@astrale-os/kernel-core 0.9.0-beta.41 → 0.9.0-beta.43

package/dist/schema/kernel/schema.js

@@ -6,7 +6,7 @@ import { Class, Extends, InstanceOf } from '../definitions/index.js';
 import { Domain as DomainClass, OfDomain } from '../domain/index.js';
 import { ConstrainedBy, ExcludedFrom, ExtendsWith, Identity } from '../identity/index.js';
 import { Descriptable, Edge, Iconable, Named, Node, Remotable, Statused, Timestamped, } from '../meta/index.js';
-import { Functions } from './syscalls/declarations/index.js';
+import { Functions, CanUseSyscall } from './syscalls/declarations/index.js';
 const KernelDefinitions = {
     classes: {
         Descriptable,
@@ -42,7 +42,7 @@ const KernelDefinitions = {
         of_domain: OfDomain,
         view_for: ViewFor,
     },
-    policies: {},
+    policies: { canUseSyscall: CanUseSyscall },
     functions: Functions,
 };
 const KernelCore = Object.freeze({
@@ -73,11 +73,9 @@ export const KernelRootFunctions = Object.freeze([
     K.functions.mutate,
     K.functions.register,
     K.functions.install,
-    K.functions.introspect,
     K.functions.uninstall,
     K.functions.journal,
     K.classes.Identity.static.methods.whois,
-    K.classes.Identity.static.methods.mint,
     K.classes.View.static.methods.resolve,
 ].sort((left, right) => (left.key < right.key ? -1 : left.key > right.key ? 1 : 0)));
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';

package/dist/schema/kernel/syscalls/contracts/mutate.d.ts

@@ -251,7 +251,6 @@ export declare const mutateInput: import("zod").ZodObject<{
         origin: import("zod").ZodString;
         revision: import("zod").ZodString;
     }, import("zod/v4/core").$strict>>>;
-    idempotencyKey: import("zod").ZodOptional<import("zod").ZodString>;
 }, import("zod/v4/core").$strict>;
 export declare const mutateOutput: import("zod").ZodObject<{
     createdNodes: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;

package/dist/schema/kernel/syscalls/contracts/mutate.js

@@ -1,9 +1,8 @@
-import { strictObject, string } from 'zod';
+import { strictObject } from 'zod';
 import { mutationAstSchema, mutationResultSchema } from '#graph/mutate/wire';
 import { domainExpectations } from './expected.js';
 export const mutateInput = strictObject({
     ast: mutationAstSchema,
     expected: domainExpectations.optional(),
-    idempotencyKey: string().min(1).max(256).optional(),
 });
 export const mutateOutput = mutationResultSchema;

package/dist/schema/kernel/syscalls/declarations/index.d.ts

@@ -379,6 +379,29 @@ export declare const Functions: Readonly<{
                 };
             })[];
             operations: ({
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                slug: unknown;
+                props?: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                } | undefined;
+            } | {
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                props: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                };
+            } | {
                 op: "node.create";
                 as: string;
                 class: string;
@@ -406,29 +429,6 @@ export declare const Functions: Readonly<{
                 };
                 slug?: unknown;
                 props: Record<string, unknown>;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                slug: unknown;
-                props?: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                } | undefined;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                props: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                };
             } | {
                 op: "edge.delete";
                 edge: {
@@ -442,7 +442,6 @@ export declare const Functions: Readonly<{
             origin: string;
             revision: string;
         }[] | undefined;
-        idempotencyKey?: string | undefined;
     }, {
         readonly mode: 'value';
         readonly value: {
@@ -690,3 +689,4 @@ export declare const ViewMethods: Readonly<{
         };
     }, "authorized", true, "sealed">>;
 }>;
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/index.js

@@ -34,3 +34,4 @@ export const FunctionMethods = Object.freeze({
 export const ViewMethods = Object.freeze({
     resolve: ViewResolve,
 });
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/install.js

@@ -1,8 +1,10 @@
 import { func, output } from '@astrale-os/kernel-dsl/v1';
 import { installInput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Install = func({
     description: 'Authorize and atomically converge a non-empty set of exact ready Domain generations.',
     auth: 'authorized',
+    policy: usePolicy(() => Install),
     input: installInput,
     output: output.binary(),
 });

package/dist/schema/kernel/syscalls/declarations/journal.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { journalInput, journalOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Journal = func({
     description: 'Read one authorized page of semantic operations from the kernel journal.',
     auth: 'authorized',
+    policy: usePolicy(() => Journal),
     input: journalInput,
     output: journalOutput,
 });

package/dist/schema/kernel/syscalls/declarations/mutate.d.ts

@@ -155,29 +155,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
         })[];
         operations: ({
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            slug: unknown;
-            props?: {
-                set: Record<string, unknown>;
-                unset: string[];
-            } | undefined;
-        } | {
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            props: {
-                set: Record<string, unknown>;
-                unset: string[];
-            };
-        } | {
             op: "node.create";
             as: string;
             class: string;
@@ -205,6 +182,29 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
             slug?: unknown;
             props: Record<string, unknown>;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            slug: unknown;
+            props?: {
+                set: Record<string, unknown>;
+                unset: string[];
+            } | undefined;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            props: {
+                set: Record<string, unknown>;
+                unset: string[];
+            };
         } | {
             op: "edge.delete";
             edge: {
@@ -218,7 +218,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
         origin: string;
         revision: string;
     }[] | undefined;
-    idempotencyKey?: string | undefined;
 }, {
     readonly mode: 'value';
     readonly value: {

package/dist/schema/kernel/syscalls/declarations/mutate.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { mutateInput, mutateOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Mutate = func({
     description: 'Validate, authorize, and commit one atomic graph mutation.',
     auth: 'authorized',
+    policy: usePolicy(() => Mutate),
     input: mutateInput,
     output: mutateOutput,
 });

package/dist/schema/kernel/syscalls/declarations/query.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { queryInput, queryOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Query = func({
     description: 'Execute one finite authorized graph query.',
     auth: 'authorized',
+    policy: usePolicy(() => Query),
     input: queryInput,
     output: queryOutput,
 });

package/dist/schema/kernel/syscalls/declarations/register.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { registerInput, registerOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Register = func({
     description: 'Atomically establish credential-evidenced, write-once Authentication on existing Identity-bearing Nodes.',
     auth: 'authorized',
+    policy: usePolicy(() => Register),
     input: registerInput,
     output: registerOutput,
 });

package/dist/schema/kernel/syscalls/declarations/uninstall.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { uninstallInput, uninstallOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Uninstall = func({
     description: 'Durably uninstall one Domain installation epoch and return its terminal receipt.',
     auth: 'authorized',
+    policy: usePolicy(() => Uninstall),
     input: uninstallInput,
     output: uninstallOutput,
 });

package/dist/schema/kernel/syscalls/declarations/use-policy.d.ts

@@ -0,0 +1,4 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export declare const CanUseSyscall: builder.Policy;
+export declare function usePolicy(callable: () => builder.Function | builder.Method): builder.CallablePolicyBuilder;

package/dist/schema/kernel/syscalls/declarations/use-policy.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/kernel-dsl/v1';
+import { CanUse } from '../../../authority/index.js';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export const CanUseSyscall = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => CanUse, target: object }),
+});
+export function usePolicy(callable) {
+    return ({ check, ref }) => check(CanUseSyscall, ref(callable));
+}

package/dist/schema/kernel/syscalls/declarations/view-resolve.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { viewResolveInput, viewResolveOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const ViewResolve = method({
     description: 'Resolve the installed View declarations applicable to one authorized graph target.',
     auth: 'authorized',
+    policy: usePolicy(() => ViewResolve),
     input: viewResolveInput,
     output: viewResolveOutput,
     static: true,

package/dist/schema/kernel/syscalls/declarations/whois.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { whoisInput, whoisOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Whois = method({
     description: 'Resolve one issuer-and-subject Identity.',
     auth: 'authorized',
+    policy: usePolicy(() => Whois),
     input: whoisInput,
     output: whoisOutput,
     static: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.41",
+  "version": "0.9.0-beta.43",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "0.2.0-beta.30",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.31",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"