@astrale-os/kernel-core 0.9.0-beta.42 → 0.9.0-beta.44

package/dist/schema/kernel/schema.js

@@ -6,7 +6,7 @@ import { Class, Extends, InstanceOf } from '../definitions/index.js';
 import { Domain as DomainClass, OfDomain } from '../domain/index.js';
 import { ConstrainedBy, ExcludedFrom, ExtendsWith, Identity } from '../identity/index.js';
 import { Descriptable, Edge, Iconable, Named, Node, Remotable, Statused, Timestamped, } from '../meta/index.js';
-import { Functions } from './syscalls/declarations/index.js';
+import { Functions, CanUseSyscall } from './syscalls/declarations/index.js';
 const KernelDefinitions = {
     classes: {
         Descriptable,
@@ -42,7 +42,7 @@ const KernelDefinitions = {
         of_domain: OfDomain,
         view_for: ViewFor,
     },
-    policies: {},
+    policies: { canUseSyscall: CanUseSyscall },
     functions: Functions,
 };
 const KernelCore = Object.freeze({
@@ -73,11 +73,9 @@ export const KernelRootFunctions = Object.freeze([
     K.functions.mutate,
     K.functions.register,
     K.functions.install,
-    K.functions.introspect,
     K.functions.uninstall,
     K.functions.journal,
     K.classes.Identity.static.methods.whois,
-    K.classes.Identity.static.methods.mint,
     K.classes.View.static.methods.resolve,
 ].sort((left, right) => (left.key < right.key ? -1 : left.key > right.key ? 1 : 0)));
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';

package/dist/schema/kernel/syscalls/contracts/admit.d.ts

@@ -1,6 +1,10 @@
 export declare const admitInput: import("zod").ZodObject<{
     call: import("zod").ZodObject<{
-        target: import("zod").ZodString;
+        target: import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodObject<{
+            callable: import("zod").ZodString;
+            instance: import("zod").ZodOptional<import("zod").ZodString>;
+            revision: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strict>]>;
         input: import("zod").ZodUnknown;
     }, import("zod/v4/core").$strict>;
     credential: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/schema/kernel/syscalls/contracts/admit.js

@@ -1,7 +1,14 @@
-import { strictObject, string, unknown as unknownSchema } from 'zod';
+import { strictObject, string, union, unknown as unknownSchema } from 'zod';
 export const admitInput = strictObject({
     call: strictObject({
-        target: string().min(1),
+        target: union([
+            string().min(1),
+            strictObject({
+                callable: string().min(1),
+                instance: string().min(1).optional(),
+                revision: string().min(1).optional(),
+            }),
+        ]),
         input: unknownSchema(),
     }),
     credential: string().optional(),

package/dist/schema/kernel/syscalls/contracts/delegate.d.ts

@@ -1,4 +1,5 @@
 export declare const delegateInput: import("zod").ZodObject<{
+    principal: import("zod").ZodString;
     audience: import("zod").ZodString;
     ttlSeconds: import("zod").ZodNumber;
     attenuation: import("zod").ZodUnknown;

package/dist/schema/kernel/syscalls/contracts/delegate.js

@@ -1,6 +1,7 @@
 import { number, strictObject, string, unknown as unknownSchema } from 'zod';
 const text = string().min(1);
 export const delegateInput = strictObject({
+    principal: text,
     audience: text,
     ttlSeconds: number().int().min(1),
     attenuation: unknownSchema(),

package/dist/schema/kernel/syscalls/declarations/admit.d.ts

@@ -1,7 +1,11 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Admit: builder.Method<builder.CallableProjection<{
     call: {
-        target: string;
+        target: string | {
+            callable: string;
+            instance?: string | undefined;
+            revision?: string | undefined;
+        };
         input: unknown;
     };
     credential?: string | undefined;
@@ -11,4 +15,4 @@ export declare const Admit: builder.Method<builder.CallableProjection<{
         callable: string;
         receiver?: string | undefined;
     };
-}, "authenticated", true, "sealed">>;
+}, "authenticated", true, false>>;

package/dist/schema/kernel/syscalls/declarations/admit.js

@@ -6,5 +6,5 @@ export const Admit = method({
     input: admitInput,
     output: admitOutput,
     static: true,
-    inheritance: 'sealed',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/can.d.ts

@@ -7,4 +7,4 @@ export declare const Can: builder.Method<builder.CallableProjection<{
     readonly value: {
         allowed: boolean;
     };
-}, "authenticated", true, "default">>;
+}, "authenticated", true, false>>;

package/dist/schema/kernel/syscalls/declarations/can.js

@@ -6,5 +6,5 @@ export const Can = method({
     input: canInput,
     output: canOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/delegate.d.ts

@@ -1,9 +1,10 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Delegate: builder.Method<builder.CallableProjection<{
+    principal: string;
     audience: string;
     ttlSeconds: number;
     attenuation: unknown;
 }, {
     readonly mode: 'value';
     readonly value: string;
-}, "authenticated", false, "default">>;
+}, "authenticated", true, false>>;

package/dist/schema/kernel/syscalls/declarations/delegate.js

@@ -1,9 +1,9 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { delegateInput, delegateOutput } from '../contracts/index.js';
 export const Delegate = method({
-    description: 'Issue one strictly attenuated credential from this authenticated Identity.',
+    description: 'Issue one strictly attenuated credential from the authenticated execution principal.',
     auth: 'authenticated',
     input: delegateInput,
     output: delegateOutput,
-    inheritance: 'default',
+    static: true,
 });

package/dist/schema/kernel/syscalls/declarations/index.d.ts

@@ -222,7 +222,7 @@ export declare const Functions: Readonly<{
                 next?: string | undefined;
             };
         };
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
     mutate: builder.Function<builder.CallableProjection<{
         ast: {
             format: "astrale.graph.mutation";
@@ -379,6 +379,29 @@ export declare const Functions: Readonly<{
                 };
             })[];
             operations: ({
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                slug: unknown;
+                props?: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                } | undefined;
+            } | {
+                op: "edge.update";
+                edge: {
+                    source: string;
+                    target: string;
+                    class: string;
+                };
+                props: {
+                    set: Record<string, unknown>;
+                    unset: string[];
+                };
+            } | {
                 op: "node.create";
                 as: string;
                 class: string;
@@ -406,29 +429,6 @@ export declare const Functions: Readonly<{
                 };
                 slug?: unknown;
                 props: Record<string, unknown>;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                slug: unknown;
-                props?: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                } | undefined;
-            } | {
-                op: "edge.update";
-                edge: {
-                    source: string;
-                    target: string;
-                    class: string;
-                };
-                props: {
-                    set: Record<string, unknown>;
-                    unset: string[];
-                };
             } | {
                 op: "edge.delete";
                 edge: {
@@ -447,7 +447,7 @@ export declare const Functions: Readonly<{
         readonly value: {
             createdNodes: Record<string, string>;
         };
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
     register: builder.Function<builder.CallableProjection<{
         idempotencyKey: string;
         identities: ({
@@ -469,7 +469,7 @@ export declare const Functions: Readonly<{
                 sub: string;
             }[];
         };
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
     install: builder.Function<builder.CallableProjection<{
         operation: string;
         domains: ({
@@ -490,13 +490,13 @@ export declare const Functions: Readonly<{
         })[];
     }, {
         readonly mode: 'binary';
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
     introspect: builder.Function<builder.CallableProjection<{
         kind: "bundle" | "inspect";
         origin: string;
     }, {
         readonly mode: 'binary';
-    }, "authenticated", false, "default">>;
+    }, "authenticated", false, false>>;
     uninstall: builder.Function<builder.CallableProjection<{
         operation: string;
         domains: string[];
@@ -537,7 +537,7 @@ export declare const Functions: Readonly<{
                 } | undefined;
             }[];
         };
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
     journal: builder.Function<builder.CallableProjection<{
         invocation?: {
             source: string;
@@ -565,17 +565,18 @@ export declare const Functions: Readonly<{
             cursor?: string | undefined;
             gap?: unknown;
         };
-    }, "authorized", false, "default">>;
+    }, "authorized", false, false>>;
 }>;
 export declare const IdentityMethods: Readonly<{
     delegate: builder.Method<builder.CallableProjection<{
+        principal: string;
         audience: string;
         ttlSeconds: number;
         attenuation: unknown;
     }, {
         readonly mode: 'value';
         readonly value: string;
-    }, "authenticated", false, "default">>;
+    }, "authenticated", true, false>>;
     can: builder.Method<builder.CallableProjection<{
         policy: string;
         object: string;
@@ -584,7 +585,7 @@ export declare const IdentityMethods: Readonly<{
         readonly value: {
             allowed: boolean;
         };
-    }, "authenticated", true, "default">>;
+    }, "authenticated", true, false>>;
     whoami: builder.Method<builder.CallableProjection<Record<string, never>, {
         readonly mode: 'value';
         readonly value: {
@@ -605,7 +606,7 @@ export declare const IdentityMethods: Readonly<{
                 op: "exists";
             })[];
         };
-    }, "authenticated", true, "default">>;
+    }, "authenticated", true, false>>;
     whois: builder.Method<builder.CallableProjection<{
         iss: string;
         sub: string;
@@ -629,7 +630,7 @@ export declare const IdentityMethods: Readonly<{
                 op: "exists";
             })[];
         } | null;
-    }, "authorized", true, "default">>;
+    }, "authorized", true, false>>;
     mint: builder.Method<builder.CallableProjection<{
         audience?: string | undefined;
         ttlSeconds: number;
@@ -637,12 +638,16 @@ export declare const IdentityMethods: Readonly<{
     }, {
         readonly mode: 'value';
         readonly value: string;
-    }, "authenticated", true, "default">>;
+    }, "authenticated", true, false>>;
 }>;
 export declare const FunctionMethods: Readonly<{
     admit: builder.Method<builder.CallableProjection<{
         call: {
-            target: string;
+            target: string | {
+                callable: string;
+                instance?: string | undefined;
+                revision?: string | undefined;
+            };
             input: unknown;
         };
         credential?: string | undefined;
@@ -652,7 +657,7 @@ export declare const FunctionMethods: Readonly<{
             callable: string;
             receiver?: string | undefined;
         };
-    }, "authenticated", true, "sealed">>;
+    }, "authenticated", true, false>>;
 }>;
 export declare const ViewMethods: Readonly<{
     resolve: builder.Method<builder.CallableProjection<{
@@ -687,5 +692,6 @@ export declare const ViewMethods: Readonly<{
                 revision: string;
             }[];
         };
-    }, "authorized", true, "sealed">>;
+    }, "authorized", true, false>>;
 }>;
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/index.js

@@ -34,3 +34,4 @@ export const FunctionMethods = Object.freeze({
 export const ViewMethods = Object.freeze({
     resolve: ViewResolve,
 });
+export { CanUseSyscall } from './use-policy.js';

package/dist/schema/kernel/syscalls/declarations/install.d.ts

@@ -19,4 +19,4 @@ export declare const Install: builder.Function<builder.CallableProjection<{
     })[];
 }, {
     readonly mode: 'binary';
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/install.js

@@ -1,8 +1,10 @@
 import { func, output } from '@astrale-os/kernel-dsl/v1';
 import { installInput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Install = func({
     description: 'Authorize and atomically converge a non-empty set of exact ready Domain generations.',
     auth: 'authorized',
+    policy: usePolicy(() => Install),
     input: installInput,
     output: output.binary(),
 });

package/dist/schema/kernel/syscalls/declarations/introspect.d.ts

@@ -4,4 +4,4 @@ export declare const Introspect: builder.Function<builder.CallableProjection<{
     origin: string;
 }, {
     readonly mode: 'binary';
-}, "authenticated", false, "default">>;
+}, "authenticated", false, false>>;

package/dist/schema/kernel/syscalls/declarations/journal.d.ts

@@ -26,4 +26,4 @@ export declare const Journal: builder.Function<builder.CallableProjection<{
         cursor?: string | undefined;
         gap?: unknown;
     };
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/journal.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { journalInput, journalOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Journal = func({
     description: 'Read one authorized page of semantic operations from the kernel journal.',
     auth: 'authorized',
+    policy: usePolicy(() => Journal),
     input: journalInput,
     output: journalOutput,
 });

package/dist/schema/kernel/syscalls/declarations/mint.d.ts

@@ -6,4 +6,4 @@ export declare const Mint: builder.Method<builder.CallableProjection<{
 }, {
     readonly mode: 'value';
     readonly value: string;
-}, "authenticated", true, "default">>;
+}, "authenticated", true, false>>;

package/dist/schema/kernel/syscalls/declarations/mint.js

@@ -6,5 +6,5 @@ export const Mint = method({
     input: mintInput,
     output: mintOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/mutate.d.ts

@@ -155,29 +155,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
         })[];
         operations: ({
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            slug: unknown;
-            props?: {
-                set: Record<string, unknown>;
-                unset: string[];
-            } | undefined;
-        } | {
-            op: "edge.update";
-            edge: {
-                source: string;
-                target: string;
-                class: string;
-            };
-            props: {
-                set: Record<string, unknown>;
-                unset: string[];
-            };
-        } | {
             op: "node.create";
             as: string;
             class: string;
@@ -205,6 +182,29 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
             };
             slug?: unknown;
             props: Record<string, unknown>;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            slug: unknown;
+            props?: {
+                set: Record<string, unknown>;
+                unset: string[];
+            } | undefined;
+        } | {
+            op: "edge.update";
+            edge: {
+                source: string;
+                target: string;
+                class: string;
+            };
+            props: {
+                set: Record<string, unknown>;
+                unset: string[];
+            };
         } | {
             op: "edge.delete";
             edge: {
@@ -223,4 +223,4 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
     readonly value: {
         createdNodes: Record<string, string>;
     };
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/mutate.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { mutateInput, mutateOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Mutate = func({
     description: 'Validate, authorize, and commit one atomic graph mutation.',
     auth: 'authorized',
+    policy: usePolicy(() => Mutate),
     input: mutateInput,
     output: mutateOutput,
 });

package/dist/schema/kernel/syscalls/declarations/query.d.ts

@@ -221,4 +221,4 @@ export declare const Query: builder.Function<builder.CallableProjection<{
             next?: string | undefined;
         };
     };
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/query.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { queryInput, queryOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Query = func({
     description: 'Execute one finite authorized graph query.',
     auth: 'authorized',
+    policy: usePolicy(() => Query),
     input: queryInput,
     output: queryOutput,
 });

package/dist/schema/kernel/syscalls/declarations/register.d.ts

@@ -20,4 +20,4 @@ export declare const Register: builder.Function<builder.CallableProjection<{
             sub: string;
         }[];
     };
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/register.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { registerInput, registerOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Register = func({
     description: 'Atomically establish credential-evidenced, write-once Authentication on existing Identity-bearing Nodes.',
     auth: 'authorized',
+    policy: usePolicy(() => Register),
     input: registerInput,
     output: registerOutput,
 });

package/dist/schema/kernel/syscalls/declarations/uninstall.d.ts

@@ -39,4 +39,4 @@ export declare const Uninstall: builder.Function<builder.CallableProjection<{
             } | undefined;
         }[];
     };
-}, "authorized", false, "default">>;
+}, "authorized", false, false>>;

package/dist/schema/kernel/syscalls/declarations/uninstall.js

@@ -1,8 +1,10 @@
 import { func } from '@astrale-os/kernel-dsl/v1';
 import { uninstallInput, uninstallOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Uninstall = func({
     description: 'Durably uninstall one Domain installation epoch and return its terminal receipt.',
     auth: 'authorized',
+    policy: usePolicy(() => Uninstall),
     input: uninstallInput,
     output: uninstallOutput,
 });

package/dist/schema/kernel/syscalls/declarations/use-policy.d.ts

@@ -0,0 +1,4 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export declare const CanUseSyscall: builder.Policy;
+export declare function usePolicy(callable: () => builder.Function | builder.Method): builder.CallablePolicyBuilder;

package/dist/schema/kernel/syscalls/declarations/use-policy.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/kernel-dsl/v1';
+import { CanUse } from '../../../authority/index.js';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export const CanUseSyscall = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => CanUse, target: object }),
+});
+export function usePolicy(callable) {
+    return ({ check, ref }) => check(CanUseSyscall, ref(callable));
+}

package/dist/schema/kernel/syscalls/declarations/view-resolve.d.ts

@@ -31,4 +31,4 @@ export declare const ViewResolve: builder.Method<builder.CallableProjection<{
             revision: string;
         }[];
     };
-}, "authorized", true, "sealed">>;
+}, "authorized", true, false>>;

package/dist/schema/kernel/syscalls/declarations/view-resolve.js

@@ -1,10 +1,12 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { viewResolveInput, viewResolveOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const ViewResolve = method({
     description: 'Resolve the installed View declarations applicable to one authorized graph target.',
     auth: 'authorized',
+    policy: usePolicy(() => ViewResolve),
     input: viewResolveInput,
     output: viewResolveOutput,
     static: true,
-    inheritance: 'sealed',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/whoami.d.ts

@@ -19,4 +19,4 @@ export declare const Whoami: builder.Method<builder.CallableProjection<Record<st
             op: "exists";
         })[];
     };
-}, "authenticated", true, "default">>;
+}, "authenticated", true, false>>;

package/dist/schema/kernel/syscalls/declarations/whoami.js

@@ -6,5 +6,5 @@ export const Whoami = method({
     input: whoamiInput,
     output: whoamiOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/whois.d.ts

@@ -22,4 +22,4 @@ export declare const Whois: builder.Method<builder.CallableProjection<{
             op: "exists";
         })[];
     } | null;
-}, "authorized", true, "default">>;
+}, "authorized", true, false>>;

package/dist/schema/kernel/syscalls/declarations/whois.js

@@ -1,10 +1,12 @@
 import { method } from '@astrale-os/kernel-dsl/v1';
 import { whoisInput, whoisOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
 export const Whois = method({
     description: 'Resolve one issuer-and-subject Identity.',
     auth: 'authorized',
+    policy: usePolicy(() => Whois),
     input: whoisInput,
     output: whoisOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/descriptors/function.d.ts

@@ -2,7 +2,11 @@ import type { ClassRef } from '@astrale-os/kernel-dsl/v1';
 import { type MethodSyscall } from './model.js';
 declare const Admit: import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     call: {
-        target: string;
+        target: string | {
+            callable: string;
+            instance?: string | undefined;
+            revision?: string | undefined;
+        };
         input: unknown;
     };
     credential?: string | undefined;
@@ -12,7 +16,7 @@ declare const Admit: import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
         callable: string;
         receiver?: string | undefined;
     };
-}, true, "sealed", "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Function.method.admit"> & {
+}, true, false, "authenticated", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Function.method.admit"> & {
     readonly name: "admit";
 };
 export declare const admit: MethodSyscall<ClassRef<'Function'> & {