentialContext } from '../context/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/index.js

@@ -2,4 +2,3 @@ export { evidence } from './evidence/index.js';
 export { inspect } from './inspection/index.js';
 export { snapshot } from './input/index.js';
 export { acceptVerified, verifyAudience } from './verified/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/input/index.d.ts

@@ -1,3 +1,2 @@
 export { snapshot } from './input.js';
 export type { CredentialInput, MintedCredential } from './input.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/input/index.js

@@ -1,2 +1 @@
 export { snapshot } from './input.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/input/input.d.ts

@@ -8,4 +8,3 @@ export type MintedCredential = string & {
 /** Detach mutable credential bytes while retaining immutable credential text. */
 export declare function snapshot(input: CredentialInput): CredentialInput;
 export {};
-//# sourceMappingURL=input.d.ts.map

package/dist/auth/credential/input/input.js

@@ -6,4 +6,3 @@ export function snapshot(input) {
         throw new TypeError('Credential must be text or bytes.');
     return input.slice();
 }
-//# sourceMappingURL=input.js.map

package/dist/auth/credential/inspection/index.d.ts

@@ -1,3 +1,2 @@
 export { inspect } from './inspect.js';
 export type { AuthenticationMethod, CredentialAudience, UnverifiedCredential, } from './inspection.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/inspection/index.js

@@ -1,2 +1 @@
 export { inspect } from './inspect.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/inspection/inspect.d.ts

@@ -2,4 +2,3 @@ import type { CredentialInput } from '../input/index.js';
 import type { UnverifiedCredential } from './inspection.js';
 /** Inspect compact JWT syntax without establishing any cryptographic trust. */
 export declare function inspect(input: CredentialInput): UnverifiedCredential;
-//# sourceMappingURL=inspect.d.ts.map

package/dist/auth/credential/inspection/inspect.js

@@ -1,8 +1,8 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { snapshot } from '../input/index.js';
 const MAX_CREDENTIAL_BYTES = 64 * 1024;
-const decoder = new TextDecoder('utf-8', { fatal: true });
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false });
 const encoder = new TextEncoder();
 /** Inspect compact JWT syntax without establishing any cryptographic trust. */
 export function inspect(input) {
@@ -94,4 +94,3 @@ function freezeValue(input) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_CREDENTIAL_INVALID', message, path);
 }
-//# sourceMappingURL=inspect.js.map

package/dist/auth/credential/inspection/inspection.d.ts

@@ -10,4 +10,3 @@ export interface UnverifiedCredential {
     readonly kid?: string;
     readonly claims: value.Object;
 }
-//# sourceMappingURL=inspection.d.ts.map

package/dist/auth/credential/inspection/inspection.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=inspection.js.map

package/dist/auth/credential/verified/admission.d.ts

@@ -4,4 +4,3 @@ import type { VerifiedCredential } from './verified.js';
  * Signature verification and trusted-key selection remain Runtime responsibilities.
  */
 export declare function acceptVerified(input: unknown): VerifiedCredential;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/credential/verified/admission.js

@@ -1,5 +1,5 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { accept as acceptIssuer, is as isIssuer } from '../../issuer/index.js';
 /**
  * Structurally admit and detach the successful output of an injected cryptographic verifier.
@@ -125,4 +125,3 @@ function isRecord(input) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_VERIFIED_CREDENTIAL_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/credential/verified/audience.d.ts

@@ -2,4 +2,3 @@ import type { IssuerId } from '../../issuer/index.js';
 import type { VerifiedCredential } from './verified.js';
 /** Assert the expected audience over an already verified credential. */
 export declare function verifyAudience(credential: VerifiedCredential, expectedAudience: IssuerId): void;
-//# sourceMappingURL=audience.d.ts.map

package/dist/auth/credential/verified/audience.js

@@ -17,4 +17,3 @@ function matches(candidate, expected) {
         return candidate === expected;
     }
 }
-//# sourceMappingURL=audience.js.map

package/dist/auth/credential/verified/index.d.ts

@@ -1,4 +1,3 @@
 export { acceptVerified } from './admission.js';
 export { verifyAudience } from './audience.js';
 export type { VerifiedCredential } from './verified.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/verified/index.js

@@ -1,3 +1,2 @@
 export { acceptVerified } from './admission.js';
 export { verifyAudience } from './audience.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/verified/verified.d.ts

@@ -1,5 +1,5 @@
 import type * as value from '@astrale-os/kernel-dsl/value';
-import type { IdentitySubject } from '../../identity/index.js';
+import type { Subject } from '../../identity/index.js';
 import type { IssuerId } from '../../issuer/index.js';
 import type { KeyId } from '../../jwk/index.js';
 import type { AuthenticationMethod, CredentialAudience } from '../inspection/index.js';
@@ -7,7 +7,7 @@ import type { AuthenticationMethod, CredentialAudience } from '../inspection/ind
 export interface VerifiedCredential {
     readonly method: AuthenticationMethod;
     readonly iss: IssuerId;
-    readonly sub: IdentitySubject;
+    readonly sub: Subject;
     readonly aud?: CredentialAudience;
     readonly kid?: KeyId;
     readonly iat?: number;
@@ -15,4 +15,3 @@ export interface VerifiedCredential {
     readonly exp?: number;
     readonly claims: value.Object;
 }
-//# sourceMappingURL=verified.d.ts.map

package/dist/auth/credential/verified/verified.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=verified.js.map

package/dist/auth/delegation/admission.d.ts

@@ -1,4 +1,3 @@
 import type { Delegation } from './delegation.js';
 /** Admit a Delegation envelope; the nested credential remains unverified. */
 export declare function accept(input: unknown): Delegation;
-//# sourceMappingURL=admission.d.ts.map