@astrale-os/kernel-core 0.9.0-beta.9 → 0.9.0

package/dist/schema/kernel/syscalls/index.d.ts

@@ -1,4 +1,4 @@
 export type { FunctionSyscall, MethodSyscall, Syscall, SyscallRef } from './descriptors/index.js';
 export * as references from './references/index.js';
-export { install, introspect, journal, mutate, provision, query, uninstall, } from './descriptors/index.js';
-export { function, identity, view } from './descriptors/index.js';
+export { download, install, introspect, journal, mutate, register, query, uninstall, upload, } from './descriptors/index.js';
+export { execution, function, identity, view } from './descriptors/index.js';

package/dist/schema/kernel/syscalls/index.js

@@ -1,3 +1,3 @@
 export * as references from './references/index.js';
-export { install, introspect, journal, mutate, provision, query, uninstall, } from './descriptors/index.js';
-export { function, identity, view } from './descriptors/index.js';
+export { download, install, introspect, journal, mutate, register, query, uninstall, upload, } from './descriptors/index.js';
+export { execution, function, identity, view } from './descriptors/index.js';

package/dist/schema/kernel/syscalls/references/execution.d.ts

@@ -0,0 +1,55 @@
+export declare const status: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "status";
+}>;
+export declare const result: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "result";
+}>;
+export declare const cancel: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "cancel";
+}>;
+export declare const signal: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "signal";
+}>;
+export declare const resume: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "resume";
+}>;
+declare const remove: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Execution';
+    }>;
+    name: "delete";
+}>;
+export { remove as delete };

package/dist/schema/kernel/syscalls/references/execution.js

@@ -0,0 +1,13 @@
+const owner = Object.freeze({
+    origin: 'kernel.astrale.ai',
+    kind: 'class',
+    name: 'Execution',
+});
+const methodRef = (name) => Object.freeze({ kind: 'method', owner, name });
+export const status = methodRef('status');
+export const result = methodRef('result');
+export const cancel = methodRef('cancel');
+export const signal = methodRef('signal');
+export const resume = methodRef('resume');
+const remove = methodRef('delete');
+export { remove as delete };

package/dist/schema/kernel/syscalls/references/functions.d.ts

@@ -8,10 +8,10 @@ export declare const mutate: Readonly<{
     kind: 'function';
     name: "mutate";
 }>;
-export declare const provision: Readonly<{
+export declare const register: Readonly<{
     origin: 'kernel.astrale.ai';
     kind: 'function';
-    name: "provision";
+    name: "register";
 }>;
 export declare const install: Readonly<{
     origin: 'kernel.astrale.ai';
@@ -33,3 +33,13 @@ export declare const journal: Readonly<{
     kind: 'function';
     name: "journal";
 }>;
+export declare const upload: Readonly<{
+    origin: 'kernel.astrale.ai';
+    kind: 'function';
+    name: "upload";
+}>;
+export declare const download: Readonly<{
+    origin: 'kernel.astrale.ai';
+    kind: 'function';
+    name: "download";
+}>;

package/dist/schema/kernel/syscalls/references/functions.js

@@ -5,8 +5,10 @@ const functionRef = (name) => Object.freeze({
 });
 export const query = functionRef('query');
 export const mutate = functionRef('mutate');
-export const provision = functionRef('provision');
+export const register = functionRef('register');
 export const install = functionRef('install');
 export const introspect = functionRef('introspect');
 export const uninstall = functionRef('uninstall');
 export const journal = functionRef('journal');
+export const upload = functionRef('upload');
+export const download = functionRef('download');

package/dist/schema/kernel/syscalls/references/identity.d.ts

@@ -43,3 +43,12 @@ export declare const mint: Readonly<{
     }>;
     name: "mint";
 }>;
+export declare const impersonate: Readonly<{
+    kind: 'method';
+    owner: Readonly<{
+        origin: 'kernel.astrale.ai';
+        kind: 'class';
+        name: 'Identity';
+    }>;
+    name: "impersonate";
+}>;

package/dist/schema/kernel/syscalls/references/identity.js

@@ -9,3 +9,4 @@ export const can = methodRef('can');
 export const whoami = methodRef('whoami');
 export const whois = methodRef('whois');
 export const mint = methodRef('mint');
+export const impersonate = methodRef('impersonate');

package/dist/schema/kernel/syscalls/references/index.d.ts

@@ -1,5 +1,6 @@
 export type { FunctionRef, SyscallRef } from './reference.js';
-export { install, introspect, journal, mutate, provision, query, uninstall } from './functions.js';
+export { download, install, introspect, journal, mutate, register, query, uninstall, upload, } from './functions.js';
+export * as execution from './execution.js';
 export * as identity from './identity.js';
 export * as function from './function.js';
 export * as view from './view.js';

package/dist/schema/kernel/syscalls/references/index.js

@@ -1,4 +1,5 @@
-export { install, introspect, journal, mutate, provision, query, uninstall } from './functions.js';
+export { download, install, introspect, journal, mutate, register, query, uninstall, upload, } from './functions.js';
+export * as execution from './execution.js';
 export * as identity from './identity.js';
 export * as function from './function.js';
 export * as view from './view.js';

package/dist/schema/meta/created-by.d.ts

@@ -0,0 +1,32 @@
+import { type builder } from '@astrale-os/kernel-dsl/v1';
+export declare const CreatedBy: builder.DirectedEdgeClass<{
+    readonly depth: 1;
+    readonly abstract: false;
+    readonly extends: readonly [builder.ClassReferenceProjection<"edge", {
+        readonly abstract: true;
+        readonly depth: 0;
+        readonly properties: never;
+        readonly source: {
+            readonly as: "source";
+            readonly outgoing: "0..*";
+        };
+        readonly target: {
+            readonly as: "target";
+            readonly incoming: "0..*";
+        };
+        readonly constraints: Record<never, never>;
+    }, never, never, never>];
+    readonly properties: never;
+    readonly source: {
+        readonly as: "resource";
+        readonly outgoing: "0..1";
+    };
+    readonly target: {
+        readonly as: "creator";
+        readonly incoming: "0..*";
+    };
+    readonly constraints: {
+        readonly noSelf: true;
+    };
+    readonly effectiveProperties: never;
+}>;

package/dist/schema/meta/created-by.js

@@ -0,0 +1,17 @@
+import { edgeClass } from '@astrale-os/kernel-dsl/v1';
+import { Edge } from './edge.js';
+import { Node } from './node.js';
+// Identity composes meta, so meta names it by reference instead of importing it.
+const IdentityRef = {
+    origin: 'kernel.astrale.ai',
+    kind: 'class',
+    name: 'Identity',
+};
+export const CreatedBy = edgeClass.directed({
+    abstract: false,
+    source: { as: 'resource', accepts: [Node], outgoing: '0..1' },
+    target: { as: 'creator', accepts: [IdentityRef], incoming: '0..*' },
+    description: 'Kernel-authored attribution of a Node to the Identity whose call created it; it grants no authority by itself.',
+    extends: [Edge],
+    constraints: { noSelf: true },
+});

package/dist/schema/meta/descriptable.d.ts

@@ -1,18 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Descriptable: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Optional human-facing description metadata with no identity or authority semantics.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        description: builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly minLength: 1;
-            readonly maxLength: 1000;
-        }>, {
-            readonly required: false;
-        }>;
+        readonly description: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "description", "self", never>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "description", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/edge.d.ts

@@ -1,21 +1,17 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Edge: builder.DirectedEdgeClass<{
+    readonly depth: 0;
     readonly abstract: true;
+    readonly extends: readonly [];
+    readonly properties: never;
     readonly source: {
         readonly as: "source";
-        readonly accepts: readonly [builder.NodeClass<{
-            readonly abstract: true;
-            readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-        }>];
         readonly outgoing: "0..*";
     };
     readonly target: {
         readonly as: "target";
-        readonly accepts: readonly [builder.NodeClass<{
-            readonly abstract: true;
-            readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-        }>];
         readonly incoming: "0..*";
     };
-    readonly description: "Explicit kernel marker for Edge definitions; it carries no structural fields.";
+    readonly constraints: Record<never, never>;
+    readonly effectiveProperties: never;
 }>;

package/dist/schema/meta/iconable.d.ts

@@ -1,18 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Iconable: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Optional bounded presentation icon metadata.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        icon: builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly minLength: 1;
-            readonly maxLength: 8000;
-        }>, {
-            readonly required: false;
-        }>;
+        readonly icon: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "icon", "self", never>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "icon", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/index.d.ts

@@ -1,3 +1,4 @@
+export { CreatedBy } from './created-by.js';
 export { Descriptable } from './descriptable.js';
 export { Edge } from './edge.js';
 export { Iconable } from './iconable.js';

package/dist/schema/meta/index.js

@@ -1,3 +1,4 @@
+export { CreatedBy } from './created-by.js';
 export { Descriptable } from './descriptable.js';
 export { Edge } from './edge.js';
 export { Iconable } from './iconable.js';

package/dist/schema/meta/named.d.ts

@@ -1,16 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Named: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Stable human-facing name metadata that never acts as a locator.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        readonly name: {
-            readonly type: "string";
-            readonly minLength: 1;
-            readonly maxLength: 100;
-        };
+        readonly name: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "name", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "name", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/node.d.ts

@@ -1,5 +1,13 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Node: builder.NodeClass<{
+    readonly depth: 0;
     readonly abstract: true;
-    readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
+    readonly extends: readonly [];
+    readonly properties: never;
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: never;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/remotable.d.ts

@@ -1,29 +1,22 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Remotable: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Optional synchronization metadata for a value originating outside the local kernel.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        externalId: builder.Property<{
-            readonly type: "string";
-            readonly minLength: 1;
-            readonly maxLength: 512;
-        }, {
-            readonly required: false;
-        }>;
-        onConflict: builder.Property<{
-            readonly enum: readonly ["defaults", "error", "merge", "replace", "skip"];
-        }, {
-            readonly required: false;
-        }>;
-        updatedAt: builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, {
-            readonly required: false;
-        }>;
+        readonly externalId: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "externalId", "self", never>;
+        readonly onConflict: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "onConflict", "self", never>;
+        readonly updatedAt: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "updatedAt", "self", never>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "externalId", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "onConflict", "self", never> | builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, false, "updatedAt", "self", never>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/statused.d.ts

@@ -1,14 +1,20 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Statused: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Explicit lifecycle-state metadata for values whose contract declares such a state.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        readonly status: {
-            readonly enum: readonly ["active", "creating", "deleting", "error", "updating"];
-        };
+        readonly status: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "status", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<import("@astrale-os/kernel-dsl/value").Value, import("@astrale-os/kernel-dsl/value").Value, true, "status", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/dist/schema/meta/timestamped.d.ts

@@ -1,19 +1,21 @@
 import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Timestamped: builder.NodeClass<{
+    readonly depth: 1;
     readonly abstract: true;
-    readonly extends: readonly [builder.NodeClass<{
+    readonly extends: readonly [builder.ClassReferenceProjection<"node", {
         readonly abstract: true;
-        readonly description: "The abstract universal kernel Node Class extended by every Kernel Node Class.";
-    }>];
-    readonly description: "Explicit creation and update timestamp metadata.";
+        readonly depth: 0;
+        readonly properties: never;
+        readonly methods: Readonly<Record<never, never>>;
+    }, never, never, never>];
     readonly properties: {
-        createdAt: builder.AutoProperty<builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, builder.PropertyOptions>>;
-        updatedAt: builder.AutoProperty<builder.Property<Readonly<{
-            readonly type: 'string';
-            readonly 'x-astrale-value-kind': 'instant';
-        }>, builder.PropertyOptions>>;
+        readonly createdAt: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "createdAt", "self", undefined>;
+        readonly updatedAt: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "updatedAt", "self", undefined>;
     };
+    readonly methods: Readonly<Record<never, never>>;
+    readonly effectiveProperties: builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "createdAt", "self", undefined> | builder.AuthoredPropertyProjection<never, import("@astrale-os/kernel-dsl/value").Value, true, "updatedAt", "self", undefined>;
+    readonly abstractInstanceMethods: never;
+    readonly abstractStaticMethods: never;
+    readonly effectiveInstanceMethods: never;
+    readonly effectiveStaticMethods: never;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.9",
+  "version": "0.9.0",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,18 +160,21 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": ">=0.2.0-beta.7 <1.0.0",
+    "@astrale-os/kernel-dsl": "0.2.0",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
-    "dequal": "2.0.3",
-    "zod": "^4.3.6"
+    "dequal": "2.0.3"
   },
   "devDependencies": {
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^25.2.3",
     "tsx": "4.23.12",
     "typescript": "7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.1",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "zod": "^4.4.3"
   },
   "scripts": {
     "build": "tsc",
@@ -183,7 +186,6 @@
     "test": "vitest run",
     "test:file": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.types.json && tsc --noEmit -p schema/.module/tsconfig.json",
-    "preinstall": "node -e \"try{require('./.check-workspace.cjs')}catch{}\""
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.types.json && tsc --noEmit -p schema/.module/tsconfig.json && tsc -p tsconfig.workers.json"
   }
 }

package/dist/auth/expression/normalization/canonicalize.d.ts

@@ -1,7 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import type { IdentityExpr } from '../language/index.js';
-export declare const EXPRESSION_DEPTH_LIMIT = 32;
-export declare const EXPRESSION_OPERAND_LIMIT = 64;
-/** Validate and canonicalize a resolved expression. */
-export declare function canonicalize(expr: IdentityExpr): IdentityExpr;
-export declare function admitResolvedExpression(input: portable.Value, path: string, depth: number): IdentityExpr;

package/dist/auth/expression/normalization/canonicalize.js

@@ -1,102 +0,0 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
-import { NodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error.js';
-export const EXPRESSION_DEPTH_LIMIT = 32;
-export const EXPRESSION_OPERAND_LIMIT = 64;
-/** Validate and canonicalize a resolved expression. */
-export function canonicalize(expr) {
-    try {
-        return admit(portable.accept(expr), '', 0);
-    }
-    catch (cause) {
-        if (cause instanceof AuthValueError)
-            throw cause;
-        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved Identity expression', '', {
-            cause,
-        });
-    }
-}
-export function admitResolvedExpression(input, path, depth) {
-    return admit(input, path, depth);
-}
-function admit(input, path, depth) {
-    if (depth > EXPRESSION_DEPTH_LIMIT)
-        invalid(path, 'Identity expression exceeds its depth limit');
-    const value = record(input, path);
-    switch (value.kind) {
-        case 'identity':
-            exact(value, ['id', 'kind'], path);
-            if (typeof value.id !== 'string')
-                invalid(`${path}/id`, 'Expected a NodeId');
-            return Object.freeze({ kind: 'identity', id: NodeId(value.id) });
-        case 'union':
-        case 'intersect': {
-            exact(value, ['kind', 'operands'], path);
-            const source = list(value.operands, `${path}/operands`, 2);
-            const kind = value.kind;
-            const operands = unique(source
-                .map((operand, index) => admit(operand, `${path}/operands/${index}`, depth + 1))
-                .flatMap((operand) => (operand.kind === kind ? operand.operands : [operand])));
-            if (operands.length > EXPRESSION_OPERAND_LIMIT) {
-                invalid(`${path}/operands`, `Expected 2-${EXPRESSION_OPERAND_LIMIT} operands`);
-            }
-            return operands.length === 1
-                ? operands[0]
-                : Object.freeze({ kind, operands: Object.freeze(operands) });
-        }
-        case 'exclude': {
-            exact(value, ['base', 'excluded', 'kind'], path);
-            const excluded = unique(list(value.excluded, `${path}/excluded`, 1)
-                .map((operand, index) => admit(operand, `${path}/excluded/${index}`, depth + 1))
-                .flatMap((operand) => (operand.kind === 'union' ? operand.operands : [operand])));
-            if (excluded.length > EXPRESSION_OPERAND_LIMIT) {
-                invalid(`${path}/excluded`, `Expected 1-${EXPRESSION_OPERAND_LIMIT} operands`);
-            }
-            return Object.freeze({
-                kind: 'exclude',
-                base: admit(required(value.base, `${path}/base`), `${path}/base`, depth + 1),
-                excluded: Object.freeze(excluded),
-            });
-        }
-        default:
-            invalid(`${path}/kind`, 'Expected identity, union, intersect, or exclude');
-    }
-}
-function unique(input) {
-    const keyed = input
-        .map((expr) => ({ expr, key: portable.json.serialize(expr) }))
-        .sort((left, right) => compare(left.key, right.key));
-    return keyed
-        .filter((entry, index) => index === 0 || entry.key !== keyed[index - 1].key)
-        .map((entry) => entry.expr);
-}
-function record(input, path) {
-    if (input === null || Array.isArray(input) || typeof input !== 'object') {
-        invalid(path, 'Expected an object');
-    }
-    return input;
-}
-function list(input, path, minimum) {
-    if (!Array.isArray(input) || input.length < minimum || input.length > EXPRESSION_OPERAND_LIMIT) {
-        invalid(path, `Expected ${minimum}-${EXPRESSION_OPERAND_LIMIT} operands`);
-    }
-    return input;
-}
-function required(input, path) {
-    if (input === undefined)
-        invalid(path, 'Expected a value');
-    return input;
-}
-function exact(value, expected, path) {
-    const actual = Object.keys(value).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-    }
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message) {
-    throw new AuthValueError('AUTH_GRANT_INVALID', message, path);
-}

package/dist/auth/expression/normalization/index.d.ts

@@ -1,2 +0,0 @@
-export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
-export { raiseDenials } from './raise-denials.js';

package/dist/auth/expression/normalization/index.js

@@ -1,2 +0,0 @@
-export { admitResolvedExpression, canonicalize, EXPRESSION_DEPTH_LIMIT, EXPRESSION_OPERAND_LIMIT, } from './canonicalize.js';
-export { raiseDenials } from './raise-denials.js';