@astrale-os/kernel-client 0.6.0-beta.8 → 0.6.0-beta.80

package/dist/session/credential/provider.js

@@ -0,0 +1,236 @@
+import { ClientError } from '../../errors/index.js';
+import { BACKOFF_MS, MINT_TIMEOUT_MS, RETRY_INTERVAL_MS, SETTLEMENT_SKEW_MS } from './limits.js';
+/**
+ * Remaining lifetime a credential must exceed to carry a delegation of `ttlSeconds`: the TTL itself
+ * plus the settlement skew, so it cannot expire between admission and delivery.
+ */
+export function delegationCoverageMs(ttlSeconds) {
+    return ttlSeconds * 1_000 + SETTLEMENT_SKEW_MS;
+}
+export function createSessionCredentialProvider(options) {
+    if (options === null || typeof options !== 'object') {
+        throw new TypeError('Session credential provider options are invalid.');
+    }
+    if (typeof options.mint !== 'function') {
+        throw new TypeError('Session credential mint capability is invalid.');
+    }
+    if (!Number.isSafeInteger(options.ttlSeconds) || options.ttlSeconds < 1) {
+        throw new TypeError('Session credential ttlSeconds must be a positive safe integer.');
+    }
+    if (options.onChange !== undefined && typeof options.onChange !== 'function') {
+        throw new TypeError('Session credential change observer is invalid.');
+    }
+    const { ttlSeconds } = options;
+    const mint = options.mint.bind(options);
+    const notify = options.onChange?.bind(options);
+    // The threshold is the coverage the caller already declared, never a separate guessed constant.
+    const marginMs = delegationCoverageMs(ttlSeconds);
+    let current = options.initial === undefined ? undefined : admitInitial(options.initial);
+    let state = Object.freeze(current === undefined
+        ? { status: 'empty' }
+        : { status: 'valid', credential: current });
+    let inflight;
+    let controller;
+    let waiting = 0;
+    let anticipating = false;
+    let refreshTimer;
+    let expiryTimer;
+    let attempt = 0;
+    return Object.freeze({
+        ttlSeconds,
+        state: () => state,
+        acquire,
+        refresh,
+        start,
+        stop,
+        resolve,
+    });
+    async function resolve(_call, signal) {
+        return { credential: (await acquire(signal)).credential };
+    }
+    function acquire(signal) {
+        if (current !== undefined && covers(current))
+            return Promise.resolve(current);
+        return share(signal);
+    }
+    function refresh(signal) {
+        return share(signal);
+    }
+    function start() {
+        anticipating = true;
+        attempt = 0;
+        schedule();
+    }
+    function stop() {
+        anticipating = false;
+        clearTimers();
+    }
+    /** Join the mint in flight, or begin one, while following only this caller's cancellation. */
+    function share(signal) {
+        if (signal?.aborted === true)
+            return Promise.reject(signal.reason);
+        const pending = inflight ?? begin();
+        if (signal === undefined)
+            return pending;
+        waiting += 1;
+        let settled = false;
+        return new Promise((complete, fail) => {
+            const leave = () => {
+                if (settled)
+                    return;
+                settled = true;
+                waiting -= 1;
+                signal.removeEventListener('abort', cancel);
+                // Nobody is waiting and nobody is anticipating: the mint has no beneficiary left.
+                if (waiting === 0 && !anticipating)
+                    controller?.abort(signal.reason);
+            };
+            const cancel = () => {
+                const reason = signal.reason;
+                leave();
+                fail(reason);
+            };
+            signal.addEventListener('abort', cancel, { once: true });
+            pending.then((credential) => {
+                if (settled)
+                    return;
+                settled = true;
+                waiting -= 1;
+                signal.removeEventListener('abort', cancel);
+                complete(credential);
+            }, (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                waiting -= 1;
+                signal.removeEventListener('abort', cancel);
+                fail(error);
+            });
+        });
+    }
+    function begin() {
+        publish({ status: 'refreshing', ...(current === undefined ? {} : { credential: current }) });
+        const owned = new AbortController();
+        controller = owned;
+        const signal = AbortSignal.any([owned.signal, AbortSignal.timeout(MINT_TIMEOUT_MS)]);
+        const pending = (async () => {
+            try {
+                const minted = admitMinted(await mint(signal));
+                current = minted;
+                attempt = 0;
+                publish({ status: 'valid', credential: minted });
+                if (anticipating)
+                    schedule();
+                return minted;
+            }
+            catch (error) {
+                settleFailure(error);
+                throw error;
+            }
+            finally {
+                inflight = undefined;
+                controller = undefined;
+            }
+        })();
+        inflight = pending;
+        // A rejection reaches every waiter; keep an unattached one from surfacing as unhandled.
+        pending.catch(() => undefined);
+        return pending;
+    }
+    function settleFailure(error) {
+        if (current !== undefined && current.expiresAt > Date.now()) {
+            publish({ status: 'degraded', credential: current, error });
+        }
+        else {
+            current = undefined;
+            publish({ status: 'expired', error });
+        }
+        if (anticipating)
+            retry();
+    }
+    /** Arm the threshold refresh and the expiry watchdog for the credential now held. */
+    function schedule() {
+        clearTimers();
+        if (!anticipating)
+            return;
+        if (current === undefined) {
+            void share().catch(() => undefined);
+            return;
+        }
+        // The threshold itself, with no extra lead: chained providers sharing this rule must not
+        // cascade into a mint loop, and the settlement skew already covers the round trip.
+        armRefresh(clamp(current.expiresAt - marginMs - Date.now()));
+        armExpiry(current);
+    }
+    function retry() {
+        if (refreshTimer !== undefined)
+            return;
+        const backoff = BACKOFF_MS[attempt];
+        attempt = Math.min(attempt + 1, BACKOFF_MS.length);
+        armRefresh(backoff ?? RETRY_INTERVAL_MS);
+        if (current !== undefined)
+            armExpiry(current);
+    }
+    function armRefresh(delay) {
+        refreshTimer = setTimeout(() => {
+            refreshTimer = undefined;
+            void share().catch(() => undefined);
+        }, delay);
+    }
+    function armExpiry(credential) {
+        if (expiryTimer !== undefined)
+            clearTimeout(expiryTimer);
+        expiryTimer = setTimeout(() => {
+            expiryTimer = undefined;
+            if (!anticipating || current !== credential)
+                return;
+            current = undefined;
+            publish({ status: 'expired', error: new ClientError('Session credential expired.') });
+        }, clamp(credential.expiresAt - Date.now()));
+    }
+    function clearTimers() {
+        if (refreshTimer !== undefined)
+            clearTimeout(refreshTimer);
+        if (expiryTimer !== undefined)
+            clearTimeout(expiryTimer);
+        refreshTimer = undefined;
+        expiryTimer = undefined;
+    }
+    function covers(credential) {
+        return credential.expiresAt - Date.now() > marginMs;
+    }
+    function publish(next) {
+        state = Object.freeze(next);
+        notify?.(state);
+    }
+    function admitMinted(input) {
+        const credential = admitShape(input);
+        if (credential === undefined)
+            throw new ClientError('Minted session credential is invalid.');
+        if (!covers(credential)) {
+            throw new ClientError('Minted session credential cannot cover the delegation TTL.');
+        }
+        return credential;
+    }
+}
+function admitInitial(input) {
+    const credential = admitShape(input);
+    if (credential === undefined || credential.expiresAt <= Date.now()) {
+        throw new TypeError('Initial session credential is invalid.');
+    }
+    return credential;
+}
+function admitShape(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        typeof input.credential !== 'string' ||
+        input.credential.length === 0 ||
+        !Number.isSafeInteger(input.expiresAt)) {
+        return undefined;
+    }
+    return Object.freeze({ credential: input.credential, expiresAt: input.expiresAt });
+}
+/** Keep every scheduled delay inside the platform timer range. */
+function clamp(delay) {
+    return Math.min(Math.max(delay, 0), 2_147_483_647);
+}

package/dist/session/discovery/bundle.d.ts

@@ -2,17 +2,20 @@ import type { bundle } from '@astrale-os/kernel-dsl/v1';
 import type { publication } from '@astrale-os/kernel-protocol';
 import type { Fetch } from '../../transport/http/index.js';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
+import { ClientError } from '../../errors/index.js';
 export interface BundleDiscoveryOptions {
     readonly fetch: Fetch;
     readonly policy: Readonly<SessionPolicy>;
     readonly maximumBytes: number;
 }
+/** Internal evidence that a selected immutable artifact is no longer served. */
+export declare class BundleUnavailableError extends ClientError {
+}
 export declare class BundleDiscovery {
     private readonly options;
-    private readonly bundles;
+    private retained?;
     constructor(options: BundleDiscoveryOptions);
     get(publication: publication.Publication, operation: SessionOperation): Promise<bundle.Bundle>;
     clear(): void;
     private fetch;
 }
-//# sourceMappingURL=bundle.d.ts.map

package/dist/session/discovery/bundle.js

@@ -1,38 +1,49 @@
+import { bundleUrl } from '@astrale-os/kernel-protocol/publication';
 import { decodeBundleValue } from '@astrale-os/kernel-protocol/publication/bundle';
 import { ClientError } from '../../errors/index.js';
-import { allowEndpoint, runSessionOperation } from '../context/index.js';
+import { allowEndpoint } from '../context/index.js';
 import { boundedResponse, requireExactResponse } from './publication.js';
+import { runAcquisition } from './transport.js';
+/** Internal evidence that a selected immutable artifact is no longer served. */
+export class BundleUnavailableError extends ClientError {
+}
 export class BundleDiscovery {
     options;
-    bundles = new Map();
+    retained;
     constructor(options) {
         this.options = options;
     }
     async get(publication, operation) {
         const key = bundleKey(publication);
-        const existing = this.bundles.get(key);
-        if (existing !== undefined)
-            return existing;
-        const discovered = await this.fetch(publication, operation);
-        const retained = this.bundles.get(key) ?? discovered;
-        this.bundles.set(key, retained);
-        return retained;
+        allowEndpoint(publication.schema.bundle.href, this.options.policy);
+        if (this.retained?.key === key)
+            return this.retained.value;
+        const value = await this.fetch(publication, operation);
+        this.retained = { key, value };
+        return value;
     }
     clear() {
-        this.bundles.clear();
+        this.retained = undefined;
     }
     async fetch(publication, operation) {
         if (publication.schema.bundle.ref.size > this.options.maximumBytes) {
             throw new ClientError('Bundle artifact exceeds its byte limit.');
         }
         const href = publication.schema.bundle.href;
-        allowEndpoint(href, this.options.policy);
-        const response = await runSessionOperation(operation, (signal) => this.options.fetch(href, {
+        const immutable = href === bundleUrl(publication.identity.issuer, publication.schema.bundle.ref);
+        const response = await runAcquisition(operation, 'bundle', 'unknown', 'Kernel bundle could not be retrieved.', (signal) => this.options.fetch(href, {
             headers: { accept: publication.schema.bundle.ref.mediaType },
+            // Omitting `cache` is the browser default; Workers reject the DOM-only 'default' mode.
+            cache: immutable ? undefined : 'no-cache',
             redirect: 'manual',
             signal,
         }));
         requireExactResponse(response, href, 'Bundle retrieval');
+        if (immutable && (response.status === 404 || response.status === 410)) {
+            // Cleanup must not hold discovery open on an injected body cancellation.
+            void response.body?.cancel().catch(() => undefined);
+            throw new BundleUnavailableError(`Bundle retrieval returned HTTP ${response.status}.`);
+        }
         if (!response.ok)
             throw new ClientError(`Bundle retrieval returned HTTP ${response.status}.`);
         if (response.headers.get('content-type') !== publication.schema.bundle.ref.mediaType) {
@@ -42,7 +53,7 @@ export class BundleDiscovery {
         if (etag !== null && etag !== `"${publication.schema.bundle.ref.digest}"`) {
             throw new ClientError('Bundle response ETag differs from its descriptor.');
         }
-        const bytes = await runSessionOperation(operation, (signal) => boundedResponse(response, publication.schema.bundle.ref.size, signal));
+        const bytes = await runAcquisition(operation, 'bundle', 'receive', 'Kernel bundle response could not be read.', (signal) => boundedResponse(response, publication.schema.bundle.ref.size, signal));
         if (bytes.byteLength !== publication.schema.bundle.ref.size) {
             throw new ClientError('Bundle artifact size differs from its descriptor.');
         }
@@ -50,6 +61,14 @@ export class BundleDiscovery {
     }
 }
 function bundleKey(publication) {
-    return `${new URL(publication.schema.bundle.href).origin}\u0000${publication.etag}`;
+    const { href, ref } = publication.schema.bundle;
+    return JSON.stringify([
+        publication.identity.issuer,
+        new URL(href).origin,
+        publication.origin,
+        publication.schema.revision,
+        ref.digest,
+        ref.mediaType,
+        ref.size,
+    ]);
 }
-//# sourceMappingURL=bundle.js.map

package/dist/session/discovery/discovery.d.ts

@@ -1,8 +1,9 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { publication } from '@astrale-os/kernel-protocol';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
-import type { BundleDiscovery } from './bundle.js';
 import type { PublicationDiscovery } from './publication.js';
 import type { SessionSnapshot } from './snapshot.js';
+import { type BundleDiscovery } from './bundle.js';
 export declare class SessionDiscovery {
     readonly kernel: IssuerId;
     private readonly policy;
@@ -12,9 +13,10 @@ export declare class SessionDiscovery {
     private readonly acquisitionOperation;
     private retained?;
     private flight?;
+    private publicationFlight?;
     constructor(kernel: IssuerId, policy: Readonly<SessionPolicy>, publications: PublicationDiscovery, bundles: BundleDiscovery, requireOpen: () => void, acquisitionOperation: () => SessionOperation);
+    publication(operation: SessionOperation): Promise<publication.Publication>;
     snapshot(operation: SessionOperation): Promise<SessionSnapshot>;
     clear(): void;
     private acquireSnapshot;
 }
-//# sourceMappingURL=discovery.d.ts.map

package/dist/session/discovery/discovery.js

@@ -1,5 +1,6 @@
 import { runSessionOperation } from '../context/index.js';
 import { rootViewCatalog } from '../views/index.js';
+import { BundleUnavailableError } from './bundle.js';
 import { createSessionSnapshot } from './snapshot.js';
 export class SessionDiscovery {
     kernel;
@@ -10,6 +11,7 @@ export class SessionDiscovery {
     acquisitionOperation;
     retained;
     flight;
+    publicationFlight;
     constructor(kernel, policy, publications, bundles, requireOpen, acquisitionOperation) {
         this.kernel = kernel;
         this.policy = policy;
@@ -18,6 +20,24 @@ export class SessionDiscovery {
         this.requireOpen = requireOpen;
         this.acquisitionOperation = acquisitionOperation;
     }
+    publication(operation) {
+        this.requireOpen();
+        const current = this.publicationFlight;
+        if (current !== undefined)
+            return runSessionOperation(operation, () => current);
+        const flight = this.publications.revalidate(this.acquisitionOperation()).then((value) => {
+            this.requireOpen();
+            return value;
+        });
+        this.publicationFlight = flight;
+        void flight
+            .finally(() => {
+            if (this.publicationFlight === flight)
+                this.publicationFlight = undefined;
+        })
+            .catch(() => undefined);
+        return runSessionOperation(operation, () => flight);
+    }
     snapshot(operation) {
         this.requireOpen();
         const current = this.flight;
@@ -39,11 +59,20 @@ export class SessionDiscovery {
         this.retained = undefined;
     }
     async acquireSnapshot(operation) {
-        const previous = this.publications.current();
-        const publication = await this.publications.revalidate(operation);
-        if (previous !== undefined && previous.etag !== publication.etag)
-            this.bundles.clear();
-        const artifact = await this.bundles.get(publication, operation);
+        let publication = await this.publication(operation);
+        let artifact;
+        try {
+            artifact = await this.bundles.get(publication, operation);
+        }
+        catch (cause) {
+            if (!(cause instanceof BundleUnavailableError))
+                throw cause;
+            const current = await this.publication(operation);
+            if (current.etag === publication.etag)
+                throw cause;
+            publication = current;
+            artifact = await this.bundles.get(publication, operation);
+        }
         this.requireOpen();
         if (this.retained?.publication.etag === publication.etag)
             return this.retained;
@@ -53,4 +82,3 @@ export class SessionDiscovery {
         return snapshot;
     }
 }
-//# sourceMappingURL=discovery.js.map

package/dist/session/discovery/index.d.ts

@@ -1,10 +1,13 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { publication } from '@astrale-os/kernel-protocol';
 import type { Fetch } from '../../transport/http/index.js';
 import type { SessionOperation, SessionPolicy } from '../context/index.js';
 import type { SessionSnapshot } from './snapshot.js';
 export type { SessionSnapshot } from './snapshot.js';
+export { boundedResponse, requireExactResponse } from './publication.js';
 export interface SessionDiscovery {
     readonly kernel: IssuerId;
+    publication(operation: SessionOperation): Promise<publication.Publication>;
     snapshot(operation: SessionOperation): Promise<SessionSnapshot>;
     clear(): void;
 }
@@ -18,4 +21,3 @@ export interface SessionDiscoveryOptions {
     readonly acquisitionOperation: () => SessionOperation;
 }
 export declare function createSessionDiscovery(options: SessionDiscoveryOptions): SessionDiscovery;
-//# sourceMappingURL=index.d.ts.map

package/dist/session/discovery/index.js

@@ -1,6 +1,7 @@
 import { BundleDiscovery } from './bundle.js';
 import { SessionDiscovery as SessionDiscoveryImplementation } from './discovery.js';
 import { PublicationDiscovery } from './publication.js';
+export { boundedResponse, requireExactResponse } from './publication.js';
 export function createSessionDiscovery(options) {
     return new SessionDiscoveryImplementation(options.kernel, options.policy, new PublicationDiscovery({
         kernel: options.kernel,
@@ -13,4 +14,3 @@ export function createSessionDiscovery(options) {
         maximumBytes: options.maximumBundleBytes,
     }), options.requireOpen, options.acquisitionOperation);
 }
-//# sourceMappingURL=index.js.map

package/dist/session/discovery/publication.d.ts

@@ -21,4 +21,3 @@ export declare class PublicationDiscovery {
 }
 export declare function boundedResponse(response: Response, maximum: number, signal: AbortSignal): Promise<Uint8Array>;
 export declare function requireExactResponse(response: Response, expected: string, label: string): void;
-//# sourceMappingURL=publication.d.ts.map

package/dist/session/discovery/publication.js

@@ -1,7 +1,8 @@
 import * as codecs from '@astrale-os/kernel-protocol/codecs';
 import * as publicationCodec from '@astrale-os/kernel-protocol/publication/publication';
 import { ClientError } from '../../errors/index.js';
-import { allowEndpoint, runSessionOperation } from '../context/index.js';
+import { allowEndpoint } from '../context/index.js';
+import { runAcquisition } from './transport.js';
 export class PublicationDiscovery {
     options;
     publication;
@@ -29,7 +30,7 @@ export class PublicationDiscovery {
     async fetch(operation, previous) {
         const url = publicationCodec.url(this.options.kernel);
         allowEndpoint(url, this.options.policy);
-        const response = await runSessionOperation(operation, (signal) => this.options.fetch(url, {
+        const response = await runAcquisition(operation, 'publication', 'unknown', 'Kernel Publication could not be retrieved.', (signal) => this.options.fetch(url, {
             headers: {
                 accept: 'application/json',
                 ...(previous === undefined ? {} : { 'if-none-match': `"${previous.etag}"` }),
@@ -51,7 +52,7 @@ export class PublicationDiscovery {
         if (!response.ok) {
             throw new ClientError(`Publication discovery returned HTTP ${response.status}.`);
         }
-        const body = await runSessionOperation(operation, (signal) => boundedResponse(response, this.options.maximumBytes, signal));
+        const body = await runAcquisition(operation, 'publication', 'receive', 'Kernel Publication response could not be read.', (signal) => boundedResponse(response, this.options.maximumBytes, signal));
         const admitted = publicationCodec.accept(codecs.json.decode(body));
         if (admitted.identity.issuer !== this.options.kernel) {
             throw new ClientError('Publication issuer differs from the requested Kernel issuer.');
@@ -120,4 +121,3 @@ function join(parts, length) {
     }
     return output;
 }
-//# sourceMappingURL=publication.js.map

package/dist/session/discovery/snapshot.d.ts

@@ -10,4 +10,3 @@ export interface SessionSnapshot {
     readonly views: ViewCatalog;
 }
 export declare function createSessionSnapshot(kernel: IssuerId, publication: publication.Publication, artifact: bundle.Bundle, views: ViewCatalog): SessionSnapshot;
-//# sourceMappingURL=snapshot.d.ts.map

package/dist/session/discovery/snapshot.js

@@ -1,4 +1,3 @@
 export function createSessionSnapshot(kernel, publication, artifact, views) {
     return Object.freeze({ kernel, publication, bundle: artifact, views });
 }
-//# sourceMappingURL=snapshot.js.map

package/dist/session/discovery/transport.d.ts

@@ -0,0 +1,6 @@
+import type { TransportPhase } from '../../errors/index.js';
+import type { SessionOperation } from '../context/index.js';
+type AcquisitionResource = 'publication' | 'bundle';
+/** Normalize only unknown failures from one injected acquisition capability. */
+export declare function runAcquisition<Result>(operation: SessionOperation, resource: AcquisitionResource, phase: Extract<TransportPhase, 'receive' | 'unknown'>, message: string, task: (signal: AbortSignal) => Result | PromiseLike<Result>): Promise<Result>;
+export {};

package/dist/session/discovery/transport.js

@@ -0,0 +1,13 @@
+import { ClientError, TransportError } from '../../errors/index.js';
+import { runSessionOperation } from '../context/index.js';
+/** Normalize only unknown failures from one injected acquisition capability. */
+export async function runAcquisition(operation, resource, phase, message, task) {
+    try {
+        return await runSessionOperation(operation, task);
+    }
+    catch (cause) {
+        if (cause instanceof ClientError)
+            throw cause;
+        throw TransportError.acquisition(message, { cause, phase, resource });
+    }
+}

package/dist/session/exchange/domain.d.ts

@@ -0,0 +1,27 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { invocation } from '@astrale-os/kernel-protocol';
+import { Path } from '@astrale-os/kernel-core/path';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { SessionOperation } from '../context/index.js';
+import type { EffectiveAuth } from '../routing/index.js';
+import type { ExchangeDependencies } from './exchange.js';
+/** Installed issuers of the Domains one Session reaches. */
+export interface Installations {
+    issuerOf(origin: Key.Origin, source: EffectiveAuth, operation: SessionOperation): Promise<IssuerId | undefined>;
+    clear(): void;
+}
+/**
+ * The origin of the Domain whose declaration a Call executes, or undefined when the target names no
+ * Domain. An instance Method belongs to its qualified Class, never to its receiver's Domain.
+ */
+export declare function declaringOrigin(target: invocation.Call['target']): Key.Origin | undefined;
+export declare function callableOrigin(path: Path): Key.Origin | undefined;
+export declare function isKernelOrigin(origin: Key.Origin): boolean;
+/** The installed remote issuer of one Domain, read as the source caller; undefined when local. */
+export declare function installedIssuer(dependencies: Pick<ExchangeDependencies, 'kernel' | 'source' | 'limits'>, origin: Key.Origin, source: EffectiveAuth, operation: SessionOperation): Promise<IssuerId | undefined>;
+/**
+ * Remember each origin's installed issuer for the Session route age. The issuer is installation
+ * state, not authority, so one inspection serves every source credential; concurrent readers share
+ * it while each keeps its own cancellation and deadline.
+ */
+export declare function createInstallations(dependencies: ExchangeDependencies): Installations;

package/dist/session/exchange/domain.js

@@ -0,0 +1,63 @@
+import { targetPath } from '@astrale-os/kernel-core/callable';
+import { Path } from '@astrale-os/kernel-core/path';
+import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { createSchema } from '../../schema/index.js';
+import { runSessionOperation } from '../context/index.js';
+import { sourceCaller } from './source.js';
+const KERNEL_ORIGIN = identity.whoami.owner.origin;
+/**
+ * The origin of the Domain whose declaration a Call executes, or undefined when the target names no
+ * Domain. An instance Method belongs to its qualified Class, never to its receiver's Domain.
+ */
+export function declaringOrigin(target) {
+    return callableOrigin(Path.parse(targetPath(target)));
+}
+export function callableOrigin(path) {
+    const last = path.ast.steps.at(-1);
+    if (last?.kind === 'method' && last.dispatch === 'instance')
+        return Key.origin(last.class);
+    return path.ast.anchor.kind === 'domain' ? path.ast.anchor.origin : undefined;
+}
+export function isKernelOrigin(origin) {
+    return origin === KERNEL_ORIGIN;
+}
+/** The installed remote issuer of one Domain, read as the source caller; undefined when local. */
+export async function installedIssuer(dependencies, origin, source, operation) {
+    const caller = sourceCaller(dependencies, source, operation);
+    const domain = await createSchema(caller.dispatch, dependencies.limits).inspect(origin);
+    const remote = domain.publication;
+    return remote === null || remote.identity.issuer === dependencies.kernel
+        ? undefined
+        : remote.identity.issuer;
+}
+/**
+ * Remember each origin's installed issuer for the Session route age. The issuer is installation
+ * state, not authority, so one inspection serves every source credential; concurrent readers share
+ * it while each keeps its own cancellation and deadline.
+ */
+export function createInstallations(dependencies) {
+    /** An inspection in flight never expires; a settled one lives for the route age. */
+    const entries = new Map();
+    return Object.freeze({
+        issuerOf(origin, source, operation) {
+            const held = entries.get(origin);
+            const { issuer } = held === undefined || held.expiresAt <= Date.now() ? inspect(origin, source) : held;
+            return runSessionOperation(operation, () => issuer);
+        },
+        clear: () => entries.clear(),
+    });
+    function inspect(origin, source) {
+        const issuer = installedIssuer(dependencies, origin, source, dependencies.operation());
+        const entry = { issuer, expiresAt: Infinity };
+        entries.set(origin, entry);
+        // Both reactions are attached, so a rejection that reaches no waiter is never unhandled.
+        issuer.then(() => {
+            entry.expiresAt = Date.now() + dependencies.policy.maximumRouteAgeMs;
+        }, () => {
+            if (entries.get(origin) === entry)
+                entries.delete(origin);
+        });
+        return entry;
+    }
+}