@astrale-os/kernel-core 0.9.0-beta.63 → 0.9.0-beta.65

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (110) hide show
  1. package/dist/auth/authority/admission/admission.d.ts +2 -2
  2. package/dist/auth/authority/admission/admission.js +10 -8
  3. package/dist/auth/authority/admission/index.d.ts +1 -1
  4. package/dist/auth/authority/admission/index.js +1 -1
  5. package/dist/auth/authority/index.d.ts +7 -3
  6. package/dist/auth/authority/index.js +4 -2
  7. package/dist/auth/authority/language/index.d.ts +2 -0
  8. package/dist/auth/authority/language/index.js +1 -0
  9. package/dist/auth/authority/language/predicate.d.ts +10 -5
  10. package/dist/auth/authority/language/predicate.js +1 -1
  11. package/dist/auth/authority/language/program.d.ts +21 -0
  12. package/dist/auth/authority/language/program.js +2 -0
  13. package/dist/auth/authority/normalization/index.d.ts +1 -1
  14. package/dist/auth/authority/normalization/index.js +1 -1
  15. package/dist/auth/authority/normalization/normalize.d.ts +1 -1
  16. package/dist/auth/authority/normalization/normalize.js +4 -5
  17. package/dist/auth/authority/ownership.optimization.js +2 -2
  18. package/dist/auth/authority/prepare-binder-body.d.ts +4 -0
  19. package/dist/auth/authority/prepare-binder-body.js +31 -0
  20. package/dist/auth/authority/program.d.ts +28 -0
  21. package/dist/auth/authority/program.js +191 -0
  22. package/dist/auth/authority/semantics/class-authority.d.ts +8 -0
  23. package/dist/auth/authority/semantics/class-authority.js +26 -0
  24. package/dist/auth/authority/semantics/composition.d.ts +39 -0
  25. package/dist/auth/authority/semantics/composition.js +112 -0
  26. package/dist/auth/authority/semantics/failure.d.ts +21 -0
  27. package/dist/auth/authority/semantics/failure.js +10 -0
  28. package/dist/auth/authority/semantics/index.d.ts +11 -0
  29. package/dist/auth/authority/semantics/index.js +5 -0
  30. package/dist/auth/authority/semantics/interpret.d.ts +35 -0
  31. package/dist/auth/authority/semantics/interpret.js +215 -0
  32. package/dist/auth/authority/semantics/snapshot.d.ts +34 -0
  33. package/dist/auth/authority/semantics/terms.d.ts +20 -0
  34. package/dist/auth/authority/semantics/terms.js +96 -0
  35. package/dist/auth/authority/semantics/vocabulary.d.ts +19 -0
  36. package/dist/auth/authority/semantics/vocabulary.js +1 -0
  37. package/dist/auth/context/context.d.ts +4 -3
  38. package/dist/auth/expression/authoring/builder.d.ts +2 -11
  39. package/dist/auth/expression/authoring/builder.js +1 -45
  40. package/dist/auth/expression/authoring/index.d.ts +1 -1
  41. package/dist/auth/expression/authoring/index.js +1 -1
  42. package/dist/auth/expression/index.d.ts +1 -2
  43. package/dist/auth/expression/index.js +1 -2
  44. package/dist/auth/expression/language/identity-expression.d.ts +2 -22
  45. package/dist/auth/grant/index.d.ts +1 -1
  46. package/dist/auth/grant/index.js +1 -1
  47. package/dist/auth/grant/resolved/admission.d.ts +4 -3
  48. package/dist/auth/grant/resolved/admission.js +23 -13
  49. package/dist/auth/grant/resolved/grant.d.ts +1 -1
  50. package/dist/auth/grant/resolved/index.d.ts +1 -1
  51. package/dist/auth/grant/resolved/index.js +1 -1
  52. package/dist/auth/grant/unresolved/admission.d.ts +4 -1
  53. package/dist/auth/grant/unresolved/admission.js +27 -67
  54. package/dist/auth/grant/unresolved/limits.d.ts +2 -4
  55. package/dist/auth/grant/unresolved/limits.js +1 -5
  56. package/dist/auth/index.d.ts +1 -1
  57. package/dist/graph/graph/graph.d.ts +1 -5
  58. package/dist/graph/graph/graph.js +3 -27
  59. package/dist/graph/graph/index.d.ts +1 -3
  60. package/dist/graph/graph/index.js +1 -2
  61. package/dist/graph/query/index.d.ts +2 -0
  62. package/dist/graph/query/index.js +1 -0
  63. package/dist/graph/query/order/index.d.ts +46 -0
  64. package/dist/graph/query/order/index.js +59 -0
  65. package/dist/graph/query/reference/evaluate.js +24 -50
  66. package/dist/graph/reconcile/planning/canonical.d.ts +6 -0
  67. package/dist/graph/reconcile/planning/canonical.js +28 -0
  68. package/dist/graph/reconcile/planning/model.d.ts +4 -0
  69. package/dist/graph/reconcile/planning/plan.js +2 -1
  70. package/dist/schema/authority/vocabulary.d.ts +3 -0
  71. package/dist/schema/authority/vocabulary.js +25 -0
  72. package/dist/schema/callables/function.d.ts +120 -90
  73. package/dist/schema/domain/domain.d.ts +120 -90
  74. package/dist/schema/identity/composition.d.ts +5 -0
  75. package/dist/schema/identity/composition.js +5 -0
  76. package/dist/schema/identity/identity.d.ts +8 -6
  77. package/dist/schema/index.d.ts +1 -0
  78. package/dist/schema/index.js +1 -0
  79. package/dist/schema/kernel/schema.d.ts +337 -276
  80. package/dist/schema/kernel/syscalls/contracts/delegate.d.ts +4 -1
  81. package/dist/schema/kernel/syscalls/contracts/delegate.js +4 -3
  82. package/dist/schema/kernel/syscalls/contracts/impersonate.d.ts +0 -1
  83. package/dist/schema/kernel/syscalls/contracts/legacy/delegate.d.ts +5 -0
  84. package/dist/schema/kernel/syscalls/contracts/legacy/delegate.js +25 -0
  85. package/dist/schema/kernel/syscalls/contracts/mint.d.ts +0 -1
  86. package/dist/schema/kernel/syscalls/contracts/mint.js +1 -2
  87. package/dist/schema/kernel/syscalls/declarations/delegate.d.ts +4 -1
  88. package/dist/schema/kernel/syscalls/declarations/impersonate.d.ts +0 -1
  89. package/dist/schema/kernel/syscalls/declarations/index.d.ts +35 -34
  90. package/dist/schema/kernel/syscalls/declarations/install.d.ts +8 -8
  91. package/dist/schema/kernel/syscalls/declarations/mint.d.ts +0 -1
  92. package/dist/schema/kernel/syscalls/declarations/mutate.d.ts +23 -23
  93. package/dist/schema/kernel/syscalls/descriptors/identity.d.ts +4 -3
  94. package/package.json +2 -2
  95. package/dist/auth/authority/prepare-grant-body.d.ts +0 -4
  96. package/dist/auth/authority/prepare-grant-body.js +0 -27
  97. package/dist/auth/expression/normalization/canonicalize.d.ts +0 -7
  98. package/dist/auth/expression/normalization/canonicalize.js +0 -102
  99. package/dist/auth/expression/normalization/index.d.ts +0 -2
  100. package/dist/auth/expression/normalization/index.js +0 -2
  101. package/dist/auth/expression/normalization/raise-denials.d.ts +0 -3
  102. package/dist/auth/expression/normalization/raise-denials.js +0 -59
  103. package/dist/graph/graph/navigation/error.d.ts +0 -12
  104. package/dist/graph/graph/navigation/error.js +0 -20
  105. package/dist/graph/graph/navigation/index.d.ts +0 -2
  106. package/dist/graph/graph/navigation/index.js +0 -1
  107. package/dist/graph/graph/navigation/model.d.ts +0 -15
  108. package/dist/schema/kernel/projection/path.d.ts +0 -2
  109. package/dist/schema/kernel/projection/path.js +0 -113
  110. /package/dist/{graph/graph/navigation/model.js → auth/authority/semantics/snapshot.js} +0 -0
@@ -2,6 +2,9 @@ export declare const delegateInput: import("zod").ZodObject<{
2
2
  principal: import("zod").ZodString;
3
3
  audience: import("zod").ZodString;
4
4
  ttlSeconds: import("zod").ZodNumber;
5
- attenuation: import("zod").ZodOptional<import("zod").ZodUnknown>;
5
+ attenuation: import("zod").ZodOptional<import("zod").ZodObject<{
6
+ kind: import("zod").ZodLiteral<"identity">;
7
+ self: import("zod").ZodLiteral<true>;
8
+ }, import("zod/v4/core").$strict>>;
6
9
  }, import("zod/v4/core").$strict>;
7
10
  export declare const delegateOutput: import("zod").ZodString;
@@ -1,10 +1,11 @@
1
- import { number, strictObject, string, unknown as unknownSchema } from 'zod';
1
+ import { number, strictObject, string } from 'zod';
2
+ import { selfAttenuation } from './legacy/delegate.js';
2
3
  const text = string().min(1);
3
4
  export const delegateInput = strictObject({
4
5
  principal: text,
5
6
  audience: text,
6
7
  ttlSeconds: number().int().min(1),
7
- /** Optional; absence means the self expression. */
8
- attenuation: unknownSchema().optional(),
8
+ /** @deprecated Ignored; admitted only as the self expression published Clients send. */
9
+ attenuation: selfAttenuation.optional(),
9
10
  });
10
11
  export const delegateOutput = text;
@@ -1,7 +1,6 @@
1
1
  export declare const impersonateInput: import("zod").ZodObject<{
2
2
  audience: import("zod").ZodOptional<import("zod").ZodString>;
3
3
  ttlSeconds: import("zod").ZodNumber;
4
- grant: import("zod").ZodOptional<import("zod").ZodUnknown>;
5
4
  identity: import("zod").ZodString;
6
5
  }, import("zod/v4/core").$strict>;
7
6
  export declare const impersonateOutput: import("zod").ZodString;
@@ -0,0 +1,5 @@
1
+ /** @deprecated The only `attenuation` value `Identity.delegate` still admits, and ignores. */
2
+ export declare const selfAttenuation: import("zod").ZodObject<{
3
+ kind: import("zod").ZodLiteral<"identity">;
4
+ self: import("zod").ZodLiteral<true>;
5
+ }, import("zod/v4/core").$strict>;
@@ -0,0 +1,25 @@
1
+ /**
2
+ * `Identity.delegate` keeps admitting the one `attenuation` value published Clients send: the self
3
+ * expression `{ kind: 'identity', self: true }`. It names the caller the delegation preserves
4
+ * anyway, so it carries no meaning: the handler ignores it and issues exactly the credential the
5
+ * same input without the field yields. Every other value, `null` included, stays refused.
6
+ *
7
+ * @deprecated Omit `attenuation`; a delegation always preserves the authenticated caller (ADR-3).
8
+ *
9
+ * Short-term consumers: `@astrale-os/kernel-client` 0.6.0-beta.77 to beta.85, whose Domain token
10
+ * exchange always sends it (`client/session/exchange/exchange.ts`, `SELF_ATTENUATION`), so the
11
+ * Console, the GUI, the Admin upgrade executor and the CLI through 1.0.0-beta.126 (exchange and
12
+ * `astrale token`). The 1Pact Host runs Kernel 0.12.0-beta.117, which requires the field, so a
13
+ * Client that serves both Kernels sends it.
14
+ *
15
+ * Removal, in a separate breaking release, once every consumer runs a Client that omits the field
16
+ * and the 0.12.0-beta.117 consumer Host is retired: delete this file and the `attenuation` member
17
+ * of `../delegate.ts`, then make the self vectors of TEST-REJECTS-AUTHORITY-EXPRESSIONS-IN-ISSUANCE-INPUTS
18
+ * and of the SYS-6 dispatch test expect refusal again.
19
+ */
20
+ import { literal, strictObject } from 'zod';
21
+ /** @deprecated The only `attenuation` value `Identity.delegate` still admits, and ignores. */
22
+ export const selfAttenuation = strictObject({
23
+ kind: literal('identity'),
24
+ self: literal(true),
25
+ }).meta({ deprecated: true });
@@ -1,6 +1,5 @@
1
1
  export declare const mintInput: import("zod").ZodObject<{
2
2
  audience: import("zod").ZodOptional<import("zod").ZodString>;
3
3
  ttlSeconds: import("zod").ZodNumber;
4
- grant: import("zod").ZodOptional<import("zod").ZodUnknown>;
5
4
  }, import("zod/v4/core").$strict>;
6
5
  export declare const mintOutput: import("zod").ZodString;
@@ -1,8 +1,7 @@
1
- import { number, strictObject, string, unknown as unknownSchema } from 'zod';
1
+ import { number, strictObject, string } from 'zod';
2
2
  const text = string().min(1);
3
3
  export const mintInput = strictObject({
4
4
  audience: text.optional(),
5
5
  ttlSeconds: number().int().min(1),
6
- grant: unknownSchema().optional(),
7
6
  });
8
7
  export const mintOutput = text;
@@ -3,7 +3,10 @@ export declare const Delegate: builder.Method<builder.CallableProjection<{
3
3
  principal: string;
4
4
  audience: string;
5
5
  ttlSeconds: number;
6
- attenuation?: unknown;
6
+ attenuation?: {
7
+ kind: "identity";
8
+ self: true;
9
+ } | undefined;
7
10
  }, {
8
11
  readonly mode: 'value';
9
12
  readonly value: string;
@@ -2,7 +2,6 @@ import { type builder } from '@astrale-os/kernel-dsl/v1';
2
2
  export declare const Impersonate: builder.Method<builder.CallableProjection<{
3
3
  audience?: string | undefined;
4
4
  ttlSeconds: number;
5
- grant?: unknown;
6
5
  identity: string;
7
6
  }, {
8
7
  readonly mode: 'value';
@@ -399,29 +399,6 @@ export declare const Functions: Readonly<{
399
399
  };
400
400
  })[];
401
401
  operations: ({
402
- op: "edge.update";
403
- edge: {
404
- source: string;
405
- target: string;
406
- class: string;
407
- };
408
- slug: unknown;
409
- props?: {
410
- set: Record<string, unknown>;
411
- unset: string[];
412
- } | undefined;
413
- } | {
414
- op: "edge.update";
415
- edge: {
416
- source: string;
417
- target: string;
418
- class: string;
419
- };
420
- props: {
421
- set: Record<string, unknown>;
422
- unset: string[];
423
- };
424
- } | {
425
402
  op: "node.create";
426
403
  as: string;
427
404
  class: string;
@@ -449,6 +426,29 @@ export declare const Functions: Readonly<{
449
426
  };
450
427
  slug?: unknown;
451
428
  props: Record<string, unknown>;
429
+ } | {
430
+ op: "edge.update";
431
+ edge: {
432
+ source: string;
433
+ target: string;
434
+ class: string;
435
+ };
436
+ slug: unknown;
437
+ props?: {
438
+ set: Record<string, unknown>;
439
+ unset: string[];
440
+ } | undefined;
441
+ } | {
442
+ op: "edge.update";
443
+ edge: {
444
+ source: string;
445
+ target: string;
446
+ class: string;
447
+ };
448
+ props: {
449
+ set: Record<string, unknown>;
450
+ unset: string[];
451
+ };
452
452
  } | {
453
453
  op: "edge.delete";
454
454
  edge: {
@@ -493,6 +493,14 @@ export declare const Functions: Readonly<{
493
493
  install: builder.Function<builder.CallableProjection<{
494
494
  operation: string;
495
495
  domains: ({
496
+ publication: {
497
+ url: string;
498
+ token?: string | undefined;
499
+ etag?: string | undefined;
500
+ };
501
+ revision?: string | undefined;
502
+ currentRevision?: string | null | undefined;
503
+ } | {
496
504
  artifact: {
497
505
  digest: string;
498
506
  mediaType: string;
@@ -514,14 +522,6 @@ export declare const Functions: Readonly<{
514
522
  } | undefined;
515
523
  revision?: string | undefined;
516
524
  currentRevision?: string | null | undefined;
517
- } | {
518
- publication: {
519
- url: string;
520
- token?: string | undefined;
521
- etag?: string | undefined;
522
- };
523
- revision?: string | undefined;
524
- currentRevision?: string | null | undefined;
525
525
  })[];
526
526
  }, {
527
527
  readonly mode: 'binary';
@@ -616,7 +616,10 @@ export declare const IdentityMethods: Readonly<{
616
616
  principal: string;
617
617
  audience: string;
618
618
  ttlSeconds: number;
619
- attenuation?: unknown;
619
+ attenuation?: {
620
+ kind: "identity";
621
+ self: true;
622
+ } | undefined;
620
623
  }, {
621
624
  readonly mode: 'value';
622
625
  readonly value: string;
@@ -687,7 +690,6 @@ export declare const IdentityMethods: Readonly<{
687
690
  mint: builder.Method<builder.CallableProjection<{
688
691
  audience?: string | undefined;
689
692
  ttlSeconds: number;
690
- grant?: unknown;
691
693
  }, {
692
694
  readonly mode: 'value';
693
695
  readonly value: string;
@@ -695,7 +697,6 @@ export declare const IdentityMethods: Readonly<{
695
697
  impersonate: builder.Method<builder.CallableProjection<{
696
698
  audience?: string | undefined;
697
699
  ttlSeconds: number;
698
- grant?: unknown;
699
700
  identity: string;
700
701
  }, {
701
702
  readonly mode: 'value';
@@ -2,6 +2,14 @@ import { type builder } from '@astrale-os/kernel-dsl/v1';
2
2
  export declare const Install: builder.Function<builder.CallableProjection<{
3
3
  operation: string;
4
4
  domains: ({
5
+ publication: {
6
+ url: string;
7
+ token?: string | undefined;
8
+ etag?: string | undefined;
9
+ };
10
+ revision?: string | undefined;
11
+ currentRevision?: string | null | undefined;
12
+ } | {
5
13
  artifact: {
6
14
  digest: string;
7
15
  mediaType: string;
@@ -23,14 +31,6 @@ export declare const Install: builder.Function<builder.CallableProjection<{
23
31
  } | undefined;
24
32
  revision?: string | undefined;
25
33
  currentRevision?: string | null | undefined;
26
- } | {
27
- publication: {
28
- url: string;
29
- token?: string | undefined;
30
- etag?: string | undefined;
31
- };
32
- revision?: string | undefined;
33
- currentRevision?: string | null | undefined;
34
34
  })[];
35
35
  }, {
36
36
  readonly mode: 'binary';
@@ -2,7 +2,6 @@ import { type builder } from '@astrale-os/kernel-dsl/v1';
2
2
  export declare const Mint: builder.Method<builder.CallableProjection<{
3
3
  audience?: string | undefined;
4
4
  ttlSeconds: number;
5
- grant?: unknown;
6
5
  }, {
7
6
  readonly mode: 'value';
8
7
  readonly value: string;
@@ -155,29 +155,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
155
155
  };
156
156
  })[];
157
157
  operations: ({
158
- op: "edge.update";
159
- edge: {
160
- source: string;
161
- target: string;
162
- class: string;
163
- };
164
- slug: unknown;
165
- props?: {
166
- set: Record<string, unknown>;
167
- unset: string[];
168
- } | undefined;
169
- } | {
170
- op: "edge.update";
171
- edge: {
172
- source: string;
173
- target: string;
174
- class: string;
175
- };
176
- props: {
177
- set: Record<string, unknown>;
178
- unset: string[];
179
- };
180
- } | {
181
158
  op: "node.create";
182
159
  as: string;
183
160
  class: string;
@@ -205,6 +182,29 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
205
182
  };
206
183
  slug?: unknown;
207
184
  props: Record<string, unknown>;
185
+ } | {
186
+ op: "edge.update";
187
+ edge: {
188
+ source: string;
189
+ target: string;
190
+ class: string;
191
+ };
192
+ slug: unknown;
193
+ props?: {
194
+ set: Record<string, unknown>;
195
+ unset: string[];
196
+ } | undefined;
197
+ } | {
198
+ op: "edge.update";
199
+ edge: {
200
+ source: string;
201
+ target: string;
202
+ class: string;
203
+ };
204
+ props: {
205
+ set: Record<string, unknown>;
206
+ unset: string[];
207
+ };
208
208
  } | {
209
209
  op: "edge.delete";
210
210
  edge: {
@@ -6,7 +6,10 @@ export declare const delegate: import("./model.js").MethodSyscall<Readonly<{
6
6
  principal: string;
7
7
  audience: string;
8
8
  ttlSeconds: number;
9
- attenuation?: unknown;
9
+ attenuation?: {
10
+ kind: "identity";
11
+ self: true;
12
+ } | undefined;
10
13
  }, {
11
14
  readonly mode: 'value';
12
15
  readonly value: string;
@@ -109,7 +112,6 @@ export declare const impersonate: import("./model.js").MethodSyscall<Readonly<{
109
112
  }>, "impersonate", import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
110
113
  audience?: string | undefined;
111
114
  ttlSeconds: number;
112
- grant?: unknown;
113
115
  identity: string;
114
116
  }, {
115
117
  readonly mode: 'value';
@@ -126,7 +128,6 @@ export declare const mint: import("./model.js").MethodSyscall<Readonly<{
126
128
  }>, "mint", import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
127
129
  audience?: string | undefined;
128
130
  ttlSeconds: number;
129
- grant?: unknown;
130
131
  }, {
131
132
  readonly mode: 'value';
132
133
  readonly value: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@astrale-os/kernel-core",
3
- "version": "0.9.0-beta.63",
3
+ "version": "0.9.0-beta.65",
4
4
  "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {
@@ -160,7 +160,7 @@
160
160
  "access": "public"
161
161
  },
162
162
  "dependencies": {
163
- "@astrale-os/kernel-dsl": "0.2.0-beta.45",
163
+ "@astrale-os/kernel-dsl": "0.2.0-beta.47",
164
164
  "@noble/hashes": "2.3.0",
165
165
  "@types/json-schema": "^7.0.15",
166
166
  "dequal": "2.0.3"
@@ -1,4 +0,0 @@
1
- import type { Grant } from '../grant/index.js';
2
- import type { AuthorityExpr, AuthorityPredicate } from './language/index.js';
3
- /** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
4
- export declare function prepareGrantBody(where: AuthorityExpr): (grant: Grant) => AuthorityPredicate;
@@ -1,27 +0,0 @@
1
- import * as portable from '@astrale-os/kernel-dsl/value';
2
- import { accept as acceptGrant, canonicalize as canonicalizeGrant } from '../grant/index.js';
3
- import { admitGrantBody } from './admission/index.js';
4
- import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
5
- import { normalizeGrantBodyAdmitted } from './normalization/index.js';
6
- import { ownCanonical } from './ownership.optimization.js';
7
- /** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
8
- export function prepareGrantBody(where) {
9
- const admitted = admitGrantBody(portable.acceptForRead(where));
10
- const body = portable.acceptImmutable(normalizeGrantBodyAdmitted(admitted));
11
- return grantBinder(body);
12
- }
13
- // A distinct closure scope retains only the normalized body, never an initial Grant or caller input.
14
- function grantBinder(where) {
15
- return (grant) => {
16
- // Charge the entire expression on every binding, including the body and its outer container.
17
- const value = portable.acceptForRead({ op: 'grant', grant, where });
18
- return ownCanonical(Object.freeze({
19
- version: AUTHORITY_PREDICATE_VERSION,
20
- predicate: Object.freeze({
21
- op: 'grant',
22
- grant: canonicalizeGrant(acceptGrant(value.grant)),
23
- where,
24
- }),
25
- }));
26
- };
27
- }
@@ -1,7 +0,0 @@
1
- import * as portable from '@astrale-os/kernel-dsl/value';
2
- import type { IdentityExpr } from '../language/index.js';
3
- export declare const EXPRESSION_DEPTH_LIMIT = 32;
4
- export declare const EXPRESSION_OPERAND_LIMIT = 64;
5
- /** Validate and canonicalize a resolved expression. */
6
- export declare function canonicalize(expr: IdentityExpr): IdentityExpr;
7
- export declare function admitResolvedExpression(input: portable.Value, path: string, depth: number): IdentityExpr;
@@ -1,102 +0,0 @@
1
- import * as portable from '@astrale-os/kernel-dsl/value';
2
- import { NodeId } from '../../../graph/node/index.js';
3
- import { AuthValueError } from '../../error.js';
4
- export const EXPRESSION_DEPTH_LIMIT = 32;
5
- export const EXPRESSION_OPERAND_LIMIT = 64;
6
- /** Validate and canonicalize a resolved expression. */
7
- export function canonicalize(expr) {
8
- try {
9
- return admit(portable.accept(expr), '', 0);
10
- }
11
- catch (cause) {
12
- if (cause instanceof AuthValueError)
13
- throw cause;
14
- throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved Identity expression', '', {
15
- cause,
16
- });
17
- }
18
- }
19
- export function admitResolvedExpression(input, path, depth) {
20
- return admit(input, path, depth);
21
- }
22
- function admit(input, path, depth) {
23
- if (depth > EXPRESSION_DEPTH_LIMIT)
24
- invalid(path, 'Identity expression exceeds its depth limit');
25
- const value = record(input, path);
26
- switch (value.kind) {
27
- case 'identity':
28
- exact(value, ['id', 'kind'], path);
29
- if (typeof value.id !== 'string')
30
- invalid(`${path}/id`, 'Expected a NodeId');
31
- return Object.freeze({ kind: 'identity', id: NodeId(value.id) });
32
- case 'union':
33
- case 'intersect': {
34
- exact(value, ['kind', 'operands'], path);
35
- const source = list(value.operands, `${path}/operands`, 2);
36
- const kind = value.kind;
37
- const operands = unique(source
38
- .map((operand, index) => admit(operand, `${path}/operands/${index}`, depth + 1))
39
- .flatMap((operand) => (operand.kind === kind ? operand.operands : [operand])));
40
- if (operands.length > EXPRESSION_OPERAND_LIMIT) {
41
- invalid(`${path}/operands`, `Expected 2-${EXPRESSION_OPERAND_LIMIT} operands`);
42
- }
43
- return operands.length === 1
44
- ? operands[0]
45
- : Object.freeze({ kind, operands: Object.freeze(operands) });
46
- }
47
- case 'exclude': {
48
- exact(value, ['base', 'excluded', 'kind'], path);
49
- const excluded = unique(list(value.excluded, `${path}/excluded`, 1)
50
- .map((operand, index) => admit(operand, `${path}/excluded/${index}`, depth + 1))
51
- .flatMap((operand) => (operand.kind === 'union' ? operand.operands : [operand])));
52
- if (excluded.length > EXPRESSION_OPERAND_LIMIT) {
53
- invalid(`${path}/excluded`, `Expected 1-${EXPRESSION_OPERAND_LIMIT} operands`);
54
- }
55
- return Object.freeze({
56
- kind: 'exclude',
57
- base: admit(required(value.base, `${path}/base`), `${path}/base`, depth + 1),
58
- excluded: Object.freeze(excluded),
59
- });
60
- }
61
- default:
62
- invalid(`${path}/kind`, 'Expected identity, union, intersect, or exclude');
63
- }
64
- }
65
- function unique(input) {
66
- const keyed = input
67
- .map((expr) => ({ expr, key: portable.json.serialize(expr) }))
68
- .sort((left, right) => compare(left.key, right.key));
69
- return keyed
70
- .filter((entry, index) => index === 0 || entry.key !== keyed[index - 1].key)
71
- .map((entry) => entry.expr);
72
- }
73
- function record(input, path) {
74
- if (input === null || Array.isArray(input) || typeof input !== 'object') {
75
- invalid(path, 'Expected an object');
76
- }
77
- return input;
78
- }
79
- function list(input, path, minimum) {
80
- if (!Array.isArray(input) || input.length < minimum || input.length > EXPRESSION_OPERAND_LIMIT) {
81
- invalid(path, `Expected ${minimum}-${EXPRESSION_OPERAND_LIMIT} operands`);
82
- }
83
- return input;
84
- }
85
- function required(input, path) {
86
- if (input === undefined)
87
- invalid(path, 'Expected a value');
88
- return input;
89
- }
90
- function exact(value, expected, path) {
91
- const actual = Object.keys(value).sort(compare);
92
- const wanted = [...expected].sort(compare);
93
- if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
94
- invalid(path, `Expected exactly ${expected.join(', ')}`);
95
- }
96
- }
97
- function compare(left, right) {
98
- return left < right ? -1 : left > right ? 1 : 0;
99
- }
100
- function invalid(path, message) {
101
- throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
102
- }
@@ -1,2 +0,0 @@
1
- export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
2
- export { raiseDenials } from './raise-denials.js';
@@ -1,2 +0,0 @@
1
- export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
2
- export { raiseDenials } from './raise-denials.js';
@@ -1,3 +0,0 @@
1
- import type { IdentityExpr } from '../language/index.js';
2
- /** Raise every positive-position exclusion into one Grant-wide veto. */
3
- export declare function raiseDenials(expr: IdentityExpr): IdentityExpr;
@@ -1,59 +0,0 @@
1
- /** Raise every positive-position exclusion into one Grant-wide veto. */
2
- export function raiseDenials(expr) {
3
- const denials = [...collectDenials(expr, new WeakMap())];
4
- if (denials.length === 0)
5
- return expr;
6
- return Object.freeze({
7
- kind: 'exclude',
8
- base: stripExcludes(expr, new WeakMap()),
9
- excluded: Object.freeze(denials),
10
- });
11
- }
12
- function stripExcludes(expr, memo) {
13
- const cached = memo.get(expr);
14
- if (cached !== undefined)
15
- return cached;
16
- let stripped;
17
- switch (expr.kind) {
18
- case 'identity':
19
- stripped = expr;
20
- break;
21
- case 'union':
22
- case 'intersect':
23
- stripped = Object.freeze({
24
- kind: expr.kind,
25
- operands: Object.freeze(expr.operands.map((operand) => stripExcludes(operand, memo))),
26
- });
27
- break;
28
- case 'exclude':
29
- stripped = stripExcludes(expr.base, memo);
30
- break;
31
- }
32
- memo.set(expr, stripped);
33
- return stripped;
34
- }
35
- function collectDenials(expr, memo) {
36
- const cached = memo.get(expr);
37
- if (cached !== undefined)
38
- return cached;
39
- const denials = new Set();
40
- switch (expr.kind) {
41
- case 'identity':
42
- break;
43
- case 'union':
44
- case 'intersect':
45
- for (const operand of expr.operands) {
46
- for (const denial of collectDenials(operand, memo))
47
- denials.add(denial);
48
- }
49
- break;
50
- case 'exclude':
51
- for (const excluded of expr.excluded)
52
- denials.add(excluded);
53
- for (const denial of collectDenials(expr.base, memo))
54
- denials.add(denial);
55
- break;
56
- }
57
- memo.set(expr, denials);
58
- return denials;
59
- }
@@ -1,12 +0,0 @@
1
- import type { NodePath } from '../../path/index.js';
2
- export declare class GraphPathAmbiguousError extends Error {
3
- readonly path: NodePath;
4
- readonly matches: number;
5
- readonly code: 'GRAPH_PATH_AMBIGUOUS';
6
- constructor(path: NodePath, matches: number);
7
- }
8
- export declare class GraphPathWalkerRequiredError extends Error {
9
- readonly path: NodePath;
10
- readonly code: 'GRAPH_PATH_WALKER_REQUIRED';
11
- constructor(path: NodePath);
12
- }
@@ -1,20 +0,0 @@
1
- export class GraphPathAmbiguousError extends Error {
2
- path;
3
- matches;
4
- code = 'GRAPH_PATH_AMBIGUOUS';
5
- constructor(path, matches) {
6
- super(`Graph Path ${JSON.stringify(path)} matched ${matches} distinct Nodes.`);
7
- this.path = path;
8
- this.matches = matches;
9
- this.name = 'GraphPathAmbiguousError';
10
- }
11
- }
12
- export class GraphPathWalkerRequiredError extends Error {
13
- path;
14
- code = 'GRAPH_PATH_WALKER_REQUIRED';
15
- constructor(path) {
16
- super(`Graph Path ${JSON.stringify(path)} requires a walker.`);
17
- this.path = path;
18
- this.name = 'GraphPathWalkerRequiredError';
19
- }
20
- }
@@ -1,2 +0,0 @@
1
- export type { GraphPathContext, GraphPathWalker } from './model.js';
2
- export { GraphPathAmbiguousError, GraphPathWalkerRequiredError } from './error.js';
@@ -1 +0,0 @@
1
- export { GraphPathAmbiguousError, GraphPathWalkerRequiredError } from './error.js';
@@ -1,15 +0,0 @@
1
- import type { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
2
- import type { EdgeOrientation } from '@astrale-os/kernel-dsl/v1/language';
3
- import type { Node } from '../../node/index.js';
4
- import type { Path } from '../../path/index.js';
5
- import type { GraphEdges, GraphNodes } from '../indexes/index.js';
6
- /** Semantic read-only graph capabilities available to a Path walker. */
7
- export interface GraphPathContext {
8
- readonly nodes: GraphNodes;
9
- readonly edges: GraphEdges;
10
- orientation(classKey: ClassKey): EdgeOrientation | undefined;
11
- }
12
- /** Pure injected semantics for walking one Path against an admitted Graph. */
13
- export interface GraphPathWalker {
14
- walk(path: Path, context: GraphPathContext): Node | undefined;
15
- }
@@ -1,2 +0,0 @@
1
- import type { GraphPathWalker } from '#graph/graph';
2
- export declare const projectionPathWalker: GraphPathWalker;