@astrale-os/kernel-core 0.9.0-beta.53 → 0.9.0-beta.55

package/dist/auth/authority/admission/admission.d.ts

@@ -9,3 +9,5 @@ export declare const limits: {
 };
 export declare const MAX_BOOLEAN_OPERANDS: 512;
 export declare function admitAuthorityExpr(input: portable.Value): AuthorityExpr;
+/** Internal constructor admission: the outer Grant binds subject, but no local escapes into it. */
+export declare function admitGrantBody(input: portable.Value): AuthorityExpr;

package/dist/auth/authority/admission/admission.js

@@ -2,6 +2,7 @@ import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isNodeId } from '../../../graph/node/index.js';
 import { AuthValueError } from '../../error.js';
 import { accept as acceptGrant } from '../../grant/index.js';
+import { ownsExpression } from '../ownership.optimization.js';
 export const limits = Object.freeze({
     expressionDepth: 64,
     operandsPerExpression: 512,
@@ -13,9 +14,15 @@ export const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
 export function admitAuthorityExpr(input) {
     return admit(input, '/predicate', new Set(), false, 0);
 }
+/** Internal constructor admission: the outer Grant binds subject, but no local escapes into it. */
+export function admitGrantBody(input) {
+    return admit(input, '/predicate/where', new Set(), true, 1);
+}
 function admit(input, path, locals, subjectBound, depth) {
     if (depth > limits.expressionDepth)
         invalid(path, 'Authority expression exceeds its depth limit');
+    if (locals.size === 0 && ownsExpression(input, limits.expressionDepth - depth))
+        return input;
     const value = record(input, path);
     switch (value.op) {
         case 'true':

package/dist/auth/authority/admission/index.d.ts

@@ -1 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
+export { admitAuthorityExpr, admitGrantBody, limits } from './admission.js';

package/dist/auth/authority/admission/index.js

@@ -1 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
+export { admitAuthorityExpr, admitGrantBody, limits } from './admission.js';

package/dist/auth/authority/index.d.ts

@@ -1,5 +1,7 @@
 export { accept } from './accept.js';
 export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareGrantBody } from './prepare-grant-body.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';

package/dist/auth/authority/index.js

@@ -1,5 +1,7 @@
 export { accept } from './accept.js';
 export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareGrantBody } from './prepare-grant-body.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';

package/dist/auth/authority/normalization/index.d.ts

@@ -1 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
+export { canonicalize, canonicalizeAdmitted, normalizeGrantBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/index.js

@@ -1 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
+export { canonicalize, canonicalizeAdmitted, normalizeGrantBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/normalize.d.ts

@@ -2,3 +2,5 @@ import type { AuthorityExpr, AuthorityPredicate } from '../language/index.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export declare function canonicalize(expr: AuthorityExpr): AuthorityPredicate;
 export declare function canonicalizeAdmitted(expr: AuthorityExpr): AuthorityPredicate;
+/** Internal scoped normalization; this body is not a closed owned authority expression. */
+export declare function normalizeGrantBodyAdmitted(expr: AuthorityExpr): AuthorityExpr;

package/dist/auth/authority/normalization/normalize.js

@@ -4,10 +4,13 @@ import { AuthValueError } from '../../error.js';
 import { canonicalize as canonicalizeGrant } from '../../grant/index.js';
 import { admitAuthorityExpr, limits } from '../admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from '../language/index.js';
-import { ownCanonical } from '../ownership.optimization.js';
+import { ownCanonical, ownedExpression, ownsExpression } from '../ownership.optimization.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export function canonicalize(expr) {
-    const admitted = admitAuthorityExpr(portable.accept(expr));
+    const owned = ownedExpression(expr);
+    if (owned !== undefined)
+        return owned;
+    const admitted = admitAuthorityExpr(portable.acceptForRead(expr));
     return canonicalizeAdmitted(admitted);
 }
 export function canonicalizeAdmitted(expr) {
@@ -16,7 +19,13 @@ export function canonicalizeAdmitted(expr) {
         predicate: normalize(expr, '/predicate', new Set(), false),
     }));
 }
+/** Internal scoped normalization; this body is not a closed owned authority expression. */
+export function normalizeGrantBodyAdmitted(expr) {
+    return normalize(expr, '/predicate/where', new Set(), true);
+}
 function normalize(expr, path, locals, subjectBound) {
+    if (ownsExpression(expr))
+        return expr;
     switch (expr.op) {
         case 'true':
         case 'false':

package/dist/auth/authority/ownership.optimization.d.ts

@@ -1,4 +1,8 @@
-import type { AuthorityPredicate } from './language/index.js';
+import { type AuthorityExpr, type AuthorityPredicate } from './language/index.js';
 /** Called only by the owner after detachment, admission and immutable normalization. */
 export declare function ownCanonical(predicate: AuthorityPredicate): AuthorityPredicate;
+/** Closed subprograms retain their lexical proof when composed outside another local binder. */
+export declare function ownsExpression(expression: unknown, remainingDepth?: number): boolean;
+/** Rewrap only owner-proven closed expressions, never a leaf borrowed from a lexical binder. */
+export declare function ownedExpression(expression: AuthorityExpr): AuthorityPredicate | undefined;
 export declare function ownsCanonical(input: unknown): boolean;

package/dist/auth/authority/ownership.optimization.js

@@ -1,6 +1,9 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
+import { AUTHORITY_PREDICATE_VERSION, } from './language/index.js';
 // Static construction provenance only. No evaluated authority or graph facts live here.
 const canonical = new WeakSet();
+const expressions = new WeakMap();
+const depths = new WeakMap();
 /** Called only by the owner after detachment, admission and immutable normalization. */
 export function ownCanonical(predicate) {
     // Carry immutable structural provenance through containing Plans as well as Core calls.
@@ -8,6 +11,10 @@ export function ownCanonical(predicate) {
     // constructor's expression fits. In that case retain Core ownership only: a later crossing
     // still applies its own limits, without adding a new constructor failure here.
     try {
+        predicate = Object.freeze({
+            ...predicate,
+            predicate: portable.acceptImmutable(predicate.predicate),
+        });
         predicate = portable.acceptImmutable(predicate);
     }
     catch (cause) {
@@ -15,8 +22,62 @@ export function ownCanonical(predicate) {
             throw cause;
     }
     canonical.add(predicate);
+    retainClosedExpression(predicate.predicate);
+    expressions.set(predicate.predicate, predicate);
     return predicate;
 }
+/** Closed subprograms retain their lexical proof when composed outside another local binder. */
+export function ownsExpression(expression, remainingDepth = Infinity) {
+    if (expression === null ||
+        typeof expression !== 'object' ||
+        !expressions.has(expression))
+        return false;
+    if (remainingDepth === Infinity)
+        return true;
+    const value = expression;
+    return expressionDepth(value) <= remainingDepth;
+}
+function expressionDepth(expression) {
+    const known = depths.get(expression);
+    if (known !== undefined)
+        return known;
+    const children = expression.op === 'all' || expression.op === 'any'
+        ? expression.predicates
+        : expression.op === 'not'
+            ? [expression.predicate]
+            : expression.op === 'grant' || expression.op === 'exists'
+                ? [expression.where]
+                : [];
+    const depth = children.length === 0 ? 0 : 1 + Math.max(...children.map(expressionDepth));
+    depths.set(expression, depth);
+    return depth;
+}
+/** Rewrap only owner-proven closed expressions, never a leaf borrowed from a lexical binder. */
+export function ownedExpression(expression) {
+    const known = expressions.get(expression);
+    if (known === undefined)
+        return undefined;
+    if (known !== null)
+        return known;
+    const predicate = ownCanonical(Object.freeze({
+        version: AUTHORITY_PREDICATE_VERSION,
+        predicate: expression,
+    }));
+    expressions.set(expression, predicate);
+    return predicate;
+}
+function retainClosedExpression(expression) {
+    if (expressions.has(expression))
+        return;
+    expressions.set(expression, null);
+    if (expression.op === 'all' || expression.op === 'any') {
+        for (const child of expression.predicates)
+            retainClosedExpression(child);
+    }
+    else if (expression.op === 'not')
+        retainClosedExpression(expression.predicate);
+    // A complete Grant or existential is closed, but its body may depend on its binder.
+}
 export function ownsCanonical(input) {
     return input !== null && typeof input === 'object' && canonical.has(input);
 }

package/dist/auth/authority/prepare-grant-body.d.ts

@@ -0,0 +1,4 @@
+import type { Grant } from '../grant/index.js';
+import type { AuthorityExpr, AuthorityPredicate } from './language/index.js';
+/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
+export declare function prepareGrantBody(where: AuthorityExpr): (grant: Grant) => AuthorityPredicate;

package/dist/auth/authority/prepare-grant-body.js

@@ -0,0 +1,27 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { accept as acceptGrant, canonicalize as canonicalizeGrant } from '../grant/index.js';
+import { admitGrantBody } from './admission/index.js';
+import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
+import { normalizeGrantBodyAdmitted } from './normalization/index.js';
+import { ownCanonical } from './ownership.optimization.js';
+/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
+export function prepareGrantBody(where) {
+    const admitted = admitGrantBody(portable.acceptForRead(where));
+    const body = portable.acceptImmutable(normalizeGrantBodyAdmitted(admitted));
+    return grantBinder(body);
+}
+// A distinct closure scope retains only the normalized body, never an initial Grant or caller input.
+function grantBinder(where) {
+    return (grant) => {
+        // Charge the entire expression on every binding, including the body and its outer container.
+        const value = portable.acceptForRead({ op: 'grant', grant, where });
+        return ownCanonical(Object.freeze({
+            version: AUTHORITY_PREDICATE_VERSION,
+            predicate: Object.freeze({
+                op: 'grant',
+                grant: canonicalizeGrant(acceptGrant(value.grant)),
+                where,
+            }),
+        }));
+    };
+}

package/dist/callable/contract/body.d.ts

@@ -0,0 +1,10 @@
+/** One root invocation's already bounded, single-consumer binary request body. */
+export interface BinaryRequestBody {
+    readonly body: ReadableStream<Uint8Array>;
+    readonly length: number;
+}
+/** The streamed request ended early or exceeded its declared Content-Length. */
+export declare class BinaryBodyLengthError extends Error {
+    readonly name = "BinaryBodyLengthError";
+    constructor();
+}

package/dist/callable/contract/body.js

@@ -0,0 +1,7 @@
+/** The streamed request ended early or exceeded its declared Content-Length. */
+export class BinaryBodyLengthError extends Error {
+    name = 'BinaryBodyLengthError';
+    constructor() {
+        super('Binary request length mismatch.');
+    }
+}

package/dist/callable/contract/index.d.ts

@@ -1,5 +1,6 @@
 export type { CallOf } from './call.js';
+export { BinaryBodyLengthError, type BinaryRequestBody } from './body.js';
 export type { InputOf } from './input.js';
-export type { BinaryOutput, BufferedBinaryResult, OutputContractOf, OutputOf, StreamingBinaryResult, TypedCallableOutput, } from './output.js';
+export type { BinaryOutput, BinaryDeliveryBudget, BufferedBinaryResult, OutputContractOf, OutputOf, StreamingBinaryResult, TypedCallableOutput, } from './output.js';
 export type { CallableSignature } from './signature.js';
 export type { Callable, SignatureOf } from './witness.js';

package/dist/callable/contract/index.js

@@ -1 +1 @@
-export {};
+export { BinaryBodyLengthError } from './body.js';

package/dist/callable/contract/output.d.ts

@@ -1,4 +1,9 @@
 import type { SignatureOf } from './witness.js';
+/** Optional owner-selected lifetime for a large HTTP binary result. */
+export interface BinaryDeliveryBudget {
+    readonly maximumDurationMs: number;
+    readonly idleTimeoutMs: number;
+}
 export interface BufferedBinaryResult {
     readonly body: Uint8Array;
     readonly mediaType: string;
@@ -7,6 +12,9 @@ export interface BufferedBinaryResult {
 }
 export interface StreamingBinaryResult {
     readonly body: AsyncIterable<Uint8Array>;
+    /** Exact byte length; HTTP aborts delivery if the stream differs. */
+    readonly length?: number;
+    readonly delivery?: BinaryDeliveryBudget;
     readonly mediaType: string;
     readonly status?: number;
     readonly headers?: Readonly<Record<string, string>>;

package/dist/callable/index.d.ts

@@ -1,2 +1,3 @@
-export type { BinaryOutput, BufferedBinaryResult, Callable, CallableSignature, CallOf, InputOf, OutputContractOf, OutputOf, SignatureOf, StreamingBinaryResult, TypedCallableOutput, } from './contract/index.js';
+export { BinaryBodyLengthError } from './contract/index.js';
+export type { BinaryOutput, BinaryDeliveryBudget, BinaryRequestBody, BufferedBinaryResult, Callable, CallableSignature, CallOf, InputOf, OutputContractOf, OutputOf, SignatureOf, StreamingBinaryResult, TypedCallableOutput, } from './contract/index.js';
 export { Target, targetPath, type Call, type CallableResult } from './invocation/index.js';

package/dist/callable/index.js

@@ -1 +1,2 @@
+export { BinaryBodyLengthError } from './contract/index.js';
 export { Target, targetPath } from './invocation/index.js';