@astrale-os/kernel-core 0.9.0-beta.1 → 0.9.0-beta.3

package/dist/schema/kernel/syscalls/contracts/uninstall.d.ts

@@ -1,9 +1,150 @@
 import { z } from 'zod';
 export declare const uninstallInput: z.ZodObject<{
+    operation: z.ZodString;
     origin: z.ZodString;
 }, z.core.$strict>;
 export declare const uninstallOutput: z.ZodObject<{
-    origin: z.ZodString;
-    revision: z.ZodString;
+    operation: z.ZodString;
+    transition: z.ZodObject<{
+        intent: z.ZodObject<{
+            transition: z.ZodString;
+            operation: z.ZodString;
+            installation: z.ZodString;
+            origin: z.ZodString;
+            source: z.ZodNullable<z.ZodObject<{
+                origin: z.ZodString;
+                schemaRevision: z.ZodString;
+                schemaBundle: z.ZodString;
+                service: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"local">;
+                    artifact: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"remote">;
+                    etag: z.ZodString;
+                }, z.core.$strict>], "kind">;
+                capabilities: z.ZodObject<{
+                    functions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    classes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        class: z.ZodObject<{
+                            origin: z.ZodString;
+                            kind: z.ZodLiteral<"class">;
+                            name: z.ZodString;
+                        }, z.core.$strict>;
+                        operations: z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            read: "read";
+                            traverse: "traverse";
+                            update: "update";
+                        }>>;
+                    }, z.core.$strict>>>;
+                    admin: z.ZodOptional<z.ZodObject<{
+                        grant: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            grant: "grant";
+                            read: "read";
+                            revoke: "revoke";
+                            traverse: "traverse";
+                            update: "update";
+                            use: "use";
+                        }>>>;
+                        revoke: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            grant: "grant";
+                            read: "read";
+                            revoke: "revoke";
+                            traverse: "traverse";
+                            update: "update";
+                            use: "use";
+                        }>>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>;
+                dependencies: z.ZodArray<z.ZodObject<{
+                    origin: z.ZodString;
+                    installation: z.ZodString;
+                    target: z.ZodString;
+                    readinessReceipt: z.ZodString;
+                    meaningComparison: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            target: z.ZodNullable<z.ZodObject<{
+                origin: z.ZodString;
+                schemaRevision: z.ZodString;
+                schemaBundle: z.ZodString;
+                service: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    kind: z.ZodLiteral<"local">;
+                    artifact: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    kind: z.ZodLiteral<"remote">;
+                    etag: z.ZodString;
+                }, z.core.$strict>], "kind">;
+                capabilities: z.ZodObject<{
+                    functions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    classes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        class: z.ZodObject<{
+                            origin: z.ZodString;
+                            kind: z.ZodLiteral<"class">;
+                            name: z.ZodString;
+                        }, z.core.$strict>;
+                        operations: z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            read: "read";
+                            traverse: "traverse";
+                            update: "update";
+                        }>>;
+                    }, z.core.$strict>>>;
+                    admin: z.ZodOptional<z.ZodObject<{
+                        grant: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            grant: "grant";
+                            read: "read";
+                            revoke: "revoke";
+                            traverse: "traverse";
+                            update: "update";
+                            use: "use";
+                        }>>>;
+                        revoke: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            create: "create";
+                            delete: "delete";
+                            grant: "grant";
+                            read: "read";
+                            revoke: "revoke";
+                            traverse: "traverse";
+                            update: "update";
+                            use: "use";
+                        }>>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>;
+                dependencies: z.ZodArray<z.ZodObject<{
+                    origin: z.ZodString;
+                    installation: z.ZodString;
+                    target: z.ZodString;
+                    readinessReceipt: z.ZodString;
+                    meaningComparison: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        phase: z.ZodEnum<{
+            converge: "converge";
+            cutover: "cutover";
+        }>;
+        state: z.ZodLiteral<"committed">;
+        readiness: z.ZodOptional<z.ZodObject<{
+            installation: z.ZodString;
+            target: z.ZodString;
+            transition: z.ZodString;
+            dependencies: z.ZodArray<z.ZodObject<{
+                origin: z.ZodString;
+                installation: z.ZodString;
+                target: z.ZodString;
+                readinessReceipt: z.ZodString;
+                meaningComparison: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
 }, z.core.$strict>;
 //# sourceMappingURL=uninstall.d.ts.map

package/dist/schema/kernel/syscalls/contracts/uninstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/contracts/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,cAAc;;kBAAmC,CAAA;AAC9D,eAAO,MAAM,eAAe;;;kBAAmD,CAAA"}
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/contracts/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,cAAc;;;kBAGzB,CAAA;AACF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG1B,CAAA"}

package/dist/schema/kernel/syscalls/contracts/uninstall.js

@@ -1,5 +1,11 @@
 import { z } from 'zod';
-const text = z.string().min(1);
-export const uninstallInput = z.strictObject({ origin: text });
-export const uninstallOutput = z.strictObject({ origin: text, revision: text });
+import { installationText, operationIdSchema, transitionReceipt } from './installation.js';
+export const uninstallInput = z.strictObject({
+    operation: operationIdSchema,
+    origin: installationText,
+});
+export const uninstallOutput = z.strictObject({
+    operation: operationIdSchema,
+    transition: transitionReceipt,
+});
 //# sourceMappingURL=uninstall.js.map

package/dist/schema/kernel/syscalls/contracts/uninstall.js.map

@@ -1 +1 @@
-{"version":3,"file":"uninstall.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/contracts/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAE9B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA"}
+{"version":3,"file":"uninstall.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/contracts/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3C,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,SAAS,EAAE,iBAAiB;IAC5B,UAAU,EAAE,iBAAiB;CAC9B,CAAC,CAAA"}

package/dist/schema/kernel/syscalls/declarations/admit.d.ts

@@ -1,8 +1,7 @@
 import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Admit: builder.Function<Omit<{
+export declare const Admit: builder.Function<{
     readonly description: "Admit one remote path-only attempt and return its request-scoped execution target.";
-    readonly auth: "required";
-    readonly admission: "authenticated";
+    readonly auth: "authenticated";
     readonly input: import("zod").ZodObject<{
         call: import("zod").ZodObject<{
             target: import("zod").ZodString;
@@ -16,5 +15,5 @@ export declare const Admit: builder.Function<Omit<{
     }, import("zod/v4/core").$strict>;
     readonly static: true;
     readonly inheritance: "sealed";
-}, "admission">>;
+}>;
 //# sourceMappingURL=admit.d.ts.map

package/dist/schema/kernel/syscalls/declarations/admit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admit.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/admit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAKxD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;gBAQW,CAAA"}
+{"version":3,"file":"admit.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/admit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAKxD,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;EAOW,CAAA"}

package/dist/schema/kernel/syscalls/declarations/admit.js

@@ -2,8 +2,7 @@ import { admitInput, admitOutput } from '../contracts/index.js';
 import { defineSyscall } from './define.js';
 export const Admit = defineSyscall({
     description: 'Admit one remote path-only attempt and return its request-scoped execution target.',
-    auth: 'required',
-    admission: 'authenticated',
+    auth: 'authenticated',
     input: admitInput,
     output: admitOutput,
     static: true,

package/dist/schema/kernel/syscalls/declarations/admit.js.map

@@ -1 +1 @@
-{"version":3,"file":"admit.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/admit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,WAAW,EAAE,oFAAoF;IACjG,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,QAAQ;CACtB,CAA4B,CAAA"}
+{"version":3,"file":"admit.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/admit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;IACjC,WAAW,EAAE,oFAAoF;IACjG,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,QAAQ;CACtB,CAA4B,CAAA"}

package/dist/schema/kernel/syscalls/declarations/can.d.ts

@@ -1,8 +1,7 @@
 import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Can: builder.Function<Omit<{
+export declare const Can: builder.Function<{
     readonly description: "Determine whether the current authenticated Identity satisfies one installed Policy for one object.";
-    readonly auth: "required";
-    readonly admission: "authenticated";
+    readonly auth: "authenticated";
     readonly input: import("zod").ZodObject<{
         policy: import("zod").ZodString;
         object: import("zod").ZodString;
@@ -12,5 +11,5 @@ export declare const Can: builder.Function<Omit<{
     }, import("zod/v4/core").$strict>;
     readonly static: true;
     readonly inheritance: "default";
-}, "admission">>;
+}>;
 //# sourceMappingURL=can.d.ts.map

package/dist/schema/kernel/syscalls/declarations/can.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/can.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAKxD,eAAO,MAAM,GAAG;;;;;;;;;;;;;gBASa,CAAA"}
+{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/can.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAKxD,eAAO,MAAM,GAAG;;;;;;;;;;;;EAQa,CAAA"}

package/dist/schema/kernel/syscalls/declarations/can.js

@@ -2,8 +2,7 @@ import { canInput, canOutput } from '../contracts/index.js';
 import { defineSyscall } from './define.js';
 export const Can = defineSyscall({
     description: 'Determine whether the current authenticated Identity satisfies one installed Policy for one object.',
-    auth: 'required',
-    admission: 'authenticated',
+    auth: 'authenticated',
     input: canInput,
     output: canOutput,
     static: true,

package/dist/schema/kernel/syscalls/declarations/can.js.map

@@ -1 +1 @@
-{"version":3,"file":"can.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/can.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,GAAG,GAAG,aAAa,CAAC;IAC/B,WAAW,EACT,qGAAqG;IACvG,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,SAAS;CACvB,CAA4B,CAAA"}
+{"version":3,"file":"can.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/can.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,GAAG,GAAG,aAAa,CAAC;IAC/B,WAAW,EACT,qGAAqG;IACvG,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,SAAS;CACvB,CAA4B,CAAA"}

package/dist/schema/kernel/syscalls/declarations/define.d.ts

@@ -1,18 +1,5 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
-type CallableFields = Omit<builder.CallableInput, 'auth' | 'policy'>;
-/**
- * Kernel callables must name both their authentication mode and their outer
- * callable-admission rule. Absence is never interpreted as a security choice.
- */
-export type SyscallDefinition = CallableFields & ({
-    readonly auth: 'required';
-    readonly admission: 'authenticated';
-    readonly policy?: never;
-} | {
-    readonly auth: 'required';
-    readonly admission: 'policy';
-    readonly policy: builder.CallablePolicyBuilder;
-});
-export declare function defineSyscall<const Config extends SyscallDefinition>(config: Config): builder.Function<Omit<Config, 'admission'>>;
-export {};
+/** Kernel callables use the same explicit Function admission contract as every Domain. */
+export type SyscallDefinition = builder.CallableInput;
+export declare function defineSyscall<const Config extends SyscallDefinition>(config: Config): builder.Function<Config>;
 //# sourceMappingURL=define.d.ts.map

package/dist/schema/kernel/syscalls/declarations/define.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAM,KAAK,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAE5D,KAAK,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAA;AAEpE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAC5C,CACI;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAA;CAC/C,CACJ,CAAA;AAEH,wBAAgB,aAAa,CAAC,KAAK,CAAC,MAAM,SAAS,iBAAiB,EAClE,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAA"}
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAM,KAAK,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAE5D,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAA;AAErD,wBAAgB,aAAa,CAAC,KAAK,CAAC,MAAM,SAAS,iBAAiB,EAClE,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA"}

package/dist/schema/kernel/syscalls/declarations/define.js

@@ -1,6 +1,5 @@
 import { fn } from '@astrale-os/kernel-dsl/v1';
 export function defineSyscall(config) {
-    const { admission: _admission, ...contract } = config;
-    return fn(contract);
+    return fn(config);
 }
 //# sourceMappingURL=define.js.map

package/dist/schema/kernel/syscalls/declarations/define.js.map

@@ -1 +1 @@
-{"version":3,"file":"define.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAgB,MAAM,2BAA2B,CAAA;AAyB5D,MAAM,UAAU,aAAa,CAAC,MAAyB;IACrD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAA;IACrD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC"}
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAgB,MAAM,2BAA2B,CAAA;AAQ5D,MAAM,UAAU,aAAa,CAAC,MAAyB;IACrD,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;AACnB,CAAC"}

package/dist/schema/kernel/syscalls/declarations/delegate.d.ts

@@ -1,16 +1,13 @@
 import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Delegate: builder.Function<Omit<{
-    readonly description: "Issue one attenuated credential from this Identity.";
-    readonly auth: "required";
-    readonly admission: "policy";
-    readonly policy: builder.CallablePolicyBuilder;
+export declare const Delegate: builder.Function<{
+    readonly description: "Issue one strictly attenuated credential from this authenticated Identity.";
+    readonly auth: "authenticated";
     readonly input: import("zod").ZodObject<{
         audience: import("zod").ZodString;
         ttlSeconds: import("zod").ZodNumber;
-        delegation: import("zod").ZodUnknown;
-        attestation: import("zod").ZodOptional<import("zod").ZodUnknown>;
+        attenuation: import("zod").ZodUnknown;
     }, import("zod/v4/core").$strict>;
     readonly output: import("zod").ZodString;
     readonly inheritance: "default";
-}, "admission">>;
+}>;
 //# sourceMappingURL=delegate.d.ts.map

package/dist/schema/kernel/syscalls/declarations/delegate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAOxD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;gBAQQ,CAAA"}
+{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAKxD,eAAO,MAAM,QAAQ;;;;;;;;;;EAMQ,CAAA"}

package/dist/schema/kernel/syscalls/declarations/delegate.js

@@ -1,12 +1,8 @@
-import { DelegateCapability } from '../../../core/index.js';
 import { delegateInput, delegateOutput } from '../contracts/index.js';
-import { requiresCapability } from './capability-policy.js';
 import { defineSyscall } from './define.js';
 export const Delegate = defineSyscall({
-    description: 'Issue one attenuated credential from this Identity.',
-    auth: 'required',
-    admission: 'policy',
-    policy: requiresCapability(DelegateCapability),
+    description: 'Issue one strictly attenuated credential from this authenticated Identity.',
+    auth: 'authenticated',
     input: delegateInput,
     output: delegateOutput,
     inheritance: 'default',

package/dist/schema/kernel/syscalls/declarations/delegate.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/delegate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IACpC,WAAW,EAAE,qDAAqD;IAClE,IAAI,EAAE,UAAU;IAChB,SAAS,EAAE,QAAQ;IACnB,MAAM,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;IAC9C,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,cAAc;IACtB,WAAW,EAAE,SAAS;CACvB,CAA4B,CAAA"}
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../../../../schema/kernel/syscalls/declarations/delegate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IACpC,WAAW,EAAE,4EAA4E;IACzF,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,cAAc;IACtB,WAAW,EAAE,SAAS;CACvB,CAA4B,CAAA"}