@astrale-os/kernel-core 0.9.0-beta.62 → 0.9.0-beta.64

package/dist/auth/authority/semantics/composition.js

@@ -0,0 +1,112 @@
+import { AuthorityFailure } from './failure.js';
+/** A binder admits its Identity when its composed status is positive and not denied. */
+export function allowed(status) {
+    return status.positive && !status.denied;
+}
+/**
+ * Close the composition of one binder root: the outgoing `extends_with`, `constrained_by` and
+ * `excluded_from` Edges, followed transitively. The root must be live and every member must have a
+ * concrete Identity Class of `identities`; otherwise the composition is invalid, not false.
+ */
+export function closeComposition(root, snapshot, vocabulary, identities, limits) {
+    const allowedClasses = new Set(identities.map(classKey));
+    const { extension, constraint, exclusion } = vocabulary.composition;
+    const members = [];
+    const ordinals = new Map();
+    const children = [];
+    let edges = 0;
+    const admit = (id) => {
+        let ordinal = ordinals.get(id);
+        if (ordinal !== undefined)
+            return ordinal;
+        const node = snapshot.node(id);
+        if (node === undefined) {
+            throw new AuthorityFailure('AUTHORITY_COMPOSITION_INVALID', 'An Identity binder names no live Node.', { identity: id });
+        }
+        if (!allowedClasses.has(classKey(node.class))) {
+            throw new AuthorityFailure('AUTHORITY_COMPOSITION_INVALID', 'An Identity composition reaches a Node that is not an Identity.', { identity: id });
+        }
+        ordinal = members.length;
+        if (limits !== undefined && ordinal >= limits.compositionNodes) {
+            throw new AuthorityFailure('AUTHORITY_BUDGET_EXCEEDED', 'An Identity composition exceeds its Node ceiling.', { root, limit: limits.compositionNodes });
+        }
+        members.push(id);
+        ordinals.set(id, ordinal);
+        children.push({ extensions: [], constraints: [], exclusions: [] });
+        return ordinal;
+    };
+    admit(root);
+    for (let next = 0; next < members.length; next++) {
+        const id = members[next];
+        const row = children[next];
+        const follow = (edge, bucket) => {
+            for (const child of snapshot.edges(id, edge, 'out')) {
+                edges += 1;
+                if (limits !== undefined && edges > limits.compositionEdges) {
+                    throw new AuthorityFailure('AUTHORITY_BUDGET_EXCEEDED', 'An Identity composition exceeds its Edge ceiling.', { root, limit: limits.compositionEdges });
+                }
+                bucket.push(admit(child));
+            }
+        };
+        follow(extension, row.extensions);
+        follow(constraint, row.constraints);
+        follow(exclusion, row.exclusions);
+    }
+    const order = childrenFirst(children);
+    const acyclic = order.length === members.length;
+    return Object.freeze({
+        root,
+        identities: Object.freeze(members),
+        acyclic,
+        status(leaf) {
+            if (!acyclic)
+                return undefined;
+            const values = [];
+            // Iterative in the dependency order, so a deep valid composition needs no call stack.
+            for (const ordinal of order) {
+                const row = children[ordinal];
+                const truth = leaf(members[ordinal]);
+                const full = (child) => values[child].full;
+                const positive = (child) => values[child].positive;
+                const denied = (child) => values[child].denied;
+                values[ordinal] = Object.freeze({
+                    full: (truth || row.extensions.some(full)) &&
+                        row.constraints.every(full) &&
+                        !row.exclusions.some(full),
+                    positive: (truth || row.extensions.some(positive)) && row.constraints.every(positive),
+                    denied: row.exclusions.some(full) ||
+                        row.extensions.some(denied) ||
+                        row.constraints.some(denied),
+                });
+            }
+            return values[0];
+        },
+    });
+}
+/** Kahn order over the closure; shorter than the closure exactly when it contains a cycle. */
+function childrenFirst(children) {
+    const parents = children.map(() => []);
+    const pending = new Uint32Array(children.length);
+    children.forEach((row, ordinal) => {
+        const dependencies = new Set([...row.extensions, ...row.constraints, ...row.exclusions]);
+        pending[ordinal] = dependencies.size;
+        for (const child of dependencies)
+            parents[child].push(ordinal);
+    });
+    const order = [];
+    pending.forEach((count, ordinal) => {
+        if (count === 0)
+            order.push(ordinal);
+    });
+    for (let next = 0; next < order.length; next++) {
+        for (const parent of parents[order[next]]) {
+            pending[parent] = pending[parent] - 1;
+            if (pending[parent] === 0)
+                order.push(parent);
+        }
+    }
+    return order;
+}
+function classKey(ref) {
+    return `${ref.origin}:${ref.kind}.${ref.name}`;
+}

package/dist/auth/authority/semantics/failure.d.ts

@@ -0,0 +1,21 @@
+/**
+ * An authority decision that cannot be made. A failure is never `false`: under `not` it would
+ * become `true`, so every backend surfaces it as a failed request instead of a decision.
+ */
+export type AuthorityFailureCode = 
+/** A bound input names no live Node. */
+'AUTHORITY_TARGET_NOT_FOUND'
+/** A term reads an input the decision frame does not bind. */
+ | 'AUTHORITY_INPUT_UNBOUND'
+/** A fixed term does not resolve to exactly one live Node. */
+ | 'AUTHORITY_REFERENCE_INVALID'
+/** A binder root is absent, or its composition reaches a Node that is not an Identity. */
+ | 'AUTHORITY_COMPOSITION_INVALID'
+/** A binder composition exceeds the evaluating backend's ceilings. */
+ | 'AUTHORITY_BUDGET_EXCEEDED';
+export declare class AuthorityFailure extends Error {
+    readonly code: AuthorityFailureCode;
+    readonly details: Readonly<Record<string, unknown>>;
+    readonly name: 'AuthorityFailure';
+    constructor(code: AuthorityFailureCode, message: string, details?: Readonly<Record<string, unknown>>);
+}

package/dist/auth/authority/semantics/failure.js

@@ -0,0 +1,10 @@
+export class AuthorityFailure extends Error {
+    code;
+    details;
+    name = 'AuthorityFailure';
+    constructor(code, message, details = {}) {
+        super(message);
+        this.code = code;
+        this.details = details;
+    }
+}

package/dist/auth/authority/semantics/index.d.ts

@@ -0,0 +1,11 @@
+export { classAuthorityMeaning } from './class-authority.js';
+export { allowed, closeComposition } from './composition.js';
+export type { CompositionClosure, CompositionLimits, CompositionStatus } from './composition.js';
+export { AuthorityFailure } from './failure.js';
+export type { AuthorityFailureCode } from './failure.js';
+export { binderRoots, createAuthorityEvaluator } from './interpret.js';
+export type { AuthorityAtom, AuthorityEvaluationOptions, AuthorityEvaluator } from './interpret.js';
+export type { AuthorityInputs, AuthorityNode, AuthoritySnapshot } from './snapshot.js';
+export { fixedPaths, isFixedTerm, requiredInputs, termPath } from './terms.js';
+export type { FixedTerm } from './terms.js';
+export type { AuthorityVocabulary } from './vocabulary.js';

package/dist/auth/authority/semantics/index.js

@@ -0,0 +1,5 @@
+export { classAuthorityMeaning } from './class-authority.js';
+export { allowed, closeComposition } from './composition.js';
+export { AuthorityFailure } from './failure.js';
+export { binderRoots, createAuthorityEvaluator } from './interpret.js';
+export { fixedPaths, isFixedTerm, requiredInputs, termPath } from './terms.js';

package/dist/auth/authority/semantics/interpret.d.ts

@@ -0,0 +1,35 @@
+import type { NodeId } from '../../../graph/node/index.js';
+import type { AuthorityExpr, AuthorityProgram, PredicateRef } from '../language/index.js';
+import type { CompositionLimits } from './composition.js';
+import type { AuthorityInputs, AuthoritySnapshot } from './snapshot.js';
+import type { AuthorityVocabulary } from './vocabulary.js';
+/** A leaf the Boolean and binder structure does not decompose. */
+export type AuthorityAtom = Exclude<AuthorityExpr, {
+    readonly op: 'true' | 'false' | 'all' | 'any' | 'not' | 'as';
+}>;
+export interface AuthorityEvaluationOptions {
+    /** The evaluating backend's composition ceilings. */
+    readonly limits?: CompositionLimits;
+    /**
+     * Decide an atom outside every existential scope from evidence the snapshot does not hold, such
+     * as a captured fact table. Undefined leaves the atom to its meaning over the snapshot.
+     */
+    readonly atom?: (atom: AuthorityAtom, subject: NodeId | undefined) => boolean | undefined;
+}
+/** Decisions of one program over one snapshot. Memoized evidence never outlives the evaluator. */
+export interface AuthorityEvaluator {
+    /**
+     * Resolve every fixed reference and admit every binder composition of the program, as a backend
+     * does for its whole request family before it exposes any decision.
+     */
+    admit(): void;
+    /** Decide one predicate for one input frame; throws `AuthorityFailure`, never returns it. */
+    evaluate(predicate: PredicateRef, inputs?: AuthorityInputs): boolean;
+}
+/**
+ * The reference interpreter of authority. It is parametric over one snapshot and the Kernel
+ * vocabulary, and every backend lowering must agree with it.
+ */
+export declare function createAuthorityEvaluator(program: AuthorityProgram, snapshot: AuthoritySnapshot, vocabulary: AuthorityVocabulary, options?: AuthorityEvaluationOptions): AuthorityEvaluator;
+/** Every Identity a binder of the program names, sorted. */
+export declare function binderRoots(expressions: readonly AuthorityExpr[]): readonly NodeId[];

package/dist/auth/authority/semantics/interpret.js

@@ -0,0 +1,215 @@
+import { Path } from '../../../graph/path/index.js';
+import { allowed, closeComposition } from './composition.js';
+import { AuthorityFailure } from './failure.js';
+import { fixedPaths, termPath } from './terms.js';
+/**
+ * The reference interpreter of authority. It is parametric over one snapshot and the Kernel
+ * vocabulary, and every backend lowering must agree with it.
+ */
+export function createAuthorityEvaluator(program, snapshot, vocabulary, options = {}) {
+    const references = new Map();
+    const closures = new Map();
+    const projections = new Map();
+    const instanceOf = classKey(vocabulary.instanceOf);
+    const reference = (path) => {
+        const known = references.get(path.raw);
+        if (known !== undefined)
+            return known;
+        const nodes = [...new Set(snapshot.resolve(path))].filter((id) => snapshot.node(id));
+        if (nodes.length !== 1) {
+            throw new AuthorityFailure('AUTHORITY_REFERENCE_INVALID', 'An authority fixed reference does not resolve to exactly one live Node.', { path: path.raw, candidates: nodes.length });
+        }
+        references.set(path.raw, nodes[0]);
+        return nodes[0];
+    };
+    const closure = (root) => {
+        let value = closures.get(root);
+        if (value === undefined) {
+            value = closeComposition(root, snapshot, vocabulary, program.identities, options.limits);
+            closures.set(root, value);
+        }
+        return value;
+    };
+    const term = (value, frame) => {
+        switch (value.kind) {
+            case 'input': {
+                const id = frame.inputs[value.input];
+                if (id === undefined) {
+                    throw new AuthorityFailure('AUTHORITY_INPUT_UNBOUND', `Authority input ${value.input} is not bound by the decision frame.`);
+                }
+                return id;
+            }
+            case 'subject':
+                if (frame.subject === undefined)
+                    throw new TypeError('Authority subject is unbound.');
+                return frame.subject;
+            case 'local': {
+                const id = frame.locals.get(value.id);
+                if (id === undefined)
+                    throw new TypeError(`Authority local ${value.id} is unbound.`);
+                return id;
+            }
+            default:
+                return reference(termPath(value));
+        }
+    };
+    const classOf = (id) => {
+        const node = snapshot.node(id);
+        if (node === undefined)
+            throw new TypeError('Authority evaluation reached a Node that is gone.');
+        return node.class;
+    };
+    /** `instance_of` is derived: the live projection of the Node's exact Class. */
+    const projection = (id) => {
+        const ref = classOf(id);
+        const key = classKey(ref);
+        let nodes = projections.get(key);
+        if (nodes === undefined) {
+            nodes = Object.freeze([...new Set(snapshot.resolve(Path.project(ref)))].filter((node) => snapshot.node(node)));
+            projections.set(key, nodes);
+        }
+        return nodes;
+    };
+    const step = (from, edge) => classKey(edge) === instanceOf
+        ? projection(from)
+        : snapshot.edges(from, edge, snapshot.orientation(edge) === 'undirected' ? 'both' : 'out');
+    /**
+     * Bounded walks: a Node reached at any depth within [min, max], revisits allowed. Each hop may
+     * take any member of the Edge Class extent.
+     */
+    const related = (source, extent, target, repeat) => {
+        const min = repeat?.min ?? 1;
+        const max = repeat?.max ?? 1;
+        if (min === 0 && source === target)
+            return true;
+        let frontier = new Set([source]);
+        for (let depth = 1; depth <= max && frontier.size > 0; depth++) {
+            const next = new Set();
+            for (const node of frontier) {
+                for (const edge of extent)
+                    for (const reached of step(node, edge))
+                        next.add(reached);
+            }
+            if (depth >= min && next.has(target))
+                return true;
+            frontier = next;
+        }
+        return false;
+    };
+    const holds = (expression, frame) => {
+        switch (expression.op) {
+            case 'true':
+                return true;
+            case 'false':
+                return false;
+            case 'all':
+                return expression.predicates.every((child) => holds(child, frame));
+            case 'any':
+                return expression.predicates.some((child) => holds(child, frame));
+            case 'not':
+                return !holds(expression.predicate, frame);
+            case 'as': {
+                // A cyclic composition makes this binder false; the scope of a cycle is the binder.
+                const status = closure(expression.identity).status((identity) => holds(expression.where, { ...frame, subject: identity }));
+                return status !== undefined && allowed(status);
+            }
+            default:
+                return atom(expression, frame);
+        }
+    };
+    const atom = (expression, frame) => {
+        if (options.atom !== undefined && frame.locals.size === 0) {
+            const decided = options.atom(expression, frame.subject);
+            if (decided !== undefined)
+                return decided;
+        }
+        switch (expression.op) {
+            case 'same-node':
+                return term(expression.left, frame) === term(expression.right, frame);
+            case 'related':
+                return related(term(expression.source, frame), expression.via, term(expression.target, frame), expression.repeat);
+            case 'instance-of':
+                return sameClass(classOf(term(expression.node, frame)), expression.class);
+            case 'edge-class': {
+                if (frame.inputs.edge === undefined) {
+                    throw new AuthorityFailure('AUTHORITY_INPUT_UNBOUND', 'Authority edge-class requires a bound Edge object.');
+                }
+                return sameClass(frame.inputs.edge, expression.class);
+            }
+            case 'class-authority': {
+                // The meaning is `classAuthorityMeaning`; it is decided directly so no atom it expands to
+                // is ever asked of a captured fact table.
+                const identity = term(expression.identity, frame);
+                if (identity === reference(Path.domain(expression.class.origin)))
+                    return true;
+                if (expression.evidence === 'owner')
+                    return false;
+                const target = reference(Path.project(expression.class));
+                return snapshot
+                    .edges(identity, vocabulary.capabilities[expression.operation], 'out')
+                    .includes(target);
+            }
+            case 'exists':
+                return exists(expression, frame);
+        }
+    };
+    const exists = (expression, frame) => {
+        const candidates = expression.nodes.map((local) => local.kind === 'any' ? snapshot.nodes() : snapshot.nodes(local.classes));
+        const bind = (index, locals) => {
+            if (index === expression.nodes.length)
+                return holds(expression.where, { ...frame, locals });
+            const id = expression.nodes[index].id;
+            return candidates[index].some((node) => bind(index + 1, new Map([...locals, [id, node]])));
+        };
+        return bind(0, frame.locals);
+    };
+    return Object.freeze({
+        admit() {
+            for (const path of fixedPaths(program.predicates))
+                reference(path);
+            for (const root of binderRoots(program.predicates))
+                closure(root);
+        },
+        evaluate(predicate, inputs = {}) {
+            const expression = program.predicates[predicate];
+            if (expression === undefined)
+                throw new TypeError('Unknown Authority predicate ordinal.');
+            for (const input of ['object', 'source', 'target']) {
+                const id = inputs[input];
+                if (id !== undefined && snapshot.node(id) === undefined) {
+                    throw new AuthorityFailure('AUTHORITY_TARGET_NOT_FOUND', `Authority ${input} does not exist in the evaluated graph.`, { [input]: id });
+                }
+            }
+            return holds(expression, { inputs, subject: undefined, locals: new Map() });
+        },
+    });
+}
+/** Every Identity a binder of the program names, sorted. */
+export function binderRoots(expressions) {
+    const roots = new Set();
+    const visit = (expression) => {
+        switch (expression.op) {
+            case 'all':
+            case 'any':
+                expression.predicates.forEach(visit);
+                return;
+            case 'not':
+                visit(expression.predicate);
+                return;
+            case 'exists':
+                visit(expression.where);
+                return;
+            case 'as':
+                roots.add(expression.identity);
+                visit(expression.where);
+        }
+    };
+    expressions.forEach(visit);
+    return Object.freeze([...roots].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0)));
+}
+function sameClass(left, right) {
+    return left.origin === right.origin && left.kind === right.kind && left.name === right.name;
+}
+function classKey(ref) {
+    return `${ref.origin}:${ref.kind}.${ref.name}`;
+}

package/dist/auth/authority/semantics/snapshot.d.ts

@@ -0,0 +1,34 @@
+import type { NodeId } from '../../../graph/node/index.js';
+import type { Path } from '../../../graph/path/index.js';
+import type { ClassRef } from '../language/index.js';
+/** One live Node as authority sees it: its exact concrete Class. */
+export interface AuthorityNode {
+    readonly class: ClassRef;
+}
+/**
+ * One consistent graph state the interpreter reads. Every Node it exposes is live and has exactly
+ * one active concrete Class; every Edge connects two such Nodes.
+ */
+export interface AuthoritySnapshot {
+    /** The live Node, or undefined when the id names none. */
+    node(id: NodeId): AuthorityNode | undefined;
+    /**
+     * Distinct Nodes one Edge of the exact Class away: `out` follows source to target, `in` target
+     * to source, `both` either orientation. The derived `instance_of` relation is never asked.
+     */
+    edges(from: NodeId, edge: ClassRef, direction: 'out' | 'in' | 'both'): readonly NodeId[];
+    /** Orientation the pinned Registry declares for one Edge Class. */
+    orientation(edge: ClassRef): 'directed' | 'undirected';
+    /** Every live Node the Path reaches; a fixed term requires exactly one. */
+    resolve(path: Path): readonly NodeId[];
+    /** Every live Node, restricted to exact Classes when given. */
+    nodes(classes?: readonly ClassRef[]): readonly NodeId[];
+}
+/** The input frame of one decision; each bound Node must be live. */
+export interface AuthorityInputs {
+    readonly object?: NodeId;
+    readonly source?: NodeId;
+    readonly target?: NodeId;
+    /** Exact Class of the bound Edge object, read only by `edge-class`. */
+    readonly edge?: ClassRef;
+}

package/dist/auth/authority/semantics/terms.d.ts

@@ -0,0 +1,20 @@
+import type { AuthorityExpr, Term } from '../language/index.js';
+import type { AuthorityInputs } from './snapshot.js';
+import { Path } from '../../../graph/path/index.js';
+/** A term that names one Node independently of any row, binder or local. */
+export type FixedTerm = Extract<Term, {
+    readonly kind: 'node' | 'class' | 'domain' | 'core' | 'ref';
+}>;
+export declare function isFixedTerm(term: Term): term is FixedTerm;
+/** The Path a fixed term denotes; the term holds when that Path reaches exactly one live Node. */
+export declare function termPath(term: FixedTerm): Path;
+/**
+ * Every fixed Path one expression depends on, sorted by raw text. `class-authority` depends on the
+ * projection of its Class and on the Domain of the Class origin.
+ */
+export declare function fixedPaths(expressions: readonly AuthorityExpr[]): readonly Path[];
+/**
+ * Every decision input the expressions read: each `input` term, and the bound Edge Class that
+ * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
+ */
+export declare function requiredInputs(expressions: readonly AuthorityExpr[]): ReadonlySet<keyof AuthorityInputs>;

package/dist/auth/authority/semantics/terms.js

@@ -0,0 +1,96 @@
+import { Path } from '../../../graph/path/index.js';
+export function isFixedTerm(term) {
+    return term.kind !== 'input' && term.kind !== 'local' && term.kind !== 'subject';
+}
+/** The Path a fixed term denotes; the term holds when that Path reaches exactly one live Node. */
+export function termPath(term) {
+    switch (term.kind) {
+        case 'node':
+            return Path.id(term.id);
+        case 'class':
+            return Path.project(term.ref);
+        case 'domain':
+            return Path.domain(term.origin);
+        case 'ref':
+        case 'core':
+            return Path.project(term.ref);
+    }
+}
+/**
+ * Every fixed Path one expression depends on, sorted by raw text. `class-authority` depends on the
+ * projection of its Class and on the Domain of the Class origin.
+ */
+export function fixedPaths(expressions) {
+    const paths = new Map();
+    const add = (path) => {
+        paths.set(path.raw, path);
+    };
+    for (const expression of subexpressions(expressions)) {
+        for (const term of ownTerms(expression))
+            if (isFixedTerm(term))
+                add(termPath(term));
+        if (expression.op === 'class-authority') {
+            add(Path.project(expression.class));
+            add(Path.domain(expression.class.origin));
+        }
+    }
+    return Object.freeze([...paths.values()].sort((left, right) => compare(left.raw, right.raw)));
+}
+/**
+ * Every decision input the expressions read: each `input` term, and the bound Edge Class that
+ * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
+ */
+export function requiredInputs(expressions) {
+    const inputs = new Set();
+    for (const expression of subexpressions(expressions)) {
+        if (expression.op === 'edge-class')
+            inputs.add('edge');
+        for (const term of ownTerms(expression))
+            if (term.kind === 'input')
+                inputs.add(term.input);
+    }
+    return inputs;
+}
+/** Every expression and nested expression, depth first in syntax order. */
+function* subexpressions(expressions) {
+    for (const expression of expressions) {
+        yield expression;
+        switch (expression.op) {
+            case 'all':
+            case 'any':
+                yield* subexpressions(expression.predicates);
+                break;
+            case 'not':
+                yield* subexpressions([expression.predicate]);
+                break;
+            case 'as':
+            case 'exists':
+                yield* subexpressions([expression.where]);
+        }
+    }
+}
+/** The terms one expression reads itself, excluding those of its nested expressions. */
+function ownTerms(expression) {
+    switch (expression.op) {
+        case 'same-node':
+            return [expression.left, expression.right];
+        case 'related':
+            return [expression.source, expression.target];
+        case 'instance-of':
+            return [expression.node];
+        case 'class-authority':
+            return [expression.identity];
+        case 'true':
+        case 'false':
+        case 'edge-class':
+        case 'all':
+        case 'any':
+        case 'not':
+        case 'as':
+        case 'exists':
+            return [];
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/authority/semantics/vocabulary.d.ts

@@ -0,0 +1,19 @@
+import type { ClassRef, Operation } from '../language/index.js';
+/**
+ * The Kernel Classes that give authority its meaning. Core Schema publishes the Kernel instance;
+ * the interpreter and every lowering take it as a parameter instead of discovering it.
+ */
+export interface AuthorityVocabulary {
+    /** Node Class whose concrete descendants an Identity binder may reach. */
+    readonly identity: ClassRef;
+    /** Outgoing composition Edges of one Identity. */
+    readonly composition: {
+        readonly extension: ClassRef;
+        readonly constraint: ClassRef;
+        readonly exclusion: ClassRef;
+    };
+    /** Edge from an Identity to a Class projection that delegates one Class operation. */
+    readonly capabilities: Readonly<Record<Operation, ClassRef>>;
+    /** The derived relation from a Node to the projection of its exact Class. */
+    readonly instanceOf: ClassRef;
+}

package/dist/auth/authority/semantics/vocabulary.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/context/context.d.ts

@@ -2,7 +2,6 @@ import type { Attestation } from '../attestation/index.js';
 import type { CredentialInput } from '../credential/input/index.js';
 import type { VerifiedCredential } from '../credential/verified/index.js';
 import type { Delegation } from '../delegation/index.js';
-import type { Grant } from '../grant/index.js';
 import type { IdentityId } from '../identity/index.js';
 /** The original credential together with the claims established by verification. */
 export interface CredentialContext {
@@ -12,15 +11,17 @@ export interface CredentialContext {
 /** Verified credential result before every runtime authority value is necessarily resolved. */
 export interface Authenticated {
     readonly credential: CredentialContext;
-    readonly grant?: Grant;
+    readonly caller?: IdentityId;
     readonly attestation?: Attestation;
     readonly delegation?: Delegation;
 }
 /** Complete authenticated kernel context. */
 export interface AuthContext {
     readonly credential: CredentialContext;
+    /** Authenticated executor: ceiling, installed ownership, Root bypass, and audit. */
     readonly principal: IdentityId;
-    readonly grant: Grant;
+    /** The one Identity whose authority the call exercises; equals principal for direct calls. */
+    readonly caller: IdentityId;
     /** Earliest expiry of all credential proofs from which this authority was derived. */
     readonly validUntil?: number;
     readonly attestation?: Attestation;

package/dist/auth/expression/authoring/builder.d.ts

@@ -6,11 +6,8 @@ export type BuiltExpr = IdentityExpr | UnresolvedIdentityExpr;
 export interface ExprBuilder<E extends BuiltExpr = IdentityExpr> {
     build(): E;
 }
-/** Immutable fluent expression handle. */
+/** Immutable handle for one Identity leaf; there is no Identity set algebra. */
 export interface Expr<E extends BuiltExpr = IdentityExpr> extends ExprBuilder<E> {
-    union(other: Expr<E>): Expr<E>;
-    intersect(other: Expr<E>): Expr<E>;
-    exclude(other: Expr<E>): Expr<E>;
 }
 export declare function isExprBuilder(input: unknown): input is ExprBuilder<IdentityExpr> | ExprBuilder<UnresolvedIdentityExpr>;
 /** Build one resolved Identity leaf. */
@@ -19,11 +16,5 @@ export declare function identity(id: IdentityId): Expr<IdentityExpr>;
 export declare function self(): Expr<UnresolvedIdentityExpr>;
 /** Build one unresolved nested-credential leaf. */
 export declare function cred(credential: CredentialInput): Expr<UnresolvedIdentityExpr>;
-/** Re-enter the fluent algebra from an already trusted or separately admitted expression. */
+/** Re-enter from an already trusted or separately admitted Identity leaf. */
 export declare function raw<E extends BuiltExpr>(expr: E): Expr<E>;
-/** Compose at least two expressions of the same resolved or unresolved phase. */
-export declare function union<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Intersect at least two expressions of the same resolved or unresolved phase. */
-export declare function intersect<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Exclude one expression from another expression of the same phase. */
-export declare function exclude<E extends BuiltExpr>(base: Expr<E>, excluded: Expr<NoInfer<E>>): Expr<E>;