@astrale-os/kernel-protocol 0.5.0-beta.30 → 0.5.0-beta.31

package/CHANGELOG.md

@@ -24,6 +24,26 @@
 * the first supported V2 release is a coordinated `1.0.0`, not a compatible continuation of the
   current `0.x` line; package and wire versions remain independent as specified in
   [the protocol architecture](./.spec/architecture.md)
+## [0.5.0-beta.31](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.30...kernel-protocol-v0.5.0-beta.31) (2026-08-31)
+
+
+### Features
+
+* **auth:** enforce two-gate Function authority ([#561](https://github.com/astrale-os/kernel/issues/561)) ([c681d4b](https://github.com/astrale-os/kernel/commit/c681d4b391520906b2cad9171cd251962b200faf))
+
+
+### Bug Fixes
+
+* **runtime:** recover legacy Publication authority safely ([#577](https://github.com/astrale-os/kernel/issues/577)) ([76e432a](https://github.com/astrale-os/kernel/commit/76e432a710f579c103a245260fb4952e7dc58ac8))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/kernel-core bumped to 0.9.0-beta.29
+    * @astrale-os/kernel-dsl bumped to 0.2.0-beta.22
+
 ## [0.5.0-beta.30](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.29...kernel-protocol-v0.5.0-beta.30) (2026-08-30)
 
 

package/dist/publication/index.d.ts

@@ -1,4 +1,4 @@
-export { MEDIA_TYPE, PATH, url, seal, accept, encode, type Publication } from './publication.js';
+export { MEDIA_TYPE, PATH, url, seal, accept, acceptStored, encode, type Publication, type StoredPublication, } from './publication.js';
 export { acceptBundle, decodeBundle } from './bundle-admission.js';
 export { BUNDLE_MEDIA_TYPE, describeBundle, type BundleDescriptor } from './bundle.js';
 export { verifyBundleBytes } from './bundle-evidence.js';
@@ -10,7 +10,7 @@ export { PublicationError, type PublicationErrorCode } from './error.js';
 export * as delivery from './delivery/index.js';
 export type { Authentication as DeliveryAuthentication, Endpoint as DeliveryEndpoint, } from './delivery-endpoint.js';
 export type { Manifest } from './manifest.js';
-export { ClassOperationOrder, admitRequirements, validateRequirements, type CapabilityAuthorityRequirements, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type PublicationRequirements, } from './requirements.js';
+export { ClassOperationOrder, admitRequirements, validateRequirements, type CapabilityAuthorityRequirements, type CapabilityProfileRequirement, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type PublicationRequirements, } from './requirements.js';
 export { acceptReference, compareReference, compareReferences, matchesReference, reference, type PublicationRef, type PublicationReferenceRelation, } from './reference.js';
 export type { BodyPick, CredentialSource, HttpMethod, HttpRoute, HttpRouteDeclaration, RouteBody, RouteHeaders, SingleCredentialSource, } from './route.js';
 export type { Schema } from './schema.js';

package/dist/publication/index.js

@@ -1,4 +1,4 @@
-export { MEDIA_TYPE, PATH, url, seal, accept, encode } from './publication.js';
+export { MEDIA_TYPE, PATH, url, seal, accept, acceptStored, encode, } from './publication.js';
 export { acceptBundle, decodeBundle } from './bundle-admission.js';
 export { BUNDLE_MEDIA_TYPE, describeBundle } from './bundle.js';
 export { verifyBundleBytes } from './bundle-evidence.js';

package/dist/publication/publication.d.ts

@@ -31,6 +31,16 @@ export interface Publication {
     readonly routes: readonly HttpRoute[];
     readonly delivery?: DeliveryEndpoint;
 }
+/** Canonical semantic Publication plus its exact coordinate in durable storage. */
+export interface StoredPublication {
+    readonly publication: Publication;
+    readonly deployedEtag: Etag;
+}
 export declare function seal(input: Content): Publication;
 export declare function accept(input: unknown): Publication;
+/**
+ * Admit a canonical Publication retained before the admin-to-authority vocabulary cutover.
+ * Network admission remains strict; this one-way reader exists only for already-trusted storage.
+ */
+export declare function acceptStored(input: unknown): StoredPublication;
 export declare function encode(input: Publication): Uint8Array;

package/dist/publication/publication.js

@@ -44,6 +44,40 @@ export function accept(input) {
     }
     return publication;
 }
+/**
+ * Admit a canonical Publication retained before the admin-to-authority vocabulary cutover.
+ * Network admission remains strict; this one-way reader exists only for already-trusted storage.
+ */
+export function acceptStored(input) {
+    try {
+        const publication = accept(input);
+        return deepFreeze({ publication, deployedEtag: publication.etag });
+    }
+    catch (currentFailure) {
+        const value = record(input, 'PUBLICATION_INVALID', 'Expected a Publication object.');
+        const requirements = record(value.requirements, 'PUBLICATION_INVALID', 'Publication requirements are invalid.');
+        const capabilities = record(requirements.capabilities, 'PUBLICATION_INVALID', 'Publication capability requirements are invalid.');
+        if (capabilities.admin === undefined)
+            throw currentFailure;
+        if (capabilities.authority !== undefined) {
+            fail('PUBLICATION_INVALID', 'Publication cannot mix admin and authority requirements.');
+        }
+        const { etag, ...content } = value;
+        const admittedEtag = admitDigest(etag);
+        if (admittedEtag !== computeEtag(content)) {
+            fail('PUBLICATION_ETAG_MISMATCH', 'Publication ETag does not match its canonical content.');
+        }
+        const { admin, ...currentCapabilities } = capabilities;
+        const admitted = acceptPublication({
+            ...value,
+            requirements: {
+                ...requirements,
+                capabilities: { ...currentCapabilities, authority: admin },
+            },
+        }, true);
+        return deepFreeze({ publication: seal(withoutEtag(admitted)), deployedEtag: admittedEtag });
+    }
+}
 export function encode(input) {
     return portable.json.encode(input);
 }

package/dist/publication/requirements.d.ts

@@ -1,6 +1,6 @@
 import type { AuthorityOperation } from '@astrale-os/kernel-core/schema/authority/operation';
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { ClassRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { schema as schemaLanguage } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
 export type NonEmpty<Value> = readonly [Value, ...Value[]];
 export declare const ClassOperationOrder: readonly ["create", "read", "traverse", "update", "delete"];
 export type ClassOperation = (typeof ClassOperationOrder)[number];
@@ -16,7 +16,14 @@ export interface CapabilityRequirements {
     readonly functions?: NonEmpty<SemanticKey.Callable>;
     readonly classes?: NonEmpty<ClassCapabilityRequirement>;
     readonly authority?: CapabilityAuthorityRequirements;
-    readonly admin?: never;
+    readonly profiles?: NonEmpty<CapabilityProfileRequirement>;
+}
+/** Installation-owned authority materialized onto one local Core Identity. */
+export interface CapabilityProfileRequirement {
+    readonly subject: CoreRef;
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
 }
 export interface PublicationRequirements {
     readonly capabilities: CapabilityRequirements;
@@ -24,4 +31,4 @@ export interface PublicationRequirements {
 /** Admit the exact closed Publication v2 requirements object. */
 export declare function admitRequirements(input: unknown): PublicationRequirements;
 /** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
-export declare function validateRequirements(root: schema.DomainSchema, closure: readonly schema.DomainSchema[], requirements: PublicationRequirements): void;
+export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: PublicationRequirements): void;

package/dist/publication/requirements.js

@@ -1,4 +1,6 @@
+import { K } from '@astrale-os/kernel-core/schema';
 import { AuthorityOperationOrder } from '@astrale-os/kernel-core/schema/authority/operation';
+import { schema as schemaApi } from '@astrale-os/kernel-dsl/v1';
 import { acceptDefinitionRef, callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { array, deepFreeze, exact, record, unique } from './content.js';
@@ -15,7 +17,7 @@ export function admitRequirements(input) {
     const requirements = record(input, 'PUBLICATION_INVALID', 'Publication requirements are invalid.');
     exact(requirements, ['capabilities'], 'PUBLICATION_INVALID');
     const capabilities = record(requirements.capabilities, 'PUBLICATION_INVALID', 'Publication capability requirements are invalid.');
-    exact(capabilities, ['authority', 'classes', 'functions'], 'PUBLICATION_INVALID');
+    exact(capabilities, ['authority', 'classes', 'functions', 'profiles'], 'PUBLICATION_INVALID');
     const functions = capabilities.functions === undefined
         ? undefined
         : nonEmpty(capabilities.functions, 'Function capability requirements').map(admitCallable);
@@ -33,6 +35,13 @@ export function admitRequirements(input) {
     const authority = capabilities.authority === undefined
         ? undefined
         : admitAuthorityRequirements(capabilities.authority);
+    const profiles = capabilities.profiles === undefined
+        ? undefined
+        : nonEmpty(capabilities.profiles, 'Capability profiles').map(admitCapabilityProfile);
+    if (profiles !== undefined) {
+        unique(profiles.map(({ subject }) => Key.of(subject)), 'PUBLICATION_INVALID', 'Capability profile subject');
+        canonical(profiles, (left, right) => compare(Key.of(left.subject), Key.of(right.subject)), 'Capability profiles');
+    }
     return deepFreeze({
         capabilities: {
             ...(functions === undefined
@@ -42,9 +51,45 @@ export function admitRequirements(input) {
                 ? {}
                 : { classes: Object.freeze(classes) }),
             ...(authority === undefined ? {} : { authority }),
+            ...(profiles === undefined
+                ? {}
+                : { profiles: Object.freeze(profiles) }),
         },
     });
 }
+function admitCapabilityProfile(input) {
+    const profile = record(input, 'PUBLICATION_INVALID', 'Capability profile requirement is invalid.');
+    exact(profile, ['authority', 'classes', 'functions', 'subject'], 'PUBLICATION_INVALID');
+    const subject = admitCoreRef(profile.subject);
+    const functions = profile.functions === undefined
+        ? undefined
+        : nonEmpty(profile.functions, 'Capability profile Function requirements').map(admitCallable);
+    if (functions !== undefined) {
+        unique(functions, 'PUBLICATION_INVALID', 'Capability profile Function requirement');
+        canonical(functions, compare, 'Capability profile Function requirements');
+    }
+    const classes = profile.classes === undefined
+        ? undefined
+        : nonEmpty(profile.classes, 'Capability profile Class requirements').map(admitClassRequirement);
+    if (classes !== undefined) {
+        unique(classes.map((entry) => classKey(entry.class)), 'PUBLICATION_INVALID', 'Capability profile Class requirement');
+        canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Capability profile Class requirements');
+    }
+    const authority = profile.authority === undefined ? undefined : admitAuthorityRequirements(profile.authority);
+    if (functions === undefined && classes === undefined && authority === undefined) {
+        fail('PUBLICATION_INVALID', 'Capability profile requirements cannot be empty.');
+    }
+    return Object.freeze({
+        subject,
+        ...(functions === undefined
+            ? {}
+            : { functions: Object.freeze(functions) }),
+        ...(classes === undefined
+            ? {}
+            : { classes: Object.freeze(classes) }),
+        ...(authority === undefined ? {} : { authority }),
+    });
+}
 /** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
 export function validateRequirements(root, closure, requirements) {
     const dependencies = exactDependencyClosure(root, closure);
@@ -61,6 +106,36 @@ export function validateRequirements(root, closure, requirements) {
             fail('PUBLICATION_INVALID', 'Class capability requirement names an unknown dependency Class.');
         }
     }
+    const resolvedRoot = requirements.capabilities.profiles === undefined
+        ? undefined
+        : schemaApi.resolve(schemaApi.accept(root, {
+            get(origin, expectedRevision) {
+                return closure.find((dependency) => dependency.origin === origin && revision(dependency) === expectedRevision);
+            },
+        }));
+    for (const profile of requirements.capabilities.profiles ?? []) {
+        const subject = resolvedRoot.core.nodes[profile.subject.name];
+        if (profile.subject.origin !== root.origin ||
+            subject === undefined ||
+            !subject.class.satisfies(K.classes.Identity)) {
+            fail('PUBLICATION_INVALID', 'Capability profile subject must name one local Core Identity.');
+        }
+        for (const callable of profile.functions ?? []) {
+            const dependency = capabilityOwner(root, dependencies, callable, 'Function');
+            if (!hasCallable(dependency, callable)) {
+                fail('PUBLICATION_INVALID', 'Capability profile Function requirement names an unknown dependency callable.');
+            }
+        }
+        for (const requirement of profile.classes ?? []) {
+            const key = Key.of(requirement.class);
+            const owner = requirement.class.origin === root.origin
+                ? root
+                : capabilityOwner(root, dependencies, key, 'Class');
+            if (owner.classes[requirement.class.name] === undefined) {
+                fail('PUBLICATION_INVALID', 'Capability profile Class requirement names an unknown dependency Class.');
+            }
+        }
+    }
 }
 function exactDependencyClosure(root, closure) {
     const supplied = new Map(closure.map((dependency) => [dependency.origin, dependency]));
@@ -136,6 +211,19 @@ function admitClassRef(input) {
         fail('PUBLICATION_INVALID', 'Class capability reference is invalid.');
     return value;
 }
+function admitCoreRef(input) {
+    let value;
+    try {
+        value = acceptDefinitionRef(input);
+    }
+    catch {
+        fail('PUBLICATION_INVALID', 'Capability profile subject is invalid.');
+    }
+    if (value.kind !== 'core') {
+        fail('PUBLICATION_INVALID', 'Capability profile subject must be one local Core reference.');
+    }
+    return value;
+}
 function nonEmpty(input, label) {
     const values = [...array(input, 'PUBLICATION_INVALID')];
     if (values.length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-protocol",
-  "version": "0.5.0-beta.30",
+  "version": "0.5.0-beta.31",
   "description": "Portable Astrale invocation, publication, installation, routing, and issuer protocols",
   "license": "Apache-2.0",
   "repository": {
@@ -133,8 +133,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.28",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.21",
+    "@astrale-os/kernel-core": "0.9.0-beta.29",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.22",
     "@noble/hashes": "2.3.0"
   },
   "devDependencies": {