@astrale-os/kernel-client 0.6.0-beta.83 → 0.6.0-beta.85

package/dist/auth/auth.d.ts

@@ -14,7 +14,10 @@ export interface FunctionAdmission {
     readonly receiver?: NodePath;
 }
 export interface AdmissionOptions extends RequestOptions {
-    /** Intersect the caller's Grant; defaults to explicit session attenuation, then self. */
+    /**
+     * @deprecated Ignored. Admission always delegates the session caller unchanged (`self`); the
+     * Kernel refuses any other attenuation.
+     */
     readonly attenuation?: UnresolvedIdentityExpr;
 }
 export interface AuthApi {

package/dist/schema/index.d.ts

@@ -1,3 +1,3 @@
-export { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, type SchemaApi, type SchemaCall, type SchemaOptions, type DomainBundle, type DomainDependencies, type DomainInfo, type InstallResult, } from './schema.js';
+export { createSchema, DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS, type SchemaApi, type SchemaCall, type SchemaOptions, type DomainBundle, type DomainDependencies, type DomainInfo, type InstalledPin, type InstalledRelease, type InstallResult, } from './schema.js';
 export { acceptOperationId, createOperationId } from './operation.js';
 export type { DomainRequest, InstallReceipt, InstallRequest, OperationId, UninstallReceipt, UninstallRequest, } from './contracts.js';

package/dist/schema/schema.d.ts

@@ -10,6 +10,8 @@ export interface SchemaOptions extends protocolSchema.installation.introspection
 export type DomainInfo = protocolSchema.installation.introspection.DomainInfo;
 export type DomainBundle = protocolSchema.installation.introspection.DomainBundle;
 export type DomainDependencies = protocolSchema.installation.introspection.DomainDependencies;
+export type InstalledRelease = protocolSchema.installation.introspection.InstalledRelease;
+export type InstalledPin = protocolSchema.installation.introspection.InstalledPin;
 export type InstallResult = protocolSchema.installation.InstallResult;
 export interface SchemaApi {
     install(request: InstallRequest, options?: RequestOptions): Promise<InstallResult>;
@@ -17,6 +19,7 @@ export interface SchemaApi {
     inspect(origin: Key.Origin, options?: RequestOptions): Promise<DomainInfo>;
     bundle(origin: Key.Origin, options?: RequestOptions): Promise<DomainBundle>;
     dependencies(origin: Key.Origin, options?: RequestOptions): Promise<DomainDependencies>;
+    installed(options?: RequestOptions): Promise<readonly InstalledRelease[]>;
 }
 export declare const DEFAULT_SCHEMA_LIFECYCLE_TIMEOUT_MS = 110000;
 /** Bind the canonical Schema lifecycle syscalls to one caller-scoped value-call capability. */

package/dist/schema/schema.js

@@ -54,6 +54,9 @@ export function createSchema(call, limits) {
         async dependencies(origin, options) {
             return introspect(call, admittedLimits, { kind: 'dependencies', origin }, options);
         },
+        async installed(options) {
+            return introspect(call, admittedLimits, { kind: 'installed' }, options);
+        },
     });
 }
 function snapshotUninstallRequest(request) {

package/dist/session/admission.d.ts

@@ -1,6 +1,6 @@
 import type { invocation } from '@astrale-os/kernel-protocol';
-import type { AdmissionOptions, FunctionAdmission } from '../auth/index.js';
+import type { FunctionAdmission } from '../auth/index.js';
 import type { SessionOperation } from './context/index.js';
 import type { ExchangeDependencies } from './exchange/index.js';
 /** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
-export declare function admitFunction(dependencies: ExchangeDependencies, call: invocation.Call, options: AdmissionOptions | undefined, operation: SessionOperation): Promise<FunctionAdmission>;
+export declare function admitFunction(dependencies: ExchangeDependencies, call: invocation.Call, operation: SessionOperation): Promise<FunctionAdmission>;

package/dist/session/admission.js

@@ -1,4 +1,3 @@
-import { grant } from '@astrale-os/kernel-core/auth';
 import { targetPath } from '@astrale-os/kernel-core/callable';
 import { Path } from '@astrale-os/kernel-core/path';
 import { admitOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
@@ -11,15 +10,12 @@ import { matchesCallable } from './reference.js';
 import { requireResultKind, resolveAuth } from './routing/index.js';
 const ADMIT = Path.staticMethod(Path.project(functions.admit.owner), functions.admit.name);
 /** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
-export async function admitFunction(dependencies, call, options, operation) {
+export async function admitFunction(dependencies, call, operation) {
     const target = Path.parse(targetPath(call.target));
     const origin = callableOrigin(target);
     if (origin === undefined) {
         throw new ClientError('Function admission requires a Domain-qualified callable target.');
     }
-    const attenuation = options?.attenuation === undefined
-        ? undefined
-        : grant.acceptUnresolved({ v: 1, expr: options.attenuation }).expr;
     const effective = await resolveAuth(dependencies.auth, call, operation);
     if (!isAuthority(effective)) {
         throw new ClientError('Function admission requires an authenticated session.');
@@ -29,11 +25,8 @@ export async function admitFunction(dependencies, call, options, operation) {
     if (domain === undefined) {
         throw new ClientError('Function admission through token exchange requires a remote Domain.');
     }
-    const exchanged = await exchangeDomainCredential(dependencies, effective, {
-        issuer: domain,
-        ttlSeconds: effective.delegate.ttlSeconds,
-        attenuation: attenuation ?? effective.delegate.attenuation ?? SELF_ATTENUATION,
-    }, operation);
+    // The Kernel preserves the session caller; `self` is the only attenuation it admits.
+    const exchanged = await exchangeDomainCredential(dependencies, effective, { issuer: domain, ttlSeconds: effective.delegate.ttlSeconds, attenuation: SELF_ATTENUATION }, operation);
     const result = await runSessionOperation(operation, () => dependencies
         .source()
         .as(exchanged.credential)

package/dist/session/bound.js

@@ -34,7 +34,15 @@ export function bindSession(source, controls) {
     const inspect = (origin, options) => schemaSource.inspect(origin, controlOptions(options, admittedControls));
     const bundle = (origin, options) => schemaSource.bundle(origin, controlOptions(options, admittedControls));
     const dependencies = (origin, options) => schemaSource.dependencies(origin, controlOptions(options, admittedControls));
-    const schema = Object.freeze({ install, uninstall, inspect, bundle, dependencies });
+    const installed = (options) => schemaSource.installed(controlOptions(options, admittedControls));
+    const schema = Object.freeze({
+        install,
+        uninstall,
+        inspect,
+        bundle,
+        dependencies,
+        installed,
+    });
     const graph = createGraph(call);
     const auth = createAuth((target, input, options) => call(createCall(target, input), options), admit);
     return Object.freeze({
@@ -103,6 +111,7 @@ function captureSchema(input) {
         inspect: capture(input, 'inspect'),
         bundle: capture(input, 'bundle'),
         dependencies: capture(input, 'dependencies'),
+        installed: capture(input, 'installed'),
     });
 }
 function invalid() {

package/dist/session/exchange/exchange.js

@@ -47,7 +47,7 @@ export async function acquireDomainCredential(dependencies, request, operation)
     const exchange = (source) => exchangeDomainCredential(dependencies, source, {
         issuer: request.issuer,
         ttlSeconds: request.ttlSeconds,
-        attenuation: source.delegate?.attenuation ?? SELF_ATTENUATION,
+        attenuation: SELF_ATTENUATION,
         ...(request.ttlSeconds * 1_000 > coverageMs ? { coverageMs } : {}),
     }, operation);
     const source = await resolveAuth(auth, call, operation);

package/dist/session/routing/cache.js

@@ -277,19 +277,9 @@ function canonicalDelegate(input) {
     });
 }
 function canonicalExpr(input) {
-    if (input.kind === 'identity') {
-        return 'self' in input
-            ? { kind: 'identity', self: true }
-            : { kind: 'identity', credential: input.credential };
-    }
-    if (input.kind === 'exclude') {
-        return {
-            kind: 'exclude',
-            base: canonicalExpr(input.base),
-            excluded: input.excluded.map(canonicalExpr),
-        };
-    }
-    return { kind: input.kind, operands: input.operands.map(canonicalExpr) };
+    return 'self' in input
+        ? { kind: 'identity', self: true }
+        : { kind: 'identity', credential: input.credential };
 }
 async function digestText(input) {
     const webCrypto = typeof crypto === 'undefined' ? undefined : crypto;

package/dist/session/session.js

@@ -138,7 +138,7 @@ export class ClientSession {
         this.graph = createGraph((call, options) => this.call(call, options));
         this.auth = createAuth((target, input, options) => this.call({ target, input }, options), (call, options) => {
             const operation = this.operation(admitControlOptions(options));
-            return admitFunction(this.exchangeDependencies, acceptCall(call), options, operation);
+            return admitFunction(this.exchangeDependencies, acceptCall(call), operation);
         });
     }
     /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-client",
-  "version": "0.6.0-beta.83",
+  "version": "0.6.0-beta.85",
   "description": "Universal Client — protocol-first, transport-agnostic",
   "keywords": [
     "astrale",
@@ -65,13 +65,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.62",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.44",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.68",
+    "@astrale-os/kernel-core": "0.9.0-beta.64",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.46",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.70",
     "@tanstack/pacer": "0.20.1"
   },
   "devDependencies": {
-    "@astrale-os/kernel-server": "0.5.0-beta.70",
+    "@astrale-os/kernel-server": "0.5.0-beta.72",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^22.0.0",
     "typescript": "7.0.2",