@astrale-os/kernel-core 0.9.0-beta.9 → 0.9.0

package/dist/schema/kernel/syscalls/declarations/uninstall.d.ts

@@ -1,153 +1,51 @@
-import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Uninstall: builder.Function<{
-    readonly description: "Durably uninstall one Domain installation epoch and return its terminal receipt.";
-    readonly auth: "authorized";
-    readonly input: import("zod").ZodObject<{
-        operation: import("zod").ZodString;
-        origin: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>;
-    readonly output: import("zod").ZodObject<{
-        operation: import("zod").ZodString;
-        transition: import("zod").ZodObject<{
-            intent: import("zod").ZodObject<{
-                transition: import("zod").ZodString;
-                operation: import("zod").ZodString;
-                installation: import("zod").ZodString;
-                origin: import("zod").ZodString;
-                source: import("zod").ZodNullable<import("zod").ZodObject<{
-                    origin: import("zod").ZodString;
-                    schemaRevision: import("zod").ZodString;
-                    schemaBundle: import("zod").ZodString;
-                    service: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"local">;
-                        artifact: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"remote">;
-                        etag: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>], "kind">;
-                    capabilities: import("zod").ZodObject<{
-                        functions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        classes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
-                            class: import("zod").ZodObject<{
-                                origin: import("zod").ZodString;
-                                kind: import("zod").ZodLiteral<"class">;
-                                name: import("zod").ZodString;
-                            }, import("zod/v4/core").$strict>;
-                            operations: import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                read: "read";
-                                traverse: "traverse";
-                                update: "update";
-                            }>>;
-                        }, import("zod/v4/core").$strict>>>;
-                        admin: import("zod").ZodOptional<import("zod").ZodObject<{
-                            grant: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                grant: "grant";
-                                read: "read";
-                                revoke: "revoke";
-                                traverse: "traverse";
-                                update: "update";
-                                use: "use";
-                            }>>>;
-                            revoke: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                grant: "grant";
-                                read: "read";
-                                revoke: "revoke";
-                                traverse: "traverse";
-                                update: "update";
-                                use: "use";
-                            }>>>;
-                        }, import("zod/v4/core").$strict>>;
-                    }, import("zod/v4/core").$strict>;
-                    dependencies: import("zod").ZodArray<import("zod").ZodObject<{
-                        origin: import("zod").ZodString;
-                        installation: import("zod").ZodString;
-                        target: import("zod").ZodString;
-                        readinessReceipt: import("zod").ZodString;
-                        meaningComparison: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>>;
-                target: import("zod").ZodNullable<import("zod").ZodObject<{
-                    origin: import("zod").ZodString;
-                    schemaRevision: import("zod").ZodString;
-                    schemaBundle: import("zod").ZodString;
-                    service: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"local">;
-                        artifact: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                        kind: import("zod").ZodLiteral<"remote">;
-                        etag: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>], "kind">;
-                    capabilities: import("zod").ZodObject<{
-                        functions: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
-                        classes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodObject<{
-                            class: import("zod").ZodObject<{
-                                origin: import("zod").ZodString;
-                                kind: import("zod").ZodLiteral<"class">;
-                                name: import("zod").ZodString;
-                            }, import("zod/v4/core").$strict>;
-                            operations: import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                read: "read";
-                                traverse: "traverse";
-                                update: "update";
-                            }>>;
-                        }, import("zod/v4/core").$strict>>>;
-                        admin: import("zod").ZodOptional<import("zod").ZodObject<{
-                            grant: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                grant: "grant";
-                                read: "read";
-                                revoke: "revoke";
-                                traverse: "traverse";
-                                update: "update";
-                                use: "use";
-                            }>>>;
-                            revoke: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
-                                create: "create";
-                                delete: "delete";
-                                grant: "grant";
-                                read: "read";
-                                revoke: "revoke";
-                                traverse: "traverse";
-                                update: "update";
-                                use: "use";
-                            }>>>;
-                        }, import("zod/v4/core").$strict>>;
-                    }, import("zod/v4/core").$strict>;
-                    dependencies: import("zod").ZodArray<import("zod").ZodObject<{
-                        origin: import("zod").ZodString;
-                        installation: import("zod").ZodString;
-                        target: import("zod").ZodString;
-                        readinessReceipt: import("zod").ZodString;
-                        meaningComparison: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>>;
-            }, import("zod/v4/core").$strict>;
-            phase: import("zod").ZodEnum<{
-                converge: "converge";
-                cutover: "cutover";
-            }>;
-            state: import("zod").ZodLiteral<"committed">;
-            readiness: import("zod").ZodOptional<import("zod").ZodObject<{
-                installation: import("zod").ZodString;
-                target: import("zod").ZodString;
-                transition: import("zod").ZodString;
-                dependencies: import("zod").ZodArray<import("zod").ZodObject<{
-                    origin: import("zod").ZodString;
-                    installation: import("zod").ZodString;
-                    target: import("zod").ZodString;
-                    readinessReceipt: import("zod").ZodString;
-                    meaningComparison: import("zod").ZodString;
-                }, import("zod/v4/core").$strict>>;
-            }, import("zod/v4/core").$strict>>;
-        }, import("zod/v4/core").$strict>;
-    }, import("zod/v4/core").$strict>;
-}>;
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const Uninstall: builder.Function<builder.CallableProjection<{
+    operation: string;
+    domains: string[];
+    data: {
+        mode: "destructive" | "safe";
+    };
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        operation: string;
+        transitions: {
+            intent: {
+                transition: string;
+                operation: string;
+                origin: string;
+                previous: {
+                    origin: string;
+                    revision: string;
+                    generation: string;
+                } | null;
+                generation: {
+                    origin: string;
+                    revision: string;
+                    generation: string;
+                } | null;
+                consent?: {
+                    issuer: {
+                        from: string;
+                        to: string;
+                    };
+                    previous: "drain" | "revoke";
+                } | undefined;
+            };
+            phase: "converge" | "cutover";
+            state: "committed";
+            readiness?: {
+                generation: string;
+                transition: string;
+                dependencies: {
+                    origin: string;
+                    generation: string;
+                    readiness: string;
+                    meaning: string;
+                }[];
+            } | undefined;
+        }[];
+    };
+}, "authorized", false, false, {
+    readonly durable: true;
+}>>;

package/dist/schema/kernel/syscalls/declarations/uninstall.js

@@ -1,8 +1,12 @@
+import { func } from '@astrale-os/kernel-dsl/v1';
 import { uninstallInput, uninstallOutput } from '../contracts/index.js';
-import { defineFunction } from './define.js';
-export const Uninstall = defineFunction({
+import { usePolicy } from './use-policy.js';
+export const Uninstall = func({
     description: 'Durably uninstall one Domain installation epoch and return its terminal receipt.',
     auth: 'authorized',
+    policy: usePolicy(() => Uninstall),
     input: uninstallInput,
     output: uninstallOutput,
+    // A durable syscall: the call returns its Execution, the Kernel's uninstall workflow runs it.
+    execution: { durable: true },
 });

package/dist/schema/kernel/syscalls/declarations/upload.d.ts

@@ -0,0 +1,15 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const Upload: builder.Function<builder.CallableProjection<import("@astrale-os/kernel-dsl/v1").BinaryInputProjection<{
+    mediaType: string;
+}>, {
+    readonly mode: 'value';
+    readonly value: {
+        receipt: string;
+        ref: {
+            digest: string;
+            mediaType: string;
+            size: number;
+        };
+        expiresAt: string;
+    };
+}, "authorized", false, false, undefined>>;

package/dist/schema/kernel/syscalls/declarations/upload.js

@@ -0,0 +1,10 @@
+import { func, input } from '@astrale-os/kernel-dsl/v1';
+import { MAXIMUM_BLOB_BYTES, uploadInput, uploadOutput } from '../contracts/index.js';
+import { usePolicy } from './use-policy.js';
+export const Upload = func({
+    description: 'Store application bytes in an upload receipt.',
+    auth: 'authorized',
+    policy: usePolicy(() => Upload),
+    input: input.binary(uploadInput, { maximumBytes: MAXIMUM_BLOB_BYTES }),
+    output: uploadOutput,
+});

package/dist/schema/kernel/syscalls/declarations/use-policy.d.ts

@@ -0,0 +1,4 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export declare const CanUseSyscall: builder.Policy;
+export declare function usePolicy(callable: () => builder.Function | builder.Method): builder.CallablePolicyBuilder;

package/dist/schema/kernel/syscalls/declarations/use-policy.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/kernel-dsl/v1';
+import { CanUse } from '../../../authority/index.js';
+/** Explicit capability admission chosen by protected Kernel callables. */
+export const CanUseSyscall = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => CanUse, target: object }),
+});
+export function usePolicy(callable) {
+    return ({ check, ref }) => check(CanUseSyscall, ref(callable));
+}

package/dist/schema/kernel/syscalls/declarations/view-resolve.d.ts

@@ -1,37 +1,30 @@
-import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const ViewResolve: builder.Method<{
-    readonly description: "Resolve the installed View declarations applicable to one authorized graph target.";
-    readonly auth: "authorized";
-    readonly input: import("zod").ZodObject<{
-        target: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>;
-    readonly output: import("zod").ZodObject<{
-        snapshot: import("zod").ZodString;
-        views: import("zod").ZodArray<import("zod").ZodObject<{
-            key: import("zod").ZodString;
-            declaration: import("zod").ZodObject<{
-                description: import("zod").ZodOptional<import("zod").ZodString>;
-                target: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"domain">;
-                }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-                    kind: import("zod").ZodLiteral<"definition">;
-                    definitions: import("zod").ZodArray<import("zod").ZodObject<{
-                        origin: import("zod").ZodString;
-                        kind: import("zod").ZodLiteral<"class">;
-                        name: import("zod").ZodString;
-                    }, import("zod/v4/core").$strict>>;
-                }, import("zod/v4/core").$strict>], "kind">;
-            }, import("zod/v4/core").$strict>;
-            href: import("zod").ZodString;
-            handshake: import("zod").ZodEnum<{
-                none: "none";
-                shell: "shell";
-            }>;
-            issuer: import("zod").ZodString;
-            etag: import("zod").ZodString;
-            revision: import("zod").ZodString;
-        }, import("zod/v4/core").$strict>>;
-    }, import("zod/v4/core").$strict>;
-    readonly static: true;
-    readonly inheritance: "sealed";
-}>;
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const ViewResolve: builder.Method<builder.CallableProjection<{
+    target: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        snapshot: string;
+        views: {
+            key: string;
+            declaration: {
+                description?: string | undefined;
+                target: {
+                    kind: "domain";
+                };
+            };
+            href: string;
+            handshake: "none" | "shell";
+            host?: {
+                navigation: {
+                    external: {
+                        origins: string[];
+                    };
+                };
+            } | undefined;
+            issuer: string;
+            release: string;
+            revision: string;
+        }[];
+    };
+}, "authorized", true, false, undefined>>;

package/dist/schema/kernel/syscalls/declarations/view-resolve.js

@@ -1,10 +1,12 @@
+import { method } from '@astrale-os/kernel-dsl/v1';
 import { viewResolveInput, viewResolveOutput } from '../contracts/index.js';
-import { defineMethod } from './define.js';
-export const ViewResolve = defineMethod({
+import { usePolicy } from './use-policy.js';
+export const ViewResolve = method({
     description: 'Resolve the installed View declarations applicable to one authorized graph target.',
     auth: 'authorized',
+    policy: usePolicy(() => ViewResolve),
     input: viewResolveInput,
     output: viewResolveOutput,
     static: true,
-    inheritance: 'sealed',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/whoami.d.ts

@@ -1,26 +1,22 @@
-import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Whoami: builder.Method<{
-    readonly description: "Return the Identity authenticated for this invocation.";
-    readonly auth: "authenticated";
-    readonly input: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
-    readonly output: import("zod").ZodObject<{
-        id: import("zod").ZodString;
-        issuer: import("zod").ZodString;
-        subject: import("zod").ZodString;
-        frozen: import("zod").ZodBoolean;
-        requiredClaims: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"contains">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"eq">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"exists">;
-        }, import("zod/v4/core").$strict>], "op">>;
-    }, import("zod/v4/core").$strict>;
-    readonly static: true;
-    readonly inheritance: "default";
-}>;
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const Whoami: builder.Method<builder.CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        id: string;
+        iss: string;
+        sub: string;
+        frozen: boolean;
+        requiredClaims: ({
+            claim: string;
+            op: "contains";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "eq";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "exists";
+        })[];
+    };
+}, "authenticated", true, false, undefined>>;

package/dist/schema/kernel/syscalls/declarations/whoami.js

@@ -1,10 +1,10 @@
+import { method } from '@astrale-os/kernel-dsl/v1';
 import { whoamiInput, whoamiOutput } from '../contracts/index.js';
-import { defineMethod } from './define.js';
-export const Whoami = defineMethod({
+export const Whoami = method({
     description: 'Return the Identity authenticated for this invocation.',
     auth: 'authenticated',
     input: whoamiInput,
     output: whoamiOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });

package/dist/schema/kernel/syscalls/declarations/whois.d.ts

@@ -1,29 +1,25 @@
-import type { builder } from '@astrale-os/kernel-dsl/v1';
-export declare const Whois: builder.Method<{
-    readonly description: "Resolve one issuer-and-subject Identity.";
-    readonly auth: "authorized";
-    readonly input: import("zod").ZodObject<{
-        issuer: import("zod").ZodString;
-        subject: import("zod").ZodString;
-    }, import("zod/v4/core").$strict>;
-    readonly output: import("zod").ZodNullable<import("zod").ZodObject<{
-        id: import("zod").ZodString;
-        issuer: import("zod").ZodString;
-        subject: import("zod").ZodString;
-        frozen: import("zod").ZodBoolean;
-        requiredClaims: import("zod").ZodArray<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"contains">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"eq">;
-            value: import("zod").ZodNonOptional<import("zod").ZodUnknown>;
-        }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
-            claim: import("zod").ZodString;
-            op: import("zod").ZodLiteral<"exists">;
-        }, import("zod/v4/core").$strict>], "op">>;
-    }, import("zod/v4/core").$strict>>;
-    readonly static: true;
-    readonly inheritance: "default";
-}>;
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const Whois: builder.Method<builder.CallableProjection<{
+    iss: string;
+    sub: string;
+}, {
+    readonly mode: 'value';
+    readonly value: {
+        id: string;
+        iss: string;
+        sub: string;
+        frozen: boolean;
+        requiredClaims: ({
+            claim: string;
+            op: "contains";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "eq";
+            value: unknown;
+        } | {
+            claim: string;
+            op: "exists";
+        })[];
+    } | null;
+}, "authorized", true, false, undefined>>;

package/dist/schema/kernel/syscalls/declarations/whois.js

@@ -1,10 +1,12 @@
+import { method } from '@astrale-os/kernel-dsl/v1';
 import { whoisInput, whoisOutput } from '../contracts/index.js';
-import { defineMethod } from './define.js';
-export const Whois = defineMethod({
+import { usePolicy } from './use-policy.js';
+export const Whois = method({
     description: 'Resolve one issuer-and-subject Identity.',
     auth: 'authorized',
+    policy: usePolicy(() => Whois),
     input: whoisInput,
     output: whoisOutput,
     static: true,
-    inheritance: 'default',
+    abstract: false,
 });