@astrale-os/kernel-client 0.6.0-beta.8 → 0.6.0-beta.81

package/dist/auth/auth.d.ts

@@ -1,19 +1,34 @@
-import type { Identity, IdentityId, MintedCredential, ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
-import type { PathLike } from '@astrale-os/kernel-core/path';
-import type { Input } from '../client/index.js';
+import type { Identity, Authentication, IdentityId, MintedCredential, RegisterResult, UnresolvedIdentityExpr } from '@astrale-os/kernel-core/auth';
+import type { NodePath, PathLike } from '@astrale-os/kernel-core/path';
+import type { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { Call, Input } from '../client/index.js';
 import type { RequestOptions } from '../transport/index.js';
 import type { PolicyDecisionInput } from './authorization.js';
-import type { DelegateOptions, MintOptions } from './credential.js';
+import type { DelegateOptions, MintOptions, ImpersonateOptions } from './credential.js';
 import type { WhoisInput } from './identity.js';
+import type { RegisterRequest } from './register.js';
 export type AuthCall = (target: PathLike, input: Input, options?: RequestOptions) => Promise<Input>;
+/** Current admission of one remote Call; the target has not been executed. */
+export interface FunctionAdmission {
+    readonly callable: Key.Callable;
+    readonly receiver?: NodePath;
+}
+export interface AdmissionOptions extends RequestOptions {
+    /** Intersect the caller's Grant; defaults to explicit session attenuation, then self. */
+    readonly attenuation?: UnresolvedIdentityExpr;
+}
 export interface AuthApi {
-    provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
-    whoami(options?: RequestOptions): Promise<Identity>;
-    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+    /** Check access and input without executing an installed remote callable. */
+    admit(call: Call, options?: AdmissionOptions): Promise<FunctionAdmission>;
+    register(input: RegisterRequest, options?: RequestOptions): Promise<RegisterResult>;
+    whoami(options?: RequestOptions): Promise<Identity & Authentication>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<(Identity & Authentication) | null>;
     can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    /** One ordered decision per check; batches above the Kernel bound are split and rejoined. */
+    can(input: readonly PolicyDecisionInput[], options?: RequestOptions): Promise<readonly boolean[]>;
+    impersonate(input: ImpersonateOptions, options?: RequestOptions): Promise<MintedCredential>;
     mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
     delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
 }
-/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
-export declare function createAuth(call: AuthCall): AuthApi;
-//# sourceMappingURL=auth.d.ts.map
+/** Internal composition over callbacks owned by the Session or its bound view. */
+export declare function createAuth(call: AuthCall, admit: AuthApi['admit']): AuthApi;

package/dist/auth/auth.js

@@ -1,16 +1,14 @@
 import { authorizationApi } from './authorization.js';
 import { credentialApi } from './credential.js';
 import { identityApi } from './identity.js';
-import { provisionApi } from './provision.js';
-/** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
-export function createAuth(call) {
-    if (typeof call !== 'function')
-        throw new TypeError('Auth call capability is invalid.');
+import { registerApi } from './register.js';
+/** Internal composition over callbacks owned by the Session or its bound view. */
+export function createAuth(call, admit) {
     return Object.freeze({
-        ...provisionApi(call),
+        admit,
+        ...registerApi(call),
         ...identityApi(call),
         ...authorizationApi(call),
         ...credentialApi(call),
     });
 }
-//# sourceMappingURL=auth.js.map

package/dist/auth/authorization.d.ts

@@ -1,14 +1,16 @@
 import type { NodeId } from '@astrale-os/kernel-core/graph/node';
 import type { NodePath, PathLike } from '@astrale-os/kernel-core/path';
-import type { schema } from '@astrale-os/kernel-dsl/v1';
+import type { PolicyRef } from '@astrale-os/kernel-dsl/v1';
 import type { RequestOptions } from '../transport/index.js';
 import type { AuthCall } from './auth.js';
 export interface PolicyDecisionInput {
-    readonly policy: PathLike | schema.PolicyRef;
+    readonly policy: PathLike | PolicyRef;
     readonly object: NodeId;
 }
 export declare const IDENTITY_CAN_PATH: NodePath;
 export declare function authorizationApi(call: AuthCall): Readonly<{
-    can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+    can: {
+        (input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
+        (input: readonly PolicyDecisionInput[], options?: RequestOptions): Promise<readonly boolean[]>;
+    };
 }>;
-//# sourceMappingURL=authorization.d.ts.map

package/dist/auth/authorization.js

@@ -1,18 +1,37 @@
 import { Path } from '@astrale-os/kernel-core/path';
+import { MAXIMUM_CHECKS } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
 import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 const identityOwner = Path.project(identity.whoami.owner);
 export const IDENTITY_CAN_PATH = Path.staticMethod(identityOwner, identity.can.name).raw;
 export function authorizationApi(call) {
-    return Object.freeze({
-        async can(input, options) {
-            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ policy: policyPath(input.policy), object: input.object }), options));
+    async function can(input, options) {
+        if (!isBatch(input)) {
+            const output = (await call(IDENTITY_CAN_PATH, check(input), options));
             return output.allowed;
-        },
-    });
+        }
+        const batches = [];
+        for (let offset = 0; offset < input.length; offset += MAXIMUM_CHECKS) {
+            batches.push(input.slice(offset, offset + MAXIMUM_CHECKS));
+        }
+        const decided = await Promise.all(batches.map(async (batch) => {
+            const output = (await call(IDENTITY_CAN_PATH, Object.freeze({ checks: batch.map(check) }), options));
+            if (output.decisions.length !== batch.length) {
+                throw new TypeError('Identity.can answered a different number of decisions.');
+            }
+            return output.decisions.map(({ allowed }) => allowed);
+        }));
+        return Object.freeze(decided.flat());
+    }
+    return Object.freeze({ can });
+}
+function isBatch(input) {
+    return Array.isArray(input);
+}
+function check(input) {
+    return Object.freeze({ policy: policyPath(input.policy), object: input.object });
 }
 function policyPath(input) {
     return input instanceof Path || typeof input === 'string'
         ? Path.from(input).raw
         : Path.project(input).raw;
 }
-//# sourceMappingURL=authorization.js.map

package/dist/auth/credential.d.ts

@@ -7,14 +7,23 @@ export interface MintOptions {
     readonly ttlSeconds: number;
     readonly grant?: UnresolvedGrant;
 }
+export interface ImpersonateOptions extends MintOptions {
+    readonly identity: IdentityId;
+}
 export interface DelegateOptions {
     readonly audience: string;
     readonly ttlSeconds: number;
-    readonly attenuation: UnresolvedIdentityExpr;
+    /**
+     * Sent only when present; the Kernel reads absence as self. A Kernel whose `Identity.delegate`
+     * still requires it rejects the omission.
+     */
+    readonly attenuation?: UnresolvedIdentityExpr;
 }
+export declare const IDENTITY_IMPERSONATE_PATH: NodePath;
 export declare const IDENTITY_MINT_PATH: NodePath;
+export declare const IDENTITY_DELEGATE_PATH: NodePath;
 export declare function credentialApi(call: AuthCall): Readonly<{
+    impersonate(input: ImpersonateOptions, options?: RequestOptions): Promise<MintedCredential>;
     mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
     delegate(principal: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
 }>;
-//# sourceMappingURL=credential.d.ts.map

package/dist/auth/credential.js

@@ -1,15 +1,19 @@
 import { Path } from '@astrale-os/kernel-core/path';
 import { identity } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
 const identityOwner = Path.project(identity.whoami.owner);
+export const IDENTITY_IMPERSONATE_PATH = Path.staticMethod(identityOwner, identity.impersonate.name).raw;
 export const IDENTITY_MINT_PATH = Path.staticMethod(identityOwner, identity.mint.name).raw;
+export const IDENTITY_DELEGATE_PATH = Path.staticMethod(identityOwner, identity.delegate.name).raw;
 export function credentialApi(call) {
     return Object.freeze({
+        async impersonate(input, options) {
+            return credential(await call(IDENTITY_IMPERSONATE_PATH, input, options));
+        },
         async mint(input, options) {
             return credential(await call(IDENTITY_MINT_PATH, input, options));
         },
         async delegate(principal, input, options) {
-            const target = Path.instanceMethod(Path.id(principal), identity.delegate.name).raw;
-            return credential(await call(target, input, options));
+            return credential(await call(IDENTITY_DELEGATE_PATH, { ...input, principal }, options));
         },
     });
 }
@@ -19,4 +23,3 @@ function credential(input) {
     }
     return input;
 }
-//# sourceMappingURL=credential.js.map

package/dist/auth/identity.d.ts

@@ -1,15 +1,12 @@
-import type { Identity, IssuerId, Subject } from '@astrale-os/kernel-core/auth';
+import type { Authentication, Identity } from '@astrale-os/kernel-core/auth';
 import type { NodePath } from '@astrale-os/kernel-core/path';
 import type { RequestOptions } from '../transport/index.js';
 import type { AuthCall } from './auth.js';
-export interface WhoisInput {
-    readonly issuer: IssuerId;
-    readonly subject: Subject;
+export type WhoisInput = Authentication;
+export interface IdentityApi {
+    whoami(options?: RequestOptions): Promise<Identity & Authentication>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<(Identity & Authentication) | null>;
 }
 export declare const IDENTITY_WHOAMI_PATH: NodePath;
 export declare const IDENTITY_WHOIS_PATH: NodePath;
-export declare function identityApi(call: AuthCall): Readonly<{
-    whoami(options?: RequestOptions): Promise<Identity>;
-    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
-}>;
-//# sourceMappingURL=identity.d.ts.map
+export declare function identityApi(call: AuthCall): IdentityApi;

package/dist/auth/identity.js

@@ -13,4 +13,3 @@ export function identityApi(call) {
         },
     });
 }
-//# sourceMappingURL=identity.js.map

package/dist/auth/index.d.ts

@@ -1,7 +1,6 @@
-export { createAuth, type AuthApi, type AuthCall } from './auth.js';
+export type { AuthApi, AdmissionOptions, FunctionAdmission } from './auth.js';
 export { IDENTITY_CAN_PATH, type PolicyDecisionInput } from './authorization.js';
-export { IDENTITY_MINT_PATH, type DelegateOptions, type MintOptions } from './credential.js';
+export { IDENTITY_MINT_PATH, IDENTITY_IMPERSONATE_PATH, type DelegateOptions, type MintOptions, type ImpersonateOptions, } from './credential.js';
 export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH, type WhoisInput } from './identity.js';
-export { IDENTITY_PROVISION_PATH } from './provision.js';
-export type { Identity, IdentityId, Subject, IssuerId, MintedCredential, ProvisionRequest, ProvisionResult, UnresolvedGrant, UnresolvedIdentityExpr, } from '@astrale-os/kernel-core/auth';
-//# sourceMappingURL=index.d.ts.map
+export { IDENTITY_REGISTER_PATH, type RegisterIdentity, type RegisterRequest } from './register.js';
+export type { Identity, IdentityId, Subject, IssuerId, MintedCredential, RegisterResult, UnresolvedGrant, UnresolvedIdentityExpr, } from '@astrale-os/kernel-core/auth';

package/dist/auth/index.js

@@ -1,6 +1,4 @@
-export { createAuth } from './auth.js';
 export { IDENTITY_CAN_PATH } from './authorization.js';
-export { IDENTITY_MINT_PATH } from './credential.js';
+export { IDENTITY_MINT_PATH, IDENTITY_IMPERSONATE_PATH, } from './credential.js';
 export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH } from './identity.js';
-export { IDENTITY_PROVISION_PATH } from './provision.js';
-//# sourceMappingURL=index.js.map
+export { IDENTITY_REGISTER_PATH } from './register.js';

package/dist/auth/register.d.ts

@@ -0,0 +1,24 @@
+import type { IdentityId, JsonWebKey, RegisterResult } from '@astrale-os/kernel-core/auth';
+import type { NodePath } from '@astrale-os/kernel-core/path';
+import type { RequestOptions } from '../transport/index.js';
+import type { AuthCall } from './auth.js';
+export declare const IDENTITY_REGISTER_PATH: NodePath;
+export type RegisterIdentity = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly credential: string;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly publicKey: JsonWebKey;
+    readonly credential: string;
+};
+/** JSON-safe client request; binary credential inputs remain Runtime-internal. */
+export interface RegisterRequest {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [RegisterIdentity, ...RegisterIdentity[]];
+}
+export declare function registerApi(call: AuthCall): Readonly<{
+    register(input: RegisterRequest, options?: RequestOptions): Promise<RegisterResult>;
+}>;

package/dist/auth/register.js

@@ -0,0 +1,10 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { register } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+export const IDENTITY_REGISTER_PATH = Path.project(register).raw;
+export function registerApi(call) {
+    return Object.freeze({
+        async register(input, options) {
+            return (await call(IDENTITY_REGISTER_PATH, input, options));
+        },
+    });
+}

package/dist/client/admission.d.ts

@@ -1,5 +1,7 @@
 import type { invocation as protocol } from '@astrale-os/kernel-protocol';
 import type { Call } from './request.js';
 /** Parent-private Call acceptance shared by Client and Client Session. */
-export declare function acceptCall(input: Call): protocol.Call;
-//# sourceMappingURL=admission.d.ts.map
+export declare function acceptCall(input: {
+    readonly target: Call['target'];
+    readonly input: unknown;
+}): protocol.Call;

package/dist/client/admission.js

@@ -1,3 +1,4 @@
+import { Target } from '@astrale-os/kernel-core/callable';
 import { Path } from '@astrale-os/kernel-core/path';
 import * as portable from '@astrale-os/kernel-dsl/value';
 /** Parent-private Call acceptance shared by Client and Client Session. */
@@ -5,7 +6,13 @@ export function acceptCall(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw new TypeError('Client call must be an object.');
     }
-    return Object.freeze({ target: admitPath(input.target), input: admitInput(input.input) });
+    const target = input.target;
+    return Object.freeze({
+        target: typeof target === 'object' && target !== null && 'callable' in target
+            ? Target(target)
+            : admitPath(target),
+        input: admitInput(input.input),
+    });
 }
 function admitPath(input) {
     try {
@@ -32,4 +39,3 @@ function freezeValue(input) {
     }
     return input;
 }
-//# sourceMappingURL=admission.js.map

package/dist/client/client.d.ts

@@ -1,14 +1,14 @@
 import type { invocation as protocol } from '@astrale-os/kernel-protocol';
 import type { Transport } from '../transport/index.js';
 import type { AuthenticatedClient, RemoteCredential } from './credential.js';
-import type { Call, ClientDispatchOptions } from './request.js';
+import type { Call, ClientDispatchOptions, ClientDispatchOptionsWithBody } from './request.js';
 import type { BinaryResponse, Result, StreamResult, ValueResult } from './result.js';
 import { type HttpTransportOptions } from '../transport/http/index.js';
 export type ClientOptions = HttpTransportOptions | {
     readonly transport: Transport;
 };
 /** Package-private redirect continuation path; intentionally absent from the public Client facade. */
-export declare function dispatchTrace(client: Client, credential: RemoteCredential | undefined, call: Call, options: ClientDispatchOptions | undefined, trace: protocol.Trace): Promise<Result>;
+export declare function dispatchTrace(client: Client, credential: RemoteCredential | undefined, call: Call, options: ClientDispatchOptions | ClientDispatchOptionsWithBody | undefined, trace: protocol.Trace): Promise<Result>;
 /** Pure client for the universal remote Function invocation boundary. */
 export declare class Client implements AuthenticatedClient {
     private readonly transport;
@@ -16,11 +16,12 @@ export declare class Client implements AuthenticatedClient {
     private closed;
     constructor(options: ClientOptions);
     dispatch(call: Call, options?: ClientDispatchOptions): Promise<Result>;
+    dispatch(call: Call, options: ClientDispatchOptionsWithBody): Promise<Result>;
     call(call: Call, options?: ClientDispatchOptions): Promise<ValueResult>;
+    call(call: Call, options: ClientDispatchOptionsWithBody): Promise<ValueResult>;
     stream(call: Call, options?: ClientDispatchOptions): Promise<StreamResult>;
     binary(call: Call, options?: ClientDispatchOptions): Promise<BinaryResponse>;
     as(credential: RemoteCredential): AuthenticatedClient;
     close(): void;
     private dispatchWith;
 }
-//# sourceMappingURL=client.d.ts.map

package/dist/client/client.js

@@ -30,7 +30,7 @@ export class Client {
         return this.dispatchWith(undefined, call, options);
     }
     call(call, options) {
-        return requireValue(this.dispatch(call, options));
+        return requireValue(this.dispatchWith(undefined, call, options));
     }
     stream(call, options) {
         return requireStream(this.dispatch(call, options));
@@ -57,7 +57,18 @@ export class Client {
             ? undefined
             : await resolveCredential(credential, request.options.signal);
         requireRequestLive(request.options.signal);
-        const result = await this.transport.dispatch(invocation(request, resolved, trace), request.options);
+        const envelope = invocation(request, resolved, trace);
+        let result;
+        if (request.body === undefined) {
+            result = await this.transport.dispatch(envelope, request.options);
+        }
+        else {
+            const transport = this.transport;
+            if (!(transport instanceof HttpTransport)) {
+                throw new TypeError('Binary dispatch requires HTTP transport.');
+            }
+            result = await transport.dispatchBinary(envelope, request.body, request.options);
+        }
         if (result.kind === 'stale')
             throw admittedStaleRouteError(result.current, result.invocation);
         if (result.kind === 'miss')
@@ -90,4 +101,3 @@ function admitTransport(input) {
         ...(close === undefined ? {} : { close: close.bind(input) }),
     });
 }
-//# sourceMappingURL=client.js.map

package/dist/client/credential.d.ts

@@ -1,13 +1,14 @@
-import type { Call, ClientDispatchOptions } from './request.js';
+import type { Call, ClientDispatchOptions, ClientDispatchOptionsWithBody } from './request.js';
 import type { BinaryResponse, Result, StreamResult, ValueResult } from './result.js';
 export type RemoteCredential = string | (() => string | Promise<string>);
 export interface AuthenticatedClient {
     dispatch(call: Call, options?: ClientDispatchOptions): Promise<Result>;
+    dispatch(call: Call, options: ClientDispatchOptionsWithBody): Promise<Result>;
     call(call: Call, options?: ClientDispatchOptions): Promise<ValueResult>;
+    call(call: Call, options: ClientDispatchOptionsWithBody): Promise<ValueResult>;
     stream(call: Call, options?: ClientDispatchOptions): Promise<StreamResult>;
     binary(call: Call, options?: ClientDispatchOptions): Promise<BinaryResponse>;
 }
-export type CredentialDispatch = (credential: RemoteCredential, call: Call, options?: ClientDispatchOptions) => Promise<Result>;
+export type CredentialDispatch = (credential: RemoteCredential, call: Call, options?: ClientDispatchOptions | ClientDispatchOptionsWithBody) => Promise<Result>;
 export declare function authenticated(dispatchWith: CredentialDispatch, credential: RemoteCredential): AuthenticatedClient;
 export declare function resolveCredential(input: RemoteCredential, signal?: AbortSignal): Promise<string>;
-//# sourceMappingURL=credential.d.ts.map

package/dist/client/credential.js

@@ -1,10 +1,15 @@
 import { ClientError } from '../errors/index.js';
 import { requireBinary, requireStream, requireValue } from './result.js';
 export function authenticated(dispatchWith, credential) {
-    const dispatch = (call, options) => dispatchWith(credential, call, options);
+    function dispatch(call, options) {
+        return dispatchWith(credential, call, options);
+    }
+    function call(request, options) {
+        return requireValue(dispatchWith(credential, request, options));
+    }
     return Object.freeze({
         dispatch,
-        call: (call, options) => requireValue(dispatch(call, options)),
+        call,
         stream: (call, options) => requireStream(dispatch(call, options)),
         binary: (call, options) => requireBinary(dispatch(call, options)),
     });
@@ -49,4 +54,3 @@ function cancellation(reason) {
         ? reason
         : new ClientError('Client request was cancelled.', { cause: reason });
 }
-//# sourceMappingURL=credential.js.map

package/dist/client/index.d.ts

@@ -1,7 +1,6 @@
 export { Client, dispatchTrace, type ClientOptions } from './client.js';
 export { acceptCall } from './admission.js';
 export type { AuthenticatedClient, RemoteCredential } from './credential.js';
-export { call, type Call, type ClientDispatchOptions } from './request.js';
+export { call, type Call, type ClientDispatchOptions, type ClientDispatchOptionsWithBody, } from './request.js';
 export type { Binary, BinaryResponse, Input, RedirectResult, Result, Stream, StreamResult, ValueResult, } from './result.js';
 export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/client/index.js

@@ -1,5 +1,4 @@
 export { Client, dispatchTrace } from './client.js';
 export { acceptCall } from './admission.js';
-export { call } from './request.js';
+export { call, } from './request.js';
 export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
-//# sourceMappingURL=index.js.map

package/dist/client/request.d.ts

@@ -1,27 +1,33 @@
+import type { Target } from '@astrale-os/kernel-core/callable';
 import type { PathLike } from '@astrale-os/kernel-core/path';
 import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 import type { RequestOptions, TransportRequest } from '../transport/index.js';
 import type { Input } from './result.js';
 /** One portable call before Path canonicalization, correlation, and credential binding. */
 export interface Call {
-    readonly target: PathLike;
+    readonly target: PathLike | Target;
     readonly input: Input;
 }
 export interface ClientDispatchOptions extends RequestOptions {
+    readonly body?: never;
     /** Untrusted delivery context; it changes neither Call meaning nor authority. */
     readonly delegate?: protocol.Delegate;
     readonly routing?: protocol.Routing;
     /** Package-owned local-target or remote-revision precondition for a bound invocation. */
     readonly schema?: protocol.SchemaTarget;
 }
+export type ClientDispatchOptionsWithBody = Omit<ClientDispatchOptions, 'body' | 'idempotencyKey'> & {
+    readonly body: Blob;
+    readonly idempotencyKey?: never;
+};
 export interface AdmittedRequest {
     readonly call: protocol.Call;
     readonly delegate?: protocol.Delegate;
     readonly routing?: protocol.Routing;
     readonly schema?: protocol.SchemaTarget;
     readonly options: RequestOptions;
+    readonly body?: Blob;
 }
-export declare function call(target: PathLike, input: Input): Call;
-export declare function admitRequest(input: Call, options: ClientDispatchOptions | undefined, lifecycle: AbortSignal): AdmittedRequest;
+export declare function call(target: PathLike | Target, input: Input): Call;
+export declare function admitRequest(input: Call, options: ClientDispatchOptions | ClientDispatchOptionsWithBody | undefined, lifecycle: AbortSignal): AdmittedRequest;
 export declare function invocation(request: AdmittedRequest, credential?: string, trace?: protocol.Trace): TransportRequest;
-//# sourceMappingURL=request.d.ts.map

package/dist/client/request.js

@@ -5,7 +5,8 @@ export function call(target, input) {
 }
 export function admitRequest(input, options, lifecycle) {
     const call = acceptCall(input);
-    const admittedOptions = lifecycleOptions(admitRequestOptions(options), lifecycle);
+    const admitted = admitRequestOptions(options);
+    const admittedOptions = lifecycleOptions(admitted.options, lifecycle);
     const delegate = admitDelegate(options?.delegate);
     const routing = admitRouting(options?.routing);
     const schema = admitSchemaTarget(options?.schema);
@@ -14,6 +15,7 @@ export function admitRequest(input, options, lifecycle) {
         ...(delegate === undefined ? {} : { delegate }),
         ...(routing === undefined ? {} : { routing }),
         ...(schema === undefined ? {} : { schema }),
+        ...(admitted.body === undefined ? {} : { body: admitted.body }),
         options: admittedOptions,
     });
 }
@@ -41,23 +43,49 @@ export function invocation(request, credential, trace) {
 }
 function admitRequestOptions(input) {
     if (input === undefined)
-        return undefined;
+        return {};
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw new TypeError('Client request options must be an object.');
     }
+    if (Reflect.ownKeys(input).some((field) => ![
+        'signal',
+        'timeoutMs',
+        'idempotencyKey',
+        'delegate',
+        'routing',
+        'schema',
+        'body',
+    ].includes(String(field)))) {
+        throw new TypeError('Client request options contain unsupported fields.');
+    }
     if (input.timeoutMs !== undefined &&
         (!Number.isSafeInteger(input.timeoutMs) ||
             input.timeoutMs < 1 ||
             input.timeoutMs > 2_147_483_647)) {
         throw new TypeError('Client request timeoutMs must be a positive safe platform integer.');
     }
+    const hasBody = Object.hasOwn(input, 'body');
+    let body;
+    if (hasBody) {
+        const candidate = input.body;
+        if (!(candidate instanceof Blob)) {
+            throw new TypeError('Binary input must be a Blob or File.');
+        }
+        body = candidate;
+    }
+    if (body !== undefined && input.idempotencyKey !== undefined) {
+        throw new TypeError('Binary requests cannot carry an idempotency key.');
+    }
     const idempotencyKey = input.idempotencyKey === undefined
         ? undefined
         : invocationProtocol.acceptIdempotencyKey(input.idempotencyKey, 'request.idempotencyKey');
     return Object.freeze({
-        ...(input.signal === undefined ? {} : { signal: input.signal }),
-        ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
-        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        options: Object.freeze({
+            ...(input.signal === undefined ? {} : { signal: input.signal }),
+            ...(input.timeoutMs === undefined ? {} : { timeoutMs: input.timeoutMs }),
+            ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        }),
+        ...(body === undefined ? {} : { body }),
     });
 }
 function admitDelegate(input) {
@@ -98,4 +126,3 @@ function lifecycleOptions(input, lifecycle) {
         ...(input?.idempotencyKey === undefined ? {} : { idempotencyKey: input.idempotencyKey }),
     });
 }
-//# sourceMappingURL=request.js.map

package/dist/client/result.d.ts

@@ -1,10 +1,10 @@
-import type { BinaryResult, CallableResult } from '@astrale-os/kernel-core/domain';
+import type { BinaryOutput, CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
 import type { invocation as protocol } from '@astrale-os/kernel-protocol';
 /** Caller-visible value accepted from one admitted remote invocation. */
 export type Input = Value;
-/** Caller-visible finite binary response. */
-export type Binary = BinaryResult;
+/** Caller-visible buffered or streaming binary response. */
+export type Binary = BinaryOutput;
 /** Caller-owned remote stream. */
 export interface Stream extends AsyncIterable<Value> {
     cancel(reason?: string): Promise<void>;
@@ -33,4 +33,3 @@ export declare function requireValue(result: Promise<Result>): Promise<ValueResu
 export declare function requireStream(result: Promise<Result>): Promise<StreamResult>;
 export declare function requireBinary(result: Promise<Result>): Promise<BinaryResponse>;
 export {};
-//# sourceMappingURL=result.d.ts.map

package/dist/client/result.js

@@ -24,6 +24,8 @@ async function rejectMismatch(expected, result) {
     if (result.kind === 'stream') {
         await result.stream.cancel(`Expected ${expected} Function result.`).catch(() => undefined);
     }
+    if (result.kind === 'binary' && !(result.value.body instanceof Uint8Array)) {
+        await result.value.body[Symbol.asyncIterator]().return?.();
+    }
     mismatch(expected, result.kind);
 }
-//# sourceMappingURL=result.js.map

package/dist/client/routing-control.d.ts

@@ -8,4 +8,3 @@ export declare function admittedStaleRouteError(currentEtag: publication.Etag, i
 export declare function isAdmittedMissError(input: unknown): input is MissError;
 /** Distinguish decoded routing control from public or caller-supplied lookalike errors. */
 export declare function isAdmittedStaleRouteError(input: unknown): input is StaleRouteError;
-//# sourceMappingURL=routing-control.d.ts.map

package/dist/client/routing-control.js

@@ -21,4 +21,3 @@ export function isAdmittedMissError(input) {
 export function isAdmittedStaleRouteError(input) {
     return input instanceof StaleRouteError && admittedStaleRoutes.has(input);
 }
-//# sourceMappingURL=routing-control.js.map

package/dist/errors/client-error.d.ts

@@ -1,4 +1,3 @@
 export declare class ClientError extends Error {
     constructor(message: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=client-error.d.ts.map

package/dist/errors/client-error.js

@@ -1,7 +1,8 @@
 export class ClientError extends Error {
     constructor(message, options) {
+        if (message.trim() === '')
+            throw new TypeError('Client error message must be non-blank.');
         super(message, options);
         this.name = 'ClientError';
     }
 }
-//# sourceMappingURL=client-error.js.map