@astrale-os/kernel-core 0.9.0-beta.39 → 0.9.0-beta.40

package/dist/auth/provision/request/admission.js

@@ -1,197 +0,0 @@
-import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
-import * as portable from '@astrale-os/kernel-dsl/value';
-import { isLocalBinding } from '../../../graph/graph/index.js';
-import { MutationAST } from '../../../graph/mutate/index.js';
-import { NodeId } from '../../../graph/node/index.js';
-import { admitConstraint, MAX_REQUIRED_CLAIMS } from '../../claims/admission/index.js';
-import { AuthValueError } from '../../error.js';
-import { accept as acceptIssuer } from '../../issuer/index.js';
-import { acceptPublic } from '../../jwk/index.js';
-const PROOF_BYTES_LIMIT = 64 * 1024;
-const textEncoder = new TextEncoder();
-/** Admit unknown input into the exact immutable Provision request language. */
-export function accept(input) {
-    if (!isRecord(input))
-        invalid('', 'Expected a Provision request object');
-    exact(input, input.mutation === undefined
-        ? ['idempotencyKey', 'identities']
-        : ['idempotencyKey', 'identities', 'mutation'], '');
-    if (typeof input.idempotencyKey !== 'string' || input.idempotencyKey.length === 0) {
-        invalid('/idempotencyKey', 'Expected a non-empty idempotency key');
-    }
-    const mutation = input.mutation === undefined ? undefined : MutationAST.decode(input.mutation);
-    if (!Array.isArray(input.identities) || input.identities.length === 0) {
-        invalid('/identities', 'Expected a non-empty Identity provision array');
-    }
-    const identities = input.identities
-        .map((candidate, index) => identityInput(candidate, `/identities/${index}`))
-        .sort(compareIdentity);
-    const targets = new Set();
-    const authentications = new Set();
-    for (const [index, identity] of identities.entries()) {
-        const target = targetKey(identity);
-        if (targets.has(target))
-            invalid(`/identities/${index}/identity`, 'Duplicate Identity target');
-        targets.add(target);
-        const authentication = assertedAuthenticationKey(identity.authentication);
-        if (authentication === undefined)
-            continue;
-        if (authentications.has(authentication)) {
-            invalid(`/identities/${index}/authentication`, 'Duplicate Authentication');
-        }
-        authentications.add(authentication);
-    }
-    return Object.freeze({
-        idempotencyKey: input.idempotencyKey,
-        ...(mutation === undefined ? {} : { mutation }),
-        identities: Object.freeze(identities),
-    });
-}
-function identityInput(input, path) {
-    if (!isRecord(input))
-        invalid(path, 'Expected an Identity provision object');
-    if (!isRecord(input.identity))
-        invalid(`${path}/identity`, 'Expected an Identity target');
-    if (Object.hasOwn(input.identity, 'created')) {
-        exact(input.identity, ['created'], `${path}/identity`);
-        const created = input.identity.created;
-        if (typeof created !== 'string' || !isLocalBinding(created)) {
-            invalid(`${path}/identity/created`, 'Expected a LocalBinding');
-        }
-        exact(input, [
-            'identity',
-            ...(input.authentication === undefined ? [] : ['authentication']),
-            ...(input.requiredClaims === undefined ? [] : ['requiredClaims']),
-        ], path);
-        const authentication = input.authentication === undefined
-            ? undefined
-            : authenticationInput(input.authentication, `${path}/authentication`);
-        const requiredClaims = constraints(input.requiredClaims, `${path}/requiredClaims`);
-        return Object.freeze({
-            identity: Object.freeze({ created }),
-            ...(authentication === undefined ? {} : { authentication }),
-            ...(requiredClaims.length === 0 ? {} : { requiredClaims }),
-        });
-    }
-    exact(input.identity, ['class', 'id'], `${path}/identity`);
-    exact(input, ['authentication', 'identity'], path);
-    if (typeof input.identity.id !== 'string') {
-        invalid(`${path}/identity/id`, 'Expected an IdentityId');
-    }
-    if (typeof input.identity.class !== 'string' || !ClassKey.is(input.identity.class)) {
-        invalid(`${path}/identity/class`, 'Expected a ClassKey');
-    }
-    let id;
-    try {
-        id = NodeId(input.identity.id);
-    }
-    catch (cause) {
-        invalid(`${path}/identity/id`, 'Expected an IdentityId', cause);
-    }
-    return Object.freeze({
-        identity: Object.freeze({
-            id,
-            class: ClassKey(input.identity.class),
-        }),
-        authentication: authenticationInput(input.authentication, `${path}/authentication`),
-    });
-}
-function authenticationInput(input, path) {
-    if (!isRecord(input))
-        invalid(path, 'Expected an Authentication provision object');
-    if (Object.hasOwn(input, 'credentials')) {
-        exact(input, ['credentials'], path);
-        if (!isRecord(input.credentials))
-            invalid(`${path}/credentials`, 'Expected credentials');
-        exact(input.credentials, ['proof', 'publicKey'], `${path}/credentials`);
-        return Object.freeze({
-            credentials: Object.freeze({
-                publicKey: publicJwk(input.credentials.publicKey, `${path}/credentials/publicKey`),
-                proof: credentialProof(input.credentials.proof, `${path}/credentials/proof`),
-            }),
-        });
-    }
-    exact(input, ['iss', 'sub'], path);
-    if (typeof input.iss !== 'string')
-        invalid(`${path}/iss`, 'Expected an issuer');
-    let iss;
-    try {
-        iss = acceptIssuer(input.iss);
-    }
-    catch (cause) {
-        invalid(`${path}/iss`, 'Expected a canonical issuer', cause);
-    }
-    if (typeof input.sub !== 'string' || input.sub.length === 0) {
-        invalid(`${path}/sub`, 'Expected a non-empty subject');
-    }
-    return Object.freeze({ iss, sub: input.sub });
-}
-function targetKey(input) {
-    return 'created' in input.identity
-        ? `created\u0000${input.identity.created}`
-        : `existing\u0000${input.identity.class}\u0000${input.identity.id}`;
-}
-function assertedAuthenticationKey(input) {
-    return input === undefined || 'credentials' in input
-        ? undefined
-        : `${input.iss}\u0000${input.sub}`;
-}
-function compareIdentity(left, right) {
-    return compare(targetKey(left), targetKey(right));
-}
-function credentialProof(input, path) {
-    if (typeof input === 'string') {
-        const bytes = textEncoder.encode(input).byteLength;
-        if (bytes === 0 || bytes > PROOF_BYTES_LIMIT) {
-            invalid(path, `Credential proof must contain 1-${PROOF_BYTES_LIMIT} bytes`);
-        }
-        return input;
-    }
-    if (!(input instanceof Uint8Array) ||
-        input.byteLength === 0 ||
-        input.byteLength > PROOF_BYTES_LIMIT) {
-        invalid(path, `Credential proof must contain 1-${PROOF_BYTES_LIMIT} bytes`);
-    }
-    return input.slice();
-}
-function publicJwk(input, path) {
-    try {
-        return acceptPublic(input);
-    }
-    catch (cause) {
-        invalid(path, 'Expected a thumbprintable public JWK', cause);
-    }
-}
-function constraints(input, path) {
-    if (input === undefined)
-        return Object.freeze([]);
-    if (!Array.isArray(input) || input.length > MAX_REQUIRED_CLAIMS) {
-        invalid(path, `Expected at most ${MAX_REQUIRED_CLAIMS} required-claim constraints`);
-    }
-    return Object.freeze(input.map((item, index) => {
-        let admitted;
-        try {
-            admitted = portable.accept(item);
-        }
-        catch (cause) {
-            invalid(`${path}/${index}`, 'Expected a portable claim constraint', cause);
-        }
-        return admitConstraint(admitted, `${path}/${index}`, invalid);
-    }));
-}
-function isRecord(input) {
-    return input !== null && typeof input === 'object' && !Array.isArray(input);
-}
-function exact(input, expected, path) {
-    const actual = Object.keys(input).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-    }
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message, cause) {
-    throw new AuthValueError('AUTH_PROVISION_REQUEST_INVALID', message, path, cause === undefined ? undefined : { cause });
-}

package/dist/auth/provision/request/index.d.ts

@@ -1,3 +0,0 @@
-export { accept } from './admission.js';
-export { isSelfIssuer, selfIssuer } from './self-issuer.js';
-export type { AuthenticationProvision, IdentityProvision, ProvisionRequest, RequiredClaims, } from './request.js';

package/dist/auth/provision/request/request.d.ts

@@ -1,35 +0,0 @@
-import type { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
-import type { LocalBinding, MutationAST } from '../../../graph/mutate/index.js';
-import type { ClaimConstraint } from '../../claims/index.js';
-import type { CredentialInput } from '../../credential/input/index.js';
-import type { Authentication, IdentityId } from '../../identity/index.js';
-import type { JsonWebKey } from '../../jwk/index.js';
-export type RequiredClaims = readonly ClaimConstraint[];
-export type AuthenticationProvision = Authentication | {
-    readonly credentials: {
-        readonly publicKey: JsonWebKey;
-        readonly proof: CredentialInput;
-    };
-    readonly iss?: never;
-    readonly sub?: never;
-};
-export type IdentityProvision = {
-    readonly identity: {
-        readonly created: LocalBinding;
-    };
-    readonly authentication?: AuthenticationProvision;
-    readonly requiredClaims?: RequiredClaims;
-} | {
-    readonly identity: {
-        readonly id: IdentityId;
-        readonly class: ClassKey;
-    };
-    readonly authentication: AuthenticationProvision;
-    readonly requiredClaims?: never;
-};
-/** One protected Identity transition with an optional caller-authored graph Mutation. */
-export interface ProvisionRequest {
-    readonly idempotencyKey: string;
-    readonly mutation?: MutationAST;
-    readonly identities: readonly [IdentityProvision, ...IdentityProvision[]];
-}

package/dist/auth/provision/result/index.d.ts

@@ -1 +0,0 @@
-export type { ProvisionedIdentity, ProvisionResult } from './result.js';

package/dist/auth/provision/result/result.d.ts

@@ -1,19 +0,0 @@
-import type { LocalBinding } from '../../../graph/mutate/index.js';
-import type { NodeId } from '../../../graph/node/index.js';
-import type { IdentityId, Subject } from '../../identity/index.js';
-import type { IssuerId } from '../../issuer/index.js';
-interface ProvisionedIdentityBase {
-    readonly id: IdentityId;
-}
-export type ProvisionedIdentity = ProvisionedIdentityBase & ({
-    readonly iss?: never;
-    readonly sub?: never;
-} | {
-    readonly iss: IssuerId;
-    readonly sub: Subject;
-});
-export interface ProvisionResult {
-    readonly createdNodes: Readonly<Record<LocalBinding, NodeId>>;
-    readonly identities: readonly [ProvisionedIdentity, ...ProvisionedIdentity[]];
-}
-export {};

package/dist/schema/kernel/syscalls/contracts/provision.d.ts

@@ -1,301 +0,0 @@
-export declare const provisionInput: import("zod").ZodObject<{
-    idempotencyKey: import("zod").ZodString;
-    mutation: import("zod").ZodOptional<import("zod").ZodObject<{
-        format: import("zod").ZodLiteral<"astrale.graph.mutation">;
-        version: import("zod").ZodLiteral<"v3">;
-        preconditions: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"node">;
-            node: import("zod").ZodString;
-            class: import("zod").ZodString;
-            props: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-                equals: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-                absent: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                absent: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>]>>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"edge">;
-            edge: import("zod").ZodObject<{
-                source: import("zod").ZodString;
-                target: import("zod").ZodString;
-                class: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-            slug: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodType<import("../../../../graph/edge/index.js").EdgeSlug, unknown, import("zod/v4/core").$ZodTypeInternals<import("../../../../graph/edge/index.js").EdgeSlug, unknown>>>>;
-            props: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-                equals: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-                absent: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                absent: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>]>>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            kind: import("zod").ZodLiteral<"query">;
-            query: import("zod").ZodObject<{
-                format: import("zod").ZodLiteral<"astrale.graph.query">;
-                version: import("zod").ZodLiteral<"v6">;
-                source: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"node">;
-                    terms: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"path">;
-                        path: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"class">;
-                        class: import("zod").ZodObject<{
-                            origin: import("zod").ZodString;
-                            kind: import("zod").ZodLiteral<"class">;
-                            name: import("zod").ZodString;
-                        }, import("zod/v4/core").$strict>;
-                    }, import("zod/v4/core").$strict>], "kind">>;
-                    binding: import("zod").ZodString;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"edge">;
-                    terms: import("zod").ZodArray<import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"class">;
-                        class: import("zod").ZodObject<{
-                            origin: import("zod").ZodString;
-                            kind: import("zod").ZodLiteral<"class">;
-                            name: import("zod").ZodString;
-                        }, import("zod/v4/core").$strict>;
-                    }, import("zod/v4/core").$strict>>;
-                    bindings: import("zod").ZodObject<{
-                        source: import("zod").ZodString;
-                        edge: import("zod").ZodString;
-                        target: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>;
-                }, import("zod/v4/core").$strict>], "kind">;
-                steps: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    op: import("zod").ZodLiteral<"filter">;
-                    binding: import("zod").ZodString;
-                    predicate: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"class.satisfies">;
-                        class: import("zod").ZodObject<{
-                            origin: import("zod").ZodString;
-                            kind: import("zod").ZodLiteral<"class">;
-                            name: import("zod").ZodString;
-                        }, import("zod/v4/core").$strict>;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"class.equal">;
-                        class: import("zod").ZodObject<{
-                            origin: import("zod").ZodString;
-                            kind: import("zod").ZodLiteral<"class">;
-                            name: import("zod").ZodString;
-                        }, import("zod/v4/core").$strict>;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"property.equal">;
-                        property: import("zod").ZodString;
-                        value: import("zod").ZodUnknown;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"property.present">;
-                        property: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"identity.equal">;
-                        identity: import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodObject<{
-                            source: import("zod").ZodString;
-                            target: import("zod").ZodString;
-                            class: import("zod").ZodString;
-                        }, import("zod/v4/core").$strict>]>;
-                    }, import("zod/v4/core").$strict>], "kind">;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    op: import("zod").ZodLiteral<"expand">;
-                    from: import("zod").ZodString;
-                    via: import("zod").ZodArray<import("zod").ZodObject<{
-                        origin: import("zod").ZodString;
-                        kind: import("zod").ZodLiteral<"class">;
-                        name: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                    direction: import("zod").ZodEnum<{
-                        incident: "incident";
-                        incoming: "incoming";
-                        outgoing: "outgoing";
-                    }>;
-                    bindings: import("zod").ZodObject<{
-                        edge: import("zod").ZodString;
-                        node: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>;
-                }, import("zod/v4/core").$strict>], "op">>;
-                select: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"graph">;
-                    binding: import("zod").ZodString;
-                    order: import("zod").ZodOptional<import("zod").ZodObject<{
-                        property: import("zod").ZodString;
-                        direction: import("zod").ZodEnum<{
-                            asc: "asc";
-                            desc: "desc";
-                        }>;
-                        unranked: import("zod").ZodEnum<{
-                            first: "first";
-                            last: "last";
-                        }>;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"nodes">;
-                    binding: import("zod").ZodString;
-                    projection: import("zod").ZodObject<{
-                        kind: import("zod").ZodEnum<{
-                            reference: "reference";
-                            value: "value";
-                        }>;
-                    }, import("zod/v4/core").$strict>;
-                    order: import("zod").ZodOptional<import("zod").ZodObject<{
-                        property: import("zod").ZodString;
-                        direction: import("zod").ZodEnum<{
-                            asc: "asc";
-                            desc: "desc";
-                        }>;
-                        unranked: import("zod").ZodEnum<{
-                            first: "first";
-                            last: "last";
-                        }>;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"edges">;
-                    binding: import("zod").ZodString;
-                    projection: import("zod").ZodObject<{
-                        edge: import("zod").ZodEnum<{
-                            reference: "reference";
-                            value: "value";
-                        }>;
-                        source: import("zod").ZodEnum<{
-                            reference: "reference";
-                            value: "value";
-                        }>;
-                        target: import("zod").ZodEnum<{
-                            reference: "reference";
-                            value: "value";
-                        }>;
-                    }, import("zod/v4/core").$strict>;
-                    order: import("zod").ZodOptional<import("zod").ZodObject<{
-                        property: import("zod").ZodString;
-                        direction: import("zod").ZodEnum<{
-                            asc: "asc";
-                            desc: "desc";
-                        }>;
-                        unranked: import("zod").ZodEnum<{
-                            first: "first";
-                            last: "last";
-                        }>;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>], "kind">;
-            }, import("zod/v4/core").$strict>;
-            equals: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"node">;
-                ids: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                kind: import("zod").ZodLiteral<"edge">;
-                keys: import("zod").ZodArray<import("zod").ZodObject<{
-                    source: import("zod").ZodString;
-                    target: import("zod").ZodString;
-                    class: import("zod").ZodString;
-                }, import("zod/v4/core").$strict>>;
-            }, import("zod/v4/core").$strict>], "kind">;
-        }, import("zod/v4/core").$strict>]>>;
-        operations: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"node.create">;
-            as: import("zod").ZodString;
-            class: import("zod").ZodString;
-            props: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"node.update">;
-            node: import("zod").ZodString;
-            class: import("zod").ZodString;
-            props: import("zod").ZodObject<{
-                set: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-                unset: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"node.delete">;
-            node: import("zod").ZodString;
-            class: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"edge.create">;
-            class: import("zod").ZodString;
-            source: import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodObject<{
-                created: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>]>;
-            target: import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodObject<{
-                created: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>]>;
-            slug: import("zod").ZodOptional<import("zod").ZodType<import("../../../../graph/edge/index.js").EdgeSlug, unknown, import("zod/v4/core").$ZodTypeInternals<import("../../../../graph/edge/index.js").EdgeSlug, unknown>>>;
-            props: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"edge.update">;
-            edge: import("zod").ZodObject<{
-                source: import("zod").ZodString;
-                target: import("zod").ZodString;
-                class: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-            slug: import("zod").ZodNullable<import("zod").ZodType<import("../../../../graph/edge/index.js").EdgeSlug, unknown, import("zod/v4/core").$ZodTypeInternals<import("../../../../graph/edge/index.js").EdgeSlug, unknown>>>;
-            props: import("zod").ZodOptional<import("zod").ZodObject<{
-                set: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-                unset: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"edge.update">;
-            edge: import("zod").ZodObject<{
-                source: import("zod").ZodString;
-                target: import("zod").ZodString;
-                class: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-            props: import("zod").ZodObject<{
-                set: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>;
-                unset: import("zod").ZodArray<import("zod").ZodString>;
-            }, import("zod/v4/core").$strict>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            op: import("zod").ZodLiteral<"edge.delete">;
-            edge: import("zod").ZodObject<{
-                source: import("zod").ZodString;
-                target: import("zod").ZodString;
-                class: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-        }, import("zod/v4/core").$strict>]>>;
-    }, import("zod/v4/core").$strict>>;
-    identities: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-        identity: import("zod").ZodObject<{
-            created: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>;
-        authentication: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-            iss: import("zod").ZodString;
-            sub: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            credentials: import("zod").ZodObject<{
-                publicKey: import("zod").ZodUnknown;
-                proof: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-        }, import("zod/v4/core").$strict>]>>;
-        requiredClaims: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"contains">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"eq">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"exists">;
-        }, import("zod/v4/core").$strict>], "op">>>;
-    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-        identity: import("zod").ZodObject<{
-            id: import("zod").ZodString;
-            class: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>;
-        authentication: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-            iss: import("zod").ZodString;
-            sub: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            credentials: import("zod").ZodObject<{
-                publicKey: import("zod").ZodUnknown;
-                proof: import("zod").ZodString;
-            }, import("zod/v4/core").$strict>;
-        }, import("zod/v4/core").$strict>]>;
-    }, import("zod/v4/core").$strict>]>>;
-}, import("zod/v4/core").$strict>;
-export declare const provisionOutput: import("zod").ZodObject<{
-    createdNodes: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;
-    identities: import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodObject<{
-        id: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-        id: import("zod").ZodString;
-        iss: import("zod").ZodString;
-        sub: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>]>>;
-}, import("zod/v4/core").$strict>;

package/dist/schema/kernel/syscalls/contracts/provision.js

@@ -1,28 +0,0 @@
-import { array, record, strictObject, string, union, unknown as unknownSchema } from 'zod';
-import { mutationAstSchema } from '#graph/mutate/wire';
-import { requiredClaimsSchema } from '../../../authority/claims.js';
-const text = string().min(1);
-const requiredClaims = requiredClaimsSchema.optional();
-const asserted = strictObject({ iss: text, sub: text });
-const self = strictObject({
-    credentials: strictObject({ publicKey: unknownSchema(), proof: text }),
-});
-const authentication = union([asserted, self]);
-const createdIdentity = strictObject({
-    identity: strictObject({ created: text }),
-    authentication: authentication.optional(),
-    requiredClaims,
-});
-const existingIdentity = strictObject({
-    identity: strictObject({ id: text, class: text }),
-    authentication,
-});
-export const provisionInput = strictObject({
-    idempotencyKey: text,
-    mutation: mutationAstSchema.optional(),
-    identities: array(union([createdIdentity, existingIdentity])).nonempty(),
-});
-export const provisionOutput = strictObject({
-    createdNodes: record(string(), text),
-    identities: array(union([strictObject({ id: text }), strictObject({ id: text, iss: text, sub: text })])).nonempty(),
-});