@astrale-os/kernel-core 0.9.0-beta.6 → 0.9.0-beta.60

package/dist/auth/attestation/admission.d.ts

@@ -1,4 +1,3 @@
 import type { Attestation } from './attestation.js';
 /** Admit a self-relative Attestation claim without establishing signer trust. */
 export declare function accept(input: unknown): Attestation;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/attestation/admission.js

@@ -1,4 +1,4 @@
-import { AuthValueError } from '../error/index.js';
+import { AuthValueError } from '../error.js';
 /** Admit a self-relative Attestation claim without establishing signer trust. */
 export function accept(input) {
     try {
@@ -41,4 +41,3 @@ function exact(input, expected, path) {
 function invalid(path) {
     throw new AuthValueError('AUTH_ATTESTATION_INVALID', 'Expected a self Attestation', path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/attestation/attestation.d.ts

@@ -3,4 +3,3 @@ import type { SelfIdentityExpr } from '../expression/index.js';
 export interface Attestation {
     readonly expr: SelfIdentityExpr;
 }
-//# sourceMappingURL=attestation.d.ts.map

package/dist/auth/attestation/attestation.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=attestation.js.map

package/dist/auth/attestation/index.d.ts

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export type { Attestation } from './attestation.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/attestation/index.js

@@ -1,2 +1 @@
 export { accept } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/accept.d.ts

@@ -1,4 +1,3 @@
 import type { AuthorityPredicate } from './language/index.js';
 /** Re-admit one persisted or crossing canonical authority predicate. */
 export declare function accept(input: unknown): AuthorityPredicate;
-//# sourceMappingURL=accept.d.ts.map

package/dist/auth/authority/accept.js

@@ -1,10 +1,14 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { AuthValueError } from '../error/index.js';
+import { AuthValueError } from '../error.js';
 import { admitAuthorityExpr } from './admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
 import { canonicalizeAdmitted } from './normalization/index.js';
+import { ownsCanonical } from './ownership.optimization.js';
 /** Re-admit one persisted or crossing canonical authority predicate. */
 export function accept(input) {
+    // The owner retains only deeply immutable, detached canonical predicates.
+    if (ownsCanonical(input))
+        return input;
     try {
         const admitted = portable.accept(input);
         if (admitted === null || Array.isArray(admitted) || typeof admitted !== 'object') {
@@ -35,4 +39,3 @@ function compare(left, right) {
 function invalid(path, message) {
     throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
 }
-//# sourceMappingURL=accept.js.map

package/dist/auth/authority/admission/admission.d.ts

@@ -4,8 +4,11 @@ export declare const limits: {
     readonly expressionDepth: 64;
     readonly operandsPerExpression: 512;
     readonly localsPerExpression: 64;
+    readonly classesPerLocal: 1024;
+    readonly classesPerRelation: 1024;
     readonly repeatMaximum: 16;
 };
 export declare const MAX_BOOLEAN_OPERANDS: 512;
 export declare function admitAuthorityExpr(input: portable.Value): AuthorityExpr;
-//# sourceMappingURL=admission.d.ts.map
+/** Internal constructor admission: the outer Grant binds subject, but no local escapes into it. */
+export declare function admitGrantBody(input: portable.Value): AuthorityExpr;

package/dist/auth/authority/admission/admission.js

@@ -1,20 +1,29 @@
-import { schema } from '@astrale-os/kernel-dsl/v1';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isNodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { accept as acceptGrant } from '../../grant/index.js';
+import { ownsExpression } from '../ownership.optimization.js';
 export const limits = Object.freeze({
     expressionDepth: 64,
     operandsPerExpression: 512,
     localsPerExpression: 64,
+    classesPerLocal: 1024,
+    classesPerRelation: 1024,
     repeatMaximum: 16,
 });
 export const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
 export function admitAuthorityExpr(input) {
     return admit(input, '/predicate', new Set(), false, 0);
 }
+/** Internal constructor admission: the outer Grant binds subject, but no local escapes into it. */
+export function admitGrantBody(input) {
+    return admit(input, '/predicate/where', new Set(), true, 1);
+}
 function admit(input, path, locals, subjectBound, depth) {
     if (depth > limits.expressionDepth)
         invalid(path, 'Authority expression exceeds its depth limit');
+    if (locals.size === 0 && ownsExpression(input, limits.expressionDepth - depth))
+        return input;
     const value = record(input, path);
     switch (value.op) {
         case 'true':
@@ -43,15 +52,22 @@ function admit(input, path, locals, subjectBound, depth) {
                 grant: acceptGrant(value.grant),
                 where: admit(required(value.where, `${path}/where`), `${path}/where`, locals, true, depth + 1),
             };
+        case 'same-node':
+            exact(value, ['op', 'left', 'right'], path);
+            return {
+                op: 'same-node',
+                left: term(value.left, `${path}/left`, locals, subjectBound),
+                right: term(value.right, `${path}/right`, locals, subjectBound),
+            };
         case 'related': {
             const hasRepeat = Object.hasOwn(value, 'repeat');
             exact(value, hasRepeat
-                ? ['class', 'op', 'repeat', 'source', 'target']
-                : ['class', 'op', 'source', 'target'], path);
+                ? ['classes', 'op', 'repeat', 'source', 'target']
+                : ['classes', 'op', 'source', 'target'], path);
             return {
                 op: 'related',
                 source: term(value.source, `${path}/source`, locals, subjectBound),
-                class: edgeClassRef(value.class, `${path}/class`),
+                classes: array(value.classes, `${path}/classes`, 1, limits.classesPerRelation).map((entry, index) => edgeClassRef(entry, `${path}/classes/${index}`)),
                 target: term(value.target, `${path}/target`, locals, subjectBound),
                 ...(hasRepeat ? { repeat: repeat(value.repeat, `${path}/repeat`) } : {}),
             };
@@ -94,13 +110,6 @@ function admit(input, path, locals, subjectBound, depth) {
                 class: classRef(value.class, `${path}/class`),
                 evidence: evidence(value.evidence, `${path}/evidence`),
             };
-        case 'domain-control':
-            exact(value, ['identity', 'op', 'origin'], path);
-            return {
-                op: 'domain-control',
-                identity: term(value.identity, `${path}/identity`, locals, subjectBound),
-                origin: domainOrigin(value.origin, `${path}/origin`),
-            };
         default:
             invalid(`${path}/op`, 'Unsupported authority operation');
     }
@@ -125,6 +134,16 @@ function term(input, path, locals, subjectBound) {
         case 'domain':
             exact(value, ['kind', 'origin'], path);
             return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
+        case 'ref': {
+            exact(value, ['kind', 'ref'], path);
+            const ref = absoluteRef(value.ref, `${path}/ref`);
+            if (ref.kind === 'core')
+                return { kind: 'ref', ref: coreRef(value.ref, `${path}/ref`) };
+            if (!['class', 'function', 'policy', 'view'].includes(ref.kind))
+                invalid(`${path}/ref/kind`, 'Expected a projected Schema member');
+            definitionName(ref.name, `${path}/ref/name`);
+            return { kind: 'ref', ref: ref };
+        }
         case 'core':
             exact(value, ['kind', 'ref'], path);
             return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };
@@ -146,8 +165,21 @@ function term(input, path, locals, subjectBound) {
 }
 function localDeclaration(input, path) {
     const value = record(input, path);
-    exact(value, ['class', 'id'], path);
-    return { id: localId(value.id, `${path}/id`), class: nodeClassRef(value.class, `${path}/class`) };
+    const id = localId(value.id, `${path}/id`);
+    if (value.kind === 'any') {
+        exact(value, ['id', 'kind'], path);
+        return { id, kind: 'any' };
+    }
+    if (value.kind === 'classes') {
+        exact(value, ['classes', 'id', 'kind'], path);
+        const classes = array(value.classes, `${path}/classes`, 1, limits.classesPerLocal).map((entry, index) => nodeClassRef(entry, `${path}/classes/${index}`));
+        return {
+            id,
+            kind: 'classes',
+            classes: classes,
+        };
+    }
+    invalid(`${path}/kind`, 'Expected any or classes local selector');
 }
 function repeat(input, path) {
     const value = record(input, path);
@@ -193,19 +225,19 @@ function absoluteRef(input, path) {
     return { origin, kind: value.kind, name: value.name };
 }
 function definitionName(input, path) {
-    if (!schema.patterns.memberName.test(input))
+    if (!patterns.memberName.test(input))
         invalid(path, 'Expected a Definition member name');
 }
 function coreRef(input, path) {
     const value = absoluteRef(input, path);
     if (value.kind !== 'core')
         invalid(`${path}/kind`, 'Expected core');
-    if (!schema.patterns.coreSlug.test(value.name))
+    if (!patterns.coreSlug.test(value.name))
         invalid(`${path}/name`, 'Expected a Core slug');
     return value;
 }
 function domainOrigin(input, path) {
-    if (typeof input !== 'string' || !schema.patterns.origin.test(input)) {
+    if (typeof input !== 'string' || !patterns.origin.test(input)) {
         invalid(path, 'Expected a canonical Domain origin');
     }
     return input;
@@ -261,4 +293,3 @@ function compare(left, right) {
 function invalid(path, message) {
     throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/authority/admission/index.d.ts

@@ -1,2 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
-//# sourceMappingURL=index.d.ts.map
+export { admitAuthorityExpr, admitGrantBody, limits } from './admission.js';

package/dist/auth/authority/admission/index.js

@@ -1,2 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
-//# sourceMappingURL=index.js.map
+export { admitAuthorityExpr, admitGrantBody, limits } from './admission.js';

package/dist/auth/authority/canonical.d.ts

@@ -0,0 +1,2 @@
+/** Canonical form, not an authorization decision. Crossing values still require admission. */
+export declare function isCanonical(input: unknown): boolean;

package/dist/auth/authority/canonical.js

@@ -0,0 +1,15 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { accept } from './accept.js';
+import { ownsCanonical } from './ownership.optimization.js';
+/** Canonical form, not an authorization decision. Crossing values still require admission. */
+export function isCanonical(input) {
+    if (ownsCanonical(input))
+        return true;
+    try {
+        const canonical = accept(input);
+        return portable.json.serialize(canonical) === portable.json.serialize(input);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/authority/index.d.ts

@@ -1,6 +1,8 @@
 export { accept } from './accept.js';
+export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareGrantBody } from './prepare-grant-body.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
 export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './language/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/index.js

@@ -1,5 +1,7 @@
 export { accept } from './accept.js';
+export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareGrantBody } from './prepare-grant-body.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/language/index.d.ts

@@ -1,3 +1,2 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
 export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './predicate.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/authority/language/index.js

@@ -1,2 +1 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/authority/language/predicate.d.ts

@@ -1,10 +1,10 @@
-import type { Key, schema } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, FunctionRef, PolicyRef, ViewRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { NodeId } from '../../../graph/node/index.js';
 import type { Grant } from '../../grant/index.js';
-export declare const AUTHORITY_PREDICATE_VERSION: 5;
+export declare const AUTHORITY_PREDICATE_VERSION: 9;
 export type Operation = 'create' | 'read' | 'traverse' | 'update' | 'delete';
 export type Input = 'object' | 'source' | 'target';
-export type ClassRef = schema.ClassRef;
+export type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
 export type Term = {
     readonly kind: 'input';
     readonly input: Input;
@@ -19,7 +19,10 @@ export type Term = {
     readonly origin: Key.Origin;
 } | {
     readonly kind: 'core';
-    readonly ref: schema.CoreRef;
+    readonly ref: CoreRef;
+} | {
+    readonly kind: 'ref';
+    readonly ref: ClassRef | FunctionRef | PolicyRef | ViewRef | CoreRef;
 } | {
     readonly kind: 'local';
     readonly id: number;
@@ -30,22 +33,26 @@ export interface Repeat {
     readonly min: number;
     readonly max: number;
 }
-export interface LocalDeclaration {
+export type LocalDeclaration = {
     readonly id: number;
-    readonly class: schema.ClassRef;
-}
-export type Requirement = {
+    readonly kind: 'any';
+} | {
+    readonly id: number;
+    readonly kind: 'classes';
+    readonly classes: readonly [ClassRef, ...ClassRef[]];
+};
+export interface Requirement {
     readonly op: 'class-authority';
     readonly identity: Term;
     readonly operation: Operation;
     readonly class: ClassRef;
     readonly evidence: 'allowed' | 'owner';
-} | {
-    readonly op: 'domain-control';
-    readonly identity: Term;
-    readonly origin: Key.Origin;
-};
+}
 export type AuthorityExpr = {
+    readonly op: 'same-node';
+    readonly left: Term;
+    readonly right: Term;
+} | {
     readonly op: 'true';
 } | {
     readonly op: 'false';
@@ -63,9 +70,10 @@ export type AuthorityExpr = {
     readonly grant: Grant;
     readonly where: AuthorityExpr;
 } | {
+    /** One concrete Class relation extent, reused at every bounded hop. */
     readonly op: 'related';
     readonly source: Term;
-    readonly class: schema.ClassRef;
+    readonly classes: readonly [ClassRef, ...ClassRef[]];
     readonly target: Term;
     readonly repeat?: Repeat;
 } | {
@@ -75,13 +83,12 @@ export type AuthorityExpr = {
 } | {
     readonly op: 'instance-of';
     readonly node: Term;
-    readonly class: schema.ClassRef;
+    readonly class: ClassRef;
 } | {
     readonly op: 'edge-class';
-    readonly class: schema.ClassRef;
+    readonly class: ClassRef;
 } | Requirement;
 export interface AuthorityPredicate {
     readonly version: typeof AUTHORITY_PREDICATE_VERSION;
     readonly predicate: AuthorityExpr;
 }
-//# sourceMappingURL=predicate.d.ts.map

package/dist/auth/authority/language/predicate.js

@@ -1,2 +1 @@
-export const AUTHORITY_PREDICATE_VERSION = 5;
-//# sourceMappingURL=predicate.js.map
+export const AUTHORITY_PREDICATE_VERSION = 9;

package/dist/auth/authority/normalization/index.d.ts

@@ -1,2 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
-//# sourceMappingURL=index.d.ts.map
+export { canonicalize, canonicalizeAdmitted, normalizeGrantBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/index.js

@@ -1,2 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
-//# sourceMappingURL=index.js.map
+export { canonicalize, canonicalizeAdmitted, normalizeGrantBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/normalize.d.ts

@@ -2,4 +2,5 @@ import type { AuthorityExpr, AuthorityPredicate } from '../language/index.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export declare function canonicalize(expr: AuthorityExpr): AuthorityPredicate;
 export declare function canonicalizeAdmitted(expr: AuthorityExpr): AuthorityPredicate;
-//# sourceMappingURL=normalize.d.ts.map
+/** Internal scoped normalization; this body is not a closed owned authority expression. */
+export declare function normalizeGrantBodyAdmitted(expr: AuthorityExpr): AuthorityExpr;

package/dist/auth/authority/normalization/normalize.js

@@ -1,21 +1,31 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
 import { NodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { canonicalize as canonicalizeGrant } from '../../grant/index.js';
 import { admitAuthorityExpr, limits } from '../admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from '../language/index.js';
+import { ownCanonical, ownedExpression, ownsExpression } from '../ownership.optimization.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export function canonicalize(expr) {
-    const admitted = admitAuthorityExpr(portable.accept(expr));
+    const owned = ownedExpression(expr);
+    if (owned !== undefined)
+        return owned;
+    const admitted = admitAuthorityExpr(portable.acceptForRead(expr));
     return canonicalizeAdmitted(admitted);
 }
 export function canonicalizeAdmitted(expr) {
-    return Object.freeze({
+    return ownCanonical(Object.freeze({
         version: AUTHORITY_PREDICATE_VERSION,
         predicate: normalize(expr, '/predicate', new Set(), false),
-    });
+    }));
+}
+/** Internal scoped normalization; this body is not a closed owned authority expression. */
+export function normalizeGrantBodyAdmitted(expr) {
+    return normalize(expr, '/predicate/where', new Set(), true);
 }
 function normalize(expr, path, locals, subjectBound) {
+    if (ownsExpression(expr))
+        return expr;
     switch (expr.op) {
         case 'true':
         case 'false':
@@ -39,11 +49,18 @@ function normalize(expr, path, locals, subjectBound) {
                 grant: canonicalizeGrant(expr.grant),
                 where: normalize(expr.where, `${path}/where`, locals, true),
             });
+        case 'same-node': {
+            const left = normalizeTerm(expr.left);
+            const right = normalizeTerm(expr.right);
+            return Object.freeze(compare(portable.json.serialize(left), portable.json.serialize(right)) <= 0
+                ? { op: 'same-node', left, right }
+                : { op: 'same-node', left: right, right: left });
+        }
         case 'related':
             return Object.freeze({
                 op: 'related',
                 source: normalizeTerm(expr.source),
-                class: Object.freeze({ ...expr.class }),
+                classes: normalizeClasses(expr.classes),
                 target: normalizeTerm(expr.target),
                 ...(expr.repeat === undefined ? {} : { repeat: Object.freeze({ ...expr.repeat }) }),
             });
@@ -71,12 +88,6 @@ function normalize(expr, path, locals, subjectBound) {
                 class: Object.freeze({ ...expr.class }),
                 evidence: expr.evidence,
             });
-        case 'domain-control':
-            return Object.freeze({
-                op: 'domain-control',
-                identity: normalizeTerm(expr.identity),
-                origin: expr.origin,
-            });
     }
 }
 function normalizeBoolean(op, input, path, locals, subjectBound) {
@@ -95,7 +106,8 @@ function normalizeBoolean(op, input, path, locals, subjectBound) {
     for (const expr of flattened) {
         if (expr.op === identity)
             continue;
-        unique.set(portable.json.serialize(expr), expr);
+        // Admission and normalization own these detached subtrees; sorting does not lose that proof.
+        unique.set(portable.json.serializeAdmitted(expr), expr);
     }
     const predicates = [...unique.entries()]
         .sort(([left], [right]) => compare(left, right))
@@ -119,6 +131,8 @@ function normalizeTerm(term) {
             return Object.freeze({ kind: 'class', ref: Object.freeze({ ...term.ref }) });
         case 'domain':
             return Object.freeze({ kind: 'domain', origin: term.origin });
+        case 'ref':
+            return Object.freeze({ kind: 'ref', ref: Object.freeze({ ...term.ref }) });
         case 'core':
             return Object.freeze({ kind: 'core', ref: Object.freeze({ ...term.ref }) });
         case 'local':
@@ -128,9 +142,17 @@ function normalizeTerm(term) {
     }
 }
 function normalizeLocal(local) {
-    return Object.freeze({ id: local.id, class: Object.freeze({ ...local.class }) });
+    if (local.kind === 'any')
+        return Object.freeze({ id: local.id, kind: 'any' });
+    return Object.freeze({ id: local.id, kind: 'classes', classes: normalizeClasses(local.classes) });
+}
+function normalizeClasses(input) {
+    const classes = new Map(input.map((ref) => [classKey(ref), Object.freeze({ ...ref })]));
+    return Object.freeze([...classes.entries()].sort(([left], [right]) => compare(left, right)).map(([, ref]) => ref));
+}
+function classKey(ref) {
+    return `${ref.origin}:${ref.kind}.${ref.name}`;
 }
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=normalize.js.map

package/dist/auth/authority/ownership.optimization.d.ts

@@ -0,0 +1,8 @@
+import { type AuthorityExpr, type AuthorityPredicate } from './language/index.js';
+/** Called only by the owner after detachment, admission and immutable normalization. */
+export declare function ownCanonical(predicate: AuthorityPredicate): AuthorityPredicate;
+/** Closed subprograms retain their lexical proof when composed outside another local binder. */
+export declare function ownsExpression(expression: unknown, remainingDepth?: number): boolean;
+/** Rewrap only owner-proven closed expressions, never a leaf borrowed from a lexical binder. */
+export declare function ownedExpression(expression: AuthorityExpr): AuthorityPredicate | undefined;
+export declare function ownsCanonical(input: unknown): boolean;

package/dist/auth/authority/ownership.optimization.js

@@ -0,0 +1,83 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { AUTHORITY_PREDICATE_VERSION, } from './language/index.js';
+// Static construction provenance only. No evaluated authority or graph facts live here.
+const canonical = new WeakSet();
+const expressions = new WeakMap();
+const depths = new WeakMap();
+/** Called only by the owner after detachment, admission and immutable normalization. */
+export function ownCanonical(predicate) {
+    // Carry immutable structural provenance through containing Plans as well as Core calls.
+    // The normalized envelope can exceed a portable boundary's default budget even when the
+    // constructor's expression fits. In that case retain Core ownership only: a later crossing
+    // still applies its own limits, without adding a new constructor failure here.
+    try {
+        predicate = Object.freeze({
+            ...predicate,
+            predicate: portable.acceptImmutable(predicate.predicate),
+        });
+        predicate = portable.acceptImmutable(predicate);
+    }
+    catch (cause) {
+        if (!(cause instanceof portable.BoundaryError) || cause.code !== 'VALUE_LIMIT')
+            throw cause;
+    }
+    canonical.add(predicate);
+    retainClosedExpression(predicate.predicate);
+    expressions.set(predicate.predicate, predicate);
+    return predicate;
+}
+/** Closed subprograms retain their lexical proof when composed outside another local binder. */
+export function ownsExpression(expression, remainingDepth = Infinity) {
+    if (expression === null ||
+        typeof expression !== 'object' ||
+        !expressions.has(expression))
+        return false;
+    if (remainingDepth === Infinity)
+        return true;
+    const value = expression;
+    return expressionDepth(value) <= remainingDepth;
+}
+function expressionDepth(expression) {
+    const known = depths.get(expression);
+    if (known !== undefined)
+        return known;
+    const children = expression.op === 'all' || expression.op === 'any'
+        ? expression.predicates
+        : expression.op === 'not'
+            ? [expression.predicate]
+            : expression.op === 'grant' || expression.op === 'exists'
+                ? [expression.where]
+                : [];
+    const depth = children.length === 0 ? 0 : 1 + Math.max(...children.map(expressionDepth));
+    depths.set(expression, depth);
+    return depth;
+}
+/** Rewrap only owner-proven closed expressions, never a leaf borrowed from a lexical binder. */
+export function ownedExpression(expression) {
+    const known = expressions.get(expression);
+    if (known === undefined)
+        return undefined;
+    if (known !== null)
+        return known;
+    const predicate = ownCanonical(Object.freeze({
+        version: AUTHORITY_PREDICATE_VERSION,
+        predicate: expression,
+    }));
+    expressions.set(expression, predicate);
+    return predicate;
+}
+function retainClosedExpression(expression) {
+    if (expressions.has(expression))
+        return;
+    expressions.set(expression, null);
+    if (expression.op === 'all' || expression.op === 'any') {
+        for (const child of expression.predicates)
+            retainClosedExpression(child);
+    }
+    else if (expression.op === 'not')
+        retainClosedExpression(expression.predicate);
+    // A complete Grant or existential is closed, but its body may depend on its binder.
+}
+export function ownsCanonical(input) {
+    return input !== null && typeof input === 'object' && canonical.has(input);
+}

package/dist/auth/authority/prepare-grant-body.d.ts

@@ -0,0 +1,4 @@
+import type { Grant } from '../grant/index.js';
+import type { AuthorityExpr, AuthorityPredicate } from './language/index.js';
+/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
+export declare function prepareGrantBody(where: AuthorityExpr): (grant: Grant) => AuthorityPredicate;

package/dist/auth/authority/prepare-grant-body.js

@@ -0,0 +1,27 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { accept as acceptGrant, canonicalize as canonicalizeGrant } from '../grant/index.js';
+import { admitGrantBody } from './admission/index.js';
+import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
+import { normalizeGrantBodyAdmitted } from './normalization/index.js';
+import { ownCanonical } from './ownership.optimization.js';
+/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
+export function prepareGrantBody(where) {
+    const admitted = admitGrantBody(portable.acceptForRead(where));
+    const body = portable.acceptImmutable(normalizeGrantBodyAdmitted(admitted));
+    return grantBinder(body);
+}
+// A distinct closure scope retains only the normalized body, never an initial Grant or caller input.
+function grantBinder(where) {
+    return (grant) => {
+        // Charge the entire expression on every binding, including the body and its outer container.
+        const value = portable.acceptForRead({ op: 'grant', grant, where });
+        return ownCanonical(Object.freeze({
+            version: AUTHORITY_PREDICATE_VERSION,
+            predicate: Object.freeze({
+                op: 'grant',
+                grant: canonicalizeGrant(acceptGrant(value.grant)),
+                where,
+            }),
+        }));
+    };
+}

package/dist/auth/claims/admission/admission.d.ts

@@ -3,4 +3,3 @@ import type { ClaimConstraint } from '../language/index.js';
 export declare const MAX_REQUIRED_CLAIMS = 64;
 /** Admit one claim constraint within an owning boundary's error vocabulary. */
 export declare function admitConstraint(input: portable.Value, path: string, invalid: (path: string, message: string) => never): ClaimConstraint;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/claims/admission/admission.js

@@ -41,4 +41,3 @@ function freezeValue(input) {
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/claims/admission/index.d.ts

@@ -1,2 +1 @@
 export { admitConstraint, MAX_REQUIRED_CLAIMS } from './admission.js';
-//# sourceMappingURL=index.d.ts.map