@astrale-os/kernel-core 0.9.0-beta.9 → 1.0.0-beta.2

package/dist/auth/authority/accept.js

@@ -3,8 +3,12 @@ import { AuthValueError } from '../error.js';
 import { admitAuthorityExpr } from './admission/index.js';
 import { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
 import { canonicalizeAdmitted } from './normalization/index.js';
+import { ownsCanonical } from './ownership.optimization.js';
 /** Re-admit one persisted or crossing canonical authority predicate. */
 export function accept(input) {
+    // The owner retains only deeply immutable, detached canonical predicates.
+    if (ownsCanonical(input))
+        return input;
     try {
         const admitted = portable.accept(input);
         if (admitted === null || Array.isArray(admitted) || typeof admitted !== 'object') {

package/dist/auth/authority/admission/admission.d.ts

@@ -4,7 +4,10 @@ export declare const limits: {
     readonly expressionDepth: 64;
     readonly operandsPerExpression: 512;
     readonly localsPerExpression: 64;
+    readonly classesPerLocal: 1024;
+    readonly classesPerRelation: 1024;
     readonly repeatMaximum: 16;
 };
-export declare const MAX_BOOLEAN_OPERANDS: 512;
 export declare function admitAuthorityExpr(input: portable.Value): AuthorityExpr;
+/** Internal constructor admission: the outer identity binder binds subject; no local escapes into it. */
+export declare function admitBinderBody(input: portable.Value): AuthorityExpr;

package/dist/auth/authority/admission/admission.js

@@ -1,20 +1,29 @@
-import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isNodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error.js';
-import { accept as acceptGrant } from '../../grant/index.js';
+import { ownsExpression } from '../ownership.optimization.js';
+import { classRef } from './references.js';
+import { localId, term } from './term.js';
+import { array, exact, invalid, record, required } from './wire.js';
 export const limits = Object.freeze({
     expressionDepth: 64,
     operandsPerExpression: 512,
     localsPerExpression: 64,
+    classesPerLocal: 1024,
+    classesPerRelation: 1024,
     repeatMaximum: 16,
 });
-export const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
+const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
 export function admitAuthorityExpr(input) {
     return admit(input, '/predicate', new Set(), false, 0);
 }
+/** Internal constructor admission: the outer identity binder binds subject; no local escapes into it. */
+export function admitBinderBody(input) {
+    return admit(input, '/predicate/where', new Set(), true, 1);
+}
 function admit(input, path, locals, subjectBound, depth) {
     if (depth > limits.expressionDepth)
         invalid(path, 'Authority expression exceeds its depth limit');
+    if (locals.size === 0 && ownsExpression(input, limits.expressionDepth - depth))
+        return input;
     const value = record(input, path);
     switch (value.op) {
         case 'true':
@@ -36,22 +45,30 @@ function admit(input, path, locals, subjectBound, depth) {
                 op: 'not',
                 predicate: admit(required(value.predicate, `${path}/predicate`), `${path}/predicate`, locals, subjectBound, depth + 1),
             };
-        case 'grant':
-            exact(value, ['grant', 'op', 'where'], path);
+        case 'as':
+            exact(value, ['identity', 'op', 'where'], path);
+            if (typeof value.identity !== 'string' || !isNodeId(value.identity)) {
+                invalid(`${path}/identity`, 'Expected one canonical IdentityId');
+            }
             return {
-                op: 'grant',
-                grant: acceptGrant(value.grant),
+                op: 'as',
+                identity: value.identity,
                 where: admit(required(value.where, `${path}/where`), `${path}/where`, locals, true, depth + 1),
             };
+        case 'same-node':
+            exact(value, ['op', 'left', 'right'], path);
+            return {
+                op: 'same-node',
+                left: term(value.left, `${path}/left`, locals, subjectBound),
+                right: term(value.right, `${path}/right`, locals, subjectBound),
+            };
         case 'related': {
             const hasRepeat = Object.hasOwn(value, 'repeat');
-            exact(value, hasRepeat
-                ? ['class', 'op', 'repeat', 'source', 'target']
-                : ['class', 'op', 'source', 'target'], path);
+            exact(value, hasRepeat ? ['via', 'op', 'repeat', 'source', 'target'] : ['via', 'op', 'source', 'target'], path);
             return {
                 op: 'related',
                 source: term(value.source, `${path}/source`, locals, subjectBound),
-                class: edgeClassRef(value.class, `${path}/class`),
+                via: array(value.via, `${path}/via`, 1, limits.classesPerRelation).map((entry, index) => classRef(entry, `${path}/via/${index}`)),
                 target: term(value.target, `${path}/target`, locals, subjectBound),
                 ...(hasRepeat ? { repeat: repeat(value.repeat, `${path}/repeat`) } : {}),
             };
@@ -80,11 +97,11 @@ function admit(input, path, locals, subjectBound, depth) {
             return {
                 op: 'instance-of',
                 node: term(value.node, `${path}/node`, locals, subjectBound),
-                class: nodeClassRef(value.class, `${path}/class`),
+                class: classRef(value.class, `${path}/class`),
             };
         case 'edge-class':
             exact(value, ['class', 'op'], path);
-            return { op: 'edge-class', class: edgeClassRef(value.class, `${path}/class`) };
+            return { op: 'edge-class', class: classRef(value.class, `${path}/class`) };
         case 'class-authority':
             exact(value, ['class', 'evidence', 'identity', 'op', 'operation'], path);
             return {
@@ -94,60 +111,27 @@ function admit(input, path, locals, subjectBound, depth) {
                 class: classRef(value.class, `${path}/class`),
                 evidence: evidence(value.evidence, `${path}/evidence`),
             };
-        case 'domain-control':
-            exact(value, ['identity', 'op', 'origin'], path);
-            return {
-                op: 'domain-control',
-                identity: term(value.identity, `${path}/identity`, locals, subjectBound),
-                origin: domainOrigin(value.origin, `${path}/origin`),
-            };
         default:
             invalid(`${path}/op`, 'Unsupported authority operation');
     }
 }
-function term(input, path, locals, subjectBound) {
-    const value = record(input, path);
-    switch (value.kind) {
-        case 'input':
-            exact(value, ['input', 'kind'], path);
-            if (value.input !== 'object' && value.input !== 'source' && value.input !== 'target') {
-                invalid(`${path}/input`, 'Expected object, source, or target');
-            }
-            return { kind: 'input', input: value.input };
-        case 'node':
-            exact(value, ['id', 'kind'], path);
-            if (!isNodeId(value.id))
-                invalid(`${path}/id`, 'Expected a canonical NodeId');
-            return { kind: 'node', id: value.id };
-        case 'class':
-            exact(value, ['kind', 'ref'], path);
-            return { kind: 'class', ref: classRef(value.ref, `${path}/ref`) };
-        case 'domain':
-            exact(value, ['kind', 'origin'], path);
-            return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
-        case 'core':
-            exact(value, ['kind', 'ref'], path);
-            return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };
-        case 'local': {
-            exact(value, ['id', 'kind'], path);
-            const id = localId(value.id, `${path}/id`);
-            if (!locals.has(id))
-                invalid(`${path}/id`, `Local ${id} is outside its lexical scope`);
-            return { kind: 'local', id };
-        }
-        case 'subject':
-            exact(value, ['kind'], path);
-            if (!subjectBound)
-                invalid(path, 'Grant subject is outside its lexical scope');
-            return { kind: 'subject' };
-        default:
-            invalid(`${path}/kind`, 'Unsupported authority term');
-    }
-}
 function localDeclaration(input, path) {
     const value = record(input, path);
-    exact(value, ['class', 'id'], path);
-    return { id: localId(value.id, `${path}/id`), class: nodeClassRef(value.class, `${path}/class`) };
+    const id = localId(value.id, `${path}/id`);
+    if (value.kind === 'any') {
+        exact(value, ['id', 'kind'], path);
+        return { id, kind: 'any' };
+    }
+    if (value.kind === 'classes') {
+        exact(value, ['classes', 'id', 'kind'], path);
+        const classes = array(value.classes, `${path}/classes`, 1, limits.classesPerLocal).map((entry, index) => classRef(entry, `${path}/classes/${index}`));
+        return {
+            id,
+            kind: 'classes',
+            classes: classes,
+        };
+    }
+    invalid(`${path}/kind`, 'Expected any or classes local selector');
 }
 function repeat(input, path) {
     const value = record(input, path);
@@ -161,61 +145,6 @@ function repeat(input, path) {
     }
     return { min, max };
 }
-function classRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function nodeClassRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function edgeClassRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function absoluteRef(input, path) {
-    const value = record(input, path);
-    exact(value, ['kind', 'name', 'origin'], path);
-    const origin = domainOrigin(value.origin, `${path}/origin`);
-    if (typeof value.kind !== 'string')
-        invalid(`${path}/kind`, 'Expected a reference kind');
-    if (typeof value.name !== 'string')
-        invalid(`${path}/name`, 'Expected a reference name');
-    return { origin, kind: value.kind, name: value.name };
-}
-function definitionName(input, path) {
-    if (!patterns.memberName.test(input))
-        invalid(path, 'Expected a Definition member name');
-}
-function coreRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'core')
-        invalid(`${path}/kind`, 'Expected core');
-    if (!patterns.coreSlug.test(value.name))
-        invalid(`${path}/name`, 'Expected a Core slug');
-    return value;
-}
-function domainOrigin(input, path) {
-    if (typeof input !== 'string' || !patterns.origin.test(input)) {
-        invalid(path, 'Expected a canonical Domain origin');
-    }
-    return input;
-}
-function localId(input, path) {
-    if (!Number.isSafeInteger(input) || input < 0) {
-        invalid(path, 'Expected a non-negative safe integer');
-    }
-    return input;
-}
 function operation(input, path) {
     if (input !== 'create' &&
         input !== 'read' &&
@@ -231,33 +160,3 @@ function evidence(input, path) {
         invalid(path, 'Expected allowed or owner');
     return input;
 }
-function record(input, path) {
-    if (input === undefined || input === null || Array.isArray(input) || typeof input !== 'object') {
-        invalid(path, 'Expected an object');
-    }
-    return input;
-}
-function array(input, path, minimum, maximum) {
-    if (!Array.isArray(input) || input.length < minimum || input.length > maximum) {
-        invalid(path, `Expected ${minimum}-${maximum} entries`);
-    }
-    return input;
-}
-function required(input, path) {
-    if (input === undefined)
-        invalid(path, 'Expected a value');
-    return input;
-}
-function exact(value, expected, path) {
-    const actual = Object.keys(value).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-    }
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message) {
-    throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
-}

package/dist/auth/authority/admission/index.d.ts

@@ -1 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
+export { admitAuthorityExpr, admitBinderBody, limits } from './admission.js';

package/dist/auth/authority/admission/index.js

@@ -1 +1 @@
-export { admitAuthorityExpr, limits } from './admission.js';
+export { admitAuthorityExpr, admitBinderBody, limits } from './admission.js';

package/dist/auth/authority/admission/references.d.ts

@@ -0,0 +1,13 @@
+import type { Key } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef } from '@astrale-os/kernel-dsl/v1/addressing';
+import type * as portable from '@astrale-os/kernel-dsl/value';
+/** One `{ origin, kind, name }` reference with a canonical origin and an unchecked kind and name. */
+export declare function absoluteRef(input: portable.Value | undefined, path: string): {
+    readonly origin: Key.Origin;
+    readonly kind: string;
+    readonly name: string;
+};
+export declare function classRef(input: portable.Value | undefined, path: string): ClassRef;
+export declare function coreRef(input: portable.Value | undefined, path: string): CoreRef;
+export declare function definitionName(input: string, path: string): void;
+export declare function domainOrigin(input: portable.Value | undefined, path: string): Key.Origin;

package/dist/auth/authority/admission/references.js

@@ -0,0 +1,38 @@
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { exact, invalid, record } from './wire.js';
+/** One `{ origin, kind, name }` reference with a canonical origin and an unchecked kind and name. */
+export function absoluteRef(input, path) {
+    const value = record(input, path);
+    exact(value, ['kind', 'name', 'origin'], path);
+    const origin = domainOrigin(value.origin, `${path}/origin`);
+    if (typeof value.kind !== 'string')
+        invalid(`${path}/kind`, 'Expected a reference kind');
+    if (typeof value.name !== 'string')
+        invalid(`${path}/name`, 'Expected a reference name');
+    return { origin, kind: value.kind, name: value.name };
+}
+export function classRef(input, path) {
+    const value = absoluteRef(input, path);
+    if (value.kind !== 'class')
+        invalid(`${path}/kind`, 'Expected class');
+    definitionName(value.name, `${path}/name`);
+    return value;
+}
+export function coreRef(input, path) {
+    const value = absoluteRef(input, path);
+    if (value.kind !== 'core')
+        invalid(`${path}/kind`, 'Expected core');
+    if (!patterns.coreSlug.test(value.name))
+        invalid(`${path}/name`, 'Expected a Core slug');
+    return value;
+}
+export function definitionName(input, path) {
+    if (!patterns.memberName.test(input))
+        invalid(path, 'Expected a Definition member name');
+}
+export function domainOrigin(input, path) {
+    if (typeof input !== 'string' || !patterns.origin.test(input)) {
+        invalid(path, 'Expected a canonical Domain origin');
+    }
+    return input;
+}

package/dist/auth/authority/admission/term.d.ts

@@ -0,0 +1,6 @@
+import type * as portable from '@astrale-os/kernel-dsl/value';
+import type { Term } from '../language/index.js';
+/** Admit one term; `locals` and `subjectBound` are the lexical scope it may reference. */
+export declare function term(input: portable.Value | undefined, path: string, locals: ReadonlySet<number>, subjectBound: boolean): Term;
+/** A local id or repeat bound: a non-negative safe integer. */
+export declare function localId(input: portable.Value | undefined, path: string): number;

package/dist/auth/authority/admission/term.js

@@ -0,0 +1,60 @@
+import { isNodeId } from '../../../graph/node/index.js';
+import { absoluteRef, classRef, coreRef, definitionName, domainOrigin } from './references.js';
+import { exact, invalid, record } from './wire.js';
+/** Admit one term; `locals` and `subjectBound` are the lexical scope it may reference. */
+export function term(input, path, locals, subjectBound) {
+    const value = record(input, path);
+    switch (value.kind) {
+        case 'input':
+            exact(value, ['input', 'kind'], path);
+            if (value.input !== 'object' && value.input !== 'source' && value.input !== 'target') {
+                invalid(`${path}/input`, 'Expected object, source, or target');
+            }
+            return { kind: 'input', input: value.input };
+        case 'node':
+            exact(value, ['id', 'kind'], path);
+            if (!isNodeId(value.id))
+                invalid(`${path}/id`, 'Expected a canonical NodeId');
+            return { kind: 'node', id: value.id };
+        case 'class':
+            exact(value, ['kind', 'ref'], path);
+            return { kind: 'class', ref: classRef(value.ref, `${path}/ref`) };
+        case 'domain':
+            exact(value, ['kind', 'origin'], path);
+            return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
+        case 'ref': {
+            exact(value, ['kind', 'ref'], path);
+            const ref = absoluteRef(value.ref, `${path}/ref`);
+            if (ref.kind === 'core')
+                return { kind: 'ref', ref: coreRef(value.ref, `${path}/ref`) };
+            if (!['class', 'function', 'policy', 'view'].includes(ref.kind))
+                invalid(`${path}/ref/kind`, 'Expected a projected Schema member');
+            definitionName(ref.name, `${path}/ref/name`);
+            return { kind: 'ref', ref: ref };
+        }
+        case 'core':
+            exact(value, ['kind', 'ref'], path);
+            return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };
+        case 'local': {
+            exact(value, ['id', 'kind'], path);
+            const id = localId(value.id, `${path}/id`);
+            if (!locals.has(id))
+                invalid(`${path}/id`, `Local ${id} is outside its lexical scope`);
+            return { kind: 'local', id };
+        }
+        case 'subject':
+            exact(value, ['kind'], path);
+            if (!subjectBound)
+                invalid(path, 'Binder subject is outside its lexical scope');
+            return { kind: 'subject' };
+        default:
+            invalid(`${path}/kind`, 'Unsupported authority term');
+    }
+}
+/** A local id or repeat bound: a non-negative safe integer. */
+export function localId(input, path) {
+    if (!Number.isSafeInteger(input) || input < 0) {
+        invalid(path, 'Expected a non-negative safe integer');
+    }
+    return input;
+}

package/dist/auth/authority/admission/wire.d.ts

@@ -0,0 +1,8 @@
+import type * as portable from '@astrale-os/kernel-dsl/value';
+/** Fail admission at one JSON-pointer path with the stable Authority predicate code. */
+export declare function invalid(path: string, message: string): never;
+export declare function record(input: portable.Value | undefined, path: string): portable.Object;
+export declare function array(input: portable.Value | undefined, path: string, minimum: number, maximum: number): readonly portable.Value[];
+export declare function required(input: portable.Value | undefined, path: string): portable.Value;
+/** Reject a record whose own keys differ from `expected`, in any order. */
+export declare function exact(value: portable.Object, expected: readonly string[], path: string): void;

package/dist/auth/authority/admission/wire.js

@@ -0,0 +1,33 @@
+import { AuthValueError } from '../../error.js';
+/** Fail admission at one JSON-pointer path with the stable Authority predicate code. */
+export function invalid(path, message) {
+    throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
+}
+export function record(input, path) {
+    if (input === undefined || input === null || Array.isArray(input) || typeof input !== 'object') {
+        invalid(path, 'Expected an object');
+    }
+    return input;
+}
+export function array(input, path, minimum, maximum) {
+    if (!Array.isArray(input) || input.length < minimum || input.length > maximum) {
+        invalid(path, `Expected ${minimum}-${maximum} entries`);
+    }
+    return input;
+}
+export function required(input, path) {
+    if (input === undefined)
+        invalid(path, 'Expected a value');
+    return input;
+}
+/** Reject a record whose own keys differ from `expected`, in any order. */
+export function exact(value, expected, path) {
+    const actual = Object.keys(value).sort(compare);
+    const wanted = [...expected].sort(compare);
+    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+        invalid(path, `Expected exactly ${expected.join(', ')}`);
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/authority/canonical.d.ts

@@ -0,0 +1,2 @@
+/** Canonical form, not an authorization decision. Crossing values still require admission. */
+export declare function isCanonical(input: unknown): boolean;

package/dist/auth/authority/canonical.js

@@ -0,0 +1,15 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { accept } from './accept.js';
+import { ownsCanonical } from './ownership.optimization.js';
+/** Canonical form, not an authorization decision. Crossing values still require admission. */
+export function isCanonical(input) {
+    if (ownsCanonical(input))
+        return true;
+    try {
+        const canonical = accept(input);
+        return portable.json.serialize(canonical) === portable.json.serialize(input);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/authority/index.d.ts

@@ -1,5 +1,12 @@
 export { accept } from './accept.js';
+export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareBinderBody } from './prepare-binder-body.js';
+export { acceptProgram, createAuthorityProgram, isPredicateRef } from './program.js';
+export type { AuthorityProgramBuilder, ClosedAuthorityProgram } from './program.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
-export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
-export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './language/index.js';
+export { AUTHORITY_PREDICATE_VERSION, AUTHORITY_PROGRAM_VERSION } from './language/index.js';
+export type { AuthorityExpr, AuthorityPredicate, AuthorityProgram, ClassRef, ClosedEdgeExtent, Input, LocalDeclaration, Operation, PredicateRef, Repeat, Requirement, Term, } from './language/index.js';
+export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, termPath, } from './semantics/index.js';
+export type { AuthorityAtom, AuthorityEvaluationOptions, AuthorityEvaluator, AuthorityFailureCode, AuthorityInputs, AuthorityNode, AuthoritySnapshot, AuthorityVocabulary, CompositionClosure, CompositionLimits, CompositionStatus, FixedTerm, } from './semantics/index.js';

package/dist/auth/authority/index.js

@@ -1,4 +1,9 @@
 export { accept } from './accept.js';
+export { isCanonical } from './canonical.js';
+export { ownsCanonical } from './ownership.optimization.js';
+export { prepareBinderBody } from './prepare-binder-body.js';
+export { acceptProgram, createAuthorityProgram, isPredicateRef } from './program.js';
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
-export { AUTHORITY_PREDICATE_VERSION } from './language/index.js';
+export { AUTHORITY_PREDICATE_VERSION, AUTHORITY_PROGRAM_VERSION } from './language/index.js';
+export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, termPath, } from './semantics/index.js';

package/dist/auth/authority/language/index.d.ts

@@ -1,2 +1,4 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
-export type { AuthorityExpr, AuthorityPredicate, ClassRef, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './predicate.js';
+export { AUTHORITY_PROGRAM_VERSION } from './program.js';
+export type { AuthorityExpr, AuthorityPredicate, ClassRef, ClosedEdgeExtent, Input, LocalDeclaration, Operation, Repeat, Requirement, Term, } from './predicate.js';
+export type { AuthorityProgram, PredicateRef } from './program.js';

package/dist/auth/authority/language/index.js

@@ -1 +1,2 @@
 export { AUTHORITY_PREDICATE_VERSION } from './predicate.js';
+export { AUTHORITY_PROGRAM_VERSION } from './program.js';

package/dist/auth/authority/language/predicate.d.ts

@@ -1,7 +1,9 @@
-import type { ClassRef, CoreRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { ClassRef, CoreRef, FunctionRef, PolicyRef, ViewRef, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { NodeId } from '../../../graph/node/index.js';
-import type { Grant } from '../../grant/index.js';
-export declare const AUTHORITY_PREDICATE_VERSION: 5;
+import type { IdentityId } from '../../identity/index.js';
+export declare const AUTHORITY_PREDICATE_VERSION: 11;
+/** Concrete Edge Classes selected by Runtime closure, reused at every bounded hop. */
+export type ClosedEdgeExtent = readonly [ClassRef, ...ClassRef[]];
 export type Operation = 'create' | 'read' | 'traverse' | 'update' | 'delete';
 export type Input = 'object' | 'source' | 'target';
 export type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
@@ -20,6 +22,9 @@ export type Term = {
 } | {
     readonly kind: 'core';
     readonly ref: CoreRef;
+} | {
+    readonly kind: 'ref';
+    readonly ref: ClassRef | FunctionRef | PolicyRef | ViewRef | CoreRef;
 } | {
     readonly kind: 'local';
     readonly id: number;
@@ -30,22 +35,26 @@ export interface Repeat {
     readonly min: number;
     readonly max: number;
 }
-export interface LocalDeclaration {
+export type LocalDeclaration = {
     readonly id: number;
-    readonly class: ClassRef;
-}
-export type Requirement = {
+    readonly kind: 'any';
+} | {
+    readonly id: number;
+    readonly kind: 'classes';
+    readonly classes: readonly [ClassRef, ...ClassRef[]];
+};
+export interface Requirement {
     readonly op: 'class-authority';
     readonly identity: Term;
     readonly operation: Operation;
     readonly class: ClassRef;
     readonly evidence: 'allowed' | 'owner';
-} | {
-    readonly op: 'domain-control';
-    readonly identity: Term;
-    readonly origin: Key.Origin;
-};
+}
 export type AuthorityExpr = {
+    readonly op: 'same-node';
+    readonly left: Term;
+    readonly right: Term;
+} | {
     readonly op: 'true';
 } | {
     readonly op: 'false';
@@ -58,14 +67,20 @@ export type AuthorityExpr = {
 } | {
     readonly op: 'not';
     readonly predicate: AuthorityExpr;
-} | {
-    readonly op: 'grant';
-    readonly grant: Grant;
+}
+/**
+ * Bind one Identity as the lexical subject of `where`. The Identity is evaluated through its live
+ * composition (extensions, constraints, exclusions; deny wins). Two binders are never fused.
+ */
+ | {
+    readonly op: 'as';
+    readonly identity: IdentityId;
     readonly where: AuthorityExpr;
 } | {
+    /** One closed Edge extent, reused at every bounded hop. */
     readonly op: 'related';
     readonly source: Term;
-    readonly class: ClassRef;
+    readonly via: ClosedEdgeExtent;
     readonly target: Term;
     readonly repeat?: Repeat;
 } | {

package/dist/auth/authority/language/predicate.js

@@ -1 +1 @@
-export const AUTHORITY_PREDICATE_VERSION = 5;
+export const AUTHORITY_PREDICATE_VERSION = 11;

package/dist/auth/authority/language/program.d.ts

@@ -0,0 +1,21 @@
+import type { ClassRef } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { AuthorityExpr } from './predicate.js';
+/** Program coordinate; its predicates are AuthorityPredicate V11 expressions. */
+export declare const AUTHORITY_PROGRAM_VERSION: 1;
+declare const PREDICATE_REF: unique symbol;
+/** Ordinal of one predicate inside the `AuthorityProgram` carried by the same plan. */
+export type PredicateRef = number & {
+    readonly [PREDICATE_REF]: true;
+};
+/**
+ * The one authority representation carried by a closed plan. Every authority position of the plan
+ * is a `PredicateRef` into `predicates`.
+ */
+export interface AuthorityProgram {
+    readonly version: typeof AUTHORITY_PROGRAM_VERSION;
+    /** Concrete Identity Classes, closed by Runtime from the pinned Registry; sorted and unique. */
+    readonly identities: readonly ClassRef[];
+    /** Canonical, sorted by canonical JSON text, unique; every member referenced by the plan. */
+    readonly predicates: readonly AuthorityExpr[];
+}
+export {};

package/dist/auth/authority/language/program.js

@@ -0,0 +1,2 @@
+/** Program coordinate; its predicates are AuthorityPredicate V11 expressions. */
+export const AUTHORITY_PROGRAM_VERSION = 1;

package/dist/auth/authority/normalization/index.d.ts

@@ -1 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
+export { canonicalize, canonicalizeAdmitted, normalizeBinderBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/index.js

@@ -1 +1 @@
-export { canonicalize, canonicalizeAdmitted } from './normalize.js';
+export { canonicalize, canonicalizeAdmitted, normalizeBinderBodyAdmitted } from './normalize.js';

package/dist/auth/authority/normalization/normalize.d.ts

@@ -2,3 +2,5 @@ import type { AuthorityExpr, AuthorityPredicate } from '../language/index.js';
 /** Validate and canonicalize one authority expression into its versioned crossing envelope. */
 export declare function canonicalize(expr: AuthorityExpr): AuthorityPredicate;
 export declare function canonicalizeAdmitted(expr: AuthorityExpr): AuthorityPredicate;
+/** Internal scoped normalization; this body is not a closed owned authority expression. */
+export declare function normalizeBinderBodyAdmitted(expr: AuthorityExpr): AuthorityExpr;