@astrale-os/sdk 0.1.8 → 0.1.9

package/dist/define/remote-function.d.ts

@@ -18,18 +18,21 @@
 import type { AuthPolicy, FunctionBinding } from '@astrale-os/kernel-api/routed';
 import type { FnMap } from '@astrale-os/kernel-client';
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { AuthContext } from '@astrale-os/kernel-core';
 import type { Context } from 'hono';
 import type { z } from 'zod';
 import type { CallRemoteFn } from '../dispatch/call-remote';
-import type { KernelForAuth } from '../method/context';
-export type RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null> = {
+import type { AuthForPolicy, KernelForAuth } from '../method/context';
+export type RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null, TAuth extends AuthPolicy = AuthPolicy> = {
     /** Validated params (Zod-checked against `inputSchema`). */
     params: TParams;
     /** Hono request context — escape hatch for headers, raw body, etc. */
     c: Context;
-    /** Resolved auth context. `null` when `auth: 'public'` or absent. */
-    auth: AuthContext | null;
+    /**
+     * Resolved auth context. Its nullability follows the function's `auth`
+     * policy: non-null for the default `'required'`, `... | null` for
+     * `'optional'`, and `null` for `'public'`.
+     */
+    auth: AuthForPolicy<TAuth>;
     /** Typed dependency container injected at server startup. */
     deps: TDeps;
     /**
@@ -83,15 +86,16 @@ export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unkn
     binding?: FunctionBinding;
     /**
      * Authentication policy. Defaults to `'required'`. Captured as a literal type
-     * so it drives {@link KernelForAuth} on the `execute`/`authorize` context:
-     * omit it (or `'required'`) → `ctx.kernel` non-null; `'optional'` → `… | null`;
-     * `'public'` → `null` (webhooks reach the graph via `ctx.selfKernel`).
+     * so it drives `ctx.auth` and {@link KernelForAuth} on the
+     * `execute`/`authorize` context: omit it (or `'required'`) makes both
+     * non-null; `'optional'` widens them to `... | null`; `'public'` makes them
+     * `null` (webhooks reach the graph via `ctx.selfKernel`).
      */
     auth?: TAuth;
     /** Optional pre-execute authorization. Throw to deny. */
-    authorize?: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>) => void | Promise<void>;
+    authorize?: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>) => void | Promise<void>;
     /** The function body. May be async. */
-    execute: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>) => TResult | Promise<TResult>;
+    execute: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>) => TResult | Promise<TResult>;
     /** Optional human-readable description. */
     description?: string;
 };

package/dist/define/remote-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-function.d.ts","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,MAAM,qBAAqB,CAC/B,OAAO,EACP,KAAK,GAAG,OAAO,EACf,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,IAC5C;IACF,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,CAAC,EAAE,OAAO,CAAA;IACV,qEAAqE;IACrE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;OAKG;IACH,UAAU,EAAE,YAAY,CAAA;IACxB;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC3E,CAAA;AAED,MAAM,MAAM,iBAAiB,CAC3B,OAAO,GAAG,OAAO,EACjB,OAAO,GAAG,OAAO,EACjB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,wCAAwC;IACxC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAChC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ,yDAAyD;IACzD,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC7D,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,uCAAuC;IACvC,OAAO,EAAE,CACP,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC7D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAMD,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE/E;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EACP,OAAO,EACP,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GACrD,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAEnD"}
+{"version":3,"file":"remote-function.d.ts","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAErE,MAAM,MAAM,qBAAqB,CAC/B,OAAO,EACP,KAAK,GAAG,OAAO,EACf,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC9C,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,CAAC,EAAE,OAAO,CAAA;IACV;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;OAKG;IACH,UAAU,EAAE,YAAY,CAAA;IACxB;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC3E,CAAA;AAED,MAAM,MAAM,iBAAiB,CAC3B,OAAO,GAAG,OAAO,EACjB,OAAO,GAAG,OAAO,EACjB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,wCAAwC;IACxC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAChC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ,yDAAyD;IACzD,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACpE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,uCAAuC;IACvC,OAAO,EAAE,CACP,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAMD,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE/E;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EACP,OAAO,EACP,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GACrD,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAEnD"}

package/dist/define/remote-function.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-function.js","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyGH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAMlC,GAAsD;IAEtD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"remote-function.js","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA8GH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAMlC,GAAsD;IAEtD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/define/view.d.ts

@@ -20,10 +20,10 @@
 import type { AuthPolicy, FunctionBinding } from '@astrale-os/kernel-api/routed';
 import type { FnMap } from '@astrale-os/kernel-client';
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { AuthContext } from '@astrale-os/kernel-core';
 import type { EdgeEndpoint } from '@astrale-os/kernel-dsl';
 import type { Context } from 'hono';
-export type ViewRenderContext<TDeps = unknown> = {
+import type { AuthForPolicy } from '../method/context';
+export type ViewRenderContext<TDeps = unknown, TAuth extends AuthPolicy = AuthPolicy> = {
     /** Hono request context — read params, headers, query, etc. */
     c: Context;
     /**
@@ -32,8 +32,12 @@ export type ViewRenderContext<TDeps = unknown> = {
      * the binding has no placeholders.
      */
     params: Record<string, string>;
-    /** Resolved auth context. `null` when `auth: 'public'` or absent. */
-    auth: AuthContext | null;
+    /**
+     * Resolved auth context. Its nullability follows the View's `auth` policy:
+     * non-null for `'required'`, `... | null` for `'optional'`, and `null` for
+     * `'public'`.
+     */
+    auth: AuthForPolicy<TAuth>;
     /** Typed dependency container injected at server startup. */
     deps: TDeps;
     /**
@@ -45,7 +49,7 @@ export type ViewRenderContext<TDeps = unknown> = {
      */
     selfKernel: (kernelUrl?: string) => Promise<BoundClientSessionView<FnMap>>;
 };
-export type ViewDef<TDeps = unknown> = {
+export type ViewDef<TDeps = unknown, TAuth extends AuthPolicy = AuthPolicy> = {
     /**
      * Override the binding (URL + route shape). When absent, SDK defaults to
      * `{ remoteUrl: ${url}/<viewsFolder>/<slug> }`. The HTTP verb (GET for
@@ -65,18 +69,18 @@ export type ViewDef<TDeps = unknown> = {
      */
     mount?: string;
     /** Authentication policy. Defaults to `'required'`. */
-    auth?: AuthPolicy;
+    auth?: TAuth;
     /**
      * Optional pre-render authorization. Runs after auth resolution; throw to
      * deny. SDK wraps as 403.
      */
-    authorize?: (ctx: ViewRenderContext<TDeps>) => void | Promise<void>;
+    authorize?: (ctx: ViewRenderContext<TDeps, TAuth>) => void | Promise<void>;
     /**
      * Render the iframe response. May return a redirect, a proxy, or inline
      * HTML. When omitted, no worker route is mounted — the binding URL
      * points elsewhere (CDN, external service).
      */
-    render?: (ctx: ViewRenderContext<TDeps>) => Response | Promise<Response>;
+    render?: (ctx: ViewRenderContext<TDeps, TAuth>) => Response | Promise<Response>;
     /**
      * Optional target(s) the View attaches to via `view_for` edge(s). Typically
      * `selfOf(SomeClass)` to bind to a class meta-node, or a `CorePath`
@@ -92,5 +96,5 @@ export type ViewDef<TDeps = unknown> = {
  * `defineRemoteDomain` consumes the typed shape and the author retains
  * full type inference on `render` / `authorize`.
  */
-export declare function defineView<TDeps = unknown>(def: ViewDef<TDeps>): ViewDef<TDeps>;
+export declare function defineView<TDeps = unknown, TAuth extends AuthPolicy = 'required'>(def: ViewDef<TDeps, TAuth>): ViewDef<TDeps, TAuth>;
 //# sourceMappingURL=view.d.ts.map

package/dist/define/view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view.d.ts","sourceRoot":"","sources":["../../src/define/view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,MAAM,MAAM,iBAAiB,CAAC,KAAK,GAAG,OAAO,IAAI;IAC/C,+DAA+D;IAC/D,CAAC,EAAE,OAAO,CAAA;IACV;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,qEAAqE;IACrE,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC3E,CAAA;AAED,MAAM,MAAM,OAAO,CAAC,KAAK,GAAG,OAAO,IAAI;IACrC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxE;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAA;IACvC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAE/E"}
+{"version":3,"file":"view.d.ts","sourceRoot":"","sources":["../../src/define/view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,MAAM,iBAAiB,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACtF,+DAA+D;IAC/D,CAAC,EAAE,OAAO,CAAA;IACV;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC3E,CAAA;AAED,MAAM,MAAM,OAAO,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IAC5E;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1E;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/E;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,EAAE,CAAA;IACvC,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,EAC/E,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GACzB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAEvB"}

package/dist/define/view.js.map

@@ -1 +1 @@
-{"version":3,"file":"view.js","sourceRoot":"","sources":["../../src/define/view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2EH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAkB,GAAmB;IAC7D,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"view.js","sourceRoot":"","sources":["../../src/define/view.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgFH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,GAA0B;IAE1B,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { Kernel, KernelForAuth, RemoteContext, RemoteHandler, MethodImpl, ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl, } from './method';
+export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext, RemoteHandler, MethodImpl, ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl, } from './method';
 export { remoteMethod, remoteClassMethods, remoteInterfaceMethods } from './method';
 export { defineDomain, deploy, defineAdapter } from './config';
 export type { ClientBinding, DefineDomainConfig, DomainDefinition, DeployConfig, AdapterSpec, DeployCtx, DeployResult, DomainAdapter, DomainInfo, WatchCtx, WatchHandle, } from './config';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,MAAM,EACN,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAOnF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC9D,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAUnE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC3D,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAcpG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAGzC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,+BAA+B,CAAA;AAGtC,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAA;AACtE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAClF,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,aAAa,EACb,MAAM,EACN,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAOnF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC9D,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAUnE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC3D,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAcpG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,YAAY,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAGzC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,SAAS,EACT,UAAU,GACX,MAAM,+BAA+B,CAAA;AAGtC,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAA;AACtE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAClF,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAEnF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAe9D,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEnE,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,wBAAwB;AACxB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAG3D,4EAA4E;AAC5E,qFAAqF;AACrF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,yDAAyD;AAEzD,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAiB1C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AASlF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAEnF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAe9D,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAEnE,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,wBAAwB;AACxB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAG3D,4EAA4E;AAC5E,qFAAqF;AACrF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,yDAAyD;AAEzD,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAiB1C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AASlF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAA4B,MAAM,YAAY,CAAA;AACpE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,YAAY,CAAA"}

package/dist/method/context.d.ts

@@ -34,11 +34,21 @@ export type Kernel = BoundClientSessionView<FnMap>;
  * pre-conditional behaviour.
  */
 export type KernelForAuth<TAuth extends AuthPolicy> = TAuth extends 'public' ? null : TAuth extends 'optional' ? Kernel | null : Kernel;
-export type RemoteContext<TParams, TSelf, TDeps, TKernel = Kernel | null> = {
+/**
+ * The resolved auth context a handler receives, derived from its declared
+ * `auth` policy. Mirrors {@link KernelForAuth}: required methods have a
+ * verified auth context, optional/public methods encode the nullable cases.
+ */
+export type AuthForPolicy<TAuth extends AuthPolicy> = TAuth extends 'public' ? null : TAuth extends 'optional' ? AuthContext | null : AuthContext;
+export type RemoteContext<TParams, TSelf, TDeps, TKernel = Kernel | null, TAuth extends AuthPolicy = AuthPolicy> = {
     /** Validated params (Zod-checked against the method's `inputSchema`). */
     params: TParams;
-    /** Auth context resolved from the inbound delegation credential. `null` for public or unauthenticated optional methods. */
-    auth: AuthContext | null;
+    /**
+     * Auth context resolved from the inbound delegation credential. Its
+     * nullability follows the method's `auth` policy: non-null for the default
+     * `'required'`, `... | null` for `'optional'`, and `null` for `'public'`.
+     */
+    auth: AuthForPolicy<TAuth>;
     /** Bound node instance — `undefined` for static methods. */
     self: TSelf;
     /** Typed dependency container injected at server startup. */

package/dist/method/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/method/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,MAAM,GAAG,IAAI,GACb,MAAM,CAAA;AAEZ,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,IAAI;IAC1E,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,2HAA2H;IAC3H,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,4DAA4D;IAC5D,IAAI,EAAE,KAAK,CAAA;IACX,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;;OAQG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;;;OAOG;IACH,UAAU,EAAE,YAAY,CAAA;CACzB,CAAA"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/method/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,MAAM,GAAG,IAAI,GACb,MAAM,CAAA;AAEZ;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,UAAU,IAAI,KAAK,SAAS,QAAQ,GACxE,IAAI,GACJ,KAAK,SAAS,UAAU,GACtB,WAAW,GAAG,IAAI,GAClB,WAAW,CAAA;AAEjB,MAAM,MAAM,aAAa,CACvB,OAAO,EACP,KAAK,EACL,KAAK,EACL,OAAO,GAAG,MAAM,GAAG,IAAI,EACvB,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,KAAK,CAAA;IACX,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;;OAQG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;;;;OAOG;IACH,UAAU,EAAE,YAAY,CAAA;CACzB,CAAA"}

package/dist/method/index.d.ts

@@ -1,4 +1,4 @@
-export type { Kernel, KernelForAuth, RemoteContext } from './context';
+export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext } from './context';
 export type { RemoteHandler, AnyRemoteHandler, MethodImpl } from './single';
 export { remoteMethod } from './single';
 export type { ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl } from './class';

package/dist/method/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACrE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/method/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACpF,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA"}

package/dist/method/single.d.ts

@@ -29,7 +29,7 @@ import type { KernelForAuth, RemoteContext } from './context';
  */
 export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPolicy = 'required'> = {
     /** The handler body. May be async or an async generator (for `output: 'stream'`). */
-    execute?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>) => TResult | Promise<TResult> | AsyncGenerator<TResult>;
+    execute?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>, TAuth>) => TResult | Promise<TResult> | AsyncGenerator<TResult>;
     /**
      * Optional REST binding — attaches a native HTTP route to this method.
      * Uses the kernel's canonical `RouteBinding` type directly.
@@ -45,9 +45,10 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPoli
     description?: string;
     /**
      * Authentication policy. Defaults to `'required'` when absent. Captured as a
-     * literal type so it drives {@link KernelForAuth} on the `execute`/`authorize`
-     * context: omit it (or set `'required'`) and `ctx.kernel` is non-null;
-     * `'optional'` widens it to `… | null`; `'public'` makes it `null`.
+     * literal type so it drives `ctx.auth` and {@link KernelForAuth} on the
+     * `execute`/`authorize` context: omit it (or set `'required'`) and both
+     * `ctx.auth` and `ctx.kernel` are non-null; `'optional'` widens them to
+     * `... | null`; `'public'` makes both `null`.
      */
     auth?: TAuth;
     /**
@@ -64,7 +65,7 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPoli
      * The kernel still enforces `has_perm` independently — `authorize` is
      * additive ergonomic gating on top, not a replacement.
      */
-    authorize?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>) => void | Promise<void>;
+    authorize?: (ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>, TAuth>) => void | Promise<void>;
 };
 export type AnyRemoteHandler = RemoteHandler<any, any, any, any, AuthPolicy>;
 /**

package/dist/method/single.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACjG,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC5D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,KAC5D,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B,CAAA;AAOD,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IAErC,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAC3E,KAAK,CAAA;AAEX,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KACpC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACtC,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GACxC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA"}
+{"version":3,"file":"single.d.ts","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACd,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,SAAS,UAAU,GAAG,UAAU,IAAI;IACjG,qFAAqF;IACrF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACzD;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACnE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B,CAAA;AAOD,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;AAE5E;;;GAGG;AACH,MAAM,MAAM,UAAU,CACpB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,MAAM,EAChB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IAErC,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IACjC,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,CAAA;IACf,IAAI,EAAE,OAAO,CAAA;IACb,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,GACG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAC3E,KAAK,CAAA;AAEX,KAAK,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CACpF,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACnB,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5B,GACC,MAAM,CAAA;AAER;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,KAAK,CACrC,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KACpC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AACtC,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,eAAe,CAAC,CAAC,CAAC,GAAG,MAAM,EACrC,CAAC,SAAS,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,EACvC,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,MAAM,EAAE,CAAC,EACT,SAAS,EAAE,CAAC,EACZ,UAAU,EAAE,CAAC,EACb,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GACxC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA"}

package/dist/method/single.js.map

@@ -1 +1 @@
-{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuIH,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}
+{"version":3,"file":"single.js","sourceRoot":"","sources":["../../src/method/single.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwIH,MAAM,UAAU,YAAY,CAAC,GAAG,IAAe;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
   "keywords": [
     "astrale",

package/src/define/remote-function.ts

@@ -19,24 +19,28 @@
 import type { AuthPolicy, FunctionBinding } from '@astrale-os/kernel-api/routed'
 import type { FnMap } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { AuthContext } from '@astrale-os/kernel-core'
 import type { Context } from 'hono'
 import type { z } from 'zod'
 
 import type { CallRemoteFn } from '../dispatch/call-remote'
-import type { KernelForAuth } from '../method/context'
+import type { AuthForPolicy, KernelForAuth } from '../method/context'
 
 export type RemoteFunctionContext<
   TParams,
   TDeps = unknown,
   TKernel = BoundClientSessionView<FnMap> | null,
+  TAuth extends AuthPolicy = AuthPolicy,
 > = {
   /** Validated params (Zod-checked against `inputSchema`). */
   params: TParams
   /** Hono request context — escape hatch for headers, raw body, etc. */
   c: Context
-  /** Resolved auth context. `null` when `auth: 'public'` or absent. */
-  auth: AuthContext | null
+  /**
+   * Resolved auth context. Its nullability follows the function's `auth`
+   * policy: non-null for the default `'required'`, `... | null` for
+   * `'optional'`, and `null` for `'public'`.
+   */
+  auth: AuthForPolicy<TAuth>
   /** Typed dependency container injected at server startup. */
   deps: TDeps
   /**
@@ -96,18 +100,19 @@ export type RemoteFunctionDef<
   binding?: FunctionBinding
   /**
    * Authentication policy. Defaults to `'required'`. Captured as a literal type
-   * so it drives {@link KernelForAuth} on the `execute`/`authorize` context:
-   * omit it (or `'required'`) → `ctx.kernel` non-null; `'optional'` → `… | null`;
-   * `'public'` → `null` (webhooks reach the graph via `ctx.selfKernel`).
+   * so it drives `ctx.auth` and {@link KernelForAuth} on the
+   * `execute`/`authorize` context: omit it (or `'required'`) makes both
+   * non-null; `'optional'` widens them to `... | null`; `'public'` makes them
+   * `null` (webhooks reach the graph via `ctx.selfKernel`).
    */
   auth?: TAuth
   /** Optional pre-execute authorization. Throw to deny. */
   authorize?: (
-    ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>,
+    ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>,
   ) => void | Promise<void>
   /** The function body. May be async. */
   execute: (
-    ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>>,
+    ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>,
   ) => TResult | Promise<TResult>
   /** Optional human-readable description. */
   description?: string

package/src/define/view.ts

@@ -21,11 +21,12 @@
 import type { AuthPolicy, FunctionBinding } from '@astrale-os/kernel-api/routed'
 import type { FnMap } from '@astrale-os/kernel-client'
 import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { AuthContext } from '@astrale-os/kernel-core'
 import type { EdgeEndpoint } from '@astrale-os/kernel-dsl'
 import type { Context } from 'hono'
 
-export type ViewRenderContext<TDeps = unknown> = {
+import type { AuthForPolicy } from '../method/context'
+
+export type ViewRenderContext<TDeps = unknown, TAuth extends AuthPolicy = AuthPolicy> = {
   /** Hono request context — read params, headers, query, etc. */
   c: Context
   /**
@@ -34,8 +35,12 @@ export type ViewRenderContext<TDeps = unknown> = {
    * the binding has no placeholders.
    */
   params: Record<string, string>
-  /** Resolved auth context. `null` when `auth: 'public'` or absent. */
-  auth: AuthContext | null
+  /**
+   * Resolved auth context. Its nullability follows the View's `auth` policy:
+   * non-null for `'required'`, `... | null` for `'optional'`, and `null` for
+   * `'public'`.
+   */
+  auth: AuthForPolicy<TAuth>
   /** Typed dependency container injected at server startup. */
   deps: TDeps
   /**
@@ -48,7 +53,7 @@ export type ViewRenderContext<TDeps = unknown> = {
   selfKernel: (kernelUrl?: string) => Promise<BoundClientSessionView<FnMap>>
 }
 
-export type ViewDef<TDeps = unknown> = {
+export type ViewDef<TDeps = unknown, TAuth extends AuthPolicy = AuthPolicy> = {
   /**
    * Override the binding (URL + route shape). When absent, SDK defaults to
    * `{ remoteUrl: ${url}/<viewsFolder>/<slug> }`. The HTTP verb (GET for
@@ -68,18 +73,18 @@ export type ViewDef<TDeps = unknown> = {
    */
   mount?: string
   /** Authentication policy. Defaults to `'required'`. */
-  auth?: AuthPolicy
+  auth?: TAuth
   /**
    * Optional pre-render authorization. Runs after auth resolution; throw to
    * deny. SDK wraps as 403.
    */
-  authorize?: (ctx: ViewRenderContext<TDeps>) => void | Promise<void>
+  authorize?: (ctx: ViewRenderContext<TDeps, TAuth>) => void | Promise<void>
   /**
    * Render the iframe response. May return a redirect, a proxy, or inline
    * HTML. When omitted, no worker route is mounted — the binding URL
    * points elsewhere (CDN, external service).
    */
-  render?: (ctx: ViewRenderContext<TDeps>) => Response | Promise<Response>
+  render?: (ctx: ViewRenderContext<TDeps, TAuth>) => Response | Promise<Response>
   /**
    * Optional target(s) the View attaches to via `view_for` edge(s). Typically
    * `selfOf(SomeClass)` to bind to a class meta-node, or a `CorePath`
@@ -96,6 +101,8 @@ export type ViewDef<TDeps = unknown> = {
  * `defineRemoteDomain` consumes the typed shape and the author retains
  * full type inference on `render` / `authorize`.
  */
-export function defineView<TDeps = unknown>(def: ViewDef<TDeps>): ViewDef<TDeps> {
+export function defineView<TDeps = unknown, TAuth extends AuthPolicy = 'required'>(
+  def: ViewDef<TDeps, TAuth>,
+): ViewDef<TDeps, TAuth> {
   return def
 }

package/src/index.ts

@@ -1,5 +1,6 @@
 // ─── Method authoring ────────────────────────────────────────────────────
 export type {
+  AuthForPolicy,
   Kernel,
   KernelForAuth,
   RemoteContext,

package/src/method/context.ts

@@ -43,11 +43,32 @@ export type KernelForAuth<TAuth extends AuthPolicy> = TAuth extends 'public'
     ? Kernel | null
     : Kernel
 
-export type RemoteContext<TParams, TSelf, TDeps, TKernel = Kernel | null> = {
+/**
+ * The resolved auth context a handler receives, derived from its declared
+ * `auth` policy. Mirrors {@link KernelForAuth}: required methods have a
+ * verified auth context, optional/public methods encode the nullable cases.
+ */
+export type AuthForPolicy<TAuth extends AuthPolicy> = TAuth extends 'public'
+  ? null
+  : TAuth extends 'optional'
+    ? AuthContext | null
+    : AuthContext
+
+export type RemoteContext<
+  TParams,
+  TSelf,
+  TDeps,
+  TKernel = Kernel | null,
+  TAuth extends AuthPolicy = AuthPolicy,
+> = {
   /** Validated params (Zod-checked against the method's `inputSchema`). */
   params: TParams
-  /** Auth context resolved from the inbound delegation credential. `null` for public or unauthenticated optional methods. */
-  auth: AuthContext | null
+  /**
+   * Auth context resolved from the inbound delegation credential. Its
+   * nullability follows the method's `auth` policy: non-null for the default
+   * `'required'`, `... | null` for `'optional'`, and `null` for `'public'`.
+   */
+  auth: AuthForPolicy<TAuth>
   /** Bound node instance — `undefined` for static methods. */
   self: TSelf
   /** Typed dependency container injected at server startup. */

package/src/method/index.ts

@@ -1,4 +1,4 @@
-export type { Kernel, KernelForAuth, RemoteContext } from './context'
+export type { AuthForPolicy, Kernel, KernelForAuth, RemoteContext } from './context'
 export type { RemoteHandler, AnyRemoteHandler, MethodImpl } from './single'
 export { remoteMethod } from './single'
 export type { ClassMethodsImpl, InterfaceMethodsImpl, SchemaMethodsImpl } from './class'

package/src/method/single.ts

@@ -38,7 +38,7 @@ import type { KernelForAuth, RemoteContext } from './context'
 export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPolicy = 'required'> = {
   /** The handler body. May be async or an async generator (for `output: 'stream'`). */
   execute?: (
-    ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>,
+    ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>, TAuth>,
   ) => TResult | Promise<TResult> | AsyncGenerator<TResult>
   /**
    * Optional REST binding — attaches a native HTTP route to this method.
@@ -55,9 +55,10 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPoli
   description?: string
   /**
    * Authentication policy. Defaults to `'required'` when absent. Captured as a
-   * literal type so it drives {@link KernelForAuth} on the `execute`/`authorize`
-   * context: omit it (or set `'required'`) and `ctx.kernel` is non-null;
-   * `'optional'` widens it to `… | null`; `'public'` makes it `null`.
+   * literal type so it drives `ctx.auth` and {@link KernelForAuth} on the
+   * `execute`/`authorize` context: omit it (or set `'required'`) and both
+   * `ctx.auth` and `ctx.kernel` are non-null; `'optional'` widens them to
+   * `... | null`; `'public'` makes both `null`.
    */
   auth?: TAuth
   /**
@@ -75,7 +76,7 @@ export type RemoteHandler<TParams, TResult, TSelf, TDeps, TAuth extends AuthPoli
    * additive ergonomic gating on top, not a replacement.
    */
   authorize?: (
-    ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>>,
+    ctx: RemoteContext<TParams, TSelf, TDeps, KernelForAuth<TAuth>, TAuth>,
   ) => void | Promise<void>
 }