/**
 * `RemoteContext` — what every remote method handler receives at runtime.
 *
 * Assembled by the dispatch pipeline before calling `execute`. Carries the
 * validated params, the resolved auth context, the bound node instance (for
 * non-static methods), the typed dependency container, and a
 * `BoundClientSessionView` to call back into the parent kernel, plus explicit
 * `domain`, `caller`, and `fn` namespaces for identity-sensitive work.
 */
import type { AuthPolicy } from '@astrale-os/kernel-api/routed';
import type { FnMap, SchemaBoundView } from '@astrale-os/kernel-client';
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
import type { AuthContext } from '@astrale-os/kernel-core';
import type { Schema } from '@astrale-os/kernel-dsl';
import type { Defer, Sleep } from '@astrale-os/kernel-server';
import type { FunctionContextApi } from '../auth/function-context.js';
import type { DomainAuthority } from '../auth/issuer-mint.js';
import type { Step } from '../step/index.js';
export type { GraphApi } from '@astrale-os/kernel-client/graph';
/**
 * The kernel session a handler holds: a credential-bound view over the parent
 * kernel — the FULL dispatch surface (`call`/`stream`/`binary`/`signal`,
 * `withSchema` typed dispatch, `as` to rebind the acting credential), not just
 * `call`. Name it from `@astrale-os/sdk` instead of reaching into
 * `@astrale-os/kernel-client`. (For the narrow `{ call }` contract — e.g. a
 * tiny test double — see {@link KernelCaller}.)
 *
 */
export type Kernel = BoundClientSessionView<FnMap>;
/** The default handler kernel for one authored domain schema. */
export type DomainKernel<S extends Schema> = SchemaBoundView<S, FnMap>;
/**
 * The `kernel` a handler receives, derived from its declared `auth` policy.
 * The runtime guarantee (see `auth/resolve.ts`) is exact:
 *   - `'required'` (the default) — the dispatcher rejects a credentialless call
 *     before `execute`, so the kernel is ALWAYS present → non-null.
 *   - `'optional'` — a kernel only when a credential was supplied → `… | null`.
 *   - `'public'` — never any inbound credential → `null`. Public handlers that
 *     must touch the graph use `ctx.fn.kernel()` after verifying their upstream.
 *
 * Distributes over a `AuthPolicy` union (e.g. when `auth` is typed but not a
 * literal) to the widened `Kernel | null` — the safe superset, matching the
 * pre-conditional behaviour.
 */
export type KernelForAuth<TAuth extends AuthPolicy, TKernel extends Kernel = Kernel> = TAuth extends 'public' ? null : TAuth extends 'optional' ? TKernel | null : TKernel;
/**
 * The resolved auth context a handler receives, derived from its declared
 * `auth` policy. Mirrors {@link KernelForAuth}: required methods have a
 * verified auth context, optional/public methods encode the nullable cases.
 */
export type AuthForPolicy<TAuth extends AuthPolicy> = TAuth extends 'public' ? null : TAuth extends 'optional' ? AuthContext | null : AuthContext;
export type RemoteEnv = {
    /** This worker's canonical serving URL. */
    url: string;
};
export type CallerContext = {
    /** Issuer of the inbound kernel/peer credential. */
    iss: string;
    /** Kernel URL associated with this invocation. */
    url: string;
};
type RemoteBaseContext<TParams, TSelf, TDeps, TKernel = Kernel | null, TAuth extends AuthPolicy = AuthPolicy> = {
    /** Validated params (Zod-checked against the method's `inputSchema`). */
    params: TParams;
    /**
     * Auth context resolved from the inbound delegation credential. Its
     * nullability follows the method's `auth` policy: non-null for the default
     * `'required'`, `... | null` for `'optional'`, and `null` for `'public'`.
     */
    auth: AuthForPolicy<TAuth>;
    /** Bound node instance — `undefined` for static methods. */
    self: TSelf;
    /** Typed dependency container injected at server startup. */
    deps: TDeps;
    /** Local serving metadata. */
    env: RemoteEnv;
    /**
     * Credential-bound client to the parent kernel. Domain methods receive a
     * schema-bound client by default; standalone functions receive the raw
     * session because they are not owned by a schema class.
     */
    kernel: TKernel;
    /** Inbound kernel/peer context. Present only for authenticated invocations. */
    caller?: CallerContext;
    /** Mint seam for identities THIS DOMAIN issues (`iss` = this worker). */
    domain: DomainAuthority;
    /** Current function identity tools: grant-bearing credentials and self-bound kernels. */
    fn: FunctionContextApi;
};
export type RemoteAuthorizeContext<TParams, TSelf, TDeps, TKernel = Kernel | null, TAuth extends AuthPolicy = AuthPolicy> = RemoteBaseContext<TParams, TSelf, TDeps, TKernel, TAuth>;
export interface RemoteContext<TParams, TSelf, TDeps, TKernel = Kernel | null, TAuth extends AuthPolicy = AuthPolicy> extends RemoteBaseContext<TParams, TSelf, TDeps, TKernel, TAuth> {
    /** Durable-shaped step builder. Inline today, replayable by future backends. */
    step: Step;
    /** Run independent work without making its completion part of this result. */
    defer: Defer;
    /** Pause execution for a relative duration. Durable hosts may persist the wait. */
    sleep: Sleep;
}
//# sourceMappingURL=context.d.ts.map