@astrale-os/kernel-client 0.6.0-beta.84 → 0.6.0-beta.85

package/dist/auth/auth.d.ts

@@ -14,7 +14,10 @@ export interface FunctionAdmission {
     readonly receiver?: NodePath;
 }
 export interface AdmissionOptions extends RequestOptions {
-    /** Intersect the caller's Grant; defaults to explicit session attenuation, then self. */
+    /**
+     * @deprecated Ignored. Admission always delegates the session caller unchanged (`self`); the
+     * Kernel refuses any other attenuation.
+     */
     readonly attenuation?: UnresolvedIdentityExpr;
 }
 export interface AuthApi {

package/dist/session/admission.d.ts

@@ -1,6 +1,6 @@
 import type { invocation } from '@astrale-os/kernel-protocol';
-import type { AdmissionOptions, FunctionAdmission } from '../auth/index.js';
+import type { FunctionAdmission } from '../auth/index.js';
 import type { SessionOperation } from './context/index.js';
 import type { ExchangeDependencies } from './exchange/index.js';
 /** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
-export declare function admitFunction(dependencies: ExchangeDependencies, call: invocation.Call, options: AdmissionOptions | undefined, operation: SessionOperation): Promise<FunctionAdmission>;
+export declare function admitFunction(dependencies: ExchangeDependencies, call: invocation.Call, operation: SessionOperation): Promise<FunctionAdmission>;

package/dist/session/admission.js

@@ -1,4 +1,3 @@
-import { grant } from '@astrale-os/kernel-core/auth';
 import { targetPath } from '@astrale-os/kernel-core/callable';
 import { Path } from '@astrale-os/kernel-core/path';
 import { admitOutput } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
@@ -11,15 +10,12 @@ import { matchesCallable } from './reference.js';
 import { requireResultKind, resolveAuth } from './routing/index.js';
 const ADMIT = Path.staticMethod(Path.project(functions.admit.owner), functions.admit.name);
 /** Check a remote Call through the existing Domain exchange and Kernel admission protocols. */
-export async function admitFunction(dependencies, call, options, operation) {
+export async function admitFunction(dependencies, call, operation) {
     const target = Path.parse(targetPath(call.target));
     const origin = callableOrigin(target);
     if (origin === undefined) {
         throw new ClientError('Function admission requires a Domain-qualified callable target.');
     }
-    const attenuation = options?.attenuation === undefined
-        ? undefined
-        : grant.acceptUnresolved({ v: 1, expr: options.attenuation }).expr;
     const effective = await resolveAuth(dependencies.auth, call, operation);
     if (!isAuthority(effective)) {
         throw new ClientError('Function admission requires an authenticated session.');
@@ -29,11 +25,8 @@ export async function admitFunction(dependencies, call, options, operation) {
     if (domain === undefined) {
         throw new ClientError('Function admission through token exchange requires a remote Domain.');
     }
-    const exchanged = await exchangeDomainCredential(dependencies, effective, {
-        issuer: domain,
-        ttlSeconds: effective.delegate.ttlSeconds,
-        attenuation: attenuation ?? effective.delegate.attenuation ?? SELF_ATTENUATION,
-    }, operation);
+    // The Kernel preserves the session caller; `self` is the only attenuation it admits.
+    const exchanged = await exchangeDomainCredential(dependencies, effective, { issuer: domain, ttlSeconds: effective.delegate.ttlSeconds, attenuation: SELF_ATTENUATION }, operation);
     const result = await runSessionOperation(operation, () => dependencies
         .source()
         .as(exchanged.credential)

package/dist/session/exchange/exchange.js

@@ -47,7 +47,7 @@ export async function acquireDomainCredential(dependencies, request, operation)
     const exchange = (source) => exchangeDomainCredential(dependencies, source, {
         issuer: request.issuer,
         ttlSeconds: request.ttlSeconds,
-        attenuation: source.delegate?.attenuation ?? SELF_ATTENUATION,
+        attenuation: SELF_ATTENUATION,
         ...(request.ttlSeconds * 1_000 > coverageMs ? { coverageMs } : {}),
     }, operation);
     const source = await resolveAuth(auth, call, operation);

package/dist/session/routing/cache.js

@@ -277,19 +277,9 @@ function canonicalDelegate(input) {
     });
 }
 function canonicalExpr(input) {
-    if (input.kind === 'identity') {
-        return 'self' in input
-            ? { kind: 'identity', self: true }
-            : { kind: 'identity', credential: input.credential };
-    }
-    if (input.kind === 'exclude') {
-        return {
-            kind: 'exclude',
-            base: canonicalExpr(input.base),
-            excluded: input.excluded.map(canonicalExpr),
-        };
-    }
-    return { kind: input.kind, operands: input.operands.map(canonicalExpr) };
+    return 'self' in input
+        ? { kind: 'identity', self: true }
+        : { kind: 'identity', credential: input.credential };
 }
 async function digestText(input) {
     const webCrypto = typeof crypto === 'undefined' ? undefined : crypto;

package/dist/session/session.js

@@ -138,7 +138,7 @@ export class ClientSession {
         this.graph = createGraph((call, options) => this.call(call, options));
         this.auth = createAuth((target, input, options) => this.call({ target, input }, options), (call, options) => {
             const operation = this.operation(admitControlOptions(options));
-            return admitFunction(this.exchangeDependencies, acceptCall(call), options, operation);
+            return admitFunction(this.exchangeDependencies, acceptCall(call), operation);
         });
     }
     /** Bind one admitted DSL Domain to authenticated graph projection and Method dispatch. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-client",
-  "version": "0.6.0-beta.84",
+  "version": "0.6.0-beta.85",
   "description": "Universal Client — protocol-first, transport-agnostic",
   "keywords": [
     "astrale",
@@ -65,13 +65,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.63",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.69",
+    "@astrale-os/kernel-core": "0.9.0-beta.64",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.46",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.70",
     "@tanstack/pacer": "0.20.1"
   },
   "devDependencies": {
-    "@astrale-os/kernel-server": "0.5.0-beta.71",
+    "@astrale-os/kernel-server": "0.5.0-beta.72",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.0",
     "@types/node": "^22.0.0",
     "typescript": "7.0.2",