@astrale-os/kernel-core 0.9.0-beta.37 → 0.9.0-beta.39

package/dist/auth/authority/admission/admission.js

@@ -44,6 +44,13 @@ function admit(input, path, locals, subjectBound, depth) {
                 grant: acceptGrant(value.grant),
                 where: admit(required(value.where, `${path}/where`), `${path}/where`, locals, true, depth + 1),
             };
+        case 'same-node':
+            exact(value, ['op', 'left', 'right'], path);
+            return {
+                op: 'same-node',
+                left: term(value.left, `${path}/left`, locals, subjectBound),
+                right: term(value.right, `${path}/right`, locals, subjectBound),
+            };
         case 'related': {
             const hasRepeat = Object.hasOwn(value, 'repeat');
             exact(value, hasRepeat
@@ -119,6 +126,16 @@ function term(input, path, locals, subjectBound) {
         case 'domain':
             exact(value, ['kind', 'origin'], path);
             return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
+        case 'ref': {
+            exact(value, ['kind', 'ref'], path);
+            const ref = absoluteRef(value.ref, `${path}/ref`);
+            if (ref.kind === 'core')
+                return { kind: 'ref', ref: coreRef(value.ref, `${path}/ref`) };
+            if (!['class', 'function', 'policy', 'view'].includes(ref.kind))
+                invalid(`${path}/ref/kind`, 'Expected a projected Schema member');
+            definitionName(ref.name, `${path}/ref/name`);
+            return { kind: 'ref', ref: ref };
+        }
         case 'core':
             exact(value, ['kind', 'ref'], path);
             return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };

package/dist/auth/authority/language/predicate.d.ts

@@ -1,7 +1,8 @@
 import type { ClassRef, CoreRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { PolicyObjectRef } from '@astrale-os/kernel-dsl/v1/language';
 import type { NodeId } from '../../../graph/node/index.js';
 import type { Grant } from '../../grant/index.js';
-export declare const AUTHORITY_PREDICATE_VERSION: 7;
+export declare const AUTHORITY_PREDICATE_VERSION: 8;
 export type Operation = 'create' | 'read' | 'traverse' | 'update' | 'delete';
 export type Input = 'object' | 'source' | 'target';
 export type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
@@ -20,6 +21,9 @@ export type Term = {
 } | {
     readonly kind: 'core';
     readonly ref: CoreRef;
+} | {
+    readonly kind: 'ref';
+    readonly ref: PolicyObjectRef;
 } | {
     readonly kind: 'local';
     readonly id: number;
@@ -46,6 +50,10 @@ export interface Requirement {
     readonly evidence: 'allowed' | 'owner';
 }
 export type AuthorityExpr = {
+    readonly op: 'same-node';
+    readonly left: Term;
+    readonly right: Term;
+} | {
     readonly op: 'true';
 } | {
     readonly op: 'false';

package/dist/auth/authority/language/predicate.js

@@ -1 +1 @@
-export const AUTHORITY_PREDICATE_VERSION = 7;
+export const AUTHORITY_PREDICATE_VERSION = 8;

package/dist/auth/authority/normalization/normalize.js

@@ -39,6 +39,13 @@ function normalize(expr, path, locals, subjectBound) {
                 grant: canonicalizeGrant(expr.grant),
                 where: normalize(expr.where, `${path}/where`, locals, true),
             });
+        case 'same-node': {
+            const left = normalizeTerm(expr.left);
+            const right = normalizeTerm(expr.right);
+            return Object.freeze(compare(portable.json.serialize(left), portable.json.serialize(right)) <= 0
+                ? { op: 'same-node', left, right }
+                : { op: 'same-node', left: right, right: left });
+        }
         case 'related':
             return Object.freeze({
                 op: 'related',
@@ -114,6 +121,8 @@ function normalizeTerm(term) {
             return Object.freeze({ kind: 'class', ref: Object.freeze({ ...term.ref }) });
         case 'domain':
             return Object.freeze({ kind: 'domain', origin: term.origin });
+        case 'ref':
+            return Object.freeze({ kind: 'ref', ref: Object.freeze({ ...term.ref }) });
         case 'core':
             return Object.freeze({ kind: 'core', ref: Object.freeze({ ...term.ref }) });
         case 'local':

package/dist/schema/kernel/schema.d.ts

@@ -5625,16 +5625,6 @@ export declare const AuthorityRelations: Readonly<{
 }>;
 /** Exact authorized Kernel Functions for which pristine Root receives direct can_use authority. */
 export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
-    kind: "bundle" | "inspect";
-    origin: string;
-}, {
-    readonly mode: 'binary';
-}, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"introspect"> & {
-        readonly origin: "kernel.astrale.ai";
-    };
-    readonly key: "kernel.astrale.ai:function.introspect";
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     operation: string;
     domains: ({
         artifact: {
@@ -5659,6 +5649,16 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
         readonly origin: "kernel.astrale.ai";
     };
     readonly key: "kernel.astrale.ai:function.install";
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
+    kind: "bundle" | "inspect";
+    origin: string;
+}, {
+    readonly mode: 'binary';
+}, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
+    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"introspect"> & {
+        readonly origin: "kernel.astrale.ai";
+    };
+    readonly key: "kernel.astrale.ai:function.introspect";
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     invocation?: {
         source: string;
@@ -6465,6 +6465,15 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
         readonly origin: "kernel.astrale.ai";
     };
     readonly key: "kernel.astrale.ai:function.uninstall";
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
+    audience?: string | undefined;
+    ttlSeconds: number;
+    grant?: unknown;
+}, {
+    readonly mode: 'value';
+    readonly value: string;
+}, true, "default", "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+    readonly name: "mint";
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     iss: string;
     sub: string;
@@ -6524,15 +6533,6 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
 }, true, "sealed", "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.View.method.resolve"> & {
     readonly name: "resolve";
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
-    audience?: string | undefined;
-    ttlSeconds: number;
-    grant?: unknown;
-}, {
-    readonly mode: 'value';
-    readonly value: string;
-}, true, "default", "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
-    readonly name: "mint";
 }))[];
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';
 export type { AuthorityOperation, AuthorityRelation } from '../authority/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.37",
+  "version": "0.9.0-beta.39",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "0.2.0-beta.28",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.30",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"