@astrale-os/shell-react 0.2.9 → 0.2.10-beta.3

package/dist/auth/can.hook.js

@@ -1,119 +1,44 @@
-import { rawOf } from '@astrale-os/kernel-client/graph';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { useEffect, useState } from 'react';
+import { useIdentityBinding } from './act-as.context.js';
 /**
- * useCan (API §4) — deduped standing-grant permission checks. `auth.check`-backed:
- * `undefined` while the first check is in flight (or `on` is idle), then a boolean.
- * Deduped per (principal, perms, nodeId) across the whole tree via the principal's
- * check ledger (folded in here as the dedup substrate). Standing-grant semantics:
- * the dispatched call remains the gatekeeper — this is a UI affordance, not the
- * enforcement point (SPEC §6.2). A local grant/revoke invalidates the ledger.
+ * Evaluate one declared Kernel policy for one exact graph object. This is a UI affordance; the
+ * invoked callable remains the authorization enforcement point.
  */
-import { useCallback, useMemo, useSyncExternalStore } from 'react';
-import { isIdleInput } from '../graph/memory/read/idle.js';
-import { useIdentityBinding } from './act-as.context.js';
-const NOOP_UNSUB = () => undefined;
-/** A node value carries the id/class/path triple (mirrors the memory's `isNodeValue`). */
-export function isNodeValue(x) {
-    return typeof x === 'object' && x !== null && 'id' in x && 'class' in x && 'path' in x;
-}
-/** Normalize a `useCan` subject to a dispatchable `Ref` plus a stable dedup key. */
-export function toRef(on) {
-    if (isNodeValue(on))
-        return { ref: on.path, key: `@${on.id}` };
-    return { ref: on, key: rawOf(on) };
-}
-// ── check ledger (the dedup substrate) ───────────────────────────────────────
-/** One deduped check — its last-known value plus the subscribers watching it. */
-class CheckCell {
-    auth;
-    perms;
-    on;
-    value = undefined;
-    inFlight = false;
-    listeners = new Set();
-    constructor(auth, perms, on) {
-        this.auth = auth;
-        this.perms = perms;
-        this.on = on;
-    }
-    subscribe = (onChange) => {
-        this.listeners.add(onChange);
-        this.ensure();
-        return () => this.listeners.delete(onChange);
-    };
-    getSnapshot = () => this.value;
-    /** Run the check once when the value is unknown and nothing is in flight. */
-    ensure() {
-        if (this.value !== undefined || this.inFlight)
-            return;
-        this.run();
-    }
-    /** Force a re-check (local grant/revoke on this principal). */
-    invalidate() {
-        if (this.listeners.size === 0) {
-            this.value = undefined; // recompute lazily on the next subscribe
+export function useCan(policy, object) {
+    const { kernel } = useIdentityBinding();
+    const objectId = objectIdOf(object);
+    const policyTarget = policyPath(policy);
+    const [decision, setDecision] = useState(undefined);
+    useEffect(() => {
+        if (policyTarget === null || objectId === null) {
+            setDecision(undefined);
             return;
         }
-        this.run();
-    }
-    run() {
-        this.inFlight = true;
-        void this.auth
-            .check({ on: this.on, perms: this.perms })
-            .then((ok) => {
-            this.value = ok;
+        let active = true;
+        setDecision(undefined);
+        void kernel.auth.can({ policy: policyTarget, object: objectId }).then((allowed) => {
+            if (active)
+                setDecision(allowed);
         }, () => {
-            // A failed check leaves the value unknown (undefined) — never a false grant.
-            this.value = undefined;
-        })
-            .finally(() => {
-            this.inFlight = false;
-            for (const l of this.listeners)
-                l();
+            if (active)
+                setDecision(undefined);
         });
-    }
-}
-/** Per-principal cell registry — dedup across the whole tree for one kernel handle. */
-export class CheckLedger {
-    auth;
-    cells = new Map();
-    constructor(auth) {
-        this.auth = auth;
-    }
-    cell(key, perms, on) {
-        let cell = this.cells.get(key);
-        if (cell === undefined) {
-            cell = new CheckCell(this.auth, perms, on);
-            this.cells.set(key, cell);
-        }
-        return cell;
-    }
-    /** Re-check every observed cell — conservative Tier-0 sweep after a local grant/revoke. */
-    invalidateAll() {
-        for (const cell of this.cells.values())
-            cell.invalidate();
-    }
+        return () => {
+            active = false;
+        };
+    }, [kernel, policyTarget, objectId]);
+    return decision;
 }
-// One ledger per bound kernel object → per principal. `session.as(cred)` mints a
-// fresh view per ActAs, so acted-as principals never share a ledger with the root.
-const ledgers = new WeakMap();
-export function ledgerFor(kernel) {
-    let ledger = ledgers.get(kernel);
-    if (ledger === undefined) {
-        ledger = new CheckLedger(kernel.auth);
-        ledgers.set(kernel, ledger);
-    }
-    return ledger;
+function policyPath(policy) {
+    if (policy === null || policy === undefined)
+        return null;
+    return policy instanceof Path || typeof policy === 'string'
+        ? Path.from(policy).raw
+        : Path.project(policy).raw;
 }
-// ── useCan ────────────────────────────────────────────────────────────────────
-export function useCan(perms, on) {
-    const binding = useIdentityBinding();
-    const ref = isIdleInput(on) ? null : toRef(on);
-    // The shared cell for (principal, perms, nodeId): identical to every other
-    // useCan reading the same triple, so one check serves the whole tree.
-    const cell = useMemo(() => ref === null ? null : ledgerFor(binding.kernel).cell(`${perms}\0${ref.key}`, perms, ref.ref), 
-    // ref is rebuilt per render; its `key` string is the stable identity.
-    [binding.kernel, perms, ref?.key]);
-    const subscribe = useCallback((onChange) => (cell === null ? NOOP_UNSUB : cell.subscribe(onChange)), [cell]);
-    const getSnapshot = useCallback(() => cell?.getSnapshot(), [cell]);
-    return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+function objectIdOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    return typeof value === 'object' ? value.id : value;
 }

package/dist/auth/index.d.ts

@@ -2,5 +2,6 @@ export { ActAs } from './act-as.context.js';
 export type { ActAsProps } from './act-as.context.js';
 export { useAuth } from './auth.hook.js';
 export { useCan } from './can.hook.js';
+export type { PolicyObject } from './can.hook.js';
 export { useSelf } from './self.hook.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/self.hook.d.ts

@@ -1,3 +1,3 @@
-import type { NodeValue } from './act-as.context.js';
-export declare function useSelf(): NodeValue;
+import type { Identity } from '@astrale-os/kernel-client/auth';
+export declare function useSelf(): Identity;
 //# sourceMappingURL=self.hook.d.ts.map

package/dist/auth/self.hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self.hook.d.ts","sourceRoot":"","sources":["../../src/auth/self.hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAWpD,wBAAgB,OAAO,IAAI,SAAS,CAEnC"}
+{"version":3,"file":"self.hook.d.ts","sourceRoot":"","sources":["../../src/auth/self.hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAI9D,wBAAgB,OAAO,IAAI,QAAQ,CAElC"}

package/dist/auth/self.hook.js

@@ -1,10 +1,3 @@
-/**
- * useSelf (API §4) — the caller's identity node, resolved at boot and read
- * synchronously (never suspends). An <ActAs> subtree returns the acted-as
- * identity. FLAG: today this is the boot-resolved whoami snapshot; it becomes a
- * live memory shape once the graph plane subscribes the self node — no signature
- * change.
- */
 import { useIdentityBinding } from './act-as.context.js';
 export function useSelf() {
     return useIdentityBinding().self;

package/dist/auth/session-kernel.d.ts

@@ -1,4 +1,3 @@
-import type { SessionView } from './act-as.context.js';
-/** The EFFECTIVE dispatch kernel for this subtree. Throws outside a provider. */
-export declare function useSessionKernel(): SessionView;
+import type { KernelClient } from '@astrale-os/shell';
+export declare function useSessionKernel(): KernelClient;
 //# sourceMappingURL=session-kernel.d.ts.map

package/dist/auth/session-kernel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-kernel.d.ts","sourceRoot":"","sources":["../../src/auth/session-kernel.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAKtD,iFAAiF;AACjF,wBAAgB,gBAAgB,IAAI,WAAW,CAQ9C"}
+{"version":3,"file":"session-kernel.d.ts","sourceRoot":"","sources":["../../src/auth/session-kernel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAOrD,wBAAgB,gBAAgB,IAAI,YAAY,CAM/C"}

package/dist/auth/session-kernel.js

@@ -1,21 +1,12 @@
-/**
- * useSessionKernel (API §4) — the dispatch-floor resolver. Inside an `<ActAs>` it
- * is the acted-as principal's bound session view; otherwise the root
- * `shell.kernel`. Every dispatch floor (schema bindings, useCall/useStream, useMove,
- * typed method dispatch) routes through this so a call runs as the subtree's
- * principal — not the root — and its scoped memory.
- */
 import { useContext } from 'react';
 import { ShellContext } from '../session/session.context.js';
 import { IdentityContext } from './act-as.context.js';
-/** The EFFECTIVE dispatch kernel for this subtree. Throws outside a provider. */
 export function useSessionKernel() {
-    const binding = useContext(IdentityContext);
+    const identity = useContext(IdentityContext);
     const runtime = useContext(ShellContext);
-    if (binding !== null)
-        return binding.kernel;
-    if (runtime === null) {
+    if (identity !== null)
+        return identity.kernel;
+    if (runtime === null)
         throw new Error('session hooks must be used within a <ShellProvider>');
-    }
     return runtime.shell.kernel;
 }

package/dist/components/astrale.d.ts

@@ -0,0 +1,14 @@
+import type { Shell, ShellConfig } from '@astrale-os/shell';
+import type { ReactElement, ReactNode } from 'react';
+import type { ShellProviderProps } from '../session/provider.js';
+export interface AstraleProps {
+    /** Defaults to the child-side sandbox handshake; pass a Shell for an embedded host or test. */
+    readonly config?: ShellConfig | Shell;
+    readonly fallback?: ReactNode;
+    readonly errorFallback?: ShellProviderProps['errorFallback'];
+    readonly onError?: (error: unknown) => void;
+    readonly children: ReactNode;
+}
+/** Complete Astrale runtime root without taking ownership of application routing. */
+export declare function Astrale(props: AstraleProps): ReactElement;
+//# sourceMappingURL=astrale.d.ts.map

package/dist/components/astrale.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astrale.d.ts","sourceRoot":"","sources":["../../src/components/astrale.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAIpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAQhE,MAAM,WAAW,YAAY;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,CAAA;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAC7B;AAED,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAgBzD"}

package/dist/components/astrale.js

@@ -0,0 +1,12 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Suspense } from 'react';
+import { ShellProvider } from '../session/provider.js';
+import { ViewStage } from '../window/stage.js';
+import { defaultViewError, defaultViewLoading, ViewErrorBoundary } from './boundaries.js';
+const SANDBOXED_SHELL = Object.freeze({ mode: 'sandboxed' });
+/** Complete Astrale runtime root without taking ownership of application routing. */
+export function Astrale(props) {
+    const loading = props.fallback ?? defaultViewLoading();
+    const errorFallback = props.errorFallback ?? defaultViewError;
+    return (_jsxs(ShellProvider, { config: props.config ?? SANDBOXED_SHELL, fallback: loading, errorFallback: errorFallback, onError: ({ error }) => props.onError?.(error), children: [_jsx(ViewErrorBoundary, { fallback: errorFallback, onError: props.onError, children: _jsx(Suspense, { fallback: loading, children: props.children }) }), _jsx(ViewStage, {})] }));
+}

package/dist/components/boundaries.d.ts

@@ -0,0 +1,47 @@
+import type { CredentialSnapshot } from '@astrale-os/shell';
+import type { ReactElement, ReactNode } from 'react';
+import { Component } from 'react';
+import type { GraphResource } from '../graph/resource.js';
+import { useConnection } from '../session/connection/connection.hook.js';
+export declare function ViewBoundary<T>(props: {
+    readonly resource: GraphResource<T>;
+    readonly children: (value: T) => ReactNode;
+    readonly loading?: ReactNode;
+    readonly empty?: ReactNode;
+    readonly error?: (error: unknown) => ReactNode;
+}): ReactElement;
+export declare const GraphBoundary: typeof ViewBoundary;
+export interface ViewErrorBoundaryProps {
+    /** A render function receives the retry generation and can recreate rejected lazy resources. */
+    readonly children: ReactNode | ((generation: number) => ReactNode);
+    readonly fallback?: (error: unknown, retry: () => void) => ReactNode;
+    readonly onError?: (error: unknown) => void;
+}
+/** Catch Shell View render/lazy failures and remount the failed subtree on explicit retry. */
+export declare class ViewErrorBoundary extends Component<ViewErrorBoundaryProps, {
+    readonly error: unknown;
+    readonly generation: number;
+}> {
+    state: {
+        error: unknown;
+        generation: number;
+    };
+    static getDerivedStateFromError(error: unknown): {
+        error: unknown;
+    };
+    componentDidCatch(error: unknown): void;
+    private readonly retry;
+    render(): ReactNode;
+}
+export declare function defaultViewLoading(): ReactElement;
+export declare function defaultViewError(_error: unknown, retry: () => void): ReactElement;
+export declare function ConnectionBoundary(props: {
+    readonly children: ReactNode;
+    readonly fallback?: (status: ReturnType<typeof useConnection>) => ReactNode;
+}): ReactElement;
+export declare function CredentialBoundary(props: {
+    readonly credential: CredentialSnapshot;
+    readonly children: ReactNode;
+    readonly fallback?: (credential: CredentialSnapshot) => ReactNode;
+}): ReactElement;
+//# sourceMappingURL=boundaries.d.ts.map

package/dist/components/boundaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaries.d.ts","sourceRoot":"","sources":["../../src/components/boundaries.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,EAAE,SAAS,EAAY,MAAM,OAAO,CAAA;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAA;AAExE,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,SAAS,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAA;CAC/C,GAAG,YAAY,CASf;AAED,eAAO,MAAM,aAAa,qBAAe,CAAA;AAEzC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAA;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,SAAS,CAAA;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAC5C;AAED,8FAA8F;AAC9F,qBAAa,iBAAkB,SAAQ,SAAS,CAC9C,sBAAsB,EACtB;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CACzD;IACU,KAAK;QAAK,KAAK,EAAe,OAAO;QAAE,UAAU;MAAK;IAE/D,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,OAAO;;MAE7C;IAEQ,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAE/C;IAED,OAAO,CAAC,QAAQ,CAAC,KAAK,CAErB;IAEQ,MAAM,IAAI,SAAS,CAY3B;CACF;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CAMjD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,YAAY,CASjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,KAAK,SAAS,CAAA;CAC5E,GAAG,YAAY,CAOf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,SAAS,CAAA;CAClE,GAAG,YAAY,CAQf"}

package/dist/components/boundaries.js

@@ -0,0 +1,55 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Component, Fragment } from 'react';
+import { useConnection } from '../session/connection/connection.hook.js';
+export function ViewBoundary(props) {
+    const { resource } = props;
+    if (resource.state === 'failed') {
+        if (props.error !== undefined)
+            return _jsx(_Fragment, { children: props.error(resource.error) });
+        throw resource.error;
+    }
+    if (resource.data === undefined)
+        return _jsx(_Fragment, { children: props.loading ?? null });
+    if (resource.data === null)
+        return _jsx(_Fragment, { children: props.empty ?? null });
+    return _jsx(_Fragment, { children: props.children(resource.data) });
+}
+export const GraphBoundary = ViewBoundary;
+/** Catch Shell View render/lazy failures and remount the failed subtree on explicit retry. */
+export class ViewErrorBoundary extends Component {
+    state = { error: undefined, generation: 0 };
+    static getDerivedStateFromError(error) {
+        return { error };
+    }
+    componentDidCatch(error) {
+        this.props.onError?.(error);
+    }
+    retry = () => {
+        this.setState((state) => ({ error: undefined, generation: state.generation + 1 }));
+    };
+    render() {
+        if (this.state.error !== undefined) {
+            return (this.props.fallback?.(this.state.error, this.retry) ??
+                defaultViewError(this.state.error, this.retry));
+        }
+        const content = typeof this.props.children === 'function'
+            ? this.props.children(this.state.generation)
+            : this.props.children;
+        return _jsx(Fragment, { children: content }, this.state.generation);
+    }
+}
+export function defaultViewLoading() {
+    return (_jsx("div", { role: "status", "aria-live": "polite", children: "Loading view\u2026" }));
+}
+export function defaultViewError(_error, retry) {
+    return (_jsxs("section", { role: "alert", children: [_jsx("p", { children: "View could not load." }), _jsx("button", { type: "button", onClick: retry, children: "Retry" })] }));
+}
+export function ConnectionBoundary(props) {
+    const connection = useConnection();
+    return connection.status === 'ready' ? (_jsx(_Fragment, { children: props.children })) : (_jsx(_Fragment, { children: props.fallback?.(connection) ?? null }));
+}
+export function CredentialBoundary(props) {
+    return props.credential.state === 'valid' ||
+        props.credential.state === 'refreshing' ||
+        props.credential.state === 'degraded' ? (_jsx(_Fragment, { children: props.children })) : (_jsx(_Fragment, { children: props.fallback?.(props.credential) ?? null }));
+}

package/dist/components/can.d.ts

@@ -0,0 +1,11 @@
+import type { PathLike } from '@astrale-os/sdk/graph/path';
+import type { schema } from '@astrale-os/sdk/schema';
+import type { ReactElement, ReactNode } from 'react';
+import type { PolicyObject } from '../auth/can.hook.js';
+export declare function Can(props: {
+    readonly policy: PathLike | schema.PolicyRef;
+    readonly object: PolicyObject;
+    readonly children: ReactNode;
+    readonly fallback?: ReactNode;
+}): ReactElement;
+//# sourceMappingURL=can.d.ts.map

package/dist/components/can.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../../src/components/can.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAIvD,wBAAgB,GAAG,CAAC,KAAK,EAAE;IACzB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAC9B,GAAG,YAAY,CAEf"}

package/dist/components/can.js

@@ -0,0 +1,5 @@
+import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { useCan } from '../auth/can.hook.js';
+export function Can(props) {
+    return _jsx(_Fragment, { children: useCan(props.policy, props.object) === true ? props.children : props.fallback });
+}

package/dist/components/index.d.ts

@@ -0,0 +1,6 @@
+export { Can } from './can.js';
+export { ConnectionBoundary, CredentialBoundary, defaultViewError, defaultViewLoading, GraphBoundary, ViewErrorBoundary, ViewBoundary, } from './boundaries.js';
+export type { ViewErrorBoundaryProps } from './boundaries.js';
+export { Astrale } from './astrale.js';
+export type { AstraleProps } from './astrale.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,YAAY,GACb,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}

package/dist/components/index.js

@@ -0,0 +1,3 @@
+export { Can } from './can.js';
+export { ConnectionBoundary, CredentialBoundary, defaultViewError, defaultViewLoading, GraphBoundary, ViewErrorBoundary, ViewBoundary, } from './boundaries.js';
+export { Astrale } from './astrale.js';

package/dist/graph/call/call.hook.d.ts

@@ -1,21 +1,11 @@
-/**
- * useCall (API §7) — unary domain-function dispatch over `kernel.call`, in the
- * Action envelope. No result caching, no liveness — domain function reads are not
- * structurally invalidatable (FRONTEND §5.7); a consumer that needs freshness
- * owns its own refetch policy. Dispatch is a graph operation (rule 2).
- */
-import type { CallFns, FnMap } from '@astrale-os/kernel-client';
+import type { Call } from '@astrale-os/kernel-client';
+import type { SessionRequestOptions } from '@astrale-os/kernel-client/session';
+import type { Value } from '@astrale-os/sdk/value';
 import type { Action } from '../action.js';
-export interface CallOptions {
-    /** Per-call timeout (ms), forwarded to the kernel dispatch. */
-    timeout?: number;
-    /** Side-channel notified on rejection (the Action also records `.error`). */
-    onError?(error: unknown): void;
+export interface CallOptions extends SessionRequestOptions {
+    readonly onError?: (error: unknown) => void;
 }
-/**
- * Unary domain-function dispatch as an {@link Action}. `method` is a typed FnMap
- * `call` path or any string (the untyped floor); `null` yields an idle action
- * that rejects if invoked. Params/result are typed from the FnMap entry.
- */
-export declare function useCall<K extends CallFns<FnMap>>(method: K | null, opts?: CallOptions): Action<[FnMap[K]['params']], FnMap[K]['result']>;
+export type CallResult = Value;
+export declare function useCall(call: Call | null, options?: CallOptions): Action<[], CallResult>;
+export declare function useCall<A extends unknown[]>(author: ((...args: A) => Call) | null, options?: CallOptions): Action<A, CallResult>;
 //# sourceMappingURL=call.hook.d.ts.map

package/dist/graph/call/call.hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call.hook.d.ts","sourceRoot":"","sources":["../../../src/graph/call/call.hook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAK1C,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,EAC9C,MAAM,EAAE,CAAC,GAAG,IAAI,EAChB,IAAI,CAAC,EAAE,WAAW,GACjB,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAalD"}
+{"version":3,"file":"call.hook.d.ts","sourceRoot":"","sources":["../../../src/graph/call/call.hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAElD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAK1C,MAAM,WAAW,WAAY,SAAQ,qBAAqB;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CAC5C;AAED,MAAM,MAAM,UAAU,GAAG,KAAK,CAAA;AAG9B,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;AACzF,wBAAgB,OAAO,CAAC,CAAC,SAAS,OAAO,EAAE,EACzC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,EACrC,OAAO,CAAC,EAAE,WAAW,GACpB,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA"}

package/dist/graph/call/call.hook.js

@@ -1,22 +1,16 @@
 import { useSessionKernel } from '../../auth/session-kernel.js';
 import { useAction } from '../action.js';
-/**
- * Unary domain-function dispatch as an {@link Action}. `method` is a typed FnMap
- * `call` path or any string (the untyped floor); `null` yields an idle action
- * that rejects if invoked. Params/result are typed from the FnMap entry.
- */
-export function useCall(method, opts) {
+export function useCall(author, options) {
     const kernel = useSessionKernel();
-    // A fresh closure per render captures the current method/opts; `useAction`
-    // keeps ONE stable callable and always dispatches this latest closure.
-    return useAction(async (params) => {
-        if (method === null)
-            throw new Error('useCall: method is null (idle action invoked)');
+    return useAction(async (...args) => {
+        if (author === null)
+            throw new Error('useCall: idle action invoked');
+        const call = typeof author === 'function' ? author(...args) : author;
         try {
-            return await kernel.call(method, params, { timeout: opts?.timeout });
+            return await kernel.call(call, options);
         }
         catch (error) {
-            opts?.onError?.(error);
+            options?.onError?.(error);
             throw error;
         }
     });

package/dist/graph/call/stream.hook.d.ts

@@ -1,28 +1,20 @@
-import type { FnMap, StreamFns } from '@astrale-os/kernel-client';
-export interface StreamOptions<T> {
-    /** Notified per chunk as it arrives (in addition to `chunks` accumulation). */
-    onChunk?(chunk: T): void;
+import type { Call } from '@astrale-os/kernel-client';
+import type { SessionRequestOptions } from '@astrale-os/kernel-client/session';
+import type { Value } from '@astrale-os/sdk/value';
+import type { KernelClient } from '@astrale-os/shell';
+export type KernelStream = Awaited<ReturnType<KernelClient['stream']>>;
+export type StreamItem = Value;
+export type CallAuthor<A extends unknown[]> = Call | ((...args: A) => Call);
+export interface StreamOptions<T = StreamItem> extends SessionRequestOptions {
+    readonly onChunk?: (chunk: T) => void;
 }
-export interface StreamHandle<T> {
-    /** Begin a run: resets chunks, then resolves when the stream ends / rejects on failure. */
-    start(params: unknown): Promise<void>;
-    /** Chunks accumulated in the current run; reset on the next `start`. */
+export interface StreamHandle<A extends unknown[] = unknown[], T = StreamItem> {
+    start(...args: A): Promise<void>;
     readonly chunks: readonly T[];
-    /** The most recent chunk, or null before the first. */
     readonly last: T | null;
-    /** A run is in flight. */
     readonly streaming: boolean;
-    /** Last run failure; retained until the next `start`. */
     readonly error: unknown;
-    /** Close the stream (returns the iterator); a later `start` begins fresh. */
     cancel(): void;
 }
-/**
- * Streaming domain-function dispatch. `start(params)` opens a run over
- * `kernel.stream`; chunks accumulate on `chunks`; `cancel()` closes the iterator
- * and a later `start` begins fresh. A superseding `start` (or unmount) closes the
- * prior run and discards its late chunks/errors — only the current run drives
- * state. Never live; the handle keeps one identity for the hook's lifetime.
- */
-export declare function useStream<K extends StreamFns<FnMap>>(method: K | null, opts?: StreamOptions<FnMap[K]['result']>): StreamHandle<FnMap[K]['result']>;
+export declare function useStream<A extends unknown[] = []>(author: CallAuthor<A> | null, options?: StreamOptions): StreamHandle<A, StreamItem>;
 //# sourceMappingURL=stream.hook.d.ts.map

package/dist/graph/call/stream.hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.hook.d.ts","sourceRoot":"","sources":["../../../src/graph/call/stream.hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAYjE,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,+EAA+E;IAC/E,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,2FAA2F;IAC3F,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IACvB,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,6EAA6E;IAC7E,MAAM,IAAI,IAAI,CAAA;CACf;AA2DD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,SAAS,CAAC,KAAK,CAAC,EAClD,MAAM,EAAE,CAAC,GAAG,IAAI,EAChB,IAAI,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GACvC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAoGlC"}
+{"version":3,"file":"stream.hook.d.ts","sourceRoot":"","sources":["../../../src/graph/call/stream.hook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMrD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACtE,MAAM,MAAM,UAAU,GAAG,KAAK,CAAA;AAC9B,MAAM,MAAM,UAAU,CAAC,CAAC,SAAS,OAAO,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,CAAA;AAE3E,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,UAAU,CAAE,SAAQ,qBAAqB;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAA;CACtC;AAED,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,GAAG,UAAU;IAC3E,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,MAAM,IAAI,IAAI,CAAA;CACf;AAmCD,wBAAgB,SAAS,CAAC,CAAC,SAAS,OAAO,EAAE,GAAG,EAAE,EAChD,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CA4D7B"}