@astrale-os/shell-react 0.2.9 → 0.2.10-beta.3

package/src/application/apps/apps.hook.ts

@@ -1,7 +1,7 @@
-import type { NodeRefInput } from '@astrale-os/kernel-client'
-import type { ApplicationNode, SpaceNode } from '@astrale-os/shell'
+import type { PathLike } from '@astrale-os/sdk/graph/path'
+import type { ApplicationNode, NodeTarget, SpaceNode } from '@astrale-os/shell'
 
-import { normalizeRef } from '@astrale-os/kernel-client'
+import { Path } from '@astrale-os/sdk/graph/path'
 /**
  * useApps(space?) (API §12.2) — the apps installed in a space (`installed_in`
  * in-edges). No arg targets the CURRENT space (shared store, so a switch anywhere
@@ -26,7 +26,7 @@ export interface AppsResult extends ReadState {
   readonly apps: readonly ApplicationNode[]
 }
 
-export function useApps(space?: SpaceNode | NodeRefInput | null): AppsResult {
+export function useApps(space?: SpaceNode | NodeTarget | null): AppsResult {
   const shell = useShell()
   const available = isOsPlaneAvailable(shell)
 
@@ -76,6 +76,13 @@ function hasId(x: unknown): x is { readonly id: string } {
 }
 
 /** An `@id` ref for a bound node, else the normalized ref of a raw subject. */
-export function toRef(x: NodeRefInput | { readonly id: string }): string {
-  return hasId(x) ? `@${x.id}` : normalizeRef(x)
+export function toRef(x: NodeTarget | { readonly id: string }): NodeTarget {
+  return hasId(x) ? x.id : x
+}
+
+/** Stable dependency identity for one Shell node target. */
+export function targetKey(x: NodeTarget | { readonly id: string }): string {
+  if (hasId(x)) return `id:${x.id}`
+  if (typeof x === 'string') return `text:${x}`
+  return `path:${Path.from(x as PathLike).raw}`
 }

package/src/application/apps/domains.hook.ts

@@ -14,7 +14,7 @@ export interface DomainsResult extends ReadState {
   readonly domains: readonly DomainSearchResult[]
 }
 
-export function useDomains(): DomainsResult {
+export function useInstalledDomains(): DomainsResult {
   const shell = useShell()
   const available = isOsPlaneAvailable(shell)
   const result = useAsyncResource<readonly DomainSearchResult[]>(

package/src/application/apps/open-app.hook.ts

@@ -3,8 +3,7 @@
  * app-open protocol lives in the shell package). Resolves to the session; disposal
  * is the caller's (AppHost disposes it with the window).
  */
-import type { NodeRefInput } from '@astrale-os/kernel-client'
-import type { ApplicationNode, AppSession } from '@astrale-os/shell'
+import type { ApplicationNode, AppSession, NodeTarget } from '@astrale-os/shell'
 
 import type { Action } from '../../graph/action.js'
 
@@ -12,7 +11,7 @@ import { useAction } from '../../graph/action.js'
 import { useShell } from '../../session/shell.hook.js'
 import { toRef } from './apps.hook.js'
 
-export function useOpenApp(): Action<[ApplicationNode | NodeRefInput], AppSession> {
+export function useOpenApp(): Action<[ApplicationNode | NodeTarget], AppSession> {
   const shell = useShell()
-  return useAction((app: ApplicationNode | NodeRefInput) => shell.apps.open(toRef(app)))
+  return useAction((app: ApplicationNode | NodeTarget) => shell.apps.open(toRef(app)))
 }

package/src/application/index.ts

@@ -1,6 +1,6 @@
 // application — API §12.2. The OS-plane hooks over the shell package's
 // `shell.user/spaces/apps` namespaces + the window module: useUser, useSpaces,
-// useCurrentSpace, useSpace, useApps, useDomains, useRoles, useOpenApp,
+// useCurrentSpace, useSpace, useApps, useInstalledDomains, useOpenApp,
 // AppHost, AppLogo.
 export { useUser } from './user/user.hook.js'
 export { useSpaces } from './spaces/spaces.hook.js'
@@ -11,22 +11,20 @@ export { useSpace } from './spaces/space.hook.js'
 export type { SpaceResult } from './spaces/space.hook.js'
 export { useApps } from './apps/apps.hook.js'
 export type { AppsResult } from './apps/apps.hook.js'
-export { useDomains } from './apps/domains.hook.js'
+export { useInstalledDomains } from './apps/domains.hook.js'
 export type { DomainsResult } from './apps/domains.hook.js'
 export { useOpenApp } from './apps/open-app.hook.js'
 export { AppHost } from './apps/app-host.js'
 export type { AppHostFallbackState, AppHostProps } from './apps/app-host.js'
 export { AppLogo } from './apps/app-logo.js'
 export type { AppLogoProps } from './apps/app-logo.js'
-export { useRoles } from './roles.hook.js'
-export type { RolesResult } from './roles.hook.js'
-
 // The OS node/session types (from the shell package, single import surface).
 export type {
   ApplicationNode,
   AppSession,
   DomainSearchResult,
-  RoleNode,
+  NodeTarget,
+  ResolvedView,
   SpaceNode,
   UserNode,
 } from '@astrale-os/shell'

package/src/application/spaces/space.hook.ts

@@ -1,7 +1,5 @@
-import type { NodeRefInput } from '@astrale-os/kernel-client'
-import type { SpaceNode } from '@astrale-os/shell'
+import type { NodeTarget, SpaceNode } from '@astrale-os/shell'
 
-import { normalizeRef } from '@astrale-os/kernel-client'
 /**
  * useSpace(ref) (API §12.2) — a single space by ref; `null`/`undefined` (or an
  * unavailable OS plane) is idle (§1.3). One-shot today (§12 flag).
@@ -13,17 +11,18 @@ import type { CurrentSpaceResult } from './current-space.hook.js'
 import { useAsyncResource } from '../../graph/async.js'
 import { isIdleInput } from '../../graph/memory/read/idle.js'
 import { useShell } from '../../session/shell.hook.js'
+import { targetKey } from '../apps/apps.hook.js'
 import { isOsPlaneAvailable } from '../user/user.store.js'
 
 export type SpaceResult = CurrentSpaceResult
 
-export function useSpace(ref: NodeRefInput | null | undefined): SpaceResult {
+export function useSpace(ref: NodeTarget | null | undefined): SpaceResult {
   const shell = useShell()
   const idle = isIdleInput(ref) || !isOsPlaneAvailable(shell)
   // The inline guard (not the stored `idle`) narrows `ref` to non-null below.
-  const key = idle ? null : normalizeRef(ref as NodeRefInput)
+  const key = idle ? null : targetKey(ref as NodeTarget)
   const res = useAsyncResource<SpaceNode | null>(
-    idle ? null : () => shell.spaces.get(ref as NodeRefInput),
+    idle ? null : () => shell.spaces.get(ref as NodeTarget),
     null,
     [shell, key],
   )

package/src/application/spaces/spaces.hook.ts

@@ -1,7 +1,7 @@
-import type { NodeRefInput } from '@astrale-os/kernel-client'
-import type { SpaceNode } from '@astrale-os/shell'
+import type { PathLike } from '@astrale-os/sdk/graph/path'
+import type { NodeTarget, SpaceNode } from '@astrale-os/shell'
 
-import { normalizeRef } from '@astrale-os/kernel-client'
+import { Path } from '@astrale-os/sdk/graph/path'
 /**
  * useSpaces (API §12.2) — the spaces list, the selected space, and a `switch`
  * Action that repoints the `selected_space` edge. Reads the SAME per-Shell
@@ -28,7 +28,7 @@ export interface SpacesResult extends ReadState {
   /** The `selected_space` target — optimistically ahead during a `switch`. */
   readonly selected: SpaceNode | null
   /** `user::switchSpace` with a manual optimistic overlay (§1.6). */
-  readonly switch: Action<[NodeRefInput], void>
+  readonly switch: Action<[NodeTarget], void>
 }
 
 export function useSpaces(): SpacesResult {
@@ -52,7 +52,7 @@ export function useSpaces(): SpacesResult {
 
   const spaces = spacesRes.data
 
-  const switchAction = useAction(async (ref: NodeRefInput): Promise<void> => {
+  const switchAction = useAction(async (ref: NodeTarget): Promise<void> => {
     // Optimistic override on the SHARED store, so useCurrentSpace / useApps ahead
     // of the round-trip too (§12.2). Only overlay a known target (a path ref that
     // matches nothing in the list simply skips the preview).
@@ -94,7 +94,7 @@ export function useSpaces(): SpacesResult {
 }
 
 /** The space in `spaces` denoted by `ref`, or `null` (path refs don't match by id). */
-function findSpace(spaces: readonly SpaceNode[], ref: NodeRefInput): SpaceNode | null {
+function findSpace(spaces: readonly SpaceNode[], ref: NodeTarget): SpaceNode | null {
   const id = refIdOf(ref)
   if (id === null) return null
   return spaces.find((s) => s.id === id) ?? null
@@ -106,8 +106,13 @@ function hasId(x: unknown): x is { readonly id: string } {
 }
 
 /** The graph id a subject denotes, or `null` when it is a path (no id to match). */
-function refIdOf(x: NodeRefInput | { readonly id: string }): string | null {
+function refIdOf(x: NodeTarget | { readonly id: string }): string | null {
   if (hasId(x)) return x.id
-  const raw = normalizeRef(x)
-  return raw.startsWith('@') ? raw.slice(1) : null
+  if (typeof x === 'string' && !x.startsWith('@') && !x.startsWith('/')) return x
+  try {
+    const path = Path.from(x as PathLike)
+    return path.ast.anchor.kind === 'id' && path.ast.steps.length === 0 ? path.ast.anchor.id : null
+  } catch {
+    return null
+  }
 }

package/src/auth/act-as.context.tsx

@@ -1,124 +1,70 @@
-import type { CredentialInput, FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
+import type { Identity } from '@astrale-os/kernel-client/auth'
+import type { KernelClient } from '@astrale-os/shell'
 import type { ReactElement, ReactNode } from 'react'
 
-/**
- * The acting-principal binding (API §4). `IdentityContext` seats the effective
- * principal a subtree dispatches as — its bound kernel view + whoami + memory
- * scope; `useIdentityBinding` resolves it (an `<ActAs>` override, else the root
- * off ShellContext). `<ActAs>` rebinds a subtree to another principal with a
- * DISTINCT memory scope so results never leak across principals (§5.4).
- */
 import { createContext, useContext, useEffect, useMemo, useState } from 'react'
 
-import type { SelfNode } from '../session/session.context.js'
-
 import { ShellContext } from '../session/session.context.js'
 
-/** A bound session view — the kernel surface `session.as(cred)` yields. */
-export type SessionView = BoundClientSessionView<FnMap>
-
-/** A whoami-shaped identity/graph node (kernel-client does not yet re-export `Node` — G8). */
-export type NodeValue = SelfNode
-
-/** The root scope key — the memory's own default scope (`createMemory` default). */
-export const ROOT_SCOPE = 'default'
+export type NodeValue = Identity
+export type SessionView = KernelClient
 
-/**
- * The principal a subtree acts as (API §4). `scope` is the memory isolation key
- * (§5.4): the graph plane scopes its memory by `memory.forScope(scope)` so an
- * <ActAs> subtree never shares cached results with another principal.
- */
 export interface IdentityBinding {
-  readonly kernel: SessionView
-  readonly self: SelfNode
-  readonly scope: string
+  readonly kernel: KernelClient
+  readonly self: Identity
 }
+
 export const IdentityContext = createContext<IdentityBinding | null>(null)
 IdentityContext.displayName = 'AstraleIdentityContext'
 
-/**
- * The principal this subtree dispatches as. An <ActAs> value wins; otherwise the
- * root binding off ShellContext. Throws outside a provider, or when the bound
- * kernel resolved no identity (a bare prebuilt Shell with no auth surface).
- */
 export function useIdentityBinding(): IdentityBinding {
   const override = useContext(IdentityContext)
   if (override !== null) return override
-
   const runtime = useContext(ShellContext)
-  if (runtime === null) {
-    throw new Error('identity hooks must be used within a <ShellProvider>')
-  }
-  if (runtime.self === null) {
-    throw new Error(
-      'identity hooks require an identity: this shell exposed no auth surface, so whoami ' +
-        'resolved nothing at boot',
-    )
-  }
-  // The root binding reads stable fields (self, shell.kernel), so a fresh object
-  // per render is inert — consumers key off `kernel`/`self`, both stable.
-  return { kernel: runtime.shell.kernel, self: runtime.self, scope: ROOT_SCOPE }
+  if (runtime === null) throw new Error('identity hooks must be used within a <ShellProvider>')
+  if (runtime.self === null) throw new Error('the active Shell has no authenticated identity')
+  return { kernel: runtime.shell.kernel, self: runtime.self }
 }
 
 export interface ActAsProps {
-  /** The principal to act as. A thunk is resolved by the kernel per dispatch. */
-  credential: CredentialInput | (() => CredentialInput)
-  children: ReactNode
+  /**
+   * A separately authenticated Kernel capability. Raw credentials are deliberately not accepted;
+   * construct the delegated Client Session at the trust boundary that owns credential resolution.
+   */
+  readonly client: KernelClient
+  readonly fallback?: ReactNode
+  readonly children: ReactNode
 }
 
-/**
- * A subtree that dispatches as another principal: rebinds the kernel (session.as),
- * resolves whoami, and provides a fresh identity binding with a DISTINCT memory
- * scope (`as:<id>`). Nestable — it rebinds from the current effective principal. A
- * brief nested boot holds the subtree (renders null) until whoami resolves.
- */
-export function ActAs({ credential, children }: ActAsProps): ReactElement | null {
-  const parent = useIdentityBinding()
-  // Key the rebind on a STABLE credential identity (like `configIdentity` does),
-  // so an inline object credential (`credential={{ … }}`) does not re-mint the
-  // session view — and re-run whoami, unmounting the subtree — every parent
-  // render. A thunk still keys by reference: pass a stable thunk to avoid churn.
-  const credKey = credentialIdentity(credential)
-  // eslint-disable-next-line react-hooks/exhaustive-deps
-  const kernel = useMemo(() => parent.kernel.as(credential), [parent.kernel, credKey])
+/** Bind a subtree to an explicitly supplied authenticated Kernel capability. */
+export function ActAs({ client, fallback, children }: ActAsProps): ReactElement | null {
+  const [state, setState] = useState<
+    | { readonly status: 'pending' }
+    | { readonly status: 'ready'; readonly self: Identity }
+    | { readonly status: 'failed'; readonly error: unknown }
+  >({ status: 'pending' })
 
-  const [self, setSelf] = useState<SelfNode | null>(null)
   useEffect(() => {
-    let alive = true
-    setSelf(null)
-    void kernel.auth.whoami().then(
-      (node) => {
-        if (alive) setSelf(node)
+    let active = true
+    setState({ status: 'pending' })
+    void client.auth.whoami().then(
+      (self) => {
+        if (active) setState({ status: 'ready', self })
       },
-      () => {
-        /* held (null) subtree on resolve failure — transport errors surface via the provider */
+      (error: unknown) => {
+        if (active) setState({ status: 'failed', error })
       },
     )
     return () => {
-      alive = false
+      active = false
     }
-  }, [kernel])
+  }, [client])
 
   const value = useMemo<IdentityBinding | null>(
-    () => (self === null ? null : { kernel, self, scope: `as:${self.id}` }),
-    [kernel, self],
+    () => (state.status === 'ready' ? { kernel: client, self: state.self } : null),
+    [client, state],
   )
-
-  if (value === null) return null
+  if (state.status === 'failed') throw state.error
+  if (value === null) return fallback === undefined ? null : <>{fallback}</>
   return <IdentityContext.Provider value={value}>{children}</IdentityContext.Provider>
 }
-
-/**
- * A stable identity for a credential: the thunk by reference, a string as itself,
- * and an object by a serialized form — so an equal inline object does not churn
- * the memo (worst case a serialize failure falls back to reference identity).
- */
-function credentialIdentity(credential: CredentialInput | (() => CredentialInput)): unknown {
-  if (typeof credential === 'function' || typeof credential === 'string') return credential
-  try {
-    return `cred:${JSON.stringify(credential)}`
-  } catch {
-    return credential
-  }
-}

package/src/auth/auth.hook.ts

@@ -1,36 +1,8 @@
 import type { AuthApi } from '@astrale-os/kernel-client/auth'
 
-/**
- * useAuth (API §4) — the imperative AuthApi of the effective principal
- * (whoami/credential/mint/delegate/check/grant/revoke/bind/unbind). Grant and
- * revoke additionally nudge the principal's useCan ledger on success, delivering
- * the Tier-0 local re-check (SPEC §11.3). DEVIATION: API §4 describes a pure
- * passthrough; the wrap is the only way to surface a local grant/revoke today,
- * since permissions dispatch as identity methods rather than graph patches.
- * Cross-client liveness still awaits the watch tiers (G7).
- */
-import { useMemo } from 'react'
-
-import type { SessionView } from './act-as.context.js'
-
 import { useIdentityBinding } from './act-as.context.js'
-import { ledgerFor } from './can.hook.js'
 
+/** The exact Client Auth capability for the effective subtree principal. */
 export function useAuth(): AuthApi {
-  const { kernel } = useIdentityBinding()
-  return useMemo(() => withLedgerNudge(kernel), [kernel])
-}
-
-/** Wrap grant/revoke so a successful local change re-checks the principal's cells. */
-function withLedgerNudge(kernel: SessionView): AuthApi {
-  const auth = kernel.auth
-  const ledger = ledgerFor(kernel)
-  const invalidate = (): void => ledger.invalidateAll()
-
-  const grant = ((arg: never) =>
-    Promise.resolve(auth.grant(arg)).then(invalidate)) as AuthApi['grant']
-  const revoke = ((arg: never) =>
-    Promise.resolve(auth.revoke(arg)).then(invalidate)) as AuthApi['revoke']
-
-  return { ...auth, grant, revoke }
+  return useIdentityBinding().kernel.auth
 }

package/src/auth/can.hook.ts

@@ -1,149 +1,58 @@
-import type { AuthApi, Perms } from '@astrale-os/kernel-client/auth'
-import type { PathLike, Ref } from '@astrale-os/kernel-client/graph'
+import type { NodeId } from '@astrale-os/sdk/graph/node'
+import type { PathLike } from '@astrale-os/sdk/graph/path'
+import type { schema } from '@astrale-os/sdk/schema'
 
-import { rawOf } from '@astrale-os/kernel-client/graph'
-/**
- * useCan (API §4) — deduped standing-grant permission checks. `auth.check`-backed:
- * `undefined` while the first check is in flight (or `on` is idle), then a boolean.
- * Deduped per (principal, perms, nodeId) across the whole tree via the principal's
- * check ledger (folded in here as the dedup substrate). Standing-grant semantics:
- * the dispatched call remains the gatekeeper — this is a UI affordance, not the
- * enforcement point (SPEC §6.2). A local grant/revoke invalidates the ledger.
- */
-import { useCallback, useMemo, useSyncExternalStore } from 'react'
+import { Path } from '@astrale-os/sdk/graph/path'
+import { useEffect, useState } from 'react'
 
-import type { NodeValue, SessionView } from './act-as.context.js'
-
-import { isIdleInput } from '../graph/memory/read/idle.js'
 import { useIdentityBinding } from './act-as.context.js'
 
-const NOOP_UNSUB = (): void => undefined
-
-/** A node value carries the id/class/path triple (mirrors the memory's `isNodeValue`). */
-export function isNodeValue(x: unknown): x is NodeValue {
-  return typeof x === 'object' && x !== null && 'id' in x && 'class' in x && 'path' in x
-}
-
-/** Normalize a `useCan` subject to a dispatchable `Ref` plus a stable dedup key. */
-export function toRef(on: NodeValue | PathLike): { ref: Ref; key: string } {
-  if (isNodeValue(on)) return { ref: on.path as Ref, key: `@${on.id}` }
-  return { ref: on, key: rawOf(on) }
-}
-
-// ── check ledger (the dedup substrate) ───────────────────────────────────────
+export type PolicyObject = NodeId | { readonly id: NodeId }
 
-/** One deduped check — its last-known value plus the subscribers watching it. */
-class CheckCell {
-  value: boolean | undefined = undefined
-  private inFlight = false
-  private readonly listeners = new Set<() => void>()
-
-  constructor(
-    private readonly auth: AuthApi,
-    private readonly perms: Perms,
-    private readonly on: Ref,
-  ) {}
-
-  subscribe = (onChange: () => void): (() => void) => {
-    this.listeners.add(onChange)
-    this.ensure()
-    return () => this.listeners.delete(onChange)
-  }
-
-  getSnapshot = (): boolean | undefined => this.value
-
-  /** Run the check once when the value is unknown and nothing is in flight. */
-  ensure(): void {
-    if (this.value !== undefined || this.inFlight) return
-    this.run()
-  }
-
-  /** Force a re-check (local grant/revoke on this principal). */
-  invalidate(): void {
-    if (this.listeners.size === 0) {
-      this.value = undefined // recompute lazily on the next subscribe
+/**
+ * Evaluate one declared Kernel policy for one exact graph object. This is a UI affordance; the
+ * invoked callable remains the authorization enforcement point.
+ */
+export function useCan(
+  policy: PathLike | schema.PolicyRef | null | undefined,
+  object: PolicyObject | null | undefined,
+): boolean | undefined {
+  const { kernel } = useIdentityBinding()
+  const objectId = objectIdOf(object)
+  const policyTarget = policyPath(policy)
+  const [decision, setDecision] = useState<boolean | undefined>(undefined)
+
+  useEffect(() => {
+    if (policyTarget === null || objectId === null) {
+      setDecision(undefined)
       return
     }
-    this.run()
-  }
-
-  private run(): void {
-    this.inFlight = true
-    void this.auth
-      .check({ on: this.on, perms: this.perms })
-      .then(
-        (ok) => {
-          this.value = ok
-        },
-        () => {
-          // A failed check leaves the value unknown (undefined) — never a false grant.
-          this.value = undefined
-        },
-      )
-      .finally(() => {
-        this.inFlight = false
-        for (const l of this.listeners) l()
-      })
-  }
-}
-
-/** Per-principal cell registry — dedup across the whole tree for one kernel handle. */
-export class CheckLedger {
-  private readonly cells = new Map<string, CheckCell>()
-
-  constructor(private readonly auth: AuthApi) {}
-
-  cell(key: string, perms: Perms, on: Ref): CheckCell {
-    let cell = this.cells.get(key)
-    if (cell === undefined) {
-      cell = new CheckCell(this.auth, perms, on)
-      this.cells.set(key, cell)
+    let active = true
+    setDecision(undefined)
+    void kernel.auth.can({ policy: policyTarget, object: objectId }).then(
+      (allowed) => {
+        if (active) setDecision(allowed)
+      },
+      () => {
+        if (active) setDecision(undefined)
+      },
+    )
+    return () => {
+      active = false
     }
-    return cell
-  }
+  }, [kernel, policyTarget, objectId])
 
-  /** Re-check every observed cell — conservative Tier-0 sweep after a local grant/revoke. */
-  invalidateAll(): void {
-    for (const cell of this.cells.values()) cell.invalidate()
-  }
+  return decision
 }
 
-// One ledger per bound kernel object → per principal. `session.as(cred)` mints a
-// fresh view per ActAs, so acted-as principals never share a ledger with the root.
-const ledgers = new WeakMap<SessionView, CheckLedger>()
-
-export function ledgerFor(kernel: SessionView): CheckLedger {
-  let ledger = ledgers.get(kernel)
-  if (ledger === undefined) {
-    ledger = new CheckLedger(kernel.auth)
-    ledgers.set(kernel, ledger)
-  }
-  return ledger
+function policyPath(policy: PathLike | schema.PolicyRef | null | undefined) {
+  if (policy === null || policy === undefined) return null
+  return policy instanceof Path || typeof policy === 'string'
+    ? Path.from(policy).raw
+    : Path.project(policy).raw
 }
 
-// ── useCan ────────────────────────────────────────────────────────────────────
-
-export function useCan(
-  perms: Perms,
-  on: NodeValue | PathLike | null | undefined,
-): boolean | undefined {
-  const binding = useIdentityBinding()
-  const ref = isIdleInput(on) ? null : toRef(on)
-
-  // The shared cell for (principal, perms, nodeId): identical to every other
-  // useCan reading the same triple, so one check serves the whole tree.
-  const cell = useMemo(
-    () =>
-      ref === null ? null : ledgerFor(binding.kernel).cell(`${perms}\0${ref.key}`, perms, ref.ref),
-    // ref is rebuilt per render; its `key` string is the stable identity.
-    [binding.kernel, perms, ref?.key],
-  )
-
-  const subscribe = useCallback(
-    (onChange: () => void) => (cell === null ? NOOP_UNSUB : cell.subscribe(onChange)),
-    [cell],
-  )
-  const getSnapshot = useCallback((): boolean | undefined => cell?.getSnapshot(), [cell])
-
-  return useSyncExternalStore(subscribe, getSnapshot, getSnapshot)
+function objectIdOf(value: PolicyObject | null | undefined): NodeId | null {
+  if (value === null || value === undefined) return null
+  return typeof value === 'object' ? value.id : value
 }

package/src/auth/index.ts

@@ -3,4 +3,5 @@ export { ActAs } from './act-as.context.js'
 export type { ActAsProps } from './act-as.context.js'
 export { useAuth } from './auth.hook.js'
 export { useCan } from './can.hook.js'
+export type { PolicyObject } from './can.hook.js'
 export { useSelf } from './self.hook.js'

package/src/auth/self.hook.ts

@@ -1,14 +1,7 @@
-import type { NodeValue } from './act-as.context.js'
+import type { Identity } from '@astrale-os/kernel-client/auth'
 
-/**
- * useSelf (API §4) — the caller's identity node, resolved at boot and read
- * synchronously (never suspends). An <ActAs> subtree returns the acted-as
- * identity. FLAG: today this is the boot-resolved whoami snapshot; it becomes a
- * live memory shape once the graph plane subscribes the self node — no signature
- * change.
- */
 import { useIdentityBinding } from './act-as.context.js'
 
-export function useSelf(): NodeValue {
+export function useSelf(): Identity {
   return useIdentityBinding().self
 }

package/src/auth/session-kernel.ts

@@ -1,24 +1,14 @@
-/**
- * useSessionKernel (API §4) — the dispatch-floor resolver. Inside an `<ActAs>` it
- * is the acted-as principal's bound session view; otherwise the root
- * `shell.kernel`. Every dispatch floor (schema bindings, useCall/useStream, useMove,
- * typed method dispatch) routes through this so a call runs as the subtree's
- * principal — not the root — and its scoped memory.
- */
-import { useContext } from 'react'
+import type { KernelClient } from '@astrale-os/shell'
 
-import type { SessionView } from './act-as.context.js'
+import { useContext } from 'react'
 
 import { ShellContext } from '../session/session.context.js'
 import { IdentityContext } from './act-as.context.js'
 
-/** The EFFECTIVE dispatch kernel for this subtree. Throws outside a provider. */
-export function useSessionKernel(): SessionView {
-  const binding = useContext(IdentityContext)
+export function useSessionKernel(): KernelClient {
+  const identity = useContext(IdentityContext)
   const runtime = useContext(ShellContext)
-  if (binding !== null) return binding.kernel
-  if (runtime === null) {
-    throw new Error('session hooks must be used within a <ShellProvider>')
-  }
+  if (identity !== null) return identity.kernel
+  if (runtime === null) throw new Error('session hooks must be used within a <ShellProvider>')
   return runtime.shell.kernel
 }