@astrale-os/kernel-core 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/schema/authority/authority-relation.js

@@ -12,5 +12,8 @@ export function authorityRelation(target, role, description) {
         target: { as: role, accepts: [target], incoming: '0..*' },
         description,
         extends: [Edge],
+        // The installed authority map is observed through Identity.can, never read wholesale: only the
+        // Kernel Domain and Root read its Edges.
+        policies: { read: false, traverse: false },
     });
 }

package/dist/schema/callables/execution.js

@@ -11,12 +11,14 @@ const nodeId = {
 // mutation cannot create an Execution, change its Properties or rewrite its created_by Edge; its
 // authority Domain deletes it by ordinary mutation. `function` is a scalar, not an Edge, so deleting
 // the Function never has to detach its Executions. State and outcome are read through the engine.
-// No Class Policy: Runtime admits every Execution method against these facts, and a relational
-// read Policy here would join every polymorphic Query reaching Node or Timestamped.
+// Runtime admits every Execution method against these facts; a public read sees none of them, since
+// `input` carries the arguments of the call. The constant rule joins nothing, where a relational
+// read Policy would join every polymorphic Query reaching Node or Timestamped.
 export const Execution = nodeClass({
     abstract: false,
     description: 'One accepted durable call of a Function, recorded as immutable facts.',
     extends: [Node, Timestamped],
+    policies: { read: false, traverse: false },
     properties: {
         function: nodeId,
         version: { type: 'string', fullMatch: 'sha256:[0-9a-f]{64}' },

package/dist/schema/kernel/schema.d.ts

@@ -8832,38 +8832,24 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
     readonly key: "kernel.astrale.ai:function.install";
     readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
-    invocation?: {
-        source: string;
-        id: string;
-    } | undefined;
-    topics?: {
-        exact?: string[] | undefined;
-        prefixes?: string[] | undefined;
-    } | undefined;
-    principal?: string | undefined;
-    since?: string | undefined;
-    until?: string | undefined;
-    cursor?: string | undefined;
-    limit?: number | undefined;
-}, {
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<import("@astrale-os/kernel-dsl/v1").BinaryInputProjection<{
+    mediaType: string;
+}>, {
     readonly mode: 'value';
     readonly value: {
-        records: unknown[];
-        frontier: {
-            id: string;
-            first?: number | undefined;
-            committed: number;
-            durable: number;
+        receipt: string;
+        ref: {
+            digest: string;
+            mediaType: string;
+            size: number;
         };
-        cursor?: string | undefined;
-        gap?: unknown;
+        expiresAt: string;
     };
 }, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"journal"> & {
+    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"upload"> & {
         readonly origin: "kernel.astrale.ai";
     };
-    readonly key: "kernel.astrale.ai:function.journal";
+    readonly key: "kernel.astrale.ai:function.upload";
     readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     ast: {
@@ -9427,35 +9413,38 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
     readonly key: "kernel.astrale.ai:function.uninstall";
     readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<import("@astrale-os/kernel-dsl/v1").BinaryInputProjection<{
-    mediaType: string;
-}>, {
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
+    invocation?: {
+        source: string;
+        id: string;
+    } | undefined;
+    topics?: {
+        exact?: string[] | undefined;
+        prefixes?: string[] | undefined;
+    } | undefined;
+    principal?: string | undefined;
+    since?: string | undefined;
+    until?: string | undefined;
+    cursor?: string | undefined;
+    limit?: number | undefined;
+}, {
     readonly mode: 'value';
     readonly value: {
-        receipt: string;
-        ref: {
-            digest: string;
-            mediaType: string;
-            size: number;
+        records: unknown[];
+        frontier: {
+            id: string;
+            first?: number | undefined;
+            committed: number;
+            durable: number;
         };
-        expiresAt: string;
+        cursor?: string | undefined;
+        gap?: unknown;
     };
 }, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"upload"> & {
+    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"journal"> & {
         readonly origin: "kernel.astrale.ai";
     };
-    readonly key: "kernel.astrale.ai:function.upload";
-    readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
-    audience?: string | undefined;
-    ttlSeconds: number;
-    identity: string;
-}, {
-    readonly mode: 'value';
-    readonly value: string;
-}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
-    readonly name: "impersonate";
-    readonly executable: true;
+    readonly key: "kernel.astrale.ai:function.journal";
     readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     iss: string;
@@ -9516,6 +9505,17 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     readonly name: "resolve";
     readonly executable: true;
     readonly execution: undefined;
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
+    audience?: string | undefined;
+    ttlSeconds: number;
+    identity: string;
+}, {
+    readonly mode: 'value';
+    readonly value: string;
+}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
+    readonly name: "impersonate";
+    readonly executable: true;
+    readonly execution: undefined;
 }))[];
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';
 export type { AuthorityOperation, AuthorityRelation } from '../authority/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "1.0.0-beta.1",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.2",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"