@astrale-os/kernel-protocol 0.5.0-beta.30 → 0.5.0-beta.32

package/CHANGELOG.md

@@ -24,6 +24,34 @@
 * the first supported V2 release is a coordinated `1.0.0`, not a compatible continuation of the
   current `0.x` line; package and wire versions remain independent as specified in
   [the protocol architecture](./.spec/architecture.md)
+## [0.5.0-beta.32](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.31...kernel-protocol-v0.5.0-beta.32) (2026-08-31)
+
+
+### Bug Fixes
+
+* **api:** keep profile validation runtime-safe ([#589](https://github.com/astrale-os/kernel/issues/589)) ([fd5c5f6](https://github.com/astrale-os/kernel/commit/fd5c5f6e7e6b2a4b617ccffe9efa605c05ea0c52))
+* **protocol:** keep profile identity reference portable ([#592](https://github.com/astrale-os/kernel/issues/592)) ([c942216](https://github.com/astrale-os/kernel/commit/c942216fa52c0344ef74cf1dea49229e7981d9bf))
+
+## [0.5.0-beta.31](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.30...kernel-protocol-v0.5.0-beta.31) (2026-08-31)
+
+
+### Features
+
+* **auth:** enforce two-gate Function authority ([#561](https://github.com/astrale-os/kernel/issues/561)) ([c681d4b](https://github.com/astrale-os/kernel/commit/c681d4b391520906b2cad9171cd251962b200faf))
+
+
+### Bug Fixes
+
+* **runtime:** recover legacy Publication authority safely ([#577](https://github.com/astrale-os/kernel/issues/577)) ([76e432a](https://github.com/astrale-os/kernel/commit/76e432a710f579c103a245260fb4952e7dc58ac8))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @astrale-os/kernel-core bumped to 0.9.0-beta.29
+    * @astrale-os/kernel-dsl bumped to 0.2.0-beta.22
+
 ## [0.5.0-beta.30](https://github.com/astrale-os/kernel/compare/kernel-protocol-v0.5.0-beta.29...kernel-protocol-v0.5.0-beta.30) (2026-08-30)
 
 

package/dist/publication/index.d.ts

@@ -10,7 +10,7 @@ export { PublicationError, type PublicationErrorCode } from './error.js';
 export * as delivery from './delivery/index.js';
 export type { Authentication as DeliveryAuthentication, Endpoint as DeliveryEndpoint, } from './delivery-endpoint.js';
 export type { Manifest } from './manifest.js';
-export { ClassOperationOrder, admitRequirements, validateRequirements, type CapabilityAuthorityRequirements, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type PublicationRequirements, } from './requirements.js';
+export { ClassOperationOrder, admitRequirements, validateRequirements, type CapabilityAuthorityRequirements, type CapabilityProfileRequirement, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type PublicationRequirements, } from './requirements.js';
 export { acceptReference, compareReference, compareReferences, matchesReference, reference, type PublicationRef, type PublicationReferenceRelation, } from './reference.js';
 export type { BodyPick, CredentialSource, HttpMethod, HttpRoute, HttpRouteDeclaration, RouteBody, RouteHeaders, SingleCredentialSource, } from './route.js';
 export type { Schema } from './schema.js';

package/dist/publication/requirements.d.ts

@@ -1,6 +1,6 @@
 import type { AuthorityOperation } from '@astrale-os/kernel-core/schema/authority/operation';
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { ClassRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { schema as schemaLanguage } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
 export type NonEmpty<Value> = readonly [Value, ...Value[]];
 export declare const ClassOperationOrder: readonly ["create", "read", "traverse", "update", "delete"];
 export type ClassOperation = (typeof ClassOperationOrder)[number];
@@ -16,7 +16,14 @@ export interface CapabilityRequirements {
     readonly functions?: NonEmpty<SemanticKey.Callable>;
     readonly classes?: NonEmpty<ClassCapabilityRequirement>;
     readonly authority?: CapabilityAuthorityRequirements;
-    readonly admin?: never;
+    readonly profiles?: NonEmpty<CapabilityProfileRequirement>;
+}
+/** Installation-owned authority materialized onto one local Core Identity. */
+export interface CapabilityProfileRequirement {
+    readonly subject: CoreRef;
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
 }
 export interface PublicationRequirements {
     readonly capabilities: CapabilityRequirements;
@@ -24,4 +31,4 @@ export interface PublicationRequirements {
 /** Admit the exact closed Publication v2 requirements object. */
 export declare function admitRequirements(input: unknown): PublicationRequirements;
 /** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
-export declare function validateRequirements(root: schema.DomainSchema, closure: readonly schema.DomainSchema[], requirements: PublicationRequirements): void;
+export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: PublicationRequirements): void;

package/dist/publication/requirements.js

@@ -3,6 +3,11 @@ import { acceptDefinitionRef, callableAddress, Key } from '@astrale-os/kernel-ds
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { array, deepFreeze, exact, record, unique } from './content.js';
 import { fail } from './error.js';
+const KernelIdentityClass = Object.freeze({
+    origin: 'kernel.astrale.ai',
+    kind: 'class',
+    name: 'Identity',
+});
 export const ClassOperationOrder = Object.freeze([
     'create',
     'read',
@@ -15,7 +20,7 @@ export function admitRequirements(input) {
     const requirements = record(input, 'PUBLICATION_INVALID', 'Publication requirements are invalid.');
     exact(requirements, ['capabilities'], 'PUBLICATION_INVALID');
     const capabilities = record(requirements.capabilities, 'PUBLICATION_INVALID', 'Publication capability requirements are invalid.');
-    exact(capabilities, ['authority', 'classes', 'functions'], 'PUBLICATION_INVALID');
+    exact(capabilities, ['authority', 'classes', 'functions', 'profiles'], 'PUBLICATION_INVALID');
     const functions = capabilities.functions === undefined
         ? undefined
         : nonEmpty(capabilities.functions, 'Function capability requirements').map(admitCallable);
@@ -33,6 +38,13 @@ export function admitRequirements(input) {
     const authority = capabilities.authority === undefined
         ? undefined
         : admitAuthorityRequirements(capabilities.authority);
+    const profiles = capabilities.profiles === undefined
+        ? undefined
+        : nonEmpty(capabilities.profiles, 'Capability profiles').map(admitCapabilityProfile);
+    if (profiles !== undefined) {
+        unique(profiles.map(({ subject }) => Key.of(subject)), 'PUBLICATION_INVALID', 'Capability profile subject');
+        canonical(profiles, (left, right) => compare(Key.of(left.subject), Key.of(right.subject)), 'Capability profiles');
+    }
     return deepFreeze({
         capabilities: {
             ...(functions === undefined
@@ -42,9 +54,45 @@ export function admitRequirements(input) {
                 ? {}
                 : { classes: Object.freeze(classes) }),
             ...(authority === undefined ? {} : { authority }),
+            ...(profiles === undefined
+                ? {}
+                : { profiles: Object.freeze(profiles) }),
         },
     });
 }
+function admitCapabilityProfile(input) {
+    const profile = record(input, 'PUBLICATION_INVALID', 'Capability profile requirement is invalid.');
+    exact(profile, ['authority', 'classes', 'functions', 'subject'], 'PUBLICATION_INVALID');
+    const subject = admitCoreRef(profile.subject);
+    const functions = profile.functions === undefined
+        ? undefined
+        : nonEmpty(profile.functions, 'Capability profile Function requirements').map(admitCallable);
+    if (functions !== undefined) {
+        unique(functions, 'PUBLICATION_INVALID', 'Capability profile Function requirement');
+        canonical(functions, compare, 'Capability profile Function requirements');
+    }
+    const classes = profile.classes === undefined
+        ? undefined
+        : nonEmpty(profile.classes, 'Capability profile Class requirements').map(admitClassRequirement);
+    if (classes !== undefined) {
+        unique(classes.map((entry) => classKey(entry.class)), 'PUBLICATION_INVALID', 'Capability profile Class requirement');
+        canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Capability profile Class requirements');
+    }
+    const authority = profile.authority === undefined ? undefined : admitAuthorityRequirements(profile.authority);
+    if (functions === undefined && classes === undefined && authority === undefined) {
+        fail('PUBLICATION_INVALID', 'Capability profile requirements cannot be empty.');
+    }
+    return Object.freeze({
+        subject,
+        ...(functions === undefined
+            ? {}
+            : { functions: Object.freeze(functions) }),
+        ...(classes === undefined
+            ? {}
+            : { classes: Object.freeze(classes) }),
+        ...(authority === undefined ? {} : { authority }),
+    });
+}
 /** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
 export function validateRequirements(root, closure, requirements) {
     const dependencies = exactDependencyClosure(root, closure);
@@ -61,6 +109,45 @@ export function validateRequirements(root, closure, requirements) {
             fail('PUBLICATION_INVALID', 'Class capability requirement names an unknown dependency Class.');
         }
     }
+    for (const profile of requirements.capabilities.profiles ?? []) {
+        const subject = root.core.nodes[profile.subject.name];
+        if (profile.subject.origin !== root.origin ||
+            subject === undefined ||
+            !classSatisfies(root, dependencies, subject.class, KernelIdentityClass)) {
+            fail('PUBLICATION_INVALID', 'Capability profile subject must name one local Core Identity.');
+        }
+        for (const callable of profile.functions ?? []) {
+            const dependency = capabilityOwner(root, dependencies, callable, 'Function');
+            if (!hasCallable(dependency, callable)) {
+                fail('PUBLICATION_INVALID', 'Capability profile Function requirement names an unknown dependency callable.');
+            }
+        }
+        for (const requirement of profile.classes ?? []) {
+            const key = Key.of(requirement.class);
+            const owner = requirement.class.origin === root.origin
+                ? root
+                : capabilityOwner(root, dependencies, key, 'Class');
+            if (owner.classes[requirement.class.name] === undefined) {
+                fail('PUBLICATION_INVALID', 'Capability profile Class requirement names an unknown dependency Class.');
+            }
+        }
+    }
+}
+function classSatisfies(root, dependencies, candidate, expected) {
+    const expectedKey = Key.of(expected);
+    const visited = new Set();
+    const visit = (reference) => {
+        const key = Key.of(reference);
+        if (key === expectedKey)
+            return true;
+        if (visited.has(key))
+            return false;
+        visited.add(key);
+        const owner = reference.origin === root.origin ? root : dependencies.get(reference.origin);
+        const definition = owner?.classes[reference.name];
+        return definition?.kind === 'node' && definition.extends.some(visit);
+    };
+    return visit(candidate);
 }
 function exactDependencyClosure(root, closure) {
     const supplied = new Map(closure.map((dependency) => [dependency.origin, dependency]));
@@ -136,6 +223,19 @@ function admitClassRef(input) {
         fail('PUBLICATION_INVALID', 'Class capability reference is invalid.');
     return value;
 }
+function admitCoreRef(input) {
+    let value;
+    try {
+        value = acceptDefinitionRef(input);
+    }
+    catch {
+        fail('PUBLICATION_INVALID', 'Capability profile subject is invalid.');
+    }
+    if (value.kind !== 'core') {
+        fail('PUBLICATION_INVALID', 'Capability profile subject must be one local Core reference.');
+    }
+    return value;
+}
 function nonEmpty(input, label) {
     const values = [...array(input, 'PUBLICATION_INVALID')];
     if (values.length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-protocol",
-  "version": "0.5.0-beta.30",
+  "version": "0.5.0-beta.32",
   "description": "Portable Astrale invocation, publication, installation, routing, and issuer protocols",
   "license": "Apache-2.0",
   "repository": {
@@ -133,8 +133,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.28",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.21",
+    "@astrale-os/kernel-core": "0.9.0-beta.29",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.22",
     "@noble/hashes": "2.3.0"
   },
   "devDependencies": {