@astrale-os/kernel-client 0.6.0-beta.75 → 0.6.0-beta.77

package/dist/session/content.js

@@ -1,15 +1,14 @@
 import { NodeId } from '@astrale-os/kernel-core/graph/node';
 import { Path } from '@astrale-os/kernel-core/path';
-import { K } from '@astrale-os/kernel-core/schema';
-import { download } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { download, meaning, upload, } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 import { PropertyKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as artifact from '@astrale-os/kernel-protocol/artifact';
 import { CODES } from '@astrale-os/kernel-protocol/errors';
 import { ClientError, ProtocolError, ResponseError, TransportError } from '../errors/index.js';
 import { admitControlOptions, runSessionOperation } from './context/index.js';
-import { reference } from './reference.js';
+import { kernelReference } from './reference.js';
 import { requireResultKind } from './routing/index.js';
-const UPLOAD = reference(K, K.functions.upload);
+const UPLOAD = kernelReference(upload, meaning.upload);
 const DOWNLOAD = Path.project(download);
 const CONTENT_TIMEOUT_MS = 30 * 60 * 1_000;
 const MAXIMUM_ATTEMPTS = 3;

package/dist/session/exchange/issuer.d.ts

@@ -11,8 +11,8 @@ type IssuerDependencies = Pick<ExchangeDependencies, 'kernel' | 'fetch' | 'polic
 export declare function tokenEndpoint(dependencies: IssuerDependencies, domain: IssuerId, operation: SessionOperation): Promise<string>;
 /**
  * Present a delegation at a Domain's token endpoint and admit the returned credential as provider
- * evidence: its issuer must be that Domain, its audience the source Kernel, and its signed expiry
- * the reported one.
+ * evidence: it must be the exchange representation served with `Cache-Control: no-store`, its
+ * issuer that Domain, its audience the source Kernel, and its signed expiry the reported one.
  */
 export declare function redeem(dependencies: IssuerDependencies, domain: IssuerId, endpoint: string, delegation: MintedCredential, operation: SessionOperation): Promise<SessionCredential>;
 export {};

package/dist/session/exchange/issuer.js

@@ -23,11 +23,14 @@ export async function tokenEndpoint(dependencies, domain, operation) {
 }
 /**
  * Present a delegation at a Domain's token endpoint and admit the returned credential as provider
- * evidence: its issuer must be that Domain, its audience the source Kernel, and its signed expiry
- * the reported one.
+ * evidence: it must be the exchange representation served with `Cache-Control: no-store`, its
+ * issuer that Domain, its audience the source Kernel, and its signed expiry the reported one.
  */
 export async function redeem(dependencies, domain, endpoint, delegation, operation) {
-    const exchanged = await fetchAdmitted(dependencies, TOKEN_EXCHANGE, endpoint, operation, (body) => issuer.exchange.acceptResponse(body), delegation);
+    const exchanged = await fetchAdmitted(dependencies, TOKEN_EXCHANGE, endpoint, operation, (body, headers) => {
+        requireCredentialHeaders(headers);
+        return issuer.exchange.acceptResponse(body);
+    }, delegation);
     let claims;
     try {
         claims = inspect(exchanged.token);
@@ -78,7 +81,7 @@ async function fetchAdmitted(dependencies, leg, url, operation, admit, credentia
             requireExactResponse(response, url, 'Domain token exchange');
             if (!response.ok)
                 throw await refusal(response, leg, signal);
-            return admit(codecs.json.decode(await boundedResponse(response, dependencies.maximumResponseBytes, signal)));
+            return admit(codecs.json.decode(await boundedResponse(response, dependencies.maximumResponseBytes, signal)), response.headers);
         }
         catch (cause) {
             throw signal.aborted ? cause : unadmitted(cause, leg);
@@ -124,6 +127,20 @@ function unadmitted(cause, leg) {
     }
     return cause;
 }
+/** A credential is served as the exchange representation and never stored by an HTTP cache. */
+function requireCredentialHeaders(headers) {
+    const mediaType = headers.get('content-type')?.split(';', 1)[0].trim().toLowerCase();
+    if (mediaType !== issuer.exchange.MEDIA_TYPE) {
+        throw invalidResponse('Domain token exchange returned an unsupported Content-Type.');
+    }
+    const directives = headers
+        .get('cache-control')
+        ?.split(',')
+        .map((directive) => directive.trim().toLowerCase()) ?? [];
+    if (!directives.includes('no-store')) {
+        throw invalidResponse('Domain token exchange response is missing Cache-Control: no-store.');
+    }
+}
 function invalidResponse(message, cause) {
     return new ExchangeError(message, {
         failure: 'invalid-response',

package/dist/session/execution.js

@@ -1,14 +1,13 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { K } from '@astrale-os/kernel-core/schema';
-import { reference } from './reference.js';
-const methods = K.classes.Execution.methods;
+import { execution as methods, meaning, } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { kernelReference } from './reference.js';
 const bound = {
-    status: reference(K, methods.status),
-    result: reference(K, methods.result),
-    cancel: reference(K, methods.cancel),
-    signal: reference(K, methods.signal),
-    resume: reference(K, methods.resume),
-    delete: reference(K, methods.delete),
+    status: kernelReference(methods.status, meaning.execution.status),
+    result: kernelReference(methods.result, meaning.execution.result),
+    cancel: kernelReference(methods.cancel, meaning.execution.cancel),
+    signal: kernelReference(methods.signal, meaning.execution.signal),
+    resume: kernelReference(methods.resume, meaning.execution.resume),
+    delete: kernelReference(methods.delete, meaning.execution.delete),
 };
 function receiver(execution) {
     return Path.id(typeof execution === 'string' ? execution : execution.id);

package/dist/session/reference.d.ts

@@ -1,6 +1,7 @@
 import type { Path as PathValue, PathLike } from '@astrale-os/kernel-core/path';
+import type { FunctionRef } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ExecutableMethod } from '@astrale-os/kernel-dsl/v1';
-import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { MethodAddress, Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { MeaningFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
 import { type Key as KeyType } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Binary, Input } from '../client/index.js';
@@ -45,6 +46,13 @@ type ExecutableInstanceMethod = ExecutableMethod<unknown, unknown, false>;
 export declare function reference<const Callable extends ResolvedFunction | ExecutableStaticMethod>(domain: Pick<Domain, 'origin' | 'revision'>, callable: Callable): CallableReference<ReferenceInput<Callable>, ReferenceOutput<Callable>, CallableInputModeOf<Callable>>;
 /** Project one exact resolved instance Method into a receiver-bound typed Client reference. */
 export declare function reference<const Callable extends ExecutableInstanceMethod>(domain: Pick<Domain, 'origin' | 'revision'>, callable: Callable): InstanceCallableReference<ReferenceInput<Callable>, ReferenceOutput<Callable>>;
+/**
+ * Reference a Kernel callable from its Core coordinate and precomputed meaning, so runtime code never
+ * loads the Kernel Schema. Core keeps each meaning equal to the resolved Kernel; every Kernel
+ * callable referenced this way answers a value.
+ */
+export declare function kernelReference(callable: FunctionRef<'kernel.astrale.ai'>, fingerprint: MeaningFingerprint): CallableReference<unknown>;
+export declare function kernelReference(callable: MethodAddress, fingerprint: MeaningFingerprint): InstanceCallableReference<unknown>;
 export declare function admitReference(input: CallableReference<unknown>): CallableReference<unknown>;
 export declare function matchesCallable(target: PathValue, callable: KeyType.Callable): boolean;
 export {};

package/dist/session/reference.js

@@ -1,5 +1,6 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { callableAddress, Key, patterns, } from '@astrale-os/kernel-dsl/v1/addressing';
+import { meaning } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { callableAddress, Key, MethodKey, patterns, } from '@astrale-os/kernel-dsl/v1/addressing';
 import { callableFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
 const FINGERPRINT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 export function reference(domain, callable) {
@@ -26,6 +27,21 @@ export function reference(domain, callable) {
         : Path.project(callable.ref);
     return admitReference({ ...common, target });
 }
+export function kernelReference(callable, fingerprint) {
+    const key = callable.kind === 'method' ? MethodKey.of(callable.owner, callable.name) : Key.of(callable);
+    const common = Object.freeze({
+        origin: Key.origin(key),
+        revision: meaning.revision,
+        fingerprint,
+        callable: key,
+        outputMode: 'value',
+    });
+    if (callable.kind === 'function')
+        return admitReference({ ...common, target: Path.project(callable) });
+    const method = key;
+    const bind = (receiver) => admitReference({ ...common, target: Path.instanceMethod(Path.from(receiver), method) });
+    return Object.assign(bind, common);
+}
 export function admitReference(input) {
     if (input === null || typeof input !== 'object')
         invalid();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-client",
-  "version": "0.6.0-beta.75",
+  "version": "0.6.0-beta.77",
   "description": "Universal Client — protocol-first, transport-agnostic",
   "keywords": [
     "astrale",
@@ -65,14 +65,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.56",
+    "@astrale-os/kernel-core": "0.9.0-beta.57",
     "@astrale-os/kernel-dsl": "0.2.0-beta.41",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.62",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.63",
     "@tanstack/pacer": "0.20.1",
     "msgpackr": "^2.0.5"
   },
   "devDependencies": {
-    "@astrale-os/kernel-server": "0.5.0-beta.64",
+    "@astrale-os/kernel-server": "0.5.0-beta.65",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^22.0.0",
     "typescript": "7.0.2",