@astrale-os/kernel-core 0.9.0-beta.8 → 0.9.0

package/dist/auth/authority/semantics/terms.js

@@ -0,0 +1,96 @@
+import { Path } from '../../../graph/path/index.js';
+export function isFixedTerm(term) {
+    return term.kind !== 'input' && term.kind !== 'local' && term.kind !== 'subject';
+}
+/** The Path a fixed term denotes; the term holds when that Path reaches exactly one live Node. */
+export function termPath(term) {
+    switch (term.kind) {
+        case 'node':
+            return Path.id(term.id);
+        case 'class':
+            return Path.project(term.ref);
+        case 'domain':
+            return Path.domain(term.origin);
+        case 'ref':
+        case 'core':
+            return Path.project(term.ref);
+    }
+}
+/**
+ * Every fixed Path one expression depends on, sorted by raw text. `class-authority` depends on the
+ * projection of its Class and on the Domain of the Class origin.
+ */
+export function fixedPaths(expressions) {
+    const paths = new Map();
+    const add = (path) => {
+        paths.set(path.raw, path);
+    };
+    for (const expression of subexpressions(expressions)) {
+        for (const term of ownTerms(expression))
+            if (isFixedTerm(term))
+                add(termPath(term));
+        if (expression.op === 'class-authority') {
+            add(Path.project(expression.class));
+            add(Path.domain(expression.class.origin));
+        }
+    }
+    return Object.freeze([...paths.values()].sort((left, right) => compare(left.raw, right.raw)));
+}
+/**
+ * Every decision input the expressions read: each `input` term, and the bound Edge Class that
+ * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
+ */
+export function requiredInputs(expressions) {
+    const inputs = new Set();
+    for (const expression of subexpressions(expressions)) {
+        if (expression.op === 'edge-class')
+            inputs.add('edge');
+        for (const term of ownTerms(expression))
+            if (term.kind === 'input')
+                inputs.add(term.input);
+    }
+    return inputs;
+}
+/** Every expression and nested expression, depth first in syntax order. */
+function* subexpressions(expressions) {
+    for (const expression of expressions) {
+        yield expression;
+        switch (expression.op) {
+            case 'all':
+            case 'any':
+                yield* subexpressions(expression.predicates);
+                break;
+            case 'not':
+                yield* subexpressions([expression.predicate]);
+                break;
+            case 'as':
+            case 'exists':
+                yield* subexpressions([expression.where]);
+        }
+    }
+}
+/** The terms one expression reads itself, excluding those of its nested expressions. */
+export function ownTerms(expression) {
+    switch (expression.op) {
+        case 'same-node':
+            return [expression.left, expression.right];
+        case 'related':
+            return [expression.source, expression.target];
+        case 'instance-of':
+            return [expression.node];
+        case 'class-authority':
+            return [expression.identity];
+        case 'true':
+        case 'false':
+        case 'edge-class':
+        case 'all':
+        case 'any':
+        case 'not':
+        case 'as':
+        case 'exists':
+            return [];
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/authority/semantics/vocabulary.d.ts

@@ -0,0 +1,19 @@
+import type { ClassRef, Operation } from '../language/index.js';
+/**
+ * The Kernel Classes that give authority its meaning. Core Schema publishes the Kernel instance;
+ * the interpreter and every lowering take it as a parameter instead of discovering it.
+ */
+export interface AuthorityVocabulary {
+    /** Node Class whose concrete descendants an Identity binder may reach. */
+    readonly identity: ClassRef;
+    /** Outgoing composition Edges of one Identity. */
+    readonly composition: {
+        readonly extension: ClassRef;
+        readonly constraint: ClassRef;
+        readonly exclusion: ClassRef;
+    };
+    /** Edge from an Identity to a Class projection that delegates one Class operation. */
+    readonly capabilities: Readonly<Record<Operation, ClassRef>>;
+    /** The derived relation from a Node to the projection of its exact Class. */
+    readonly instanceOf: ClassRef;
+}

package/dist/auth/authority/semantics/vocabulary.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/claims/admission/admission.d.ts

@@ -3,4 +3,3 @@ import type { ClaimConstraint } from '../language/index.js';
 export declare const MAX_REQUIRED_CLAIMS = 64;
 /** Admit one claim constraint within an owning boundary's error vocabulary. */
 export declare function admitConstraint(input: portable.Value, path: string, invalid: (path: string, message: string) => never): ClaimConstraint;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/claims/admission/admission.js

@@ -41,4 +41,3 @@ function freezeValue(input) {
 function compare(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/claims/admission/index.d.ts

@@ -1,2 +1 @@
 export { admitConstraint, MAX_REQUIRED_CLAIMS } from './admission.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/admission/index.js

@@ -1,2 +1 @@
 export { admitConstraint, MAX_REQUIRED_CLAIMS } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/evaluation/index.d.ts

@@ -1,3 +1,2 @@
 export { matches } from './match.js';
 export { verifyRequired } from './verify-required.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/evaluation/index.js

@@ -1,3 +1,2 @@
 export { matches } from './match.js';
 export { verifyRequired } from './verify-required.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/evaluation/match.d.ts

@@ -2,4 +2,3 @@ import * as portable from '@astrale-os/kernel-dsl/value';
 import type { ClaimConstraint } from '../language/index.js';
 /** Evaluate one claim constraint over already-parsed claims. */
 export declare function matches(constraint: ClaimConstraint, claims: portable.Object): boolean;
-//# sourceMappingURL=match.d.ts.map

package/dist/auth/claims/evaluation/match.js

@@ -14,4 +14,3 @@ export function matches(constraint, claims) {
 function equal(left, right) {
     return portable.json.serialize(left) === portable.json.serialize(right);
 }
-//# sourceMappingURL=match.js.map

package/dist/auth/claims/evaluation/verify-required.d.ts

@@ -2,4 +2,3 @@ import type * as portable from '@astrale-os/kernel-dsl/value';
 import type { ClaimConstraint } from '../language/index.js';
 /** Assert every required constraint, reporting the first mismatch. */
 export declare function verifyRequired(constraints: readonly ClaimConstraint[], claims: portable.Object): void;
-//# sourceMappingURL=verify-required.d.ts.map

package/dist/auth/claims/evaluation/verify-required.js

@@ -7,4 +7,3 @@ export function verifyRequired(constraints, claims) {
         }
     }
 }
-//# sourceMappingURL=verify-required.js.map

package/dist/auth/claims/index.d.ts

@@ -1,4 +1,3 @@
 export { MAX_REQUIRED_CLAIMS } from './admission/index.js';
 export { matches, verifyRequired } from './evaluation/index.js';
 export type { ClaimConstraint } from './language/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/index.js

@@ -1,3 +1,2 @@
 export { MAX_REQUIRED_CLAIMS } from './admission/index.js';
 export { matches, verifyRequired } from './evaluation/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/claims/language/constraint.d.ts

@@ -11,4 +11,3 @@ export type ClaimConstraint = {
     readonly claim: string;
     readonly op: 'exists';
 };
-//# sourceMappingURL=constraint.d.ts.map

package/dist/auth/claims/language/constraint.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=constraint.js.map

package/dist/auth/claims/language/index.d.ts

@@ -1,2 +1 @@
 export type { ClaimConstraint } from './constraint.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/language/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/context/context.d.ts

@@ -2,7 +2,6 @@ import type { Attestation } from '../attestation/index.js';
 import type { CredentialInput } from '../credential/input/index.js';
 import type { VerifiedCredential } from '../credential/verified/index.js';
 import type { Delegation } from '../delegation/index.js';
-import type { Grant } from '../grant/index.js';
 import type { IdentityId } from '../identity/index.js';
 /** The original credential together with the claims established by verification. */
 export interface CredentialContext {
@@ -12,18 +11,19 @@ export interface CredentialContext {
 /** Verified credential result before every runtime authority value is necessarily resolved. */
 export interface Authenticated {
     readonly credential: CredentialContext;
-    readonly grant?: Grant;
+    readonly caller?: IdentityId;
     readonly attestation?: Attestation;
     readonly delegation?: Delegation;
 }
 /** Complete authenticated kernel context. */
 export interface AuthContext {
     readonly credential: CredentialContext;
+    /** Authenticated executor: ceiling, installed ownership, Root bypass, and audit. */
     readonly principal: IdentityId;
-    readonly grant: Grant;
+    /** The one Identity whose authority the call exercises; equals principal for direct calls. */
+    readonly caller: IdentityId;
     /** Earliest expiry of all credential proofs from which this authority was derived. */
     readonly validUntil?: number;
     readonly attestation?: Attestation;
     readonly delegation?: Delegation;
 }
-//# sourceMappingURL=context.d.ts.map

package/dist/auth/context/context.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=context.js.map

package/dist/auth/context/index.d.ts

@@ -1,2 +1 @@
 export type { AuthContext, Authenticated, CredentialContext } from './context.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/context/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/evidence/evidence.d.ts

@@ -16,4 +16,3 @@ export interface AuthenticationEvidence {
 }
 /** Project trusted credential state without retaining bearer material or arbitrary claims. */
 export declare function evidence(context: CredentialContext): AuthenticationEvidence;
-//# sourceMappingURL=evidence.d.ts.map

package/dist/auth/credential/evidence/evidence.js

@@ -15,4 +15,3 @@ export function evidence(context) {
         ...(credential.exp === undefined ? {} : { expiresAt: credential.exp }),
     });
 }
-//# sourceMappingURL=evidence.js.map

package/dist/auth/credential/evidence/index.d.ts

@@ -1,3 +1,2 @@
 export { evidence } from './evidence.js';
 export type { AuthenticationEvidence } from './evidence.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/evidence/index.js

@@ -1,2 +1 @@
 export { evidence } from './evidence.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/index.d.ts

@@ -7,4 +7,3 @@ export type { CredentialInput, MintedCredential } from './input/index.js';
 export { acceptVerified, verifyAudience } from './verified/index.js';
 export type { VerifiedCredential } from './verified/index.js';
 export type { AuthContext, Authenticated, CredentialContext } from '../context/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/index.js

@@ -2,4 +2,3 @@ export { evidence } from './evidence/index.js';
 export { inspect } from './inspection/index.js';
 export { snapshot } from './input/index.js';
 export { acceptVerified, verifyAudience } from './verified/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/input/index.d.ts

@@ -1,3 +1,2 @@
 export { snapshot } from './input.js';
 export type { CredentialInput, MintedCredential } from './input.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/input/index.js

@@ -1,2 +1 @@
 export { snapshot } from './input.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/input/input.d.ts

@@ -8,4 +8,3 @@ export type MintedCredential = string & {
 /** Detach mutable credential bytes while retaining immutable credential text. */
 export declare function snapshot(input: CredentialInput): CredentialInput;
 export {};
-//# sourceMappingURL=input.d.ts.map

package/dist/auth/credential/input/input.js

@@ -6,4 +6,3 @@ export function snapshot(input) {
         throw new TypeError('Credential must be text or bytes.');
     return input.slice();
 }
-//# sourceMappingURL=input.js.map

package/dist/auth/credential/inspection/index.d.ts

@@ -1,3 +1,2 @@
 export { inspect } from './inspect.js';
 export type { AuthenticationMethod, CredentialAudience, UnverifiedCredential, } from './inspection.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/inspection/index.js

@@ -1,2 +1 @@
 export { inspect } from './inspect.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/inspection/inspect.d.ts

@@ -2,4 +2,3 @@ import type { CredentialInput } from '../input/index.js';
 import type { UnverifiedCredential } from './inspection.js';
 /** Inspect compact JWT syntax without establishing any cryptographic trust. */
 export declare function inspect(input: CredentialInput): UnverifiedCredential;
-//# sourceMappingURL=inspect.d.ts.map

package/dist/auth/credential/inspection/inspect.js

@@ -94,4 +94,3 @@ function freezeValue(input) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_CREDENTIAL_INVALID', message, path);
 }
-//# sourceMappingURL=inspect.js.map

package/dist/auth/credential/inspection/inspection.d.ts

@@ -10,4 +10,3 @@ export interface UnverifiedCredential {
     readonly kid?: string;
     readonly claims: value.Object;
 }
-//# sourceMappingURL=inspection.d.ts.map

package/dist/auth/credential/inspection/inspection.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=inspection.js.map

package/dist/auth/credential/verified/admission.d.ts

@@ -4,4 +4,3 @@ import type { VerifiedCredential } from './verified.js';
  * Signature verification and trusted-key selection remain Runtime responsibilities.
  */
 export declare function acceptVerified(input: unknown): VerifiedCredential;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/credential/verified/admission.js

@@ -125,4 +125,3 @@ function isRecord(input) {
 function invalid(path, message) {
     throw new AuthValueError('AUTH_VERIFIED_CREDENTIAL_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/credential/verified/audience.d.ts

@@ -2,4 +2,3 @@ import type { IssuerId } from '../../issuer/index.js';
 import type { VerifiedCredential } from './verified.js';
 /** Assert the expected audience over an already verified credential. */
 export declare function verifyAudience(credential: VerifiedCredential, expectedAudience: IssuerId): void;
-//# sourceMappingURL=audience.d.ts.map

package/dist/auth/credential/verified/audience.js

@@ -17,4 +17,3 @@ function matches(candidate, expected) {
         return candidate === expected;
     }
 }
-//# sourceMappingURL=audience.js.map

package/dist/auth/credential/verified/index.d.ts

@@ -1,4 +1,3 @@
 export { acceptVerified } from './admission.js';
 export { verifyAudience } from './audience.js';
 export type { VerifiedCredential } from './verified.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/credential/verified/index.js

@@ -1,3 +1,2 @@
 export { acceptVerified } from './admission.js';
 export { verifyAudience } from './audience.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/credential/verified/verified.d.ts

@@ -15,4 +15,3 @@ export interface VerifiedCredential {
     readonly exp?: number;
     readonly claims: value.Object;
 }
-//# sourceMappingURL=verified.d.ts.map

package/dist/auth/credential/verified/verified.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=verified.js.map

package/dist/auth/delegation/admission.d.ts

@@ -1,4 +1,3 @@
 import type { Delegation } from './delegation.js';
 /** Admit a Delegation envelope; the nested credential remains unverified. */
 export declare function accept(input: unknown): Delegation;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/delegation/admission.js

@@ -37,4 +37,3 @@ function snapshot(input, path) {
 function invalid(path) {
     throw new AuthValueError('AUTH_DELEGATION_INVALID', 'Expected bounded credential text or bytes', path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/delegation/delegation.d.ts

@@ -5,4 +5,3 @@ export type DelegationCredential = CredentialInput;
 export interface Delegation {
     readonly credential: DelegationCredential;
 }
-//# sourceMappingURL=delegation.d.ts.map

package/dist/auth/delegation/delegation.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=delegation.js.map

package/dist/auth/delegation/index.d.ts

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export type { Delegation, DelegationCredential } from './delegation.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/delegation/index.js

@@ -1,2 +1 @@
 export { accept } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/error.d.ts

@@ -4,4 +4,3 @@ export declare class AuthValueError<Code extends string = string> extends TypeEr
     readonly path: string;
     constructor(code: Code, message: string, path?: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=error.d.ts.map

package/dist/auth/error.js

@@ -9,4 +9,3 @@ export class AuthValueError extends TypeError {
         this.path = path;
     }
 }
-//# sourceMappingURL=error.js.map

package/dist/auth/expression/authoring/builder.d.ts

@@ -6,11 +6,8 @@ export type BuiltExpr = IdentityExpr | UnresolvedIdentityExpr;
 export interface ExprBuilder<E extends BuiltExpr = IdentityExpr> {
     build(): E;
 }
-/** Immutable fluent expression handle. */
+/** Immutable handle for one Identity leaf; there is no Identity set algebra. */
 export interface Expr<E extends BuiltExpr = IdentityExpr> extends ExprBuilder<E> {
-    union(other: Expr<E>): Expr<E>;
-    intersect(other: Expr<E>): Expr<E>;
-    exclude(other: Expr<E>): Expr<E>;
 }
 export declare function isExprBuilder(input: unknown): input is ExprBuilder<IdentityExpr> | ExprBuilder<UnresolvedIdentityExpr>;
 /** Build one resolved Identity leaf. */
@@ -19,12 +16,5 @@ export declare function identity(id: IdentityId): Expr<IdentityExpr>;
 export declare function self(): Expr<UnresolvedIdentityExpr>;
 /** Build one unresolved nested-credential leaf. */
 export declare function cred(credential: CredentialInput): Expr<UnresolvedIdentityExpr>;
-/** Re-enter the fluent algebra from an already trusted or separately admitted expression. */
+/** Re-enter from an already trusted or separately admitted Identity leaf. */
 export declare function raw<E extends BuiltExpr>(expr: E): Expr<E>;
-/** Compose at least two expressions of the same resolved or unresolved phase. */
-export declare function union<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Intersect at least two expressions of the same resolved or unresolved phase. */
-export declare function intersect<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Exclude one expression from another expression of the same phase. */
-export declare function exclude<E extends BuiltExpr>(base: Expr<E>, excluded: Expr<NoInfer<E>>): Expr<E>;
-//# sourceMappingURL=builder.d.ts.map

package/dist/auth/expression/authoring/builder.js

@@ -13,27 +13,6 @@ class Expression {
     build() {
         return this.value;
     }
-    union(other) {
-        return compose('union', this, other);
-    }
-    intersect(other) {
-        return compose('intersect', this, other);
-    }
-    exclude(other) {
-        const current = this.value;
-        if (current.kind === 'exclude') {
-            return expression({
-                kind: 'exclude',
-                base: current.base,
-                excluded: [...current.excluded, other.build()],
-            });
-        }
-        return expression({
-            kind: 'exclude',
-            base: current,
-            excluded: [other.build()],
-        });
-    }
 }
 /** Build one resolved Identity leaf. */
 export function identity(id) {
@@ -55,34 +34,10 @@ export function cred(credential) {
     }
     return expression(Object.freeze({ kind: 'identity', credential: credential.slice() }));
 }
-/** Re-enter the fluent algebra from an already trusted or separately admitted expression. */
+/** Re-enter from an already trusted or separately admitted Identity leaf. */
 export function raw(expr) {
     return expression(expr);
 }
-/** Compose at least two expressions of the same resolved or unresolved phase. */
-export function union(first, second, ...rest) {
-    return compose('union', first, second, ...rest);
-}
-/** Intersect at least two expressions of the same resolved or unresolved phase. */
-export function intersect(first, second, ...rest) {
-    return compose('intersect', first, second, ...rest);
-}
-/** Exclude one expression from another expression of the same phase. */
-export function exclude(base, excluded) {
-    return base.exclude(excluded);
-}
-function compose(kind, first, second, ...rest) {
-    const operands = [];
-    for (const builder of [first, second, ...rest]) {
-        const value = builder.build();
-        if (value.kind === kind)
-            operands.push(...value.operands);
-        else
-            operands.push(value);
-    }
-    return expression({ kind, operands });
-}
 function expression(value) {
     return Object.freeze(new Expression(value));
 }
-//# sourceMappingURL=builder.js.map

package/dist/auth/expression/authoring/index.d.ts

@@ -1,3 +1,2 @@
 export type { BuiltExpr, Expr, ExprBuilder } from './builder.js';
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union } from './builder.js';
-//# sourceMappingURL=index.d.ts.map
+export { cred, identity, isExprBuilder, raw, self } from './builder.js';

package/dist/auth/expression/authoring/index.js

@@ -1,2 +1 @@
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union } from './builder.js';
-//# sourceMappingURL=index.js.map
+export { cred, identity, isExprBuilder, raw, self } from './builder.js';

package/dist/auth/expression/index.d.ts

@@ -1,5 +1,3 @@
 export type { BuiltExpr, Expr, ExprBuilder } from './authoring/index.js';
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union, } from './authoring/index.js';
+export { cred, identity, isExprBuilder, raw, self } from './authoring/index.js';
 export type { IdentityExpr, SelfIdentityExpr, UnresolvedIdentityExpr } from './language/index.js';
-export { canonicalize, raiseDenials } from './normalization/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/expression/index.js

@@ -1,3 +1 @@
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union, } from './authoring/index.js';
-export { canonicalize, raiseDenials } from './normalization/index.js';
-//# sourceMappingURL=index.js.map
+export { cred, identity, isExprBuilder, raw, self } from './authoring/index.js';

package/dist/auth/expression/language/identity-expression.d.ts

@@ -5,34 +5,13 @@ export type SelfIdentityExpr = {
     readonly kind: 'identity';
     readonly self: true;
 };
-/** Resolved Identity set algebra. Every leaf is one stable IdentityId. */
+/** The one resolved Identity leaf carried by Kernel bearer and delegation proof claims. */
 export type IdentityExpr = {
     readonly kind: 'identity';
     readonly id: IdentityId;
-} | {
-    readonly kind: 'union';
-    readonly operands: readonly IdentityExpr[];
-} | {
-    readonly kind: 'intersect';
-    readonly operands: readonly IdentityExpr[];
-} | {
-    readonly kind: 'exclude';
-    readonly base: IdentityExpr;
-    readonly excluded: readonly IdentityExpr[];
 };
-/** Caller-authored expression accepted only inside a versioned credential claim. */
+/** Caller-authored single leaf accepted only inside a versioned credential claim. */
 export type UnresolvedIdentityExpr = SelfIdentityExpr | {
     readonly kind: 'identity';
     readonly credential: CredentialInput;
-} | {
-    readonly kind: 'union';
-    readonly operands: readonly UnresolvedIdentityExpr[];
-} | {
-    readonly kind: 'intersect';
-    readonly operands: readonly UnresolvedIdentityExpr[];
-} | {
-    readonly kind: 'exclude';
-    readonly base: UnresolvedIdentityExpr;
-    readonly excluded: readonly UnresolvedIdentityExpr[];
 };
-//# sourceMappingURL=identity-expression.d.ts.map

package/dist/auth/expression/language/identity-expression.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=identity-expression.js.map

package/dist/auth/expression/language/index.d.ts

@@ -1,2 +1 @@
 export type { IdentityExpr, SelfIdentityExpr, UnresolvedIdentityExpr, } from './identity-expression.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/expression/language/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/grant/index.d.ts

@@ -1,5 +1,4 @@
-export { accept, canonicalize, self } from './resolved/index.js';
+export { accept, self } from './resolved/index.js';
 export type { Grant } from './resolved/index.js';
 export { acceptUnresolved, limits } from './unresolved/index.js';
 export type { UnresolvedGrant } from './unresolved/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/grant/index.js

@@ -1,3 +1,2 @@
-export { accept, canonicalize, self } from './resolved/index.js';
+export { accept, self } from './resolved/index.js';
 export { acceptUnresolved, limits } from './unresolved/index.js';
-//# sourceMappingURL=index.js.map