@astrale-os/kernel-core 0.9.0-beta.9 → 1.0.0-beta.2

package/dist/schema/meta/iconable.d.ts

@@ -1,18 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Iconable: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Optional bounded presentation icon metadata.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        icon: builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly minLength: 1;
-            readonly maxLength: 8000;
-        }>, {
-            readonly required: false;
-        }>;
+        readonly icon: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "icon", "self", never>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "icon", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/index.d.ts

@@ -1,3 +1,4 @@
+export { CreatedBy } from './created-by.js';
 export { Descriptable } from './descriptable.js';
 export { Edge } from './edge.js';
 export { Iconable } from './iconable.js';

package/dist/schema/meta/index.js

@@ -1,3 +1,4 @@
+export { CreatedBy } from './created-by.js';
 export { Descriptable } from './descriptable.js';
 export { Edge } from './edge.js';
 export { Iconable } from './iconable.js';

package/dist/schema/meta/named.d.ts

@@ -1,16 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Named: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Stable human-facing name metadata that never acts as a locator.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        readonly name: {
-            readonly type: "string";
-            readonly minLength: 1;
-            readonly maxLength: 100;
-        };
+        readonly name: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "name", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "name", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/node.d.ts

@@ -1,5 +1,13 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Node: builder.NodeClass<{
+    readonly depth: 0;
     readonly abstract: true;
-    readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
+    readonly extends: readonly [];
+    readonly properties: never;
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: never;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/remotable.d.ts

@@ -1,29 +1,22 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Remotable: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Optional synchronization metadata for a value originating outside the local kernel.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        externalId: builder.Property<{
-            readonly type: "string";
-            readonly minLength: 1;
-            readonly maxLength: 512;
-        }, {
-            readonly required: false;
-        }>;
-        onConflict: builder.Property<{
-            readonly enum: readonly ["defaults", "error", "merge", "replace", "skip"];
-        }, {
-            readonly required: false;
-        }>;
-        updatedAt: builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, {
-            readonly required: false;
-        }>;
+        readonly externalId: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "externalId", "self", never>;
+        readonly onConflict: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "onConflict", "self", never>;
+        readonly updatedAt: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "updatedAt", "self", never>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "externalId", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "onConflict", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "updatedAt", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/statused.d.ts

@@ -1,14 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Statused: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Explicit lifecycle-state metadata for values whose contract declares such a state.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        readonly status: {
-            readonly enum: readonly ["active", "creating", "deleting", "error", "updating"];
-        };
+        readonly status: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "status", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "status", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/timestamped.d.ts

@@ -1,19 +1,21 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Timestamped: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Explicit creation and update timestamp metadata.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        createdAt: builder.AutoProperty<builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, builder.PropertyOptions>>;
-        updatedAt: builder.AutoProperty<builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, builder.PropertyOptions>>;
+        readonly createdAt: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "createdAt", "self", undefined>;
+        readonly updatedAt: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "updatedAt", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "createdAt", "self", undefined> | builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "updatedAt", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.9",
+  "version": "1.0.0-beta.2",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,18 +160,21 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": ">=0.2.0-beta.7 <1.0.0",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.2",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
-    "dequal": "2.0.3",
-    "zod": "^4.3.6"
+    "dequal": "2.0.3"
   },
   "devDependencies": {
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^25.2.3",
     "tsx": "4.23.12",
     "typescript": "7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.1",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "zod": "^4.4.3"
   },
   "scripts": {
     "build": "tsc",
@@ -183,7 +186,6 @@
     "test": "vitest run",
     "test:file": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.types.json && tsc --noEmit -p schema/.module/tsconfig.json",
-    "preinstall": "node -e \"try{require('./.check-workspace.cjs')}catch{}\""
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.types.json && tsc --noEmit -p schema/.module/tsconfig.json && tsc -p tsconfig.workers.json"
   }
 }

package/dist/auth/expression/normalization/canonicalize.d.ts

@@ -1,7 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import type { IdentityExpr } from '../language/index.js';
-export declare const EXPRESSION_DEPTH_LIMIT = 32;
-export declare const EXPRESSION_OPERAND_LIMIT = 64;
-/** Validate and canonicalize a resolved expression. */
-export declare function canonicalize(expr: IdentityExpr): IdentityExpr;
-export declare function admitResolvedExpression(input: portable.Value, path: string, depth: number): IdentityExpr;

package/dist/auth/expression/normalization/canonicalize.js

@@ -1,102 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import { NodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error.js';
-export const EXPRESSION_DEPTH_LIMIT = 32;
-export const EXPRESSION_OPERAND_LIMIT = 64;
-/** Validate and canonicalize a resolved expression. */
-export function canonicalize(expr) {
-    try {
-        return admit(portable.accept(expr), '', 0);
-    }
-    catch (cause) {
-        if (cause instanceof AuthValueError)
-            throw cause;
-        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved Identity expression', '', {
-            cause,
-        });
-    }
-}
-export function admitResolvedExpression(input, path, depth) {
-    return admit(input, path, depth);
-}
-function admit(input, path, depth) {
-    if (depth > EXPRESSION_DEPTH_LIMIT)
-        invalid(path, 'Identity expression exceeds its depth limit');
-    const value = record(input, path);
-    switch (value.kind) {
-        case 'identity':
-            exact(value, ['id', 'kind'], path);
-            if (typeof value.id !== 'string')
-                invalid(`${path}/id`, 'Expected a NodeId');
-            return Object.freeze({ kind: 'identity', id: NodeId(value.id) });
-        case 'union':
-        case 'intersect': {
-            exact(value, ['kind', 'operands'], path);
-            const source = list(value.operands, `${path}/operands`, 2);
-            const kind = value.kind;
-            const operands = unique(source
-                .map((operand, index) => admit(operand, `${path}/operands/${index}`, depth + 1))
-                .flatMap((operand) => (operand.kind === kind ? operand.operands : [operand])));
-            if (operands.length > EXPRESSION_OPERAND_LIMIT) {
-                invalid(`${path}/operands`, `Expected 2-${EXPRESSION_OPERAND_LIMIT} operands`);
-            }
-            return operands.length === 1
-                ? operands[0]
-                : Object.freeze({ kind, operands: Object.freeze(operands) });
-        }
-        case 'exclude': {
-            exact(value, ['base', 'excluded', 'kind'], path);
-            const excluded = unique(list(value.excluded, `${path}/excluded`, 1)
-                .map((operand, index) => admit(operand, `${path}/excluded/${index}`, depth + 1))
-                .flatMap((operand) => (operand.kind === 'union' ? operand.operands : [operand])));
-            if (excluded.length > EXPRESSION_OPERAND_LIMIT) {
-                invalid(`${path}/excluded`, `Expected 1-${EXPRESSION_OPERAND_LIMIT} operands`);
-            }
-            return Object.freeze({
-                kind: 'exclude',
-                base: admit(required(value.base, `${path}/base`), `${path}/base`, depth + 1),
-                excluded: Object.freeze(excluded),
-            });
-        }
-        default:
-            invalid(`${path}/kind`, 'Expected identity, union, intersect, or exclude');
-    }
-}
-function unique(input) {
-    const keyed = input
-        .map((expr) => ({ expr, key: portable.json.serialize(expr) }))
-        .sort((left, right) => compare(left.key, right.key));
-    return keyed
-        .filter((entry, index) => index === 0 || entry.key !== keyed[index - 1].key)
-        .map((entry) => entry.expr);
-}
-function record(input, path) {
-    if (input === null || Array.isArray(input) || typeof input !== 'object') {
-        invalid(path, 'Expected an object');
-    }
-    return input;
-}
-function list(input, path, minimum) {
-    if (!Array.isArray(input) || input.length < minimum || input.length > EXPRESSION_OPERAND_LIMIT) {
-        invalid(path, `Expected ${minimum}-${EXPRESSION_OPERAND_LIMIT} operands`);
-    }
-    return input;
-}
-function required(input, path) {
-    if (input === undefined)
-        invalid(path, 'Expected a value');
-    return input;
-}
-function exact(value, expected, path) {
-    const actual = Object.keys(value).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-    }
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message) {
-    throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
-}

package/dist/auth/expression/normalization/index.d.ts

@@ -1,2 +0,0 @@
-export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
-export { raiseDenials } from './raise-denials.js';

package/dist/auth/expression/normalization/index.js

@@ -1,2 +0,0 @@
-export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
-export { raiseDenials } from './raise-denials.js';

package/dist/auth/expression/normalization/raise-denials.d.ts

@@ -1,3 +0,0 @@
-import type { IdentityExpr } from '../language/index.js';
-/** Raise every positive-position exclusion into one Grant-wide veto. */
-export declare function raiseDenials(expr: IdentityExpr): IdentityExpr;

package/dist/auth/expression/normalization/raise-denials.js

@@ -1,59 +0,0 @@
-/** Raise every positive-position exclusion into one Grant-wide veto. */
-export function raiseDenials(expr) {
-    const denials = [...collectDenials(expr, new WeakMap())];
-    if (denials.length === 0)
-        return expr;
-    return Object.freeze({
-        kind: 'exclude',
-        base: stripExcludes(expr, new WeakMap()),
-        excluded: Object.freeze(denials),
-    });
-}
-function stripExcludes(expr, memo) {
-    const cached = memo.get(expr);
-    if (cached !== undefined)
-        return cached;
-    let stripped;
-    switch (expr.kind) {
-        case 'identity':
-            stripped = expr;
-            break;
-        case 'union':
-        case 'intersect':
-            stripped = Object.freeze({
-                kind: expr.kind,
-                operands: Object.freeze(expr.operands.map((operand) => stripExcludes(operand, memo))),
-            });
-            break;
-        case 'exclude':
-            stripped = stripExcludes(expr.base, memo);
-            break;
-    }
-    memo.set(expr, stripped);
-    return stripped;
-}
-function collectDenials(expr, memo) {
-    const cached = memo.get(expr);
-    if (cached !== undefined)
-        return cached;
-    const denials = new Set();
-    switch (expr.kind) {
-        case 'identity':
-            break;
-        case 'union':
-        case 'intersect':
-            for (const operand of expr.operands) {
-                for (const denial of collectDenials(operand, memo))
-                    denials.add(denial);
-            }
-            break;
-        case 'exclude':
-            for (const excluded of expr.excluded)
-                denials.add(excluded);
-            for (const denial of collectDenials(expr.base, memo))
-                denials.add(denial);
-            break;
-    }
-    memo.set(expr, denials);
-    return denials;
-}

package/dist/auth/provision/fingerprint/fingerprint.d.ts

@@ -1,9 +0,0 @@
-import type { ProvisionRequest } from '../index.js';
-declare const PROVISION_FINGERPRINT: unique symbol;
-/** Digest of the semantic request. Self-proof bytes are deliberately excluded. */
-export type ProvisionFingerprint = `sha256:${string}` & {
-    readonly [PROVISION_FINGERPRINT]: true;
-};
-/** Compute a deterministic semantic request digest without retaining bearer proof bytes. */
-export declare function fingerprint(request: ProvisionRequest): Promise<ProvisionFingerprint>;
-export {};

package/dist/auth/provision/fingerprint/fingerprint.js

@@ -1,33 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import { MutationAST } from '../../../graph/mutate/index.js';
-/** Compute a deterministic semantic request digest without retaining bearer proof bytes. */
-export async function fingerprint(request) {
-    const identities = Object.fromEntries(Object.entries(request.identities)
-        .sort(([left], [right]) => compare(left, right))
-        .map(([binding, input]) => [
-        binding,
-        input.credentials !== undefined
-            ? {
-                credentials: { publicKey: input.credentials.publicKey },
-                requiredClaims: input.requiredClaims ?? [],
-            }
-            : {
-                issuer: input.issuer,
-                subject: input.subject,
-                requiredClaims: input.requiredClaims ?? [],
-            },
-    ]));
-    const basis = portable.json.encode(portable.accept({
-        idempotencyKey: request.idempotencyKey,
-        mutation: MutationAST.encode(request.mutation),
-        identities,
-    }));
-    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(basis).buffer);
-    return `sha256:${hex(new Uint8Array(digest))}`;
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function hex(input) {
-    return [...input].map((value) => value.toString(16).padStart(2, '0')).join('');
-}

package/dist/auth/provision/fingerprint/index.d.ts

@@ -1,2 +0,0 @@
-export { fingerprint } from './fingerprint.js';
-export type { ProvisionFingerprint } from './fingerprint.js';

package/dist/auth/provision/index.d.ts

@@ -1,5 +0,0 @@
-export { fingerprint } from './fingerprint/index.js';
-export type { ProvisionFingerprint } from './fingerprint/index.js';
-export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
-export type { AssertedIdentityProvision, IdentityProvisionInput, ProvisionRequest, RequiredClaims, SelfIdentityProvision, } from './request/index.js';
-export type { ProvisionedIdentity, ProvisionResult } from './result/index.js';

package/dist/auth/provision/request/admission.d.ts

@@ -1,3 +0,0 @@
-import type { ProvisionRequest } from './request.js';
-/** Admit unknown input into the exact immutable Provision request language. */
-export declare function accept(input: unknown): ProvisionRequest;

package/dist/auth/provision/request/admission.js

@@ -1,125 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import { isLocalBinding } from '../../../graph/graph/index.js';
-import { MutationAST } from '../../../graph/mutate/index.js';
-import { admitConstraint, MAX_REQUIRED_CLAIMS } from '../../claims/admission/index.js';
-import { AuthValueError } from '../../error.js';
-import { accept as acceptIssuer } from '../../issuer/index.js';
-import { acceptPublic } from '../../jwk/index.js';
-const PROOF_BYTES_LIMIT = 64 * 1024;
-const textEncoder = new TextEncoder();
-/** Admit unknown input into the exact immutable Provision request language. */
-export function accept(input) {
-    if (!isRecord(input))
-        invalid('', 'Expected a Provision request object');
-    exact(input, ['idempotencyKey', 'identities', 'mutation'], '');
-    if (typeof input.idempotencyKey !== 'string' || input.idempotencyKey.length === 0) {
-        invalid('/idempotencyKey', 'Expected a non-empty idempotency key');
-    }
-    const mutation = MutationAST.decode(input.mutation);
-    if (!isRecord(input.identities))
-        invalid('/identities', 'Expected an Identity binding map');
-    const identities = {};
-    for (const binding of Object.keys(input.identities).sort(compare)) {
-        if (!isLocalBinding(binding))
-            invalid(`/identities/${pointer(binding)}`, 'Invalid LocalBinding');
-        identities[binding] = identityInput(input.identities[binding], `/identities/${pointer(binding)}`);
-    }
-    return Object.freeze({
-        idempotencyKey: input.idempotencyKey,
-        mutation,
-        identities: Object.freeze(identities),
-    });
-}
-function identityInput(input, path) {
-    if (!isRecord(input))
-        invalid(path, 'Expected an Identity provision object');
-    const requiredClaims = constraints(input.requiredClaims, `${path}/requiredClaims`);
-    if (Object.hasOwn(input, 'credentials')) {
-        exact(input, input.requiredClaims === undefined ? ['credentials'] : ['credentials', 'requiredClaims'], path);
-        if (!isRecord(input.credentials))
-            invalid(`${path}/credentials`, 'Expected credentials');
-        exact(input.credentials, ['proof', 'publicKey'], `${path}/credentials`);
-        return Object.freeze({
-            credentials: Object.freeze({
-                publicKey: publicJwk(input.credentials.publicKey, `${path}/credentials/publicKey`),
-                proof: credentialProof(input.credentials.proof, `${path}/credentials/proof`),
-            }),
-            ...(requiredClaims.length === 0 ? {} : { requiredClaims }),
-        });
-    }
-    exact(input, input.requiredClaims === undefined
-        ? ['issuer', 'subject']
-        : ['issuer', 'requiredClaims', 'subject'], path);
-    if (typeof input.issuer !== 'string')
-        invalid(`${path}/issuer`, 'Expected an issuer');
-    let issuer;
-    try {
-        issuer = acceptIssuer(input.issuer);
-    }
-    catch (cause) {
-        invalid(`${path}/issuer`, 'Expected a canonical issuer', cause);
-    }
-    if (typeof input.subject !== 'string' || input.subject.length === 0)
-        invalid(`${path}/subject`, 'Expected a non-empty subject');
-    return Object.freeze({
-        issuer,
-        subject: input.subject,
-        ...(requiredClaims.length === 0 ? {} : { requiredClaims }),
-    });
-}
-function credentialProof(input, path) {
-    if (typeof input === 'string') {
-        const bytes = textEncoder.encode(input).byteLength;
-        if (bytes === 0 || bytes > PROOF_BYTES_LIMIT)
-            invalid(path, `Credential proof must contain 1-${PROOF_BYTES_LIMIT} bytes`);
-        return input;
-    }
-    if (!(input instanceof Uint8Array) ||
-        input.byteLength === 0 ||
-        input.byteLength > PROOF_BYTES_LIMIT) {
-        invalid(path, `Credential proof must contain 1-${PROOF_BYTES_LIMIT} bytes`);
-    }
-    return input.slice();
-}
-function publicJwk(input, path) {
-    try {
-        return acceptPublic(input);
-    }
-    catch (cause) {
-        invalid(path, 'Expected a thumbprintable public JWK', cause);
-    }
-}
-function constraints(input, path) {
-    if (input === undefined)
-        return Object.freeze([]);
-    if (!Array.isArray(input) || input.length > MAX_REQUIRED_CLAIMS)
-        invalid(path, `Expected at most ${MAX_REQUIRED_CLAIMS} required-claim constraints`);
-    return Object.freeze(input.map((item, index) => {
-        let admitted;
-        try {
-            admitted = portable.accept(item);
-        }
-        catch (cause) {
-            invalid(`${path}/${index}`, 'Expected a portable claim constraint', cause);
-        }
-        return admitConstraint(admitted, `${path}/${index}`, invalid);
-    }));
-}
-function isRecord(input) {
-    return input !== null && typeof input === 'object' && !Array.isArray(input);
-}
-function exact(input, expected, path) {
-    const actual = Object.keys(input).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index]))
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-}
-function pointer(input) {
-    return input.replaceAll('~', '~0').replaceAll('/', '~1');
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message, cause) {
-    throw new AuthValueError('AUTH_PROVISION_REQUEST_INVALID', message, path, cause === undefined ? undefined : { cause });
-}

package/dist/auth/provision/request/index.d.ts

@@ -1,3 +0,0 @@
-export { accept } from './admission.js';
-export { isSelfIssuer, selfIssuer } from './self-issuer.js';
-export type { AssertedIdentityProvision, IdentityProvisionInput, ProvisionRequest, RequiredClaims, SelfIdentityProvision, } from './request.js';