@astrale-os/kernel-core 0.9.0-beta.42 → 0.9.0-beta.43

package/dist/auth/authority/language/predicate.d.ts

@@ -1,5 +1,4 @@
-import type { ClassRef, CoreRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
-import type { PolicyObjectRef } from '@astrale-os/kernel-dsl/v1/language';
+import type { ClassRef, CoreRef, FunctionRef, PolicyRef, ViewRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { NodeId } from '../../../graph/node/index.js';
 import type { Grant } from '../../grant/index.js';
 export declare const AUTHORITY_PREDICATE_VERSION: 8;
@@ -23,7 +22,7 @@ export type Term = {
     readonly ref: CoreRef;
 } | {
     readonly kind: 'ref';
-    readonly ref: PolicyObjectRef;
+    readonly ref: ClassRef | FunctionRef | PolicyRef | ViewRef | CoreRef;
 } | {
     readonly kind: 'local';
     readonly id: number;

package/dist/schema/kernel/projection/index.d.ts

@@ -1,6 +1,6 @@
 export { project } from './project.js';
 export { compile } from './compile.js';
-export { projectedCallables } from './callables.js';
+export { projectedCallables, projectedMethodPath } from './callables.js';
 export { ProjectionError } from './diagnostics.js';
 export type { ProjectionErrorCode } from './diagnostics.js';
 export type { CoreProjection, Projection, ProjectionPart } from './types.js';

package/dist/schema/kernel/projection/index.js

@@ -1,4 +1,4 @@
 export { project } from './project.js';
 export { compile } from './compile.js';
-export { projectedCallables } from './callables.js';
+export { projectedCallables, projectedMethodPath } from './callables.js';
 export { ProjectionError } from './diagnostics.js';

package/dist/schema/kernel/schema.d.ts

@@ -212,14 +212,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -243,6 +235,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", "self"> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -668,14 +668,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -699,6 +691,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -858,14 +858,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -889,6 +881,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1048,14 +1048,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -1079,6 +1071,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1238,14 +1238,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -1269,6 +1261,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1435,14 +1435,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -1466,6 +1458,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1645,14 +1645,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -1676,6 +1668,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1683,14 +1683,29 @@ declare const KernelDefinitions: {
                 readonly mode: 'value';
                 readonly value: string;
             }, "authenticated", true, "default">>, "mint", unknown>>> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
+                iss: string;
+                sub: string;
             }, {
                 readonly mode: 'value';
                 readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", builder.ClassOwnerProjection<"node", {
+                    id: string;
+                    iss: string;
+                    sub: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, "authorized", true, "default">>, "whois", builder.ClassOwnerProjection<"node", {
                 readonly abstract: true;
                 readonly depth: 1;
                 readonly properties: {
@@ -1843,14 +1858,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -1874,6 +1881,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -1881,29 +1896,14 @@ declare const KernelDefinitions: {
                 readonly mode: 'value';
                 readonly value: string;
             }, "authenticated", true, "default">>, "mint", unknown>>> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                iss: string;
-                sub: string;
+                policy: string;
+                object: string;
             }, {
                 readonly mode: 'value';
                 readonly value: {
-                    id: string;
-                    iss: string;
-                    sub: string;
-                    frozen: boolean;
-                    requiredClaims: ({
-                        claim: string;
-                        op: "contains";
-                        value: unknown;
-                    } | {
-                        claim: string;
-                        op: "eq";
-                        value: unknown;
-                    } | {
-                        claim: string;
-                        op: "exists";
-                    })[];
-                } | null;
-            }, "authorized", true, "default">>, "whois", builder.ClassOwnerProjection<"node", {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", builder.ClassOwnerProjection<"node", {
                 readonly abstract: true;
                 readonly depth: 1;
                 readonly properties: {
@@ -2056,14 +2056,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -2087,6 +2079,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -2253,14 +2253,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -2284,6 +2276,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -2473,14 +2473,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -2504,6 +2496,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -2663,14 +2663,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -2694,6 +2686,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -2853,14 +2853,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -2884,6 +2876,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -3043,14 +3043,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -3074,6 +3066,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -3241,14 +3241,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -3272,6 +3264,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -3452,14 +3452,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -3483,6 +3475,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -3490,14 +3490,29 @@ declare const KernelDefinitions: {
                 readonly mode: 'value';
                 readonly value: string;
             }, "authenticated", true, "default">>, "mint", unknown>>> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
+                iss: string;
+                sub: string;
             }, {
                 readonly mode: 'value';
                 readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", builder.ClassOwnerProjection<"node", {
+                    id: string;
+                    iss: string;
+                    sub: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, "authorized", true, "default">>, "whois", builder.ClassOwnerProjection<"node", {
                 readonly abstract: true;
                 readonly depth: 1;
                 readonly properties: {
@@ -3650,14 +3665,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -3681,6 +3688,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -3688,29 +3703,14 @@ declare const KernelDefinitions: {
                 readonly mode: 'value';
                 readonly value: string;
             }, "authenticated", true, "default">>, "mint", unknown>>> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                iss: string;
-                sub: string;
+                policy: string;
+                object: string;
             }, {
                 readonly mode: 'value';
                 readonly value: {
-                    id: string;
-                    iss: string;
-                    sub: string;
-                    frozen: boolean;
-                    requiredClaims: ({
-                        claim: string;
-                        op: "contains";
-                        value: unknown;
-                    } | {
-                        claim: string;
-                        op: "eq";
-                        value: unknown;
-                    } | {
-                        claim: string;
-                        op: "exists";
-                    })[];
-                } | null;
-            }, "authorized", true, "default">>, "whois", builder.ClassOwnerProjection<"node", {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", builder.ClassOwnerProjection<"node", {
                 readonly abstract: true;
                 readonly depth: 1;
                 readonly properties: {
@@ -3863,14 +3863,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -3894,6 +3886,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -4060,14 +4060,6 @@ declare const KernelDefinitions: {
                     })[];
                 };
             }, "authenticated", true, "default">>, "whoami", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
-                policy: string;
-                object: string;
-            }, {
-                readonly mode: 'value';
-                readonly value: {
-                    allowed: boolean;
-                };
-            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 iss: string;
                 sub: string;
             }, {
@@ -4091,6 +4083,14 @@ declare const KernelDefinitions: {
                     })[];
                 } | null;
             }, "authorized", true, "default">>, "whois", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, "authenticated", true, "default">>, "can", unknown> | builder.AuthoredMethodProjection<builder.Method<builder.CallableProjection<{
                 audience?: string | undefined;
                 ttlSeconds: number;
                 grant?: unknown;
@@ -4523,7 +4523,9 @@ declare const KernelDefinitions: {
             readonly effectiveProperties: never;
         }>;
     };
-    readonly policies: {};
+    readonly policies: {
+        readonly canUseSyscall: builder.Policy;
+    };
     readonly functions: Readonly<{
         query: builder.Function<builder.CallableProjection<{
             ast: {
@@ -5916,16 +5918,6 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
         readonly origin: "kernel.astrale.ai";
     };
     readonly key: "kernel.astrale.ai:function.install";
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
-    kind: "bundle" | "inspect";
-    origin: string;
-}, {
-    readonly mode: 'binary';
-}, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"introspect"> & {
-        readonly origin: "kernel.astrale.ai";
-    };
-    readonly key: "kernel.astrale.ai:function.introspect";
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     operation: string;
     domains: string[];
@@ -6030,15 +6022,6 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
 }, true, "sealed", "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.View.method.resolve"> & {
     readonly name: "resolve";
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
-    audience?: string | undefined;
-    ttlSeconds: number;
-    grant?: unknown;
-}, {
-    readonly mode: 'value';
-    readonly value: string;
-}, true, "default", "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
-    readonly name: "mint";
 }))[];
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';
 export type { AuthorityOperation, AuthorityRelation } from '../authority/index.js';

package/dist/schema/kernel/schema.js

@@ -6,7 +6,7 @@ import { Class, Extends, InstanceOf } from '../definitions/index.js';
 import { Domain as DomainClass, OfDomain } from '../domain/index.js';
 import { ConstrainedBy, ExcludedFrom, ExtendsWith, Identity } from '../identity/index.js';
 import { Descriptable, Edge, Iconable, Named, Node, Remotable, Statused, Timestamped, } from '../meta/index.js';
-import { Functions } from './syscalls/declarations/index.js';
+import { Functions, CanUseSyscall } from './syscalls/declarations/index.js';
 const KernelDefinitions = {
     classes: {
         Descriptable,
@@ -42,7 +42,7 @@ const KernelDefinitions = {
         of_domain: OfDomain,
         view_for: ViewFor,
     },
-    policies: {},
+    policies: { canUseSyscall: CanUseSyscall },
     functions: Functions,
 };
 const KernelCore = Object.freeze({
@@ -73,11 +73,9 @@ export const KernelRootFunctions = Object.freeze([
     K.functions.mutate,
     K.functions.register,
     K.functions.install,
-    K.functions.introspect,
     K.functions.uninstall,
     K.functions.journal,
     K.classes.Identity.static.methods.whois,
-    K.classes.Identity.static.methods.mint,
     K.classes.View.static.methods.resolve,
 ].sort((left, right) => (left.key < right.key ? -1 : left.key > right.key ? 1 : 0)));
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';

package/dist/schema/kernel/syscalls/declarations/index.d.ts

@@ -379,6 +379,29 @@ export declare const Functions: Readonly<{
                 };
             })[];
             operations: ({
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                slug: unknown;
+                props?: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                } | undefined;
+            } | {
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                props: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                };
+            } | {
                 op: "node.create";
                 as: string;
                 class: string;
@@ -406,29 +429,6 @@ export declare const Functions: Readonly<{
                 };
                 slug?: unknown;
                 props: Record<string, unknown>;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                slug: unknown;
-                props?: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                } | undefined;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                props: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                };
             } | {
                 op: "edge.delete";
                 edge: {
@@ -689,3 +689,4 @@ export declare const ViewMethods: Readonly<{
         };
     }, "authorized", true, "sealed">>;
 }>;
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/index.js

@@ -34,3 +34,4 @@ export const FunctionMethods = Object.freeze({
 export const ViewMethods = Object.freeze({
     resolve: ViewResolve,
 });
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/install.js

@@ -1,8 +1,10 @@
 import { func, output } from '@astrale-os/kernel-dsl/v1';
 import { installInput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Install = func({
     description: 'Authorize and atomically converge a non-empty set of exact ready Domain generations.',
     auth: 'authorized',
+    policy: usePolicy(() => Install),
     input: installInput,
     output: output.binary(),
 });

package/dist/schema/kernel/syscalls/declarations/journal.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { journalInput, journalOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Journal = func({
     description: 'Read one authorized page of semantic operations from the kernel journal.',
     auth: 'authorized',
+    policy: usePolicy(() => Journal),
     input: journalInput,
     output: journalOutput,
 });

package/dist/schema/kernel/syscalls/declarations/mutate.d.ts

@@ -155,29 +155,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
         })[];
         operations: ({
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            slug: unknown;
-            props?: {
-                set: Record<string, unknown>;
-                unset: string[];
-            } | undefined;
-        } | {
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            props: {
-                set: Record<string, unknown>;
-                unset: string[];
-            };
-        } | {
             op: "node.create";
             as: string;
             class: string;
@@ -205,6 +182,29 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
             slug?: unknown;
             props: Record<string, unknown>;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            slug: unknown;
+            props?: {
+                set: Record<string, unknown>;
+                unset: string[];
+            } | undefined;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            props: {
+                set: Record<string, unknown>;
+                unset: string[];
+            };
         } | {
             op: "edge.delete";
             edge: {

package/dist/schema/kernel/syscalls/declarations/mutate.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { mutateInput, mutateOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Mutate = func({
     description: 'Validate, authorize, and commit one atomic graph mutation.',
     auth: 'authorized',
+    policy: usePolicy(() => Mutate),
     input: mutateInput,
     output: mutateOutput,
 });

package/dist/schema/kernel/syscalls/declarations/query.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { queryInput, queryOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Query = func({
     description: 'Execute one finite authorized graph query.',
     auth: 'authorized',
+    policy: usePolicy(() => Query),
     input: queryInput,
     output: queryOutput,
 });

package/dist/schema/kernel/syscalls/declarations/register.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { registerInput, registerOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Register = func({
     description: 'Atomically establish credential-evidenced, write-once Authentication on existing Identity-bearing Nodes.',
     auth: 'authorized',
+    policy: usePolicy(() => Register),
     input: registerInput,
     output: registerOutput,
 });

package/dist/schema/kernel/syscalls/declarations/uninstall.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { uninstallInput, uninstallOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Uninstall = func({
     description: 'Durably uninstall one Domain installation epoch and return its terminal receipt.',
     auth: 'authorized',
+    policy: usePolicy(() => Uninstall),
     input: uninstallInput,
     output: uninstallOutput,
 });

package/dist/schema/kernel/syscalls/declarations/use-policy.d.ts

@@ -0,0 +1,4 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export declare const CanUseSyscall: builder.Policy;
+export declare function usePolicy(callable: () => builder.Function | builder.Method): builder.CallablePolicyBuilder;

package/dist/schema/kernel/syscalls/declarations/use-policy.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/kernel-dsl/v1';
+import { CanUse } from '../../../authority/index.js';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export const CanUseSyscall = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => CanUse, target: object }),
+});
+export function usePolicy(callable) {
+    return ({ check, ref }) => check(CanUseSyscall, ref(callable));
+}

package/dist/schema/kernel/syscalls/declarations/view-resolve.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { viewResolveInput, viewResolveOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const ViewResolve = method({
     description: 'Resolve the installed View declarations applicable to one authorized graph target.',
     auth: 'authorized',
+    policy: usePolicy(() => ViewResolve),
     input: viewResolveInput,
     output: viewResolveOutput,
     static: true,

package/dist/schema/kernel/syscalls/declarations/whois.js

@@ -1,8 +1,10 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { whoisInput, whoisOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Whois = method({
     description: 'Resolve one issuer-and-subject Identity.',
     auth: 'authorized',
+    policy: usePolicy(() => Whois),
     input: whoisInput,
     output: whoisOutput,
     static: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.42",
+  "version": "0.9.0-beta.43",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "0.2.0-beta.30",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.31",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"