@astrale-os/kernel-client 0.6.0-beta.67 → 0.6.0-beta.69

package/dist/auth/auth.d.ts

@@ -12,6 +12,8 @@ export interface AuthApi {
     whoami(options?: RequestOptions): Promise<Identity & Authentication>;
     whois(input: WhoisInput, options?: RequestOptions): Promise<(Identity & Authentication) | null>;
     can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    /** One ordered decision per check; batches above the Kernel bound are split and rejoined. */
+    can(input: readonly PolicyDecisionInput[], options?: RequestOptions): Promise<readonly boolean[]>;
     impersonate(input: ImpersonateOptions, options?: RequestOptions): Promise<MintedCredential>;
     mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
     delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;

package/dist/auth/authorization.d.ts

@@ -9,5 +9,8 @@ export interface PolicyDecisionInput {
 }
 export declare const IDENTITY_CAN_PATH: NodePath;
 export declare function authorizationApi(call: AuthCall): Readonly<{
-    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    can: {
+        (input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+        (input: readonly PolicyDecisionInput[], options?: RequestOptions): Promise<readonly boolean[]>;
+    };
 }>;

package/dist/auth/authorization.js

@@ -1,14 +1,34 @@
 import { Path } from '@astrale-os/kernel-core/path';
+import { MAXIMUM_CHECKS } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 const identityOwner = Path.project(identity.whoami.owner);
 export const IDENTITY_CAN_PATH = Path.staticMethod(identityOwner, identity.can.name).raw;
 export function authorizationApi(call) {
-    return Object.freeze({
-        async can(input, options) {
-            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ policy: policyPath(input.policy), object: input.object }), options));
+    async function can(input, options) {
+        if (!isBatch(input)) {
+            const output = (await call(IDENTITY_CAN_PATH, check(input), options));
             return output.allowed;
-        },
-    });
+        }
+        const batches = [];
+        for (let offset = 0; offset < input.length; offset += MAXIMUM_CHECKS) {
+            batches.push(input.slice(offset, offset + MAXIMUM_CHECKS));
+        }
+        const decided = await Promise.all(batches.map(async (batch) => {
+            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ checks: batch.map(check) }), options));
+            if (output.decisions.length !== batch.length) {
+                throw new TypeError('Identity.can answered a different number of decisions.');
+            }
+            return output.decisions.map(({ allowed }) => allowed);
+        }));
+        return Object.freeze(decided.flat());
+    }
+    return Object.freeze({ can });
+}
+function isBatch(input) {
+    return Array.isArray(input);
+}
+function check(input) {
+    return Object.freeze({ policy: policyPath(input.policy), object: input.object });
 }
 function policyPath(input) {
     return input instanceof Path || typeof input === 'string'

package/dist/session/routing/dispatch.js

@@ -97,9 +97,23 @@ export class SessionDispatcher {
             ...sessionTransportOptions(operation, options.idempotencyKey),
             routing: learned.route.via,
         };
+        // The source has admitted this fingerprint against the exact Publication carried by Via.
+        // Pin that revision at the destination so existing Workers can execute the same admitted
+        // callable without understanding the newer fingerprint Target representation. The cache
+        // remains partitioned by the original fingerprint, and stale recovery re-admits it at source.
+        const destinationCall = typeof call.target !== 'string' && call.target.fingerprint !== undefined
+            ? {
+                ...call,
+                target: invocationProtocol.Target({
+                    callable: call.target.callable,
+                    revision: learned.route.via.publication.revision,
+                    ...(call.target.instance === undefined ? {} : { instance: call.target.instance }),
+                }),
+            }
+            : call;
         const result = await runSessionOperation(operation, () => trace === undefined
-            ? authenticated(envelope.client, learned.credential).dispatch(call, requestOptions)
-            : dispatchTrace(envelope.client, learned.credential, call, requestOptions, trace));
+            ? authenticated(envelope.client, learned.credential).dispatch(destinationCall, requestOptions)
+            : dispatchTrace(envelope.client, learned.credential, destinationCall, requestOptions, trace));
         if (result.kind === 'redirect') {
             throw new ClientError('A destination redirect is invalid; only the source Kernel may redirect.');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-client",
-  "version": "0.6.0-beta.67",
+  "version": "0.6.0-beta.69",
   "description": "Universal Client — protocol-first, transport-agnostic",
   "keywords": [
     "astrale",
@@ -65,14 +65,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.51",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.36",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.57",
+    "@astrale-os/kernel-core": "0.9.0-beta.52",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.37",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.58",
     "@tanstack/pacer": "0.20.1",
     "msgpackr": "^2.0.5"
   },
   "devDependencies": {
-    "@astrale-os/kernel-server": "0.5.0-beta.59",
+    "@astrale-os/kernel-server": "0.5.0-beta.60",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^22.0.0",
     "typescript": "7.0.2",