@soulcraft/sdk 3.3.7 → 3.3.8

package/dist/client/index.d.ts

@@ -33,6 +33,7 @@
 export { createSoulcraftProxy } from './namespace-proxy.js';
 export type { NamespaceTransport } from './namespace-proxy.js';
 export { createVenueProxy } from '../venue/proxy.js';
+export { ReadOnlyTransport } from '../transports/read-only.js';
 export { HttpNamespaceTransport, PostMessageNamespaceTransport, HttpRpcTransport, PostMessageRpcTransport, } from '../transports/http-namespace.js';
 export type { HttpNamespaceTransportOptions } from '../transports/http-namespace.js';
 export { WsTransport } from '../transports/ws.js';
@@ -46,5 +47,5 @@ export type { SoulcraftSDK } from '../types.js';
 export type { SoulcraftNamespaces } from '../namespaces.js';
 export type { SoulcraftBrainy } from '../modules/brainy/types.js';
 export type { BrainyChangeEvent } from '../modules/brainy/events.js';
-export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKRpcError, SDKMethodNotFoundError, } from '../modules/brainy/errors.js';
+export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKReadOnlyError, SDKRpcError, SDKMethodNotFoundError, } from '../modules/brainy/errors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAG9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAGpF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAGhE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAChG,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAC5F,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AAGjC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GACvB,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAG9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAGpF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAGhE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAChG,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAC5F,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,WAAW,GACZ,MAAM,0BAA0B,CAAA;AAGjC,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AACjE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACpE,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,GACvB,MAAM,6BAA6B,CAAA"}

package/dist/client/index.js

@@ -34,6 +34,8 @@
 export { createSoulcraftProxy } from './namespace-proxy.js';
 // ── Venue proxy factory ────────────────────────────────────────────────────
 export { createVenueProxy } from '../venue/proxy.js';
+// ── Read-only transport wrapper ─────────────────────────────────────────────
+export { ReadOnlyTransport } from '../transports/read-only.js';
 // ── Namespace-aware transports ──────────────────────────────────────────────
 export { HttpNamespaceTransport, PostMessageNamespaceTransport, HttpRpcTransport, PostMessageRpcTransport, } from '../transports/http-namespace.js';
 // ── Real-time transports ────────────────────────────────────────────────────
@@ -43,5 +45,5 @@ export { SseTransport } from '../transports/sse.js';
 export { createYjsProvider } from '../transports/yjs-provider.js';
 // ── Hall room + pub/sub clients (browser) ───────────────────────────────────
 export { joinHallRoom, joinHallPubsub, getWhepUrl, getHlsUrl } from '../modules/hall/browser.js';
-export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKRpcError, SDKMethodNotFoundError, } from '../modules/brainy/errors.js';
+export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKReadOnlyError, SDKRpcError, SDKMethodNotFoundError, } from '../modules/brainy/errors.js';
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAG3D,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AAGxC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGjE,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAgChG,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GACvB,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAG3D,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AAGxC,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGjE,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAgChG,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,GACvB,MAAM,6BAA6B,CAAA"}

package/dist/index.d.ts

@@ -16,7 +16,8 @@ export type { SoulcraftProduct } from './modules/auth/products.js';
 export type { SoulcraftBrainy } from './modules/brainy/types.js';
 export type { Entity, Relation, Result, AddParams, UpdateParams, RelateParams, FindParams, BrainyConfig, AggregateDefinition, DiagnosticsResult, MigrationResult, MigrateOptions, MigrationPreview, NounType, VerbType, BrainyChangeEvent, BrainyChangeEntity, BrainyChangeRelation, } from './modules/brainy/types.js';
 export type { CreateCapabilityTokenOptions, CapabilityTokenClaims, } from './modules/brainy/auth.js';
-export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKRpcError, SDKMethodNotFoundError, } from './modules/brainy/errors.js';
+export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKReadOnlyError, SDKRpcError, SDKMethodNotFoundError, } from './modules/brainy/errors.js';
+export { isWriteMethod, WRITE_METHODS } from './read-only.js';
 export type { VfsModule } from './modules/vfs/types.js';
 export type { VersionsModule } from './modules/versions/types.js';
 export type { HallModule, HallRoom, HallRoomHandle, HallPubsubHandle, HallRoomEvents, HallRoomHandleEvents, HallPubsubHandleEvents, HallPubsubEvents, HallConnectionOptions, HallPeerRole, ScreenShareMode, RoomOptions, ConceptInput, RecordingManifest, RoleChangedEvent, TranscriptEvent, ConceptMentionEvent, RelationProposedEvent, SpeakerChangedEvent, PeerJoinedEvent, PeerLeftEvent, PeerPromotedEvent, PeerDemotedEvent, ViewerCountEvent, ScreenShareThumbnailEvent, ChatMessage as HallChatMessage, ChatHistoryEvent, MediaInfo as HallMediaInfo, MediaReadyEvent, MediaErrorEvent, TranscodeTarget, ReplayEntry, TopicSubscribedEvent, TopicUnsubscribedEvent, TopicMessageEvent, PresenceUpdateEvent, PresenceEntry, PresenceSnapshotEvent, } from './modules/hall/types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAGlE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GACvB,MAAM,4BAA4B,CAAA;AAGnC,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGvD,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAGjE,YAAY,EACV,UAAU,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,WAAW,IAAI,eAAe,EAC9B,gBAAgB,EAChB,SAAS,IAAI,aAAa,EAC1B,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,yBAAyB,CAAA;AAGhC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAGjC,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,UAAU,EACV,SAAS,EACT,cAAc,EACd,MAAM,EACN,OAAO,GACR,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAGjD,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,GACf,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EACV,YAAY,EACZ,KAAK,EACL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EACV,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAGnC,YAAY,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAGhC,YAAY,EACV,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAA;AAGnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,kCAAkC,CAAA;AAGzC,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,UAAU,CAAA;AAGjB,YAAY,EACV,mBAAmB,EAEnB,aAAa,EACb,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,GACvB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5E,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAGlE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,GACvB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG7D,YAAY,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAGvD,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAGjE,YAAY,EACV,UAAU,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,WAAW,IAAI,eAAe,EAC9B,gBAAgB,EAChB,SAAS,IAAI,aAAa,EAC1B,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,yBAAyB,CAAA;AAGhC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GACT,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAGjC,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,UAAU,EACV,SAAS,EACT,cAAc,EACd,MAAM,EACN,OAAO,GACR,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAGjD,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,GACf,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EACV,YAAY,EACZ,KAAK,EACL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EACV,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAGnC,YAAY,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAGhC,YAAY,EACV,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,uBAAuB,GACxB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAG9D,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAA;AAGnC,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,kCAAkC,CAAA;AAGzC,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,UAAU,CAAA;AAGjB,YAAY,EACV,mBAAmB,EAEnB,aAAa,EACb,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,YAAY,EACZ,cAAc,EACd,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,GACvB,MAAM,iBAAiB,CAAA"}

package/dist/index.js

@@ -13,7 +13,9 @@
  */
 // createCapabilityToken and verifyCapabilityToken are server-only (node:crypto).
 // Import from @soulcraft/sdk/server.
-export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKRpcError, SDKMethodNotFoundError, } from './modules/brainy/errors.js';
+export { SDKError, SDKDisconnectedError, SDKTimeoutError, SDKAuthError, SDKForbiddenError, SDKReadOnlyError, SDKRpcError, SDKMethodNotFoundError, } from './modules/brainy/errors.js';
+// ── Read-only enforcement (shared registry) ─────────────────────────────────
+export { isWriteMethod, WRITE_METHODS } from './read-only.js';
 // SOULCRAFT_USER_FIELDS and SOULCRAFT_SESSION_CONFIG are pure constants — safe on shared entry.
 // computeEmailHash, getAuthMode, getOIDCClientConfig use node:crypto / process.env.
 // Import those from @soulcraft/sdk/server.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA+BH,iFAAiF;AACjF,qCAAqC;AACrC,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,sBAAsB,GACvB,MAAM,4BAA4B,CAAA;AA8DnC,gGAAgG;AAChG,oFAAoF;AACpF,2CAA2C;AAC3C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAejC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAoFjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA+BH,iFAAiF;AACjF,qCAAqC;AACrC,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,GACvB,MAAM,4BAA4B,CAAA;AAEnC,+EAA+E;AAC/E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AA8D7D,gGAAgG;AAChG,oFAAoF;AACpF,2CAA2C;AAC3C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,0BAA0B,CAAA;AAejC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAoFjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA"}

package/dist/modules/brainy/errors.d.ts

@@ -98,6 +98,35 @@ export declare class SDKForbiddenError extends SDKError {
      */
     constructor(detail?: string, cause?: unknown);
 }
+/**
+ * Thrown when a mutation is attempted on a read-only transport.
+ *
+ * The {@link ReadOnlyTransport} wrapper blocks known write methods (create, update,
+ * delete, etc.) before they reach the wire. This error provides an AI-friendly
+ * message that can be relayed directly to the user.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await sdk.brainy.add({ data: { name: 'test' } })
+ * } catch (err) {
+ *   if (err instanceof SDKReadOnlyError) {
+ *     showToast(err.message)  // "Cannot create entities — workspace is read-only..."
+ *   }
+ * }
+ * ```
+ */
+export declare class SDKReadOnlyError extends SDKError {
+    /** The namespace that was targeted (e.g. `'brainy'`, `'collections'`). */
+    readonly namespace: string;
+    /** The method that was blocked (e.g. `'add'`, `'writeFile'`). */
+    readonly method: string;
+    /**
+     * @param ns - The target namespace.
+     * @param method - The blocked method name.
+     */
+    constructor(ns: string, method: string);
+}
 /**
  * Thrown when a remote RPC call fails on the server side.
  *

package/dist/modules/brainy/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/modules/brainy/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,wEAAwE;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAA;IAE5B;;;;OAIG;gBACS,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAK3D;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD;;OAEG;gBACS,KAAK,CAAC,EAAE,OAAO;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,8EAA8E;IAC9E,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B;;OAEG;gBACS,MAAM,EAAE,MAAM;CAK3B;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IACxC;;;OAGG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C;;;OAGG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,QAAQ;IACvC,qEAAqE;IACrE,SAAgB,UAAU,EAAE,MAAM,CAAA;IAElC;;;;OAIG;gBACS,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAKvE;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD;;OAEG;gBACS,MAAM,EAAE,MAAM;CAI3B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/modules/brainy/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,wEAAwE;IACxE,SAAgB,IAAI,EAAE,MAAM,CAAA;IAE5B;;;;OAIG;gBACS,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAK3D;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD;;OAEG;gBACS,KAAK,CAAC,EAAE,OAAO;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,8EAA8E;IAC9E,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B;;OAEG;gBACS,MAAM,EAAE,MAAM;CAK3B;AAED;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IACxC;;;OAGG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C;;;OAGG;gBACS,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,0EAA0E;IAC1E,SAAgB,SAAS,EAAE,MAAM,CAAA;IACjC,iEAAiE;IACjE,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B;;;OAGG;gBACS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAUvC;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,QAAQ;IACvC,qEAAqE;IACrE,SAAgB,UAAU,EAAE,MAAM,CAAA;IAElC;;;;OAIG;gBACS,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAKvE;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD;;OAEG;gBACS,MAAM,EAAE,MAAM;CAI3B"}

package/dist/modules/brainy/errors.js

@@ -115,6 +115,41 @@ export class SDKForbiddenError extends SDKError {
         this.name = 'SDKForbiddenError';
     }
 }
+/**
+ * Thrown when a mutation is attempted on a read-only transport.
+ *
+ * The {@link ReadOnlyTransport} wrapper blocks known write methods (create, update,
+ * delete, etc.) before they reach the wire. This error provides an AI-friendly
+ * message that can be relayed directly to the user.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await sdk.brainy.add({ data: { name: 'test' } })
+ * } catch (err) {
+ *   if (err instanceof SDKReadOnlyError) {
+ *     showToast(err.message)  // "Cannot create entities — workspace is read-only..."
+ *   }
+ * }
+ * ```
+ */
+export class SDKReadOnlyError extends SDKError {
+    /** The namespace that was targeted (e.g. `'brainy'`, `'collections'`). */
+    namespace;
+    /** The method that was blocked (e.g. `'add'`, `'writeFile'`). */
+    method;
+    /**
+     * @param ns - The target namespace.
+     * @param method - The blocked method name.
+     */
+    constructor(ns, method) {
+        super('READ_ONLY', `Cannot execute ${ns}.${method} — this workspace is in read-only mode. ` +
+            `Enable editing from the lock icon in the toolbar to make changes.`);
+        this.name = 'SDKReadOnlyError';
+        this.namespace = ns;
+        this.method = method;
+    }
+}
 /**
  * Thrown when a remote RPC call fails on the server side.
  *

package/dist/modules/brainy/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/modules/brainy/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,wEAAwE;IACxD,IAAI,CAAQ;IAE5B;;;;OAIG;IACH,YAAY,IAAY,EAAE,OAAe,EAAE,KAAe;QACxD,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD;;OAEG;IACH,YAAY,KAAe;QACzB,KAAK,CAAC,cAAc,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAA;QACrE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,8EAA8E;IAC9D,MAAM,CAAQ;IAE9B;;OAEG;IACH,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,EAAE,yBAAyB,MAAM,kBAAkB,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACxC;;;OAGG;IACH,YAAY,MAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,cAAc,EAAE,+BAA+B,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAC3F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C;;;OAGG;IACH,YAAY,MAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,WAAW,EAAE,gCAAgC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QACzF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,QAAQ;IACvC,qEAAqE;IACrD,UAAU,CAAQ;IAElC;;;;OAIG;IACH,YAAY,UAAkB,EAAE,aAAqB,EAAE,KAAe;QACpE,KAAK,CAAC,WAAW,EAAE,sBAAsB,UAAU,KAAK,aAAa,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD;;OAEG;IACH,YAAY,MAAc;QACxB,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,MAAM,gCAAgC,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/modules/brainy/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,wEAAwE;IACxD,IAAI,CAAQ;IAE5B;;;;OAIG;IACH,YAAY,IAAY,EAAE,OAAe,EAAE,KAAe;QACxD,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD;;OAEG;IACH,YAAY,KAAe;QACzB,KAAK,CAAC,cAAc,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAA;QACrE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,8EAA8E;IAC9D,MAAM,CAAQ;IAE9B;;OAEG;IACH,YAAY,MAAc;QACxB,KAAK,CAAC,SAAS,EAAE,yBAAyB,MAAM,kBAAkB,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACxC;;;OAGG;IACH,YAAY,MAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,cAAc,EAAE,+BAA+B,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAC3F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC5B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C;;;OAGG;IACH,YAAY,MAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,WAAW,EAAE,gCAAgC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QACzF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAC5C,0EAA0E;IAC1D,SAAS,CAAQ;IACjC,iEAAiE;IACjD,MAAM,CAAQ;IAE9B;;;OAGG;IACH,YAAY,EAAU,EAAE,MAAc;QACpC,KAAK,CACH,WAAW,EACX,kBAAkB,EAAE,IAAI,MAAM,0CAA0C;YACxE,mEAAmE,CACpE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;QACnB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,QAAQ;IACvC,qEAAqE;IACrD,UAAU,CAAQ;IAElC;;;;OAIG;IACH,YAAY,UAAkB,EAAE,aAAqB,EAAE,KAAe;QACpE,KAAK,CAAC,WAAW,EAAE,sBAAsB,UAAU,KAAK,aAAa,EAAE,EAAE,KAAK,CAAC,CAAA;QAC/E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD;;OAEG;IACH,YAAY,MAAc;QACxB,KAAK,CAAC,kBAAkB,EAAE,gBAAgB,MAAM,gCAAgC,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF"}

package/dist/read-only.d.ts

@@ -0,0 +1,56 @@
+/**
+ * @module read-only
+ * @description Shared read-only enforcement for @soulcraft/sdk.
+ *
+ * Defines the canonical registry of mutation methods per SDK namespace. Both the
+ * client-side {@link ReadOnlyTransport} (blocks before the wire) and the server-side
+ * {@link createReadOnlyAuthorize} helper (blocks after the wire) import from this
+ * module to guarantee the same methods are blocked on both sides.
+ *
+ * ## Architecture
+ *
+ * ```
+ * Browser (Workshop)              Server (Venue)
+ * ┌─────────────────┐             ┌─────────────────┐
+ * │ ReadOnlyTransport│ ── wire ──▶│  authorize()     │
+ * │ blocks before   │             │  blocks after    │
+ * │ callNs()        │             │  dispatch()      │
+ * └────────┬────────┘             └────────┬────────┘
+ *          │                               │
+ *          └──── both use ────────────────┘
+ *                 isWriteMethod()
+ *                 from @soulcraft/sdk
+ * ```
+ *
+ * @example
+ * ```typescript
+ * import { isWriteMethod } from '@soulcraft/sdk'
+ *
+ * isWriteMethod('brainy', 'find')      // false (read)
+ * isWriteMethod('brainy', 'add')       // true  (write)
+ * isWriteMethod('brainy.vfs', 'readdir') // false (read)
+ * isWriteMethod('brainy.vfs', 'writeFile') // true (write)
+ * ```
+ */
+export { SDKReadOnlyError } from './modules/brainy/errors.js';
+/**
+ * Known mutation methods per SDK namespace. Any `callNs(ns, method)` matching
+ * an entry here is considered a write operation.
+ *
+ * Methods not in this registry are considered reads — the default is "allow".
+ * This registry is the single source of truth for both client-side
+ * {@link ReadOnlyTransport} and server-side {@link createReadOnlyAuthorize}.
+ */
+export declare const WRITE_METHODS: Readonly<Record<string, ReadonlySet<string>>>;
+/**
+ * Check whether a namespace + method combination is a known write operation.
+ *
+ * Used by both {@link ReadOnlyTransport} (client) and
+ * {@link createReadOnlyAuthorize} (server) to enforce read-only mode.
+ *
+ * @param ns - The target namespace (e.g. `'brainy'`, `'brainy.vfs'`).
+ * @param method - The method name (e.g. `'add'`, `'readdir'`).
+ * @returns `true` if the method mutates data, `false` if it's a read or unknown.
+ */
+export declare function isWriteMethod(ns: string, method: string): boolean;
+//# sourceMappingURL=read-only.d.ts.map

package/dist/read-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../src/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAM7D;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CA2DvE,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjE"}

package/dist/read-only.js

@@ -0,0 +1,108 @@
+/**
+ * @module read-only
+ * @description Shared read-only enforcement for @soulcraft/sdk.
+ *
+ * Defines the canonical registry of mutation methods per SDK namespace. Both the
+ * client-side {@link ReadOnlyTransport} (blocks before the wire) and the server-side
+ * {@link createReadOnlyAuthorize} helper (blocks after the wire) import from this
+ * module to guarantee the same methods are blocked on both sides.
+ *
+ * ## Architecture
+ *
+ * ```
+ * Browser (Workshop)              Server (Venue)
+ * ┌─────────────────┐             ┌─────────────────┐
+ * │ ReadOnlyTransport│ ── wire ──▶│  authorize()     │
+ * │ blocks before   │             │  blocks after    │
+ * │ callNs()        │             │  dispatch()      │
+ * └────────┬────────┘             └────────┬────────┘
+ *          │                               │
+ *          └──── both use ────────────────┘
+ *                 isWriteMethod()
+ *                 from @soulcraft/sdk
+ * ```
+ *
+ * @example
+ * ```typescript
+ * import { isWriteMethod } from '@soulcraft/sdk'
+ *
+ * isWriteMethod('brainy', 'find')      // false (read)
+ * isWriteMethod('brainy', 'add')       // true  (write)
+ * isWriteMethod('brainy.vfs', 'readdir') // false (read)
+ * isWriteMethod('brainy.vfs', 'writeFile') // true (write)
+ * ```
+ */
+// Re-export the error class for convenience
+export { SDKReadOnlyError } from './modules/brainy/errors.js';
+// ─────────────────────────────────────────────────────────────────────────────
+// Write method registry
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Known mutation methods per SDK namespace. Any `callNs(ns, method)` matching
+ * an entry here is considered a write operation.
+ *
+ * Methods not in this registry are considered reads — the default is "allow".
+ * This registry is the single source of truth for both client-side
+ * {@link ReadOnlyTransport} and server-side {@link createReadOnlyAuthorize}.
+ */
+export const WRITE_METHODS = {
+    // Brainy core — entity CRUD + relationship mutations
+    'brainy': new Set([
+        'add', 'update', 'remove', 'upsert', 'batch',
+        'relate', 'unrelate', 'flush',
+    ]),
+    // Brainy VFS — file system mutations
+    'brainy.vfs': new Set([
+        'writeFile', 'deleteFile', 'mkdir', 'rename',
+    ]),
+    // Brainy versions — commit/revert
+    'brainy.versions': new Set([
+        'commit', 'revert', 'createBranch', 'deleteBranch', 'checkout',
+    ]),
+    // Graph — node deletion
+    'graph': new Set(['deleteNode']),
+    // Collections — CRUD + membership
+    'collections': new Set([
+        'create', 'update', 'delete',
+        'addMember', 'removeMember',
+        'loadSampleData', 'clearSampleData',
+    ]),
+    // Annotations — CRUD
+    'annotations': new Set(['create', 'update', 'delete']),
+    // Import — file ingestion
+    'import': new Set(['uploadFiles', 'importData', 'cancel']),
+    // Workspace — mutations (but not reads)
+    'workspace': new Set([
+        'create', 'update', 'delete',
+        'backup', 'restore', 'connectVenue', 'updateSettings',
+    ]),
+    // Publish — link/deploy mutations
+    'publish': new Set([
+        'createLink', 'deleteLink',
+        'deployToVenue', 'publishToAcademy', 'to',
+    ]),
+    // Settings — key/config mutations
+    'settings': new Set(['saveApiKey', 'deleteApiKey', 'updateSettings']),
+    // Media — upload/delete
+    'media': new Set(['upload', 'delete']),
+    // Commerce — transactional mutations
+    'commerce': new Set(['createProduct', 'checkout']),
+    // Certification — issuance
+    'certification': new Set(['issue', 'revoke']),
+    // Pulse — event tracking (write-only namespace)
+    'pulse': new Set(['track']),
+};
+/**
+ * Check whether a namespace + method combination is a known write operation.
+ *
+ * Used by both {@link ReadOnlyTransport} (client) and
+ * {@link createReadOnlyAuthorize} (server) to enforce read-only mode.
+ *
+ * @param ns - The target namespace (e.g. `'brainy'`, `'brainy.vfs'`).
+ * @param method - The method name (e.g. `'add'`, `'readdir'`).
+ * @returns `true` if the method mutates data, `false` if it's a read or unknown.
+ */
+export function isWriteMethod(ns, method) {
+    return WRITE_METHODS[ns]?.has(method) === true;
+}
+//# sourceMappingURL=read-only.js.map

package/dist/read-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.js","sourceRoot":"","sources":["../src/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,4CAA4C;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkD;IAC1E,qDAAqD;IACrD,QAAQ,EAAE,IAAI,GAAG,CAAC;QAChB,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;QAC5C,QAAQ,EAAE,UAAU,EAAE,OAAO;KAC9B,CAAC;IAEF,qCAAqC;IACrC,YAAY,EAAE,IAAI,GAAG,CAAC;QACpB,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ;KAC7C,CAAC;IAEF,kCAAkC;IAClC,iBAAiB,EAAE,IAAI,GAAG,CAAC;QACzB,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU;KAC/D,CAAC;IAEF,wBAAwB;IACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAEhC,kCAAkC;IAClC,aAAa,EAAE,IAAI,GAAG,CAAC;QACrB,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,WAAW,EAAE,cAAc;QAC3B,gBAAgB,EAAE,iBAAiB;KACpC,CAAC;IAEF,qBAAqB;IACrB,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtD,0BAA0B;IAC1B,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAE1D,wCAAwC;IACxC,WAAW,EAAE,IAAI,GAAG,CAAC;QACnB,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB;KACtD,CAAC;IAEF,kCAAkC;IAClC,SAAS,EAAE,IAAI,GAAG,CAAC;QACjB,YAAY,EAAE,YAAY;QAC1B,eAAe,EAAE,kBAAkB,EAAE,IAAI;KAC1C,CAAC;IAEF,kCAAkC;IAClC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAErE,wBAAwB;IACxB,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEtC,qCAAqC;IACrC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAElD,2BAA2B;IAC3B,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE7C,gDAAgD;IAChD,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;CAC5B,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,MAAc;IACtD,OAAO,aAAa,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAA;AAChD,CAAC"}

package/dist/server/index.d.ts

@@ -56,6 +56,7 @@ export type { CreateCapabilityTokenOptions, CapabilityTokenClaims } from '../mod
 export { LocalTransport } from '../transports/local.js';
 export { createCachedDispatch, LruCacheProvider, DEFAULT_CACHEABLE_METHODS } from './rpc-cache.js';
 export type { CacheProvider, CacheEntry, RpcCacheConfig, CacheMetricsEvent } from './rpc-cache.js';
+export { createReadOnlyAuthorize } from './read-only.js';
 export { createNamespaceRouter } from './namespace-router.js';
 export type { NamespaceRouterConfig, NamespaceRouter, NamespaceProvider, NamespaceProviders, RequestContext, UserContext, HandlerContext, PreAuthenticatedContext, DispatchResult, } from './namespace-router.js';
 export { createNamespaceWsHandler } from './ws-handler.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAG/D,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,GACR,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,4BAA4B,EAC5B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,uCAAuC,CAAA;AAG9C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,YAAY,EACV,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,wCAAwC,CAAA;AAG/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GACf,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACjE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACxF,YAAY,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAGvD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAClG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,cAAc,GACf,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,YAAY,EACV,wBAAwB,EACxB,kBAAkB,EAClB,SAAS,GACV,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAI3E,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAG/D,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GACtB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,GACR,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,4BAA4B,EAC5B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,uCAAuC,CAAA;AAG9C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,YAAY,EACV,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,wCAAwC,CAAA;AAG/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,GACf,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACjE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACxF,YAAY,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAGvD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAClG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAGxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,cAAc,GACf,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,YAAY,EACV,wBAAwB,EACxB,kBAAkB,EAClB,SAAS,GACV,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAI3E,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,qBAAqB,CAAA"}

package/dist/server/index.js

@@ -54,6 +54,8 @@ export { createCapabilityToken, verifyCapabilityToken } from '../modules/brainy/
 export { LocalTransport } from '../transports/local.js';
 // ── RPC response cache ────────────────────────────────────────────────────────
 export { createCachedDispatch, LruCacheProvider, DEFAULT_CACHEABLE_METHODS } from './rpc-cache.js';
+// ── Read-only enforcement (server-side) ──────────────────────────────────────
+export { createReadOnlyAuthorize } from './read-only.js';
 // ── Namespace router ─────────────────────────────────────────────────────────
 export { createNamespaceRouter } from './namespace-router.js';
 // ── Namespace WebSocket handler ─────────────────────────────────────────────

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAM3B,iFAAiF;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAE/D,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,eAAe,GAChB,MAAM,oBAAoB,CAAA;AA4C3B,iFAAiF;AACjF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,GACR,MAAM,uCAAuC,CAAA;AAa9C,+EAA+E;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAM9F,iFAAiF;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AASlE,iFAAiF;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAU5D,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAEzC,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAElC,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,6BAA6B,CAAA;AAMpC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEvD,iFAAiF;AACjF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAGlG,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAa7D,+EAA+E;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAO1D,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGnD,gFAAgF;AAChF,iFAAiF;AACjF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AA4D5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAA;AAM3B,iFAAiF;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAE/D,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,eAAe,GAChB,MAAM,oBAAoB,CAAA;AA4C3B,iFAAiF;AACjF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,OAAO,GACR,MAAM,uCAAuC,CAAA;AAa9C,+EAA+E;AAC/E,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAM9F,iFAAiF;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AASlE,iFAAiF;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAU5D,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,kCAAkC,CAAA;AAEzC,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,GACpB,MAAM,2BAA2B,CAAA;AAElC,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,GACnB,MAAM,6BAA6B,CAAA;AAMpC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAEvD,iFAAiF;AACjF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAGlG,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAExD,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAa7D,+EAA+E;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAO1D,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGnD,gFAAgF;AAChF,iFAAiF;AACjF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AA4D5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,sBAAsB,GACvB,MAAM,qBAAqB,CAAA"}

package/dist/server/read-only.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @module server/read-only
+ * @description Server-side read-only enforcement for the SDK namespace router.
+ *
+ * Provides {@link createReadOnlyAuthorize} — a factory that returns an `authorize`
+ * callback compatible with {@link NamespaceRouterConfig}. When plugged in, it blocks
+ * mutation methods **after they arrive over the wire** but before they reach the
+ * namespace handler or Brainy instance.
+ *
+ * Uses {@link isWriteMethod} from `@soulcraft/sdk` — the same registry used by the
+ * client-side {@link ReadOnlyTransport}, ensuring symmetrical enforcement.
+ *
+ * ## Architecture
+ *
+ * ```
+ * Client (ReadOnlyTransport)        Server (authorize callback)
+ *   blocks BEFORE the wire    ←→      blocks AFTER the wire
+ *   same isWriteMethod()              same isWriteMethod()
+ * ```
+ *
+ * @example Venue — block writes for non-owner users
+ * ```typescript
+ * import { createReadOnlyAuthorize } from '@soulcraft/sdk/server'
+ *
+ * const routerConfig = {
+ *   authenticate: async (ctx) => { ... },
+ *   authorize: createReadOnlyAuthorize((user) => user.readOnly === true),
+ *   resolveBrain: async (ctx) => { ... },
+ *   providers: { ... },
+ * }
+ * ```
+ *
+ * @example Workshop — read-only for remote workspaces
+ * ```typescript
+ * authorize: createReadOnlyAuthorize((user) => !!user.readOnly),
+ * ```
+ */
+import type { UserContext } from './namespace-router.js';
+/**
+ * Creates an `authorize` callback for {@link NamespaceRouterConfig} that blocks
+ * mutation methods when the user is in read-only mode.
+ *
+ * The `shouldBlock` predicate receives the authenticated {@link UserContext} and
+ * returns `true` to enforce read-only mode for that request. The authorize callback
+ * then uses {@link isWriteMethod} to check whether the targeted namespace + method
+ * is a mutation — if so, returns `false` (403 Forbidden).
+ *
+ * @param shouldBlock - Predicate that determines whether the user is in read-only mode.
+ * @returns An `authorize` function compatible with `NamespaceRouterConfig.authorize`.
+ *
+ * @example
+ * ```typescript
+ * // Block when UserContext has readOnly flag
+ * const authorize = createReadOnlyAuthorize(user => user.readOnly === true)
+ *
+ * // Block based on role
+ * const authorize = createReadOnlyAuthorize(user => user.role === 'viewer')
+ * ```
+ */
+export declare function createReadOnlyAuthorize(shouldBlock: (user: UserContext) => boolean): (ns: string, method: string, args: unknown[], user: UserContext) => boolean;
+//# sourceMappingURL=read-only.d.ts.map

package/dist/server/read-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../../src/server/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,GAC1C,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAK7E"}

package/dist/server/read-only.js

@@ -0,0 +1,67 @@
+/**
+ * @module server/read-only
+ * @description Server-side read-only enforcement for the SDK namespace router.
+ *
+ * Provides {@link createReadOnlyAuthorize} — a factory that returns an `authorize`
+ * callback compatible with {@link NamespaceRouterConfig}. When plugged in, it blocks
+ * mutation methods **after they arrive over the wire** but before they reach the
+ * namespace handler or Brainy instance.
+ *
+ * Uses {@link isWriteMethod} from `@soulcraft/sdk` — the same registry used by the
+ * client-side {@link ReadOnlyTransport}, ensuring symmetrical enforcement.
+ *
+ * ## Architecture
+ *
+ * ```
+ * Client (ReadOnlyTransport)        Server (authorize callback)
+ *   blocks BEFORE the wire    ←→      blocks AFTER the wire
+ *   same isWriteMethod()              same isWriteMethod()
+ * ```
+ *
+ * @example Venue — block writes for non-owner users
+ * ```typescript
+ * import { createReadOnlyAuthorize } from '@soulcraft/sdk/server'
+ *
+ * const routerConfig = {
+ *   authenticate: async (ctx) => { ... },
+ *   authorize: createReadOnlyAuthorize((user) => user.readOnly === true),
+ *   resolveBrain: async (ctx) => { ... },
+ *   providers: { ... },
+ * }
+ * ```
+ *
+ * @example Workshop — read-only for remote workspaces
+ * ```typescript
+ * authorize: createReadOnlyAuthorize((user) => !!user.readOnly),
+ * ```
+ */
+import { isWriteMethod } from '../read-only.js';
+/**
+ * Creates an `authorize` callback for {@link NamespaceRouterConfig} that blocks
+ * mutation methods when the user is in read-only mode.
+ *
+ * The `shouldBlock` predicate receives the authenticated {@link UserContext} and
+ * returns `true` to enforce read-only mode for that request. The authorize callback
+ * then uses {@link isWriteMethod} to check whether the targeted namespace + method
+ * is a mutation — if so, returns `false` (403 Forbidden).
+ *
+ * @param shouldBlock - Predicate that determines whether the user is in read-only mode.
+ * @returns An `authorize` function compatible with `NamespaceRouterConfig.authorize`.
+ *
+ * @example
+ * ```typescript
+ * // Block when UserContext has readOnly flag
+ * const authorize = createReadOnlyAuthorize(user => user.readOnly === true)
+ *
+ * // Block based on role
+ * const authorize = createReadOnlyAuthorize(user => user.role === 'viewer')
+ * ```
+ */
+export function createReadOnlyAuthorize(shouldBlock) {
+    return (ns, method, _args, user) => {
+        if (!shouldBlock(user))
+            return true;
+        return !isWriteMethod(ns, method);
+    };
+}
+//# sourceMappingURL=read-only.js.map

package/dist/server/read-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.js","sourceRoot":"","sources":["../../src/server/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAG/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAA2C;IAE3C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC,CAAA;AACH,CAAC"}

package/dist/transports/read-only.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @module transports/read-only
+ * @description Client-side transport wrapper that blocks mutation methods in read-only mode.
+ *
+ * Wraps any {@link NamespaceTransport} and intercepts `callNs()` / `callNsStream()`
+ * to reject known write operations **before they hit the wire**. Read operations pass
+ * through unmodified to the inner transport.
+ *
+ * The `isReadOnly` callback is evaluated on every call, so the read-only state can
+ * change dynamically (e.g. when the user clicks "Enable Editing" in the UI).
+ *
+ * Uses {@link isWriteMethod} from `@soulcraft/sdk` — the same registry used by
+ * the server-side {@link createReadOnlyAuthorize} helper, ensuring symmetrical
+ * enforcement on both sides of the wire.
+ *
+ * @example Workshop — wrap the DelegatingTransport
+ * ```typescript
+ * import { ReadOnlyTransport } from '@soulcraft/sdk/client'
+ *
+ * const readOnlyTransport = new ReadOnlyTransport(
+ *   delegatingTransport,
+ *   () => window.__soulcraft_read_only === true,
+ * )
+ * const sdk = createSoulcraftProxy(readOnlyTransport)
+ * ```
+ *
+ * @example Venue Viewer — always read-only in Portfolio mode
+ * ```typescript
+ * const readOnlyTransport = new ReadOnlyTransport(httpTransport, () => isPortfolioMode)
+ * ```
+ */
+import type { NamespaceTransport } from '../client/namespace-proxy.js';
+/**
+ * Transport wrapper that blocks mutation methods when in read-only mode.
+ *
+ * Intercepts `callNs()` and `callNsStream()` to check whether the targeted
+ * namespace + method is a known write operation. If so, throws
+ * {@link SDKReadOnlyError} immediately — no network round-trip, no server load.
+ *
+ * Read operations and all calls when `isReadOnly()` returns `false` are
+ * delegated to the inner transport unchanged.
+ */
+export declare class ReadOnlyTransport implements NamespaceTransport {
+    private _inner;
+    private _isReadOnly;
+    /**
+     * @param inner - The real transport to delegate allowed calls to.
+     * @param isReadOnly - Callback evaluated on every call. Return `true` to block writes.
+     */
+    constructor(inner: NamespaceTransport, isReadOnly: () => boolean);
+    /**
+     * Replace the inner transport (e.g. when upgrading from HTTP to WS).
+     *
+     * @param transport - The new inner transport.
+     */
+    setInner(transport: NamespaceTransport): void;
+    /**
+     * Get the current inner transport.
+     *
+     * @returns The wrapped transport.
+     */
+    getInner(): NamespaceTransport;
+    callNs(ns: string, method: string, args: unknown[]): Promise<unknown>;
+    callNsStream(ns: string, method: string, args: unknown[]): AsyncIterable<unknown>;
+    isAlive(): boolean;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=read-only.d.ts.map

package/dist/transports/read-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../../src/transports/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAQtE;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,kBAAkB;IAC1D,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,WAAW,CAAe;IAElC;;;OAGG;gBACS,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,OAAO;IAKhE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,kBAAkB,GAAG,IAAI;IAI7C;;;;OAIG;IACH,QAAQ,IAAI,kBAAkB;IAI9B,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOrE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC;IAejF,OAAO,IAAI,OAAO;IAIlB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAGvB"}

package/dist/transports/read-only.js

@@ -0,0 +1,101 @@
+/**
+ * @module transports/read-only
+ * @description Client-side transport wrapper that blocks mutation methods in read-only mode.
+ *
+ * Wraps any {@link NamespaceTransport} and intercepts `callNs()` / `callNsStream()`
+ * to reject known write operations **before they hit the wire**. Read operations pass
+ * through unmodified to the inner transport.
+ *
+ * The `isReadOnly` callback is evaluated on every call, so the read-only state can
+ * change dynamically (e.g. when the user clicks "Enable Editing" in the UI).
+ *
+ * Uses {@link isWriteMethod} from `@soulcraft/sdk` — the same registry used by
+ * the server-side {@link createReadOnlyAuthorize} helper, ensuring symmetrical
+ * enforcement on both sides of the wire.
+ *
+ * @example Workshop — wrap the DelegatingTransport
+ * ```typescript
+ * import { ReadOnlyTransport } from '@soulcraft/sdk/client'
+ *
+ * const readOnlyTransport = new ReadOnlyTransport(
+ *   delegatingTransport,
+ *   () => window.__soulcraft_read_only === true,
+ * )
+ * const sdk = createSoulcraftProxy(readOnlyTransport)
+ * ```
+ *
+ * @example Venue Viewer — always read-only in Portfolio mode
+ * ```typescript
+ * const readOnlyTransport = new ReadOnlyTransport(httpTransport, () => isPortfolioMode)
+ * ```
+ */
+import { SDKReadOnlyError } from '../modules/brainy/errors.js';
+import { isWriteMethod } from '../read-only.js';
+// ─────────────────────────────────────────────────────────────────────────────
+// ReadOnlyTransport
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Transport wrapper that blocks mutation methods when in read-only mode.
+ *
+ * Intercepts `callNs()` and `callNsStream()` to check whether the targeted
+ * namespace + method is a known write operation. If so, throws
+ * {@link SDKReadOnlyError} immediately — no network round-trip, no server load.
+ *
+ * Read operations and all calls when `isReadOnly()` returns `false` are
+ * delegated to the inner transport unchanged.
+ */
+export class ReadOnlyTransport {
+    _inner;
+    _isReadOnly;
+    /**
+     * @param inner - The real transport to delegate allowed calls to.
+     * @param isReadOnly - Callback evaluated on every call. Return `true` to block writes.
+     */
+    constructor(inner, isReadOnly) {
+        this._inner = inner;
+        this._isReadOnly = isReadOnly;
+    }
+    /**
+     * Replace the inner transport (e.g. when upgrading from HTTP to WS).
+     *
+     * @param transport - The new inner transport.
+     */
+    setInner(transport) {
+        this._inner = transport;
+    }
+    /**
+     * Get the current inner transport.
+     *
+     * @returns The wrapped transport.
+     */
+    getInner() {
+        return this._inner;
+    }
+    callNs(ns, method, args) {
+        if (this._isReadOnly() && isWriteMethod(ns, method)) {
+            return Promise.reject(new SDKReadOnlyError(ns, method));
+        }
+        return this._inner.callNs(ns, method, args);
+    }
+    callNsStream(ns, method, args) {
+        if (this._isReadOnly() && isWriteMethod(ns, method)) {
+            return {
+                [Symbol.asyncIterator]() {
+                    return {
+                        next() {
+                            return Promise.reject(new SDKReadOnlyError(ns, method));
+                        },
+                    };
+                },
+            };
+        }
+        return this._inner.callNsStream(ns, method, args);
+    }
+    isAlive() {
+        return this._inner.isAlive();
+    }
+    close() {
+        return this._inner.close();
+    }
+}
+//# sourceMappingURL=read-only.js.map

package/dist/transports/read-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.js","sourceRoot":"","sources":["../../src/transports/read-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAoB;IAC1B,WAAW,CAAe;IAElC;;;OAGG;IACH,YAAY,KAAyB,EAAE,UAAyB;QAC9D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAA6B;QACpC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,MAAc,EAAE,IAAe;QAChD,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,MAAc,EAAE,IAAe;QACtD,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,CAAC,MAAM,CAAC,aAAa,CAAC;oBACpB,OAAO;wBACL,IAAI;4BACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;wBACzD,CAAC;qBACF,CAAA;gBACH,CAAC;aACF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IAC9B,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulcraft/sdk",
-  "version": "3.3.7",
+  "version": "3.3.8",
   "description": "The unified Soulcraft platform SDK — data, auth, AI, billing, and notifications",
   "type": "module",
   "publishConfig": {