@astrale-os/kernel-core 0.9.0-beta.63 → 0.9.0-beta.65
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/authority/admission/admission.d.ts +2 -2
- package/dist/auth/authority/admission/admission.js +10 -8
- package/dist/auth/authority/admission/index.d.ts +1 -1
- package/dist/auth/authority/admission/index.js +1 -1
- package/dist/auth/authority/index.d.ts +7 -3
- package/dist/auth/authority/index.js +4 -2
- package/dist/auth/authority/language/index.d.ts +2 -0
- package/dist/auth/authority/language/index.js +1 -0
- package/dist/auth/authority/language/predicate.d.ts +10 -5
- package/dist/auth/authority/language/predicate.js +1 -1
- package/dist/auth/authority/language/program.d.ts +21 -0
- package/dist/auth/authority/language/program.js +2 -0
- package/dist/auth/authority/normalization/index.d.ts +1 -1
- package/dist/auth/authority/normalization/index.js +1 -1
- package/dist/auth/authority/normalization/normalize.d.ts +1 -1
- package/dist/auth/authority/normalization/normalize.js +4 -5
- package/dist/auth/authority/ownership.optimization.js +2 -2
- package/dist/auth/authority/prepare-binder-body.d.ts +4 -0
- package/dist/auth/authority/prepare-binder-body.js +31 -0
- package/dist/auth/authority/program.d.ts +28 -0
- package/dist/auth/authority/program.js +191 -0
- package/dist/auth/authority/semantics/class-authority.d.ts +8 -0
- package/dist/auth/authority/semantics/class-authority.js +26 -0
- package/dist/auth/authority/semantics/composition.d.ts +39 -0
- package/dist/auth/authority/semantics/composition.js +112 -0
- package/dist/auth/authority/semantics/failure.d.ts +21 -0
- package/dist/auth/authority/semantics/failure.js +10 -0
- package/dist/auth/authority/semantics/index.d.ts +11 -0
- package/dist/auth/authority/semantics/index.js +5 -0
- package/dist/auth/authority/semantics/interpret.d.ts +35 -0
- package/dist/auth/authority/semantics/interpret.js +215 -0
- package/dist/auth/authority/semantics/snapshot.d.ts +34 -0
- package/dist/auth/authority/semantics/terms.d.ts +20 -0
- package/dist/auth/authority/semantics/terms.js +96 -0
- package/dist/auth/authority/semantics/vocabulary.d.ts +19 -0
- package/dist/auth/authority/semantics/vocabulary.js +1 -0
- package/dist/auth/context/context.d.ts +4 -3
- package/dist/auth/expression/authoring/builder.d.ts +2 -11
- package/dist/auth/expression/authoring/builder.js +1 -45
- package/dist/auth/expression/authoring/index.d.ts +1 -1
- package/dist/auth/expression/authoring/index.js +1 -1
- package/dist/auth/expression/index.d.ts +1 -2
- package/dist/auth/expression/index.js +1 -2
- package/dist/auth/expression/language/identity-expression.d.ts +2 -22
- package/dist/auth/grant/index.d.ts +1 -1
- package/dist/auth/grant/index.js +1 -1
- package/dist/auth/grant/resolved/admission.d.ts +4 -3
- package/dist/auth/grant/resolved/admission.js +23 -13
- package/dist/auth/grant/resolved/grant.d.ts +1 -1
- package/dist/auth/grant/resolved/index.d.ts +1 -1
- package/dist/auth/grant/resolved/index.js +1 -1
- package/dist/auth/grant/unresolved/admission.d.ts +4 -1
- package/dist/auth/grant/unresolved/admission.js +27 -67
- package/dist/auth/grant/unresolved/limits.d.ts +2 -4
- package/dist/auth/grant/unresolved/limits.js +1 -5
- package/dist/auth/index.d.ts +1 -1
- package/dist/graph/graph/graph.d.ts +1 -5
- package/dist/graph/graph/graph.js +3 -27
- package/dist/graph/graph/index.d.ts +1 -3
- package/dist/graph/graph/index.js +1 -2
- package/dist/graph/query/index.d.ts +2 -0
- package/dist/graph/query/index.js +1 -0
- package/dist/graph/query/order/index.d.ts +46 -0
- package/dist/graph/query/order/index.js +59 -0
- package/dist/graph/query/reference/evaluate.js +24 -50
- package/dist/graph/reconcile/planning/canonical.d.ts +6 -0
- package/dist/graph/reconcile/planning/canonical.js +28 -0
- package/dist/graph/reconcile/planning/model.d.ts +4 -0
- package/dist/graph/reconcile/planning/plan.js +2 -1
- package/dist/schema/authority/vocabulary.d.ts +3 -0
- package/dist/schema/authority/vocabulary.js +25 -0
- package/dist/schema/callables/function.d.ts +120 -90
- package/dist/schema/domain/domain.d.ts +120 -90
- package/dist/schema/identity/composition.d.ts +5 -0
- package/dist/schema/identity/composition.js +5 -0
- package/dist/schema/identity/identity.d.ts +8 -6
- package/dist/schema/index.d.ts +1 -0
- package/dist/schema/index.js +1 -0
- package/dist/schema/kernel/schema.d.ts +337 -276
- package/dist/schema/kernel/syscalls/contracts/delegate.d.ts +4 -1
- package/dist/schema/kernel/syscalls/contracts/delegate.js +4 -3
- package/dist/schema/kernel/syscalls/contracts/impersonate.d.ts +0 -1
- package/dist/schema/kernel/syscalls/contracts/legacy/delegate.d.ts +5 -0
- package/dist/schema/kernel/syscalls/contracts/legacy/delegate.js +25 -0
- package/dist/schema/kernel/syscalls/contracts/mint.d.ts +0 -1
- package/dist/schema/kernel/syscalls/contracts/mint.js +1 -2
- package/dist/schema/kernel/syscalls/declarations/delegate.d.ts +4 -1
- package/dist/schema/kernel/syscalls/declarations/impersonate.d.ts +0 -1
- package/dist/schema/kernel/syscalls/declarations/index.d.ts +35 -34
- package/dist/schema/kernel/syscalls/declarations/install.d.ts +8 -8
- package/dist/schema/kernel/syscalls/declarations/mint.d.ts +0 -1
- package/dist/schema/kernel/syscalls/declarations/mutate.d.ts +23 -23
- package/dist/schema/kernel/syscalls/descriptors/identity.d.ts +4 -3
- package/package.json +2 -2
- package/dist/auth/authority/prepare-grant-body.d.ts +0 -4
- package/dist/auth/authority/prepare-grant-body.js +0 -27
- package/dist/auth/expression/normalization/canonicalize.d.ts +0 -7
- package/dist/auth/expression/normalization/canonicalize.js +0 -102
- package/dist/auth/expression/normalization/index.d.ts +0 -2
- package/dist/auth/expression/normalization/index.js +0 -2
- package/dist/auth/expression/normalization/raise-denials.d.ts +0 -3
- package/dist/auth/expression/normalization/raise-denials.js +0 -59
- package/dist/graph/graph/navigation/error.d.ts +0 -12
- package/dist/graph/graph/navigation/error.js +0 -20
- package/dist/graph/graph/navigation/index.d.ts +0 -2
- package/dist/graph/graph/navigation/index.js +0 -1
- package/dist/graph/graph/navigation/model.d.ts +0 -15
- package/dist/schema/kernel/projection/path.d.ts +0 -2
- package/dist/schema/kernel/projection/path.js +0 -113
- /package/dist/{graph/graph/navigation/model.js → auth/authority/semantics/snapshot.js} +0 -0
|
@@ -2,6 +2,9 @@ export declare const delegateInput: import("zod").ZodObject<{
|
|
|
2
2
|
principal: import("zod").ZodString;
|
|
3
3
|
audience: import("zod").ZodString;
|
|
4
4
|
ttlSeconds: import("zod").ZodNumber;
|
|
5
|
-
attenuation: import("zod").ZodOptional<import("zod").
|
|
5
|
+
attenuation: import("zod").ZodOptional<import("zod").ZodObject<{
|
|
6
|
+
kind: import("zod").ZodLiteral<"identity">;
|
|
7
|
+
self: import("zod").ZodLiteral<true>;
|
|
8
|
+
}, import("zod/v4/core").$strict>>;
|
|
6
9
|
}, import("zod/v4/core").$strict>;
|
|
7
10
|
export declare const delegateOutput: import("zod").ZodString;
|
|
@@ -1,10 +1,11 @@
|
|
|
1
|
-
import { number, strictObject, string
|
|
1
|
+
import { number, strictObject, string } from 'zod';
|
|
2
|
+
import { selfAttenuation } from './legacy/delegate.js';
|
|
2
3
|
const text = string().min(1);
|
|
3
4
|
export const delegateInput = strictObject({
|
|
4
5
|
principal: text,
|
|
5
6
|
audience: text,
|
|
6
7
|
ttlSeconds: number().int().min(1),
|
|
7
|
-
/**
|
|
8
|
-
attenuation:
|
|
8
|
+
/** @deprecated Ignored; admitted only as the self expression published Clients send. */
|
|
9
|
+
attenuation: selfAttenuation.optional(),
|
|
9
10
|
});
|
|
10
11
|
export const delegateOutput = text;
|
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
export declare const impersonateInput: import("zod").ZodObject<{
|
|
2
2
|
audience: import("zod").ZodOptional<import("zod").ZodString>;
|
|
3
3
|
ttlSeconds: import("zod").ZodNumber;
|
|
4
|
-
grant: import("zod").ZodOptional<import("zod").ZodUnknown>;
|
|
5
4
|
identity: import("zod").ZodString;
|
|
6
5
|
}, import("zod/v4/core").$strict>;
|
|
7
6
|
export declare const impersonateOutput: import("zod").ZodString;
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
/** @deprecated The only `attenuation` value `Identity.delegate` still admits, and ignores. */
|
|
2
|
+
export declare const selfAttenuation: import("zod").ZodObject<{
|
|
3
|
+
kind: import("zod").ZodLiteral<"identity">;
|
|
4
|
+
self: import("zod").ZodLiteral<true>;
|
|
5
|
+
}, import("zod/v4/core").$strict>;
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `Identity.delegate` keeps admitting the one `attenuation` value published Clients send: the self
|
|
3
|
+
* expression `{ kind: 'identity', self: true }`. It names the caller the delegation preserves
|
|
4
|
+
* anyway, so it carries no meaning: the handler ignores it and issues exactly the credential the
|
|
5
|
+
* same input without the field yields. Every other value, `null` included, stays refused.
|
|
6
|
+
*
|
|
7
|
+
* @deprecated Omit `attenuation`; a delegation always preserves the authenticated caller (ADR-3).
|
|
8
|
+
*
|
|
9
|
+
* Short-term consumers: `@astrale-os/kernel-client` 0.6.0-beta.77 to beta.85, whose Domain token
|
|
10
|
+
* exchange always sends it (`client/session/exchange/exchange.ts`, `SELF_ATTENUATION`), so the
|
|
11
|
+
* Console, the GUI, the Admin upgrade executor and the CLI through 1.0.0-beta.126 (exchange and
|
|
12
|
+
* `astrale token`). The 1Pact Host runs Kernel 0.12.0-beta.117, which requires the field, so a
|
|
13
|
+
* Client that serves both Kernels sends it.
|
|
14
|
+
*
|
|
15
|
+
* Removal, in a separate breaking release, once every consumer runs a Client that omits the field
|
|
16
|
+
* and the 0.12.0-beta.117 consumer Host is retired: delete this file and the `attenuation` member
|
|
17
|
+
* of `../delegate.ts`, then make the self vectors of TEST-REJECTS-AUTHORITY-EXPRESSIONS-IN-ISSUANCE-INPUTS
|
|
18
|
+
* and of the SYS-6 dispatch test expect refusal again.
|
|
19
|
+
*/
|
|
20
|
+
import { literal, strictObject } from 'zod';
|
|
21
|
+
/** @deprecated The only `attenuation` value `Identity.delegate` still admits, and ignores. */
|
|
22
|
+
export const selfAttenuation = strictObject({
|
|
23
|
+
kind: literal('identity'),
|
|
24
|
+
self: literal(true),
|
|
25
|
+
}).meta({ deprecated: true });
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
export declare const mintInput: import("zod").ZodObject<{
|
|
2
2
|
audience: import("zod").ZodOptional<import("zod").ZodString>;
|
|
3
3
|
ttlSeconds: import("zod").ZodNumber;
|
|
4
|
-
grant: import("zod").ZodOptional<import("zod").ZodUnknown>;
|
|
5
4
|
}, import("zod/v4/core").$strict>;
|
|
6
5
|
export declare const mintOutput: import("zod").ZodString;
|
|
@@ -1,8 +1,7 @@
|
|
|
1
|
-
import { number, strictObject, string
|
|
1
|
+
import { number, strictObject, string } from 'zod';
|
|
2
2
|
const text = string().min(1);
|
|
3
3
|
export const mintInput = strictObject({
|
|
4
4
|
audience: text.optional(),
|
|
5
5
|
ttlSeconds: number().int().min(1),
|
|
6
|
-
grant: unknownSchema().optional(),
|
|
7
6
|
});
|
|
8
7
|
export const mintOutput = text;
|
|
@@ -3,7 +3,10 @@ export declare const Delegate: builder.Method<builder.CallableProjection<{
|
|
|
3
3
|
principal: string;
|
|
4
4
|
audience: string;
|
|
5
5
|
ttlSeconds: number;
|
|
6
|
-
attenuation?:
|
|
6
|
+
attenuation?: {
|
|
7
|
+
kind: "identity";
|
|
8
|
+
self: true;
|
|
9
|
+
} | undefined;
|
|
7
10
|
}, {
|
|
8
11
|
readonly mode: 'value';
|
|
9
12
|
readonly value: string;
|
|
@@ -399,29 +399,6 @@ export declare const Functions: Readonly<{
|
|
|
399
399
|
};
|
|
400
400
|
})[];
|
|
401
401
|
operations: ({
|
|
402
|
-
op: "edge.update";
|
|
403
|
-
edge: {
|
|
404
|
-
source: string;
|
|
405
|
-
target: string;
|
|
406
|
-
class: string;
|
|
407
|
-
};
|
|
408
|
-
slug: unknown;
|
|
409
|
-
props?: {
|
|
410
|
-
set: Record<string, unknown>;
|
|
411
|
-
unset: string[];
|
|
412
|
-
} | undefined;
|
|
413
|
-
} | {
|
|
414
|
-
op: "edge.update";
|
|
415
|
-
edge: {
|
|
416
|
-
source: string;
|
|
417
|
-
target: string;
|
|
418
|
-
class: string;
|
|
419
|
-
};
|
|
420
|
-
props: {
|
|
421
|
-
set: Record<string, unknown>;
|
|
422
|
-
unset: string[];
|
|
423
|
-
};
|
|
424
|
-
} | {
|
|
425
402
|
op: "node.create";
|
|
426
403
|
as: string;
|
|
427
404
|
class: string;
|
|
@@ -449,6 +426,29 @@ export declare const Functions: Readonly<{
|
|
|
449
426
|
};
|
|
450
427
|
slug?: unknown;
|
|
451
428
|
props: Record<string, unknown>;
|
|
429
|
+
} | {
|
|
430
|
+
op: "edge.update";
|
|
431
|
+
edge: {
|
|
432
|
+
source: string;
|
|
433
|
+
target: string;
|
|
434
|
+
class: string;
|
|
435
|
+
};
|
|
436
|
+
slug: unknown;
|
|
437
|
+
props?: {
|
|
438
|
+
set: Record<string, unknown>;
|
|
439
|
+
unset: string[];
|
|
440
|
+
} | undefined;
|
|
441
|
+
} | {
|
|
442
|
+
op: "edge.update";
|
|
443
|
+
edge: {
|
|
444
|
+
source: string;
|
|
445
|
+
target: string;
|
|
446
|
+
class: string;
|
|
447
|
+
};
|
|
448
|
+
props: {
|
|
449
|
+
set: Record<string, unknown>;
|
|
450
|
+
unset: string[];
|
|
451
|
+
};
|
|
452
452
|
} | {
|
|
453
453
|
op: "edge.delete";
|
|
454
454
|
edge: {
|
|
@@ -493,6 +493,14 @@ export declare const Functions: Readonly<{
|
|
|
493
493
|
install: builder.Function<builder.CallableProjection<{
|
|
494
494
|
operation: string;
|
|
495
495
|
domains: ({
|
|
496
|
+
publication: {
|
|
497
|
+
url: string;
|
|
498
|
+
token?: string | undefined;
|
|
499
|
+
etag?: string | undefined;
|
|
500
|
+
};
|
|
501
|
+
revision?: string | undefined;
|
|
502
|
+
currentRevision?: string | null | undefined;
|
|
503
|
+
} | {
|
|
496
504
|
artifact: {
|
|
497
505
|
digest: string;
|
|
498
506
|
mediaType: string;
|
|
@@ -514,14 +522,6 @@ export declare const Functions: Readonly<{
|
|
|
514
522
|
} | undefined;
|
|
515
523
|
revision?: string | undefined;
|
|
516
524
|
currentRevision?: string | null | undefined;
|
|
517
|
-
} | {
|
|
518
|
-
publication: {
|
|
519
|
-
url: string;
|
|
520
|
-
token?: string | undefined;
|
|
521
|
-
etag?: string | undefined;
|
|
522
|
-
};
|
|
523
|
-
revision?: string | undefined;
|
|
524
|
-
currentRevision?: string | null | undefined;
|
|
525
525
|
})[];
|
|
526
526
|
}, {
|
|
527
527
|
readonly mode: 'binary';
|
|
@@ -616,7 +616,10 @@ export declare const IdentityMethods: Readonly<{
|
|
|
616
616
|
principal: string;
|
|
617
617
|
audience: string;
|
|
618
618
|
ttlSeconds: number;
|
|
619
|
-
attenuation?:
|
|
619
|
+
attenuation?: {
|
|
620
|
+
kind: "identity";
|
|
621
|
+
self: true;
|
|
622
|
+
} | undefined;
|
|
620
623
|
}, {
|
|
621
624
|
readonly mode: 'value';
|
|
622
625
|
readonly value: string;
|
|
@@ -687,7 +690,6 @@ export declare const IdentityMethods: Readonly<{
|
|
|
687
690
|
mint: builder.Method<builder.CallableProjection<{
|
|
688
691
|
audience?: string | undefined;
|
|
689
692
|
ttlSeconds: number;
|
|
690
|
-
grant?: unknown;
|
|
691
693
|
}, {
|
|
692
694
|
readonly mode: 'value';
|
|
693
695
|
readonly value: string;
|
|
@@ -695,7 +697,6 @@ export declare const IdentityMethods: Readonly<{
|
|
|
695
697
|
impersonate: builder.Method<builder.CallableProjection<{
|
|
696
698
|
audience?: string | undefined;
|
|
697
699
|
ttlSeconds: number;
|
|
698
|
-
grant?: unknown;
|
|
699
700
|
identity: string;
|
|
700
701
|
}, {
|
|
701
702
|
readonly mode: 'value';
|
|
@@ -2,6 +2,14 @@ import { type builder } from '@astrale-os/kernel-dsl/v1';
|
|
|
2
2
|
export declare const Install: builder.Function<builder.CallableProjection<{
|
|
3
3
|
operation: string;
|
|
4
4
|
domains: ({
|
|
5
|
+
publication: {
|
|
6
|
+
url: string;
|
|
7
|
+
token?: string | undefined;
|
|
8
|
+
etag?: string | undefined;
|
|
9
|
+
};
|
|
10
|
+
revision?: string | undefined;
|
|
11
|
+
currentRevision?: string | null | undefined;
|
|
12
|
+
} | {
|
|
5
13
|
artifact: {
|
|
6
14
|
digest: string;
|
|
7
15
|
mediaType: string;
|
|
@@ -23,14 +31,6 @@ export declare const Install: builder.Function<builder.CallableProjection<{
|
|
|
23
31
|
} | undefined;
|
|
24
32
|
revision?: string | undefined;
|
|
25
33
|
currentRevision?: string | null | undefined;
|
|
26
|
-
} | {
|
|
27
|
-
publication: {
|
|
28
|
-
url: string;
|
|
29
|
-
token?: string | undefined;
|
|
30
|
-
etag?: string | undefined;
|
|
31
|
-
};
|
|
32
|
-
revision?: string | undefined;
|
|
33
|
-
currentRevision?: string | null | undefined;
|
|
34
34
|
})[];
|
|
35
35
|
}, {
|
|
36
36
|
readonly mode: 'binary';
|
|
@@ -155,29 +155,6 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
|
|
|
155
155
|
};
|
|
156
156
|
})[];
|
|
157
157
|
operations: ({
|
|
158
|
-
op: "edge.update";
|
|
159
|
-
edge: {
|
|
160
|
-
source: string;
|
|
161
|
-
target: string;
|
|
162
|
-
class: string;
|
|
163
|
-
};
|
|
164
|
-
slug: unknown;
|
|
165
|
-
props?: {
|
|
166
|
-
set: Record<string, unknown>;
|
|
167
|
-
unset: string[];
|
|
168
|
-
} | undefined;
|
|
169
|
-
} | {
|
|
170
|
-
op: "edge.update";
|
|
171
|
-
edge: {
|
|
172
|
-
source: string;
|
|
173
|
-
target: string;
|
|
174
|
-
class: string;
|
|
175
|
-
};
|
|
176
|
-
props: {
|
|
177
|
-
set: Record<string, unknown>;
|
|
178
|
-
unset: string[];
|
|
179
|
-
};
|
|
180
|
-
} | {
|
|
181
158
|
op: "node.create";
|
|
182
159
|
as: string;
|
|
183
160
|
class: string;
|
|
@@ -205,6 +182,29 @@ export declare const Mutate: builder.Function<builder.CallableProjection<{
|
|
|
205
182
|
};
|
|
206
183
|
slug?: unknown;
|
|
207
184
|
props: Record<string, unknown>;
|
|
185
|
+
} | {
|
|
186
|
+
op: "edge.update";
|
|
187
|
+
edge: {
|
|
188
|
+
source: string;
|
|
189
|
+
target: string;
|
|
190
|
+
class: string;
|
|
191
|
+
};
|
|
192
|
+
slug: unknown;
|
|
193
|
+
props?: {
|
|
194
|
+
set: Record<string, unknown>;
|
|
195
|
+
unset: string[];
|
|
196
|
+
} | undefined;
|
|
197
|
+
} | {
|
|
198
|
+
op: "edge.update";
|
|
199
|
+
edge: {
|
|
200
|
+
source: string;
|
|
201
|
+
target: string;
|
|
202
|
+
class: string;
|
|
203
|
+
};
|
|
204
|
+
props: {
|
|
205
|
+
set: Record<string, unknown>;
|
|
206
|
+
unset: string[];
|
|
207
|
+
};
|
|
208
208
|
} | {
|
|
209
209
|
op: "edge.delete";
|
|
210
210
|
edge: {
|
|
@@ -6,7 +6,10 @@ export declare const delegate: import("./model.js").MethodSyscall<Readonly<{
|
|
|
6
6
|
principal: string;
|
|
7
7
|
audience: string;
|
|
8
8
|
ttlSeconds: number;
|
|
9
|
-
attenuation?:
|
|
9
|
+
attenuation?: {
|
|
10
|
+
kind: "identity";
|
|
11
|
+
self: true;
|
|
12
|
+
} | undefined;
|
|
10
13
|
}, {
|
|
11
14
|
readonly mode: 'value';
|
|
12
15
|
readonly value: string;
|
|
@@ -109,7 +112,6 @@ export declare const impersonate: import("./model.js").MethodSyscall<Readonly<{
|
|
|
109
112
|
}>, "impersonate", import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
|
|
110
113
|
audience?: string | undefined;
|
|
111
114
|
ttlSeconds: number;
|
|
112
|
-
grant?: unknown;
|
|
113
115
|
identity: string;
|
|
114
116
|
}, {
|
|
115
117
|
readonly mode: 'value';
|
|
@@ -126,7 +128,6 @@ export declare const mint: import("./model.js").MethodSyscall<Readonly<{
|
|
|
126
128
|
}>, "mint", import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
|
|
127
129
|
audience?: string | undefined;
|
|
128
130
|
ttlSeconds: number;
|
|
129
|
-
grant?: unknown;
|
|
130
131
|
}, {
|
|
131
132
|
readonly mode: 'value';
|
|
132
133
|
readonly value: string;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@astrale-os/kernel-core",
|
|
3
|
-
"version": "0.9.0-beta.
|
|
3
|
+
"version": "0.9.0-beta.65",
|
|
4
4
|
"description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -160,7 +160,7 @@
|
|
|
160
160
|
"access": "public"
|
|
161
161
|
},
|
|
162
162
|
"dependencies": {
|
|
163
|
-
"@astrale-os/kernel-dsl": "0.2.0-beta.
|
|
163
|
+
"@astrale-os/kernel-dsl": "0.2.0-beta.47",
|
|
164
164
|
"@noble/hashes": "2.3.0",
|
|
165
165
|
"@types/json-schema": "^7.0.15",
|
|
166
166
|
"dequal": "2.0.3"
|
|
@@ -1,4 +0,0 @@
|
|
|
1
|
-
import type { Grant } from '../grant/index.js';
|
|
2
|
-
import type { AuthorityExpr, AuthorityPredicate } from './language/index.js';
|
|
3
|
-
/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
|
|
4
|
-
export declare function prepareGrantBody(where: AuthorityExpr): (grant: Grant) => AuthorityPredicate;
|
|
@@ -1,27 +0,0 @@
|
|
|
1
|
-
import * as portable from '@astrale-os/kernel-dsl/value';
|
|
2
|
-
import { accept as acceptGrant, canonicalize as canonicalizeGrant } from '../grant/index.js';
|
|
3
|
-
import { admitGrantBody } from './admission/index.js';
|
|
4
|
-
import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
|
|
5
|
-
import { normalizeGrantBodyAdmitted } from './normalization/index.js';
|
|
6
|
-
import { ownCanonical } from './ownership.optimization.js';
|
|
7
|
-
/** Prepare one body in a fresh Grant subject scope, independently of any concrete Grant. */
|
|
8
|
-
export function prepareGrantBody(where) {
|
|
9
|
-
const admitted = admitGrantBody(portable.acceptForRead(where));
|
|
10
|
-
const body = portable.acceptImmutable(normalizeGrantBodyAdmitted(admitted));
|
|
11
|
-
return grantBinder(body);
|
|
12
|
-
}
|
|
13
|
-
// A distinct closure scope retains only the normalized body, never an initial Grant or caller input.
|
|
14
|
-
function grantBinder(where) {
|
|
15
|
-
return (grant) => {
|
|
16
|
-
// Charge the entire expression on every binding, including the body and its outer container.
|
|
17
|
-
const value = portable.acceptForRead({ op: 'grant', grant, where });
|
|
18
|
-
return ownCanonical(Object.freeze({
|
|
19
|
-
version: AUTHORITY_PREDICATE_VERSION,
|
|
20
|
-
predicate: Object.freeze({
|
|
21
|
-
op: 'grant',
|
|
22
|
-
grant: canonicalizeGrant(acceptGrant(value.grant)),
|
|
23
|
-
where,
|
|
24
|
-
}),
|
|
25
|
-
}));
|
|
26
|
-
};
|
|
27
|
-
}
|
|
@@ -1,7 +0,0 @@
|
|
|
1
|
-
import * as portable from '@astrale-os/kernel-dsl/value';
|
|
2
|
-
import type { IdentityExpr } from '../language/index.js';
|
|
3
|
-
export declare const EXPRESSION_DEPTH_LIMIT = 32;
|
|
4
|
-
export declare const EXPRESSION_OPERAND_LIMIT = 64;
|
|
5
|
-
/** Validate and canonicalize a resolved expression. */
|
|
6
|
-
export declare function canonicalize(expr: IdentityExpr): IdentityExpr;
|
|
7
|
-
export declare function admitResolvedExpression(input: portable.Value, path: string, depth: number): IdentityExpr;
|
|
@@ -1,102 +0,0 @@
|
|
|
1
|
-
import * as portable from '@astrale-os/kernel-dsl/value';
|
|
2
|
-
import { NodeId } from '../../../graph/node/index.js';
|
|
3
|
-
import { AuthValueError } from '../../error.js';
|
|
4
|
-
export const EXPRESSION_DEPTH_LIMIT = 32;
|
|
5
|
-
export const EXPRESSION_OPERAND_LIMIT = 64;
|
|
6
|
-
/** Validate and canonicalize a resolved expression. */
|
|
7
|
-
export function canonicalize(expr) {
|
|
8
|
-
try {
|
|
9
|
-
return admit(portable.accept(expr), '', 0);
|
|
10
|
-
}
|
|
11
|
-
catch (cause) {
|
|
12
|
-
if (cause instanceof AuthValueError)
|
|
13
|
-
throw cause;
|
|
14
|
-
throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved Identity expression', '', {
|
|
15
|
-
cause,
|
|
16
|
-
});
|
|
17
|
-
}
|
|
18
|
-
}
|
|
19
|
-
export function admitResolvedExpression(input, path, depth) {
|
|
20
|
-
return admit(input, path, depth);
|
|
21
|
-
}
|
|
22
|
-
function admit(input, path, depth) {
|
|
23
|
-
if (depth > EXPRESSION_DEPTH_LIMIT)
|
|
24
|
-
invalid(path, 'Identity expression exceeds its depth limit');
|
|
25
|
-
const value = record(input, path);
|
|
26
|
-
switch (value.kind) {
|
|
27
|
-
case 'identity':
|
|
28
|
-
exact(value, ['id', 'kind'], path);
|
|
29
|
-
if (typeof value.id !== 'string')
|
|
30
|
-
invalid(`${path}/id`, 'Expected a NodeId');
|
|
31
|
-
return Object.freeze({ kind: 'identity', id: NodeId(value.id) });
|
|
32
|
-
case 'union':
|
|
33
|
-
case 'intersect': {
|
|
34
|
-
exact(value, ['kind', 'operands'], path);
|
|
35
|
-
const source = list(value.operands, `${path}/operands`, 2);
|
|
36
|
-
const kind = value.kind;
|
|
37
|
-
const operands = unique(source
|
|
38
|
-
.map((operand, index) => admit(operand, `${path}/operands/${index}`, depth + 1))
|
|
39
|
-
.flatMap((operand) => (operand.kind === kind ? operand.operands : [operand])));
|
|
40
|
-
if (operands.length > EXPRESSION_OPERAND_LIMIT) {
|
|
41
|
-
invalid(`${path}/operands`, `Expected 2-${EXPRESSION_OPERAND_LIMIT} operands`);
|
|
42
|
-
}
|
|
43
|
-
return operands.length === 1
|
|
44
|
-
? operands[0]
|
|
45
|
-
: Object.freeze({ kind, operands: Object.freeze(operands) });
|
|
46
|
-
}
|
|
47
|
-
case 'exclude': {
|
|
48
|
-
exact(value, ['base', 'excluded', 'kind'], path);
|
|
49
|
-
const excluded = unique(list(value.excluded, `${path}/excluded`, 1)
|
|
50
|
-
.map((operand, index) => admit(operand, `${path}/excluded/${index}`, depth + 1))
|
|
51
|
-
.flatMap((operand) => (operand.kind === 'union' ? operand.operands : [operand])));
|
|
52
|
-
if (excluded.length > EXPRESSION_OPERAND_LIMIT) {
|
|
53
|
-
invalid(`${path}/excluded`, `Expected 1-${EXPRESSION_OPERAND_LIMIT} operands`);
|
|
54
|
-
}
|
|
55
|
-
return Object.freeze({
|
|
56
|
-
kind: 'exclude',
|
|
57
|
-
base: admit(required(value.base, `${path}/base`), `${path}/base`, depth + 1),
|
|
58
|
-
excluded: Object.freeze(excluded),
|
|
59
|
-
});
|
|
60
|
-
}
|
|
61
|
-
default:
|
|
62
|
-
invalid(`${path}/kind`, 'Expected identity, union, intersect, or exclude');
|
|
63
|
-
}
|
|
64
|
-
}
|
|
65
|
-
function unique(input) {
|
|
66
|
-
const keyed = input
|
|
67
|
-
.map((expr) => ({ expr, key: portable.json.serialize(expr) }))
|
|
68
|
-
.sort((left, right) => compare(left.key, right.key));
|
|
69
|
-
return keyed
|
|
70
|
-
.filter((entry, index) => index === 0 || entry.key !== keyed[index - 1].key)
|
|
71
|
-
.map((entry) => entry.expr);
|
|
72
|
-
}
|
|
73
|
-
function record(input, path) {
|
|
74
|
-
if (input === null || Array.isArray(input) || typeof input !== 'object') {
|
|
75
|
-
invalid(path, 'Expected an object');
|
|
76
|
-
}
|
|
77
|
-
return input;
|
|
78
|
-
}
|
|
79
|
-
function list(input, path, minimum) {
|
|
80
|
-
if (!Array.isArray(input) || input.length < minimum || input.length > EXPRESSION_OPERAND_LIMIT) {
|
|
81
|
-
invalid(path, `Expected ${minimum}-${EXPRESSION_OPERAND_LIMIT} operands`);
|
|
82
|
-
}
|
|
83
|
-
return input;
|
|
84
|
-
}
|
|
85
|
-
function required(input, path) {
|
|
86
|
-
if (input === undefined)
|
|
87
|
-
invalid(path, 'Expected a value');
|
|
88
|
-
return input;
|
|
89
|
-
}
|
|
90
|
-
function exact(value, expected, path) {
|
|
91
|
-
const actual = Object.keys(value).sort(compare);
|
|
92
|
-
const wanted = [...expected].sort(compare);
|
|
93
|
-
if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
|
|
94
|
-
invalid(path, `Expected exactly ${expected.join(', ')}`);
|
|
95
|
-
}
|
|
96
|
-
}
|
|
97
|
-
function compare(left, right) {
|
|
98
|
-
return left < right ? -1 : left > right ? 1 : 0;
|
|
99
|
-
}
|
|
100
|
-
function invalid(path, message) {
|
|
101
|
-
throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
|
|
102
|
-
}
|
|
@@ -1,59 +0,0 @@
|
|
|
1
|
-
/** Raise every positive-position exclusion into one Grant-wide veto. */
|
|
2
|
-
export function raiseDenials(expr) {
|
|
3
|
-
const denials = [...collectDenials(expr, new WeakMap())];
|
|
4
|
-
if (denials.length === 0)
|
|
5
|
-
return expr;
|
|
6
|
-
return Object.freeze({
|
|
7
|
-
kind: 'exclude',
|
|
8
|
-
base: stripExcludes(expr, new WeakMap()),
|
|
9
|
-
excluded: Object.freeze(denials),
|
|
10
|
-
});
|
|
11
|
-
}
|
|
12
|
-
function stripExcludes(expr, memo) {
|
|
13
|
-
const cached = memo.get(expr);
|
|
14
|
-
if (cached !== undefined)
|
|
15
|
-
return cached;
|
|
16
|
-
let stripped;
|
|
17
|
-
switch (expr.kind) {
|
|
18
|
-
case 'identity':
|
|
19
|
-
stripped = expr;
|
|
20
|
-
break;
|
|
21
|
-
case 'union':
|
|
22
|
-
case 'intersect':
|
|
23
|
-
stripped = Object.freeze({
|
|
24
|
-
kind: expr.kind,
|
|
25
|
-
operands: Object.freeze(expr.operands.map((operand) => stripExcludes(operand, memo))),
|
|
26
|
-
});
|
|
27
|
-
break;
|
|
28
|
-
case 'exclude':
|
|
29
|
-
stripped = stripExcludes(expr.base, memo);
|
|
30
|
-
break;
|
|
31
|
-
}
|
|
32
|
-
memo.set(expr, stripped);
|
|
33
|
-
return stripped;
|
|
34
|
-
}
|
|
35
|
-
function collectDenials(expr, memo) {
|
|
36
|
-
const cached = memo.get(expr);
|
|
37
|
-
if (cached !== undefined)
|
|
38
|
-
return cached;
|
|
39
|
-
const denials = new Set();
|
|
40
|
-
switch (expr.kind) {
|
|
41
|
-
case 'identity':
|
|
42
|
-
break;
|
|
43
|
-
case 'union':
|
|
44
|
-
case 'intersect':
|
|
45
|
-
for (const operand of expr.operands) {
|
|
46
|
-
for (const denial of collectDenials(operand, memo))
|
|
47
|
-
denials.add(denial);
|
|
48
|
-
}
|
|
49
|
-
break;
|
|
50
|
-
case 'exclude':
|
|
51
|
-
for (const excluded of expr.excluded)
|
|
52
|
-
denials.add(excluded);
|
|
53
|
-
for (const denial of collectDenials(expr.base, memo))
|
|
54
|
-
denials.add(denial);
|
|
55
|
-
break;
|
|
56
|
-
}
|
|
57
|
-
memo.set(expr, denials);
|
|
58
|
-
return denials;
|
|
59
|
-
}
|
|
@@ -1,12 +0,0 @@
|
|
|
1
|
-
import type { NodePath } from '../../path/index.js';
|
|
2
|
-
export declare class GraphPathAmbiguousError extends Error {
|
|
3
|
-
readonly path: NodePath;
|
|
4
|
-
readonly matches: number;
|
|
5
|
-
readonly code: 'GRAPH_PATH_AMBIGUOUS';
|
|
6
|
-
constructor(path: NodePath, matches: number);
|
|
7
|
-
}
|
|
8
|
-
export declare class GraphPathWalkerRequiredError extends Error {
|
|
9
|
-
readonly path: NodePath;
|
|
10
|
-
readonly code: 'GRAPH_PATH_WALKER_REQUIRED';
|
|
11
|
-
constructor(path: NodePath);
|
|
12
|
-
}
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
export class GraphPathAmbiguousError extends Error {
|
|
2
|
-
path;
|
|
3
|
-
matches;
|
|
4
|
-
code = 'GRAPH_PATH_AMBIGUOUS';
|
|
5
|
-
constructor(path, matches) {
|
|
6
|
-
super(`Graph Path ${JSON.stringify(path)} matched ${matches} distinct Nodes.`);
|
|
7
|
-
this.path = path;
|
|
8
|
-
this.matches = matches;
|
|
9
|
-
this.name = 'GraphPathAmbiguousError';
|
|
10
|
-
}
|
|
11
|
-
}
|
|
12
|
-
export class GraphPathWalkerRequiredError extends Error {
|
|
13
|
-
path;
|
|
14
|
-
code = 'GRAPH_PATH_WALKER_REQUIRED';
|
|
15
|
-
constructor(path) {
|
|
16
|
-
super(`Graph Path ${JSON.stringify(path)} requires a walker.`);
|
|
17
|
-
this.path = path;
|
|
18
|
-
this.name = 'GraphPathWalkerRequiredError';
|
|
19
|
-
}
|
|
20
|
-
}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
export { GraphPathAmbiguousError, GraphPathWalkerRequiredError } from './error.js';
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
import type { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
|
|
2
|
-
import type { EdgeOrientation } from '@astrale-os/kernel-dsl/v1/language';
|
|
3
|
-
import type { Node } from '../../node/index.js';
|
|
4
|
-
import type { Path } from '../../path/index.js';
|
|
5
|
-
import type { GraphEdges, GraphNodes } from '../indexes/index.js';
|
|
6
|
-
/** Semantic read-only graph capabilities available to a Path walker. */
|
|
7
|
-
export interface GraphPathContext {
|
|
8
|
-
readonly nodes: GraphNodes;
|
|
9
|
-
readonly edges: GraphEdges;
|
|
10
|
-
orientation(classKey: ClassKey): EdgeOrientation | undefined;
|
|
11
|
-
}
|
|
12
|
-
/** Pure injected semantics for walking one Path against an admitted Graph. */
|
|
13
|
-
export interface GraphPathWalker {
|
|
14
|
-
walk(path: Path, context: GraphPathContext): Node | undefined;
|
|
15
|
-
}
|