@astrale-os/sdk 0.4.19 → 0.5.0-beta.10

package/dist/workflow/runner.js

@@ -0,0 +1,24 @@
+import { createInlineStep } from './step/index.js';
+const DIRECT_ACTIVATION = Object.freeze({ kind: 'direct' });
+/** Explicit process-local runner for tests and non-durable embeddings. */
+export function createInlineWorkflowRunner() {
+    return Object.freeze({
+        run(workflow, execution) {
+            const control = execution.execution ??
+                Object.freeze({
+                    deadline: Number.MAX_SAFE_INTEGER,
+                    signal: execution.signal ?? new AbortController().signal,
+                });
+            control.signal.throwIfAborted();
+            return workflow.run(Object.freeze({
+                activation: execution.activation ?? DIRECT_ACTIVATION,
+                execution: control,
+                step: createInlineStep({ signal: control.signal }),
+                query: execution.query,
+                mutate: execution.mutate,
+                capabilities: execution.capabilities,
+            }), execution.input);
+        },
+    });
+}
+//# sourceMappingURL=runner.js.map

package/dist/workflow/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/workflow/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAA;AAEpE,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CACD,QAAyD,EACzD,SAAiD;YAEjD,MAAM,OAAO,GACX,SAAS,CAAC,SAAS;gBACnB,MAAM,CAAC,MAAM,CAAC;oBACZ,QAAQ,EAAE,MAAM,CAAC,gBAAgB;oBACjC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM;iBACzD,CAAC,CAAA;YACJ,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YAC/B,OAAO,QAAQ,CAAC,GAAG,CACjB,MAAM,CAAC,MAAM,CAAC;gBACZ,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,iBAAiB;gBACrD,SAAS,EAAE,OAAO;gBAClB,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClD,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,YAAY,EAAE,SAAS,CAAC,YAAY;aACrC,CAAC,EACF,SAAS,CAAC,KAAK,CAChB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/workflow/step/index.d.ts

@@ -0,0 +1,3 @@
+export { createInlineStep } from './inline.js';
+export type { WorkflowStep } from './step.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/workflow/step/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA"}

package/dist/workflow/step/index.js

@@ -0,0 +1,2 @@
+export { createInlineStep } from './inline.js';
+//# sourceMappingURL=index.js.map

package/dist/workflow/step/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/workflow/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/workflow/step/inline.d.ts

@@ -0,0 +1,6 @@
+import type { WorkflowStep } from './step.js';
+/** Process-local Step profile for tests and explicitly non-durable embeddings. */
+export declare function createInlineStep(options?: {
+    readonly signal?: AbortSignal;
+}): WorkflowStep;
+//# sourceMappingURL=inline.d.ts.map

package/dist/workflow/step/inline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/inline.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAI7C,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAAG,YAAY,CAgC9F"}

package/dist/workflow/step/inline.js

@@ -0,0 +1,44 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+const MAXIMUM_STEP_ID_LENGTH = 128;
+/** Process-local Step profile for tests and explicitly non-durable embeddings. */
+export function createInlineStep(options = {}) {
+    const signal = options.signal;
+    const occurrences = new Map();
+    let active = false;
+    return Object.freeze({
+        async run(id, execute) {
+            const accepted = acceptStepId(id);
+            signal?.throwIfAborted();
+            if (active) {
+                throw new TypeError('step.run does not allow nested or concurrent inline steps');
+            }
+            const occurrence = occurrences.get(accepted) ?? 0;
+            occurrences.set(accepted, occurrence + 1);
+            active = true;
+            try {
+                const result = await execute();
+                if (result === undefined)
+                    return result;
+                try {
+                    return portable.accept(result);
+                }
+                catch (cause) {
+                    throw new TypeError(`step.run("${accepted}"${occurrence === 0 ? '' : ` #${occurrence + 1}`}): result must be a portable value`, { cause });
+                }
+            }
+            finally {
+                active = false;
+            }
+        },
+    });
+}
+function acceptStepId(id) {
+    if (typeof id !== 'string' ||
+        id.length === 0 ||
+        id.length > MAXIMUM_STEP_ID_LENGTH ||
+        id.trim() !== id) {
+        throw new TypeError('step.run id must contain 1-128 characters with no surrounding whitespace');
+    }
+    return id;
+}
+//# sourceMappingURL=inline.js.map

package/dist/workflow/step/inline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline.js","sourceRoot":"","sources":["../../../src/workflow/step/inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,8BAA8B,CAAA;AAIxD,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAElC,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsC,EAAE;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,GAAG,CAAS,EAAU,EAAE,OAAuC;YACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAA;YAClF,CAAC;YAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YACjD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;gBAC9B,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAA;gBACvC,IAAI,CAAC;oBACH,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAW,CAAA;gBAC1C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,SAAS,CACjB,aAAa,QAAQ,IAAI,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,EAAE,oCAAoC,EAC1G,EAAE,KAAK,EAAE,CACV,CAAA;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,GAAG,KAAK,CAAA;YAChB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,CAAC,MAAM,KAAK,CAAC;QACf,EAAE,CAAC,MAAM,GAAG,sBAAsB;QAClC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC"}

package/dist/workflow/step/step.d.ts

@@ -0,0 +1,5 @@
+/** Durable operation boundary supplied by the selected Workflow runner. */
+export interface WorkflowStep {
+    run<Result>(id: string, execute: () => Result | Promise<Result>): Promise<Result>;
+}
+//# sourceMappingURL=step.d.ts.map

package/dist/workflow/step/step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../../src/workflow/step/step.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAClF"}

package/dist/workflow/step/step.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=step.js.map

package/dist/workflow/step/step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step.js","sourceRoot":"","sources":["../../../src/workflow/step/step.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.4.19",
-  "description": "Astrale Remote Domain SDK - Define and deploy domains as standalone Hono servers",
+  "version": "0.5.0-beta.10",
+  "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
     "domain",
@@ -19,8 +19,7 @@
     "astrale-domain": "./dist/cli/bin.js"
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "type": "module",
   "main": "./dist/index.js",
@@ -34,48 +33,136 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
     },
+    "./server/node": {
+      "types": "./dist/server/node/index.d.ts",
+      "import": "./dist/server/node/index.js"
+    },
     "./domain": {
       "types": "./dist/domain/index.d.ts",
       "import": "./dist/domain/index.js"
     },
+    "./auth": {
+      "types": "./dist/auth/index.d.ts",
+      "import": "./dist/auth/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema/index.d.ts",
+      "import": "./dist/schema/index.js"
+    },
+    "./schema/v1": {
+      "types": "./dist/schema/v1/index.d.ts",
+      "import": "./dist/schema/v1/index.js"
+    },
+    "./schema/kernel": {
+      "types": "./dist/schema/kernel/index.d.ts",
+      "import": "./dist/schema/kernel/index.js"
+    },
+    "./value": {
+      "types": "./dist/value/index.d.ts",
+      "import": "./dist/value/index.js"
+    },
+    "./graph": {
+      "types": "./dist/graph/index.d.ts",
+      "import": "./dist/graph/index.js"
+    },
+    "./graph/class": {
+      "types": "./dist/graph/class/index.d.ts",
+      "import": "./dist/graph/class/index.js"
+    },
+    "./graph/node": {
+      "types": "./dist/graph/node/index.d.ts",
+      "import": "./dist/graph/node/index.js"
+    },
+    "./graph/edge": {
+      "types": "./dist/graph/edge/index.d.ts",
+      "import": "./dist/graph/edge/index.js"
+    },
+    "./graph/model": {
+      "types": "./dist/graph/model/index.d.ts",
+      "import": "./dist/graph/model/index.js"
+    },
+    "./graph/properties": {
+      "types": "./dist/graph/properties/index.d.ts",
+      "import": "./dist/graph/properties/index.js"
+    },
+    "./graph/path": {
+      "types": "./dist/graph/path/index.d.ts",
+      "import": "./dist/graph/path/index.js"
+    },
+    "./capability": {
+      "types": "./dist/capability/index.d.ts",
+      "import": "./dist/capability/index.js"
+    },
+    "./deployment": {
+      "types": "./dist/deployment/index.d.ts",
+      "import": "./dist/deployment/index.js"
+    },
+    "./deployment/artifact": {
+      "types": "./dist/deployment/artifact/index.d.ts",
+      "import": "./dist/deployment/artifact/index.js"
+    },
+    "./deployment/check": {
+      "types": "./dist/deployment/check/index.d.ts",
+      "import": "./dist/deployment/check/index.js"
+    },
+    "./deployment/provider": {
+      "types": "./dist/deployment/provider/index.d.ts",
+      "import": "./dist/deployment/provider/index.js"
+    },
     "./cli": {
       "types": "./dist/cli/index.d.ts",
       "import": "./dist/cli/index.js"
     },
-    "./deploy": {
-      "types": "./dist/deploy/index.d.ts",
-      "import": "./dist/deploy/index.js"
+    "./query": {
+      "types": "./dist/query/index.d.ts",
+      "import": "./dist/query/index.js"
+    },
+    "./mutation": {
+      "types": "./dist/mutation/index.d.ts",
+      "import": "./dist/mutation/index.js"
+    },
+    "./result": {
+      "types": "./dist/result/index.d.ts",
+      "import": "./dist/result/index.js"
     },
-    "./step": {
-      "types": "./dist/step/index.d.ts",
-      "import": "./dist/step/index.js"
+    "./state": {
+      "types": "./dist/state/index.d.ts",
+      "import": "./dist/state/index.js"
+    },
+    "./view": {
+      "types": "./dist/view/index.d.ts",
+      "import": "./dist/view/index.js"
+    },
+    "./workflow": {
+      "types": "./dist/workflow/index.d.ts",
+      "import": "./dist/workflow/index.js"
+    },
+    "./workflow/step": {
+      "types": "./dist/workflow/step/index.d.ts",
+      "import": "./dist/workflow/step/index.js"
     },
     "./linter": {
       "types": "./dist/linter/index.d.ts",
       "import": "./dist/linter/index.js"
     },
     "./linter/oxlint-config": {
-      "types": "./dist/linter/oxlint/config.d.ts",
-      "import": "./dist/linter/oxlint/config.js"
-    },
-    "./linter/oxlint-plugin": {
-      "types": "./dist/linter/oxlint/plugin.d.ts",
-      "import": "./dist/linter/oxlint/plugin.js"
+      "types": "./dist/linter/oxlint-config/index.d.ts",
+      "import": "./dist/linter/oxlint-config/index.js"
     },
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@astrale-os/kernel-api": ">=0.4.16 <1.0.0",
-    "@astrale-os/kernel-client": ">=0.4.11 <1.0.0",
-    "@astrale-os/kernel-core": ">=0.7.7 <1.0.0",
-    "@astrale-os/kernel-dsl": ">=0.1.4 <1.0.0",
-    "@astrale-os/kernel-server": ">=0.4.15 <1.0.0",
+    "@astrale-os/kernel-client": ">=0.6.0-beta.4 <1.0.0",
+    "@astrale-os/kernel-core": ">=0.9.0-beta.4 <1.0.0",
+    "@astrale-os/kernel-dsl": ">=0.2.0-beta.3 <1.0.0",
+    "@astrale-os/kernel-protocol": ">=0.5.0-beta.3 <1.0.0",
+    "@astrale-os/kernel-server": ">=0.5.0-beta.4 <1.0.0",
     "hono": "^4.6.20",
     "jose": "^6.1.3",
+    "typescript": "~6.0.1-rc",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@astrale-os/kernel-test": ">=0.1.0 <1.0.0",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
@@ -86,11 +173,14 @@
     "@typescript/native-preview": "latest",
     "husky": "~9.1.7",
     "lint-staged": "~16.2.7",
+    "mermaid": "^11.16.1",
     "oxfmt": "0.52.0",
     "oxlint": "latest",
+    "preact": "^10.29.8",
     "tsx": "^4.21.0",
-    "typescript": "~6.0.1-rc",
-    "vitest": "^3.0.0"
+    "vite": "^7.3.6",
+    "vitest": "^3.0.0",
+    "yaml": "^2.9.0"
   },
   "peerDependencies": {
     "@astrale-os/ox": ">=0.1.3 <1.0.0",
@@ -120,7 +210,7 @@
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": ">=24 <25",
+      "version": ">=24 <25 || >=26 <27",
       "onFail": "error"
     }
   },
@@ -132,12 +222,17 @@
     "build": "tsgo && pnpm run verify:package",
     "typecheck": "tsgo --noEmit && pnpm run typecheck:types",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
-    "test": "vitest run --config __tests__/vitest.config.ts",
+    "test": "pnpm run check:knowledge && pnpm run check:linter-policy && pnpm run check:issues && vitest run --config __tests__/vitest.config.ts && node --test scripts/*.test.mjs",
+    "test:file": "vitest run --config __tests__/vitest.config.ts",
     "verify:package": "node ./verify-package.mjs",
     "test:watch": "vitest --config __tests__/vitest.config.ts",
     "lint": "oxlint --disable-nested-config .",
     "lint:fix": "oxlint --disable-nested-config --fix .",
     "format": "pnpm exec oxfmt --write .",
-    "format:check": "pnpm exec oxfmt --check ."
+    "format:check": "pnpm exec oxfmt --check .",
+    "check:knowledge": "node knowledge/cli/main.mjs check knowledge && bash knowledge/cli/test.sh",
+    "check:linter-policy": "node scripts/sync-domain-policy.mjs --check",
+    "check:issues": "issues/.cli/issues check && node --test issues/.cli/history.test.mjs && node --test issues/.cli/view-server.test.mjs && node --test issues/.view/contract.test.mjs",
+    "sync:linter-policy": "node scripts/sync-domain-policy.mjs"
   }
 }

package/dist/auth/authenticate.d.ts

@@ -1,24 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type AuthenticateResult = {
-    authenticated: Authenticated;
-    kernel: BoundClientSessionView<FnMap> | null;
-};
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export declare function authenticateRequest(credential: CredentialInput, config: RemoteIdentityConfig): Promise<AuthenticateResult>;
-//# sourceMappingURL=authenticate.d.ts.map

package/dist/auth/authenticate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAI7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,aAAa,CAAA;IAC5B,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;CAC7C,CAAA;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B"}

package/dist/auth/authenticate.js

@@ -1,29 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-import { IdentityId, selfGrant } from '@astrale-os/kernel-core';
-import { bindKernel } from './kernel-client.js';
-import { verifyInboundCredential } from './verify.js';
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export async function authenticateRequest(credential, config) {
-    const { verified, issuer, attestation, delegation } = await verifyInboundCredential(credential, config);
-    const authenticated = {
-        credential: { raw: credential, verified },
-        grant: selfGrant(IdentityId(verified.sub)),
-        attestation,
-        delegation,
-    };
-    const kernel = await bindKernel(delegation, issuer, config);
-    return { authenticated, kernel };
-}
-//# sourceMappingURL=authenticate.js.map

package/dist/auth/authenticate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/auth/authenticate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAOrD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA2B,EAC3B,MAA4B;IAE5B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CACjF,UAAU,EACV,MAAM,CACP,CAAA;IAED,MAAM,aAAa,GAAkB;QACnC,UAAU,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE;QACzC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,WAAW;QACX,UAAU;KACX,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC"}

package/dist/auth/check.d.ts

@@ -1,38 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { IdentityId } from '@astrale-os/kernel-core';
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core';
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export declare function assertPerm(kernel: BoundClientSessionView<FnMap> | null, target: string, principal: IdentityId | null | undefined, requiredBits: number): Promise<void>;
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export declare function requireOwnership(kernel: BoundClientSessionView<FnMap> | null, target: string, principal: IdentityId | null | undefined): Promise<void>;
-//# sourceMappingURL=check.d.ts.map

package/dist/auth/check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/auth/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAMzD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAErE;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,sFAAsF;AACtF,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth/check.js

@@ -1,50 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-import { SHARE } from '@astrale-os/kernel-core';
-import { AuthorizationDeniedError } from '../dispatch/errors.js';
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core';
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export async function assertPerm(kernel, target, principal, requiredBits) {
-    if (!kernel) {
-        throw new AuthorizationDeniedError('No kernel client — cannot verify permissions');
-    }
-    if (!principal) {
-        throw new AuthorizationDeniedError('No authenticated principal');
-    }
-    const ok = await kernel.auth.check({ who: principal, on: target, perms: requiredBits });
-    if (!ok) {
-        throw new AuthorizationDeniedError(`Permission denied on "${target}" — required bits=${requiredBits} for principal "${principal}"`);
-    }
-}
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export async function requireOwnership(kernel, target, principal) {
-    await assertPerm(kernel, target, principal, SHARE);
-}
-//# sourceMappingURL=check.js.map

package/dist/auth/check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/auth/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AAE/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAA4C,EAC5C,MAAc,EACd,SAAwC,EACxC,YAAoB;IAEpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,wBAAwB,CAAC,8CAA8C,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,4BAA4B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;IACvF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,wBAAwB,CAChC,yBAAyB,MAAM,qBAAqB,YAAY,mBAAmB,SAAS,GAAG,CAChG,CAAA;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA4C,EAC5C,MAAc,EACd,SAAwC;IAExC,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;AACpD,CAAC"}

package/dist/auth/compose.d.ts

@@ -1,41 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-import type { Delegation } from '@astrale-os/kernel-core';
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export declare function buildComposedExpr(delegation: Delegation): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export declare function buildComposedGrant(delegation: Delegation): {
-    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
-};
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export declare function buildSelfExpr(): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
-/** Self-only grant for function-owned credentials. */
-export declare function buildSelfGrant(): {
-    grant: import("@astrale-os/kernel-core").UnresolvedGrant;
-};
-//# sourceMappingURL=compose.d.ts.map

package/dist/auth/compose.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AASzD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,4DAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU;IAC9C,KAAK;EACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,6DAE5B;AAED,sDAAsD;AACtD,wBAAgB,cAAc;IACnB,KAAK;EACf"}

package/dist/auth/compose.js

@@ -1,45 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-import { createUnresolvedGrant, unresolvedCredential, unresolvedSelf, unresolvedUnion, } from '@astrale-os/kernel-core';
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export function buildComposedExpr(delegation) {
-    return unresolvedUnion(unresolvedCredential(delegation.credential), unresolvedSelf());
-}
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export function buildComposedGrant(delegation) {
-    return { grant: createUnresolvedGrant(buildComposedExpr(delegation)) };
-}
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export function buildSelfExpr() {
-    return unresolvedSelf();
-}
-/** Self-only grant for function-owned credentials. */
-export function buildSelfGrant() {
-    return { grant: createUnresolvedGrant(buildSelfExpr()) };
-}
-//# sourceMappingURL=compose.js.map

package/dist/auth/compose.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,OAAO,eAAe,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAsB;IACvD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,cAAc,EAAE,CAAA;AACzB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC"}

package/dist/auth/errors.d.ts

@@ -1,16 +0,0 @@
-/**
- * Errors thrown by the auth bridge.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api';
-export declare class AuthMissingError extends Error implements KernelErrorClassifiable {
-    constructor();
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export declare class AuthInvalidError extends Error implements KernelErrorClassifiable {
-    constructor(message: string, cause?: unknown);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAIzF,qBAAa,gBAAiB,SAAQ,KAAM,YAAW,uBAAuB;IAC5E,cAGC;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAM,YAAW,uBAAuB;IAC5E,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAG3C;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF"}