@astrale-os/kernel-core 0.9.0-beta.9 → 0.9.0

package/dist/auth/authority/semantics/residual.js

@@ -0,0 +1,166 @@
+import { ownTerms, requiredInputs } from './terms.js';
+/**
+ * The static atoms of the expressions, each once by structure, in depth-first order: the atoms
+ * `residualProgram` asks to decide. An `exists` that reads no input is one atom.
+ */
+export function staticAtoms(expressions) {
+    const found = new Map();
+    const visit = (value) => {
+        switch (value.op) {
+            case 'true':
+            case 'false':
+                return;
+            case 'all':
+            case 'any':
+                value.predicates.forEach(visit);
+                return;
+            case 'not':
+                visit(value.predicate);
+                return;
+            case 'as':
+                visit(value.where);
+                return;
+            default: {
+                const subject = names(value);
+                const key = JSON.stringify(value);
+                if (subject !== undefined && !found.has(key))
+                    found.set(key, { atom: value, subject });
+            }
+        }
+    };
+    expressions.forEach(visit);
+    return Object.freeze([...found.values()]);
+}
+/**
+ * The program specialized to one snapshot: each static atom replaced by the value `atom` gives it,
+ * and each expression those values decide folded into it, in Kleene's strong three-valued logic.
+ * `atom` receives the subject only for an atom that names it, and undefined leaves the atom in
+ * place. A binder whose composition decides it from its members' specialized leaves
+ * (`CompositionClosure.decide`) is folded too. Otherwise it keeps the leaf every member
+ * specializes to alike, or the leaf specialized without a subject. `closure` is the admitted
+ * composition of a binder root.
+ *
+ * Once the program is admitted in that snapshot (AUTH-FAILURE-ADMITTED-EAGERLY), the residual
+ * decides every input frame as the program does (`pe_sound` of `proofs/Authority.lean`). Each
+ * member keeps its ordinal, so the residual is not canonical, and an expression nothing decides
+ * stays the same object.
+ */
+export function residualProgram(program, closure, atom) {
+    const subjects = new Map();
+    const binders = new Map();
+    const known = (value, subject) => {
+        let named = subjects.get(value);
+        if (named === undefined)
+            subjects.set(value, (named = names(value) ?? null));
+        if (named === null)
+            return undefined;
+        if (!named)
+            return atom(value, undefined);
+        return subject === undefined ? undefined : atom(value, subject);
+    };
+    const specialize = (value, subject) => {
+        switch (value.op) {
+            case 'true':
+            case 'false':
+                return value;
+            case 'all':
+            case 'any': {
+                // `all` is false once one member is, `any` true once one member is.
+                const absorbing = value.op === 'any';
+                const kept = [];
+                let changed = false;
+                for (const child of value.predicates) {
+                    const residual = specialize(child, subject);
+                    const decided = truth(residual);
+                    if (decided === absorbing)
+                        return constant(absorbing);
+                    if (decided === undefined)
+                        kept.push(residual);
+                    if (residual !== child || decided !== undefined)
+                        changed = true;
+                }
+                if (!changed)
+                    return value;
+                if (kept.length === 0)
+                    return constant(!absorbing);
+                return kept.length === 1 ? kept[0] : Object.freeze({ op: value.op, predicates: kept });
+            }
+            case 'not': {
+                const residual = specialize(value.predicate, subject);
+                const decided = truth(residual);
+                if (decided !== undefined)
+                    return constant(!decided);
+                return residual === value.predicate
+                    ? value
+                    : Object.freeze({ op: 'not', predicate: residual });
+            }
+            case 'as': {
+                // A binder names its own subject: its residual is the same under every outer subject.
+                let residual = binders.get(value);
+                if (residual === undefined)
+                    binders.set(value, (residual = binder(value)));
+                return residual;
+            }
+            default: {
+                const decided = known(value, subject);
+                return decided === undefined ? value : constant(decided);
+            }
+        }
+    };
+    const binder = (value) => {
+        const composed = closure(value.identity);
+        if (composed === undefined)
+            return value;
+        const leaves = new Map(composed.identities.map((member) => [member, specialize(value.where, member)]));
+        const decided = composed.decide((member) => truth(leaves.get(member)));
+        if (decided !== undefined)
+            return constant(decided);
+        const [first, ...others] = leaves.values();
+        // Each member's leaf decides as its own specialization: one shared by every member replaces
+        // the leaf; otherwise only what no subject decides is specialized.
+        const where = others.every((leaf) => same(leaf, first))
+            ? first
+            : specialize(value.where, undefined);
+        return where === value.where ? value : Object.freeze({ ...value, where });
+    };
+    const predicates = program.predicates.map((predicate) => specialize(predicate, undefined));
+    if (predicates.every((predicate, index) => predicate === program.predicates[index])) {
+        return program;
+    }
+    return Object.freeze({ ...program, predicates: Object.freeze(predicates) });
+}
+const TRUE = Object.freeze({ op: 'true' });
+const FALSE = Object.freeze({ op: 'false' });
+function constant(value) {
+    return value ? TRUE : FALSE;
+}
+function truth(value) {
+    return value.op === 'true' ? true : value.op === 'false' ? false : undefined;
+}
+function same(left, right) {
+    return left === right || JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * Undefined when the atom reads a decision input (`requiredInputs`); otherwise whether it names the
+ * subject of its binder, outside the binders nested in it.
+ */
+function names(atom) {
+    if (requiredInputs([atom]).size > 0)
+        return undefined;
+    const subject = (value) => {
+        switch (value.op) {
+            case 'all':
+            case 'any':
+                return value.predicates.some(subject);
+            case 'not':
+                return subject(value.predicate);
+            case 'as':
+                return false;
+            case 'exists':
+                return subject(value.where);
+            default:
+                return ownTerms(value).some((term) => term.kind === 'subject');
+        }
+    };
+    return subject(atom);
+}

package/dist/auth/authority/semantics/snapshot.d.ts

@@ -0,0 +1,40 @@
+import type { NodeId } from '../../../graph/node/index.js';
+import type { Path } from '../../../graph/path/index.js';
+import type { ClassRef } from '../language/index.js';
+/** One live Node as authority sees it: its exact concrete Class. */
+export interface AuthorityNode {
+    readonly class: ClassRef;
+}
+/**
+ * One consistent graph state the interpreter reads. Every Node it exposes is live and has exactly
+ * one active concrete Class; every Edge connects two such Nodes.
+ */
+export interface AuthoritySnapshot {
+    /** The live Node, or undefined when the id names none. */
+    node(id: NodeId): AuthorityNode | undefined;
+    /**
+     * Distinct Nodes one Edge of the exact Class away: `out` follows source to target, `in` target
+     * to source, `both` either orientation. The derived `instance_of` relation is never asked.
+     */
+    edges(from: NodeId, edge: ClassRef, direction: 'out' | 'in' | 'both'): readonly NodeId[];
+    /** Orientation the pinned Registry declares for one Edge Class. */
+    orientation(edge: ClassRef): 'directed' | 'undirected';
+    /** Every live Node the Path reaches; a fixed term requires exactly one. */
+    resolve(path: Path): readonly NodeId[];
+    /**
+     * Pinned Registry candidates for derived `instance_of`, admitted through `node` before use.
+     * An absent hook falls back to `resolve(Path.project(ref))`; an empty result never does.
+     * Fixed terms always use `resolve` independently of this projection.
+     */
+    classProjection?(ref: ClassRef): readonly NodeId[];
+    /** Every live Node, restricted to exact Classes when given. */
+    nodes(classes?: readonly ClassRef[]): readonly NodeId[];
+}
+/** The input frame of one decision; each bound Node must be live. */
+export interface AuthorityInputs {
+    readonly object?: NodeId;
+    readonly source?: NodeId;
+    readonly target?: NodeId;
+    /** Exact Class of the bound Edge object, read only by `edge-class`. */
+    readonly edge?: ClassRef;
+}

package/dist/auth/authority/semantics/terms.d.ts

@@ -0,0 +1,22 @@
+import type { AuthorityExpr, Term } from '../language/index.js';
+import type { AuthorityInputs } from './snapshot.js';
+import { Path } from '../../../graph/path/index.js';
+/** A term that names one Node independently of any row, binder or local. */
+export type FixedTerm = Extract<Term, {
+    readonly kind: 'node' | 'class' | 'domain' | 'core' | 'ref';
+}>;
+export declare function isFixedTerm(term: Term): term is FixedTerm;
+/** The Path a fixed term denotes; the term holds when that Path reaches exactly one live Node. */
+export declare function termPath(term: FixedTerm): Path;
+/**
+ * Every fixed Path one expression depends on, sorted by raw text. `class-authority` depends on the
+ * projection of its Class and on the Domain of the Class origin.
+ */
+export declare function fixedPaths(expressions: readonly AuthorityExpr[]): readonly Path[];
+/**
+ * Every decision input the expressions read: each `input` term, and the bound Edge Class that
+ * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
+ */
+export declare function requiredInputs(expressions: readonly AuthorityExpr[]): ReadonlySet<keyof AuthorityInputs>;
+/** The terms one expression reads itself, excluding those of its nested expressions. */
+export declare function ownTerms(expression: AuthorityExpr): readonly Term[];

package/dist/auth/authority/semantics/terms.js

@@ -0,0 +1,96 @@
+import { Path } from '../../../graph/path/index.js';
+export function isFixedTerm(term) {
+    return term.kind !== 'input' && term.kind !== 'local' && term.kind !== 'subject';
+}
+/** The Path a fixed term denotes; the term holds when that Path reaches exactly one live Node. */
+export function termPath(term) {
+    switch (term.kind) {
+        case 'node':
+            return Path.id(term.id);
+        case 'class':
+            return Path.project(term.ref);
+        case 'domain':
+            return Path.domain(term.origin);
+        case 'ref':
+        case 'core':
+            return Path.project(term.ref);
+    }
+}
+/**
+ * Every fixed Path one expression depends on, sorted by raw text. `class-authority` depends on the
+ * projection of its Class and on the Domain of the Class origin.
+ */
+export function fixedPaths(expressions) {
+    const paths = new Map();
+    const add = (path) => {
+        paths.set(path.raw, path);
+    };
+    for (const expression of subexpressions(expressions)) {
+        for (const term of ownTerms(expression))
+            if (isFixedTerm(term))
+                add(termPath(term));
+        if (expression.op === 'class-authority') {
+            add(Path.project(expression.class));
+            add(Path.domain(expression.class.origin));
+        }
+    }
+    return Object.freeze([...paths.values()].sort((left, right) => compare(left.raw, right.raw)));
+}
+/**
+ * Every decision input the expressions read: each `input` term, and the bound Edge Class that
+ * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
+ */
+export function requiredInputs(expressions) {
+    const inputs = new Set();
+    for (const expression of subexpressions(expressions)) {
+        if (expression.op === 'edge-class')
+            inputs.add('edge');
+        for (const term of ownTerms(expression))
+            if (term.kind === 'input')
+                inputs.add(term.input);
+    }
+    return inputs;
+}
+/** Every expression and nested expression, depth first in syntax order. */
+function* subexpressions(expressions) {
+    for (const expression of expressions) {
+        yield expression;
+        switch (expression.op) {
+            case 'all':
+            case 'any':
+                yield* subexpressions(expression.predicates);
+                break;
+            case 'not':
+                yield* subexpressions([expression.predicate]);
+                break;
+            case 'as':
+            case 'exists':
+                yield* subexpressions([expression.where]);
+        }
+    }
+}
+/** The terms one expression reads itself, excluding those of its nested expressions. */
+export function ownTerms(expression) {
+    switch (expression.op) {
+        case 'same-node':
+            return [expression.left, expression.right];
+        case 'related':
+            return [expression.source, expression.target];
+        case 'instance-of':
+            return [expression.node];
+        case 'class-authority':
+            return [expression.identity];
+        case 'true':
+        case 'false':
+        case 'edge-class':
+        case 'all':
+        case 'any':
+        case 'not':
+        case 'as':
+        case 'exists':
+            return [];
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/authority/semantics/vocabulary.d.ts

@@ -0,0 +1,19 @@
+import type { ClassRef, Operation } from '../language/index.js';
+/**
+ * The Kernel Classes that give authority its meaning. Core Schema publishes the Kernel instance;
+ * the interpreter and every lowering take it as a parameter instead of discovering it.
+ */
+export interface AuthorityVocabulary {
+    /** Node Class whose concrete descendants an Identity binder may reach. */
+    readonly identity: ClassRef;
+    /** Outgoing composition Edges of one Identity. */
+    readonly composition: {
+        readonly extension: ClassRef;
+        readonly constraint: ClassRef;
+        readonly exclusion: ClassRef;
+    };
+    /** Edge from an Identity to a Class projection that delegates one Class operation. */
+    readonly capabilities: Readonly<Record<Operation, ClassRef>>;
+    /** The derived relation from a Node to the projection of its exact Class. */
+    readonly instanceOf: ClassRef;
+}

package/dist/auth/context/context.d.ts

@@ -2,7 +2,6 @@ import type { Attestation } from '../attestation/index.js';
 import type { CredentialInput } from '../credential/input/index.js';
 import type { VerifiedCredential } from '../credential/verified/index.js';
 import type { Delegation } from '../delegation/index.js';
-import type { Grant } from '../grant/index.js';
 import type { IdentityId } from '../identity/index.js';
 /** The original credential together with the claims established by verification. */
 export interface CredentialContext {
@@ -12,15 +11,17 @@ export interface CredentialContext {
 /** Verified credential result before every runtime authority value is necessarily resolved. */
 export interface Authenticated {
     readonly credential: CredentialContext;
-    readonly grant?: Grant;
+    readonly caller?: IdentityId;
     readonly attestation?: Attestation;
     readonly delegation?: Delegation;
 }
 /** Complete authenticated kernel context. */
 export interface AuthContext {
     readonly credential: CredentialContext;
+    /** Authenticated executor: ceiling, installed ownership, Root bypass, and audit. */
     readonly principal: IdentityId;
-    readonly grant: Grant;
+    /** The one Identity whose authority the call exercises; equals principal for direct calls. */
+    readonly caller: IdentityId;
     /** Earliest expiry of all credential proofs from which this authority was derived. */
     readonly validUntil?: number;
     readonly attestation?: Attestation;

package/dist/auth/expression/authoring/builder.d.ts

@@ -6,11 +6,8 @@ export type BuiltExpr = IdentityExpr | UnresolvedIdentityExpr;
 export interface ExprBuilder<E extends BuiltExpr = IdentityExpr> {
     build(): E;
 }
-/** Immutable fluent expression handle. */
+/** Immutable handle for one Identity leaf; there is no Identity set algebra. */
 export interface Expr<E extends BuiltExpr = IdentityExpr> extends ExprBuilder<E> {
-    union(other: Expr<E>): Expr<E>;
-    intersect(other: Expr<E>): Expr<E>;
-    exclude(other: Expr<E>): Expr<E>;
 }
 export declare function isExprBuilder(input: unknown): input is ExprBuilder<IdentityExpr> | ExprBuilder<UnresolvedIdentityExpr>;
 /** Build one resolved Identity leaf. */
@@ -19,11 +16,5 @@ export declare function identity(id: IdentityId): Expr<IdentityExpr>;
 export declare function self(): Expr<UnresolvedIdentityExpr>;
 /** Build one unresolved nested-credential leaf. */
 export declare function cred(credential: CredentialInput): Expr<UnresolvedIdentityExpr>;
-/** Re-enter the fluent algebra from an already trusted or separately admitted expression. */
+/** Re-enter from an already trusted or separately admitted Identity leaf. */
 export declare function raw<E extends BuiltExpr>(expr: E): Expr<E>;
-/** Compose at least two expressions of the same resolved or unresolved phase. */
-export declare function union<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Intersect at least two expressions of the same resolved or unresolved phase. */
-export declare function intersect<E extends BuiltExpr>(first: Expr<E>, second: Expr<NoInfer<E>>, ...rest: Expr<NoInfer<E>>[]): Expr<E>;
-/** Exclude one expression from another expression of the same phase. */
-export declare function exclude<E extends BuiltExpr>(base: Expr<E>, excluded: Expr<NoInfer<E>>): Expr<E>;

package/dist/auth/expression/authoring/builder.js

@@ -13,27 +13,6 @@ class Expression {
     build() {
         return this.value;
     }
-    union(other) {
-        return compose('union', this, other);
-    }
-    intersect(other) {
-        return compose('intersect', this, other);
-    }
-    exclude(other) {
-        const current = this.value;
-        if (current.kind === 'exclude') {
-            return expression({
-                kind: 'exclude',
-                base: current.base,
-                excluded: [...current.excluded, other.build()],
-            });
-        }
-        return expression({
-            kind: 'exclude',
-            base: current,
-            excluded: [other.build()],
-        });
-    }
 }
 /** Build one resolved Identity leaf. */
 export function identity(id) {
@@ -55,33 +34,10 @@ export function cred(credential) {
     }
     return expression(Object.freeze({ kind: 'identity', credential: credential.slice() }));
 }
-/** Re-enter the fluent algebra from an already trusted or separately admitted expression. */
+/** Re-enter from an already trusted or separately admitted Identity leaf. */
 export function raw(expr) {
     return expression(expr);
 }
-/** Compose at least two expressions of the same resolved or unresolved phase. */
-export function union(first, second, ...rest) {
-    return compose('union', first, second, ...rest);
-}
-/** Intersect at least two expressions of the same resolved or unresolved phase. */
-export function intersect(first, second, ...rest) {
-    return compose('intersect', first, second, ...rest);
-}
-/** Exclude one expression from another expression of the same phase. */
-export function exclude(base, excluded) {
-    return base.exclude(excluded);
-}
-function compose(kind, first, second, ...rest) {
-    const operands = [];
-    for (const builder of [first, second, ...rest]) {
-        const value = builder.build();
-        if (value.kind === kind)
-            operands.push(...value.operands);
-        else
-            operands.push(value);
-    }
-    return expression({ kind, operands });
-}
 function expression(value) {
     return Object.freeze(new Expression(value));
 }

package/dist/auth/expression/authoring/index.d.ts

@@ -1,2 +1,2 @@
 export type { BuiltExpr, Expr, ExprBuilder } from './builder.js';
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union } from './builder.js';
+export { cred, identity, isExprBuilder, raw, self } from './builder.js';

package/dist/auth/expression/authoring/index.js

@@ -1 +1 @@
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union } from './builder.js';
+export { cred, identity, isExprBuilder, raw, self } from './builder.js';

package/dist/auth/expression/index.d.ts

@@ -1,4 +1,3 @@
 export type { BuiltExpr, Expr, ExprBuilder } from './authoring/index.js';
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union, } from './authoring/index.js';
+export { cred, identity, isExprBuilder, raw, self } from './authoring/index.js';
 export type { IdentityExpr, SelfIdentityExpr, UnresolvedIdentityExpr } from './language/index.js';
-export { canonicalize, raiseDenials } from './normalization/index.js';

package/dist/auth/expression/index.js

@@ -1,2 +1 @@
-export { cred, exclude, identity, intersect, isExprBuilder, raw, self, union, } from './authoring/index.js';
-export { canonicalize, raiseDenials } from './normalization/index.js';
+export { cred, identity, isExprBuilder, raw, self } from './authoring/index.js';

package/dist/auth/expression/language/identity-expression.d.ts

@@ -5,33 +5,13 @@ export type SelfIdentityExpr = {
     readonly kind: 'identity';
     readonly self: true;
 };
-/** Resolved Identity set algebra. Every leaf is one stable IdentityId. */
+/** The one resolved Identity leaf carried by Kernel bearer and delegation proof claims. */
 export type IdentityExpr = {
     readonly kind: 'identity';
     readonly id: IdentityId;
-} | {
-    readonly kind: 'union';
-    readonly operands: readonly IdentityExpr[];
-} | {
-    readonly kind: 'intersect';
-    readonly operands: readonly IdentityExpr[];
-} | {
-    readonly kind: 'exclude';
-    readonly base: IdentityExpr;
-    readonly excluded: readonly IdentityExpr[];
 };
-/** Caller-authored expression accepted only inside a versioned credential claim. */
+/** Caller-authored single leaf accepted only inside a versioned credential claim. */
 export type UnresolvedIdentityExpr = SelfIdentityExpr | {
     readonly kind: 'identity';
     readonly credential: CredentialInput;
-} | {
-    readonly kind: 'union';
-    readonly operands: readonly UnresolvedIdentityExpr[];
-} | {
-    readonly kind: 'intersect';
-    readonly operands: readonly UnresolvedIdentityExpr[];
-} | {
-    readonly kind: 'exclude';
-    readonly base: UnresolvedIdentityExpr;
-    readonly excluded: readonly UnresolvedIdentityExpr[];
 };

package/dist/auth/grant/index.d.ts

@@ -1,4 +1,4 @@
-export { accept, canonicalize, self } from './resolved/index.js';
+export { accept, self } from './resolved/index.js';
 export type { Grant } from './resolved/index.js';
 export { acceptUnresolved, limits } from './unresolved/index.js';
 export type { UnresolvedGrant } from './unresolved/index.js';

package/dist/auth/grant/index.js

@@ -1,2 +1,2 @@
-export { accept, canonicalize, self } from './resolved/index.js';
+export { accept, self } from './resolved/index.js';
 export { acceptUnresolved, limits } from './unresolved/index.js';

package/dist/auth/grant/resolved/admission.d.ts

@@ -1,5 +1,6 @@
 import type { Grant } from './grant.js';
-/** Admit one exact resolved Grant. */
+/**
+ * Admit one exact resolved claim value `{ expr: { kind: 'identity', id } }`. Compound structure
+ * keeps the unresolved claim's stable code, AUTH_GRANT_COMPOUND.
+ */
 export declare function accept(input: unknown): Grant;
-/** Re-canonicalize a trusted Grant value. */
-export declare function canonicalize(input: Grant): Grant;

package/dist/auth/grant/resolved/admission.js

@@ -1,30 +1,40 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
+import { isNodeId, NodeId } from '../../../graph/node/index.js';
 import { AuthValueError } from '../../error.js';
-import { admitResolvedExpression, canonicalize as canonicalizeExpression, } from '../../expression/normalization/index.js';
-/** Admit one exact resolved Grant. */
+const COMPOUND = new Set(['union', 'intersect', 'exclude']);
+/**
+ * Admit one exact resolved claim value `{ expr: { kind: 'identity', id } }`. Compound structure
+ * keeps the unresolved claim's stable code, AUTH_GRANT_COMPOUND.
+ */
 export function accept(input) {
     try {
         const value = portable.accept(input);
-        if (value === null || Array.isArray(value) || typeof value !== 'object') {
-            invalid('', 'Expected a Grant object');
-        }
-        const grant = value;
+        const grant = record(value, '', 'Expected a Grant object');
         exact(grant, ['expr'], '');
-        if (grant.expr === undefined)
-            invalid('/expr', 'Expected a resolved Identity expression');
-        return Object.freeze({ expr: admitResolvedExpression(grant.expr, '/expr', 0) });
+        const expr = record(grant.expr, '/expr', 'Expected one resolved Identity leaf');
+        if (typeof expr.kind === 'string' && COMPOUND.has(expr.kind)) {
+            throw new AuthValueError('AUTH_GRANT_COMPOUND', 'Resolved Grant must name exactly one Identity', '/expr');
+        }
+        exact(expr, ['id', 'kind'], '/expr');
+        if (expr.kind !== 'identity')
+            invalid('/expr/kind', 'Expected one resolved Identity leaf');
+        if (typeof expr.id !== 'string' || !isNodeId(expr.id)) {
+            invalid('/expr/id', 'Expected one canonical IdentityId');
+        }
+        return Object.freeze({ expr: Object.freeze({ kind: 'identity', id: NodeId(expr.id) }) });
     }
     catch (cause) {
         if (cause instanceof AuthValueError)
             throw cause;
-        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a canonical resolved Grant', '', {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected a resolved single-Identity Grant', '', {
             cause,
         });
     }
 }
-/** Re-canonicalize a trusted Grant value. */
-export function canonicalize(input) {
-    return Object.freeze({ expr: canonicalizeExpression(input.expr) });
+function record(value, path, message) {
+    if (value === null || Array.isArray(value) || typeof value !== 'object')
+        invalid(path, message);
+    return value;
 }
 function exact(value, expected, path) {
     const actual = Object.keys(value).sort(compare);

package/dist/auth/grant/resolved/grant.d.ts

@@ -1,5 +1,5 @@
 import type { IdentityExpr } from '../../expression/language/index.js';
-/** One resolved, canonical authority expression. */
+/** The resolved single-identity claim value carried by Kernel bearers and delegation proofs. */
 export interface Grant {
     readonly expr: IdentityExpr;
 }

package/dist/auth/grant/resolved/index.d.ts

@@ -1,3 +1,3 @@
-export { accept, canonicalize } from './admission.js';
+export { accept } from './admission.js';
 export { self } from './self.js';
 export type { Grant } from './grant.js';

package/dist/auth/grant/resolved/index.js

@@ -1,2 +1,2 @@
-export { accept, canonicalize } from './admission.js';
+export { accept } from './admission.js';
 export { self } from './self.js';

package/dist/auth/grant/unresolved/admission.d.ts

@@ -1,3 +1,6 @@
 import type { UnresolvedGrant } from './grant.js';
-/** Admit the exact bounded unresolved Grant wire language. */
+/**
+ * Admit the exact version-1 unresolved Grant claim: exactly one `self` or one credential leaf.
+ * Compound structure is refused before any nested credential could be verified.
+ */
 export declare function acceptUnresolved(input: unknown): UnresolvedGrant;