@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/GrantEvent.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Durable grant decision events.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Capability, CapabilityPattern } from "@smthrs/capability/Capability";
+import * as Schema from "effect/Schema";
+/**
+ * The tier at which a capability decision was made.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantTier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+/**
+ * The scope selected for a permission grant.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantScope: Schema.Literals<readonly ["once", "run", "remembered"]>;
+declare const OnceGrant_base: Schema.Class<OnceGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/OnceGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.once.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"once">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A one-call grant.
+ *
+ * It is durable audit evidence but is deliberately never replayed as active
+ * authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class OnceGrant extends OnceGrant_base {
+}
+declare const RememberedGrant_base: Schema.Class<RememberedGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/RememberedGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.remembered.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"remembered">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A grant remembered across runs.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class RememberedGrant extends RememberedGrant_base {
+}
+declare const RunGrant_base: Schema.Class<RunGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/RunGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.run.v2">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.String;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly ceiling: Schema.$Array<Schema.$Array<typeof CapabilityPattern>>;
+    readonly scope: Schema.Literal<"run">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A grant scoped to the current run.
+ *
+ * Version 2 captures the requesting fiber's normalized conjunction of any-of
+ * capability-pattern groups. Replay intersects it with the constructor ceiling.
+ * Version 1 omitted this boundary and cannot safely activate authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class RunGrant extends RunGrant_base {
+}
+declare const DeniedGrant_base: Schema.Class<DeniedGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/DeniedGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.denied.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"once">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A denied permission request.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class DeniedGrant extends DeniedGrant_base {
+}
+declare const EnvelopeGrant_base: Schema.Class<EnvelopeGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/EnvelopeGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.envelope.v1">;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.String;
+    readonly patterns: Schema.$Array<typeof CapabilityPattern>;
+    readonly scope: Schema.Literals<readonly ["run", "remembered"]>;
+}>, {}>;
+/**
+ * A capability envelope grant.
+ *
+ * Envelope grants are not attached to an individual request. `planDigest`
+ * binds the decision to exactly the plan shown to the approver. A `run`
+ * envelope is replayed only for that run and digest; a `remembered` envelope
+ * becomes remembered predicate grants for future plans while retaining its
+ * origin digest as audit evidence.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class EnvelopeGrant extends EnvelopeGrant_base {
+}
+/**
+ * All durable grant events understood by the kernel.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantEventSchema: Schema.Union<readonly [typeof OnceGrant, typeof RememberedGrant, typeof DeniedGrant, typeof EnvelopeGrant, typeof RunGrant]>;
+/**
+ * All durable grant events understood by the kernel.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type GrantEvent = typeof GrantEventSchema.Type;
+/**
+ * Decodes one JSON-compatible journal payload into a grant event.
+ *
+ * Excess payload keys are rejected rather than stripped. Grant payloads are
+ * replayed as active permission authority, so a payload that mixes fields
+ * from two grant variants — for example an envelope carrying request-only
+ * fields — is treated as corrupt instead of silently narrowed to whichever
+ * variant its declared keys happen to satisfy.
+ *
+ * @category decoding
+ * @since 1.0.0-rc.0
+ */
+export declare const decode: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Result").Result<OnceGrant | RememberedGrant | RunGrant | DeniedGrant | EnvelopeGrant, Schema.SchemaError>;
+/**
+ * Encodes a grant event into its JSON-compatible journal payload.
+ *
+ * @category encoding
+ * @since 1.0.0-rc.0
+ */
+export declare const encode: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Result").Result<{
+    readonly _tag: "@smthrs/kernel/GrantEvent/OnceGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.once.v1";
+    readonly scope: "once";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/RememberedGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.remembered.v1";
+    readonly scope: "remembered";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/RunGrant";
+    readonly eventType: "flows.kernel.grant.run.v2";
+    readonly requestId: string;
+    readonly runId: string;
+    readonly planDigest: string;
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly ceiling: readonly (readonly {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    }[])[];
+    readonly scope: "run";
+    readonly tier: "sealed" | "compensable" | "irreversible";
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/DeniedGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.denied.v1";
+    readonly scope: "once";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/EnvelopeGrant";
+    readonly eventType: "flows.kernel.grant.envelope.v1";
+    readonly runId: string;
+    readonly planDigest: string;
+    readonly patterns: readonly {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    }[];
+    readonly scope: "run" | "remembered";
+}, Schema.SchemaError>;
+export {};
+//# sourceMappingURL=GrantEvent.d.ts.map

package/dist/esm/GrantEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantEvent.d.ts","sourceRoot":"","sources":["../../src/GrantEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,SAAS,qEAA6D,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,yDAAiD,CAAA;;;;;;;;;;;AAExE;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,cAS7B;CAAG;;;;;;;;;;;AAEL;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,oBAYpC;CAAG;;;;;;;;;;;;AAEJ;;;;;;;;;GASG;AACH,qBAAa,QAAS,SAAQ,aAU5B;CAAG;;;;;;;;;;;AAEL;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAS/B;CAAG;;;;;;;;AAEL;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,SAAQ,kBASlC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,8HAM3B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,iMAA8E,CAAA;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAA+C,CAAA"}

package/dist/esm/GrantEvent.js

@@ -0,0 +1,155 @@
+/**
+ * Durable grant decision events.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Capability, CapabilityPattern } from "@smthrs/capability/Capability";
+import * as Schema from "effect/Schema";
+/**
+ * The tier at which a capability decision was made.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export const GrantTier = Schema.Literals(["sealed", "compensable", "irreversible"]);
+/**
+ * The scope selected for a permission grant.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export const GrantScope = Schema.Literals(["once", "run", "remembered"]);
+/**
+ * A one-call grant.
+ *
+ * It is durable audit evidence but is deliberately never replayed as active
+ * authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export class OnceGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/OnceGrant", {
+    eventType: Schema.Literal("flows.kernel.grant.once.v1"),
+    requestId: Schema.String,
+    runId: Schema.String,
+    planDigest: Schema.optional(Schema.String),
+    capability: Capability,
+    pattern: CapabilityPattern,
+    scope: Schema.Literal("once"),
+    tier: GrantTier
+}) {
+}
+/**
+ * A grant remembered across runs.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export class RememberedGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/RememberedGrant", {
+    eventType: Schema.Literal("flows.kernel.grant.remembered.v1"),
+    requestId: Schema.String,
+    runId: Schema.String,
+    planDigest: Schema.optional(Schema.String),
+    capability: Capability,
+    pattern: CapabilityPattern,
+    scope: Schema.Literal("remembered"),
+    tier: GrantTier
+}) {
+}
+/**
+ * A grant scoped to the current run.
+ *
+ * Version 2 captures the requesting fiber's normalized conjunction of any-of
+ * capability-pattern groups. Replay intersects it with the constructor ceiling.
+ * Version 1 omitted this boundary and cannot safely activate authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export class RunGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/RunGrant", {
+    eventType: Schema.Literal("flows.kernel.grant.run.v2"),
+    requestId: Schema.String,
+    runId: Schema.String,
+    planDigest: Schema.String,
+    capability: Capability,
+    pattern: CapabilityPattern,
+    ceiling: Schema.Array(Schema.Array(CapabilityPattern)),
+    scope: Schema.Literal("run"),
+    tier: GrantTier
+}) {
+}
+/**
+ * A denied permission request.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export class DeniedGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/DeniedGrant", {
+    eventType: Schema.Literal("flows.kernel.grant.denied.v1"),
+    requestId: Schema.String,
+    runId: Schema.String,
+    planDigest: Schema.optional(Schema.String),
+    capability: Capability,
+    pattern: CapabilityPattern,
+    scope: Schema.Literal("once"),
+    tier: GrantTier
+}) {
+}
+/**
+ * A capability envelope grant.
+ *
+ * Envelope grants are not attached to an individual request. `planDigest`
+ * binds the decision to exactly the plan shown to the approver. A `run`
+ * envelope is replayed only for that run and digest; a `remembered` envelope
+ * becomes remembered predicate grants for future plans while retaining its
+ * origin digest as audit evidence.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export class EnvelopeGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/EnvelopeGrant", {
+    eventType: Schema.Literal("flows.kernel.grant.envelope.v1"),
+    runId: Schema.String,
+    planDigest: Schema.String,
+    patterns: Schema.Array(CapabilityPattern),
+    scope: Schema.Literals(["run", "remembered"])
+}) {
+}
+/**
+ * All durable grant events understood by the kernel.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const GrantEventSchema = Schema.Union([
+    OnceGrant,
+    RememberedGrant,
+    DeniedGrant,
+    EnvelopeGrant,
+    RunGrant
+]);
+/**
+ * Decodes one JSON-compatible journal payload into a grant event.
+ *
+ * Excess payload keys are rejected rather than stripped. Grant payloads are
+ * replayed as active permission authority, so a payload that mixes fields
+ * from two grant variants — for example an envelope carrying request-only
+ * fields — is treated as corrupt instead of silently narrowed to whichever
+ * variant its declared keys happen to satisfy.
+ *
+ * @category decoding
+ * @since 1.0.0-rc.0
+ */
+export const decode = Schema.decodeUnknownResult(GrantEventSchema, { onExcessProperty: "error" });
+/**
+ * Encodes a grant event into its JSON-compatible journal payload.
+ *
+ * @category encoding
+ * @since 1.0.0-rc.0
+ */
+export const encode = Schema.encodeUnknownResult(GrantEventSchema);
+//# sourceMappingURL=GrantEvent.js.map

package/dist/esm/GrantEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantEvent.js","sourceRoot":"","sources":["../../src/GrantEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;AAExE;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,WAAW,EAAa,CAAC,qCAAqC,EAAE;IACpG,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,iBAAiB;IAC1B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,SAAS;CAChB,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,WAAW,EAAmB,CACxE,2CAA2C,EAC3C;IACE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,iBAAiB;IAC1B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IACnC,IAAI,EAAE,SAAS;CAChB,CACF;CAAG;AAEJ;;;;;;;;;GASG;AACH,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,WAAW,EAAY,CAAC,oCAAoC,EAAE;IACjG,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACtD,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,EAAE,SAAS;CAChB,CAAC;CAAG;AAEL;;;;;GAKG;AACH,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,WAAW,EAAe,CAAC,uCAAuC,EAAE;IAC1G,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC;IACzD,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,iBAAiB;IAC1B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,SAAS;CAChB,CAAC;CAAG;AAEL;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CACpE,yCAAyC,EACzC;IACE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC;IAC3D,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;CAC9C,CACF;CAAG;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3C,SAAS;IACT,eAAe;IACf,WAAW;IACX,aAAa;IACb,QAAQ;CACT,CAAC,CAAA;AAUF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;AAEjG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAA","sourcesContent":["/**\n * Durable grant decision events.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md` and\n * `docs/specs/Concepts/Journal Queue.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport { Capability, CapabilityPattern } from \"@smthrs/capability/Capability\"\nimport * as Schema from \"effect/Schema\"\n\n/**\n * The tier at which a capability decision was made.\n *\n * @category schemas\n * @since 1.0.0-rc.0\n */\nexport const GrantTier = Schema.Literals([\"sealed\", \"compensable\", \"irreversible\"])\n\n/**\n * The scope selected for a permission grant.\n *\n * @category schemas\n * @since 1.0.0-rc.0\n */\nexport const GrantScope = Schema.Literals([\"once\", \"run\", \"remembered\"])\n\n/**\n * A one-call grant.\n *\n * It is durable audit evidence but is deliberately never replayed as active\n * authority.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class OnceGrant extends Schema.TaggedClass<OnceGrant>()(\"@smthrs/kernel/GrantEvent/OnceGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.once.v1\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.optional(Schema.String),\n  capability: Capability,\n  pattern: CapabilityPattern,\n  scope: Schema.Literal(\"once\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A grant remembered across runs.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class RememberedGrant extends Schema.TaggedClass<RememberedGrant>()(\n  \"@smthrs/kernel/GrantEvent/RememberedGrant\",\n  {\n    eventType: Schema.Literal(\"flows.kernel.grant.remembered.v1\"),\n    requestId: Schema.String,\n    runId: Schema.String,\n    planDigest: Schema.optional(Schema.String),\n    capability: Capability,\n    pattern: CapabilityPattern,\n    scope: Schema.Literal(\"remembered\"),\n    tier: GrantTier\n  }\n) {}\n\n/**\n * A grant scoped to the current run.\n *\n * Version 2 captures the requesting fiber's normalized conjunction of any-of\n * capability-pattern groups. Replay intersects it with the constructor ceiling.\n * Version 1 omitted this boundary and cannot safely activate authority.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class RunGrant extends Schema.TaggedClass<RunGrant>()(\"@smthrs/kernel/GrantEvent/RunGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.run.v2\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.String,\n  capability: Capability,\n  pattern: CapabilityPattern,\n  ceiling: Schema.Array(Schema.Array(CapabilityPattern)),\n  scope: Schema.Literal(\"run\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A denied permission request.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class DeniedGrant extends Schema.TaggedClass<DeniedGrant>()(\"@smthrs/kernel/GrantEvent/DeniedGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.denied.v1\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.optional(Schema.String),\n  capability: Capability,\n  pattern: CapabilityPattern,\n  scope: Schema.Literal(\"once\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A capability envelope grant.\n *\n * Envelope grants are not attached to an individual request. `planDigest`\n * binds the decision to exactly the plan shown to the approver. A `run`\n * envelope is replayed only for that run and digest; a `remembered` envelope\n * becomes remembered predicate grants for future plans while retaining its\n * origin digest as audit evidence.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class EnvelopeGrant extends Schema.TaggedClass<EnvelopeGrant>()(\n  \"@smthrs/kernel/GrantEvent/EnvelopeGrant\",\n  {\n    eventType: Schema.Literal(\"flows.kernel.grant.envelope.v1\"),\n    runId: Schema.String,\n    planDigest: Schema.String,\n    patterns: Schema.Array(CapabilityPattern),\n    scope: Schema.Literals([\"run\", \"remembered\"])\n  }\n) {}\n\n/**\n * All durable grant events understood by the kernel.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const GrantEventSchema = Schema.Union([\n  OnceGrant,\n  RememberedGrant,\n  DeniedGrant,\n  EnvelopeGrant,\n  RunGrant\n])\n\n/**\n * All durable grant events understood by the kernel.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type GrantEvent = typeof GrantEventSchema.Type\n\n/**\n * Decodes one JSON-compatible journal payload into a grant event.\n *\n * Excess payload keys are rejected rather than stripped. Grant payloads are\n * replayed as active permission authority, so a payload that mixes fields\n * from two grant variants — for example an envelope carrying request-only\n * fields — is treated as corrupt instead of silently narrowed to whichever\n * variant its declared keys happen to satisfy.\n *\n * @category decoding\n * @since 1.0.0-rc.0\n */\nexport const decode = Schema.decodeUnknownResult(GrantEventSchema, { onExcessProperty: \"error\" })\n\n/**\n * Encodes a grant event into its JSON-compatible journal payload.\n *\n * @category encoding\n * @since 1.0.0-rc.0\n */\nexport const encode = Schema.encodeUnknownResult(GrantEventSchema)\n"]}