@astrale-os/kernel-core 0.9.0-beta.5 → 0.9.0-beta.51

package/dist/auth/register/fingerprint/fingerprint.d.ts

@@ -0,0 +1,25 @@
+import type { Authentication, IdentityId } from '../../identity/index.js';
+import type { JsonWebKey } from '../../jwk/index.js';
+declare const REGISTER_FINGERPRINT: unique symbol;
+/** Digest of the semantic request. Credential bytes and verifier evidence are excluded. */
+export type RegisterFingerprint = `sha256:${string}` & {
+    readonly [REGISTER_FINGERPRINT]: true;
+};
+export type RegisterFingerprintIdentity = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly authentication: Authentication;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly authentication: Authentication;
+    readonly publicKey: JsonWebKey;
+};
+export interface RegisterFingerprintInput {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [RegisterFingerprintIdentity, ...RegisterFingerprintIdentity[]];
+}
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export declare function fingerprint(input: RegisterFingerprintInput): Promise<RegisterFingerprint>;
+export {};

package/dist/auth/register/fingerprint/fingerprint.js

@@ -0,0 +1,31 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { thumbprint as jwkThumbprint } from '../../jwk/index.js';
+/** Compute a deterministic post-verification digest without retaining credential evidence. */
+export async function fingerprint(input) {
+    const identities = await Promise.all([...input.identities]
+        .sort((left, right) => compare(left.id, right.id))
+        .map(async (identity) => ({
+        id: identity.id,
+        mode: identity.mode,
+        iss: identity.authentication.iss,
+        sub: identity.authentication.sub,
+        ...(identity.mode === 'self' ? { publication: await publication(identity.publicKey) } : {}),
+    })));
+    const encoded = portable.json.encode(portable.accept({ version: 2, idempotencyKey: input.idempotencyKey, identities }));
+    const digest = await crypto.subtle.digest('SHA-256', Uint8Array.from(encoded).buffer);
+    return `sha256:${hex(new Uint8Array(digest))}`;
+}
+async function publication(publicKey) {
+    const thumbprint = await jwkThumbprint(publicKey);
+    return Object.freeze({
+        key: publicKey,
+        thumbprint,
+        slot: publicKey.kid === undefined ? `thumbprint:${thumbprint}` : `kid:${publicKey.kid}`,
+    });
+}
+function hex(input) {
+    return [...input].map((value) => value.toString(16).padStart(2, '0')).join('');
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/register/fingerprint/index.d.ts

@@ -0,0 +1,2 @@
+export { fingerprint } from './fingerprint.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint.js';

package/dist/auth/{provision → register}/fingerprint/index.js

@@ -1,2 +1 @@
 export { fingerprint } from './fingerprint.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/register/index.d.ts

@@ -0,0 +1,5 @@
+export { fingerprint } from './fingerprint/index.js';
+export type { RegisterFingerprint, RegisterFingerprintIdentity, RegisterFingerprintInput, } from './fingerprint/index.js';
+export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
+export type { IdentityRegistration, RegisterRequest } from './request/index.js';
+export type { RegisteredIdentity, RegisterResult } from './result/index.js';

package/dist/auth/{provision → register}/index.js

@@ -1,3 +1,2 @@
 export { fingerprint } from './fingerprint/index.js';
 export { accept, isSelfIssuer, selfIssuer } from './request/index.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/register/request/admission.d.ts

@@ -0,0 +1,3 @@
+import type { RegisterRequest } from './request.js';
+/** Admit unknown input into the exact immutable existing-target Register language. */
+export declare function accept(input: unknown): RegisterRequest;

package/dist/auth/register/request/admission.js

@@ -0,0 +1,103 @@
+import { NodeId } from '../../../graph/node/index.js';
+import { AuthValueError } from '../../error.js';
+import { acceptPublic } from '../../jwk/index.js';
+import { REGISTER_REQUEST_LIMITS } from './limits.js';
+const textEncoder = new TextEncoder();
+/** Admit unknown input into the exact immutable existing-target Register language. */
+export function accept(input) {
+    if (!isRecord(input))
+        invalid('', 'Expected a Register request object');
+    exact(input, ['idempotencyKey', 'identities'], '');
+    if (typeof input.idempotencyKey !== 'string' ||
+        input.idempotencyKey.length === 0 ||
+        input.idempotencyKey.length > REGISTER_REQUEST_LIMITS.idempotencyKeyCharacters ||
+        textEncoder.encode(input.idempotencyKey).byteLength >
+            REGISTER_REQUEST_LIMITS.idempotencyKeyBytes) {
+        invalid('/idempotencyKey', 'Expected a bounded non-empty idempotency key');
+    }
+    if (!Array.isArray(input.identities) ||
+        input.identities.length === 0 ||
+        input.identities.length > REGISTER_REQUEST_LIMITS.identities) {
+        invalid('/identities', 'Expected a bounded non-empty Identity register array');
+    }
+    const identities = input.identities
+        .map((candidate, index) => identityInput(candidate, `/identities/${index}`))
+        .sort((left, right) => compare(left.id, right.id));
+    for (let index = 1; index < identities.length; index += 1) {
+        if (identities[index - 1].id === identities[index].id) {
+            invalid(`/identities/${index}/id`, 'Duplicate Identity target');
+        }
+    }
+    return Object.freeze({
+        idempotencyKey: input.idempotencyKey,
+        identities: Object.freeze(identities),
+    });
+}
+function identityInput(input, path) {
+    if (!isRecord(input))
+        invalid(path, 'Expected an Identity register object');
+    if (input.mode !== 'external' && input.mode !== 'self') {
+        invalid(`${path}/mode`, 'Expected external or self');
+    }
+    exact(input, input.mode === 'self'
+        ? ['credential', 'id', 'mode', 'publicKey']
+        : ['credential', 'id', 'mode'], path);
+    let id;
+    try {
+        if (typeof input.id !== 'string')
+            throw new TypeError('IdentityId must be text.');
+        id = NodeId(input.id);
+    }
+    catch (cause) {
+        invalid(`${path}/id`, 'Expected an IdentityId', cause);
+    }
+    const credential = credentialInput(input.credential, `${path}/credential`);
+    if (input.mode === 'external') {
+        return Object.freeze({ id, mode: 'external', credential });
+    }
+    return Object.freeze({
+        id,
+        mode: 'self',
+        publicKey: publicJwk(input.publicKey, `${path}/publicKey`),
+        credential,
+    });
+}
+function credentialInput(input, path) {
+    if (typeof input === 'string') {
+        const bytes = textEncoder.encode(input).byteLength;
+        if (bytes === 0 || bytes > REGISTER_REQUEST_LIMITS.credentialBytes) {
+            invalid(path, `Credential must contain 1-${REGISTER_REQUEST_LIMITS.credentialBytes} bytes`);
+        }
+        return input;
+    }
+    if (!(input instanceof Uint8Array) ||
+        input.byteLength === 0 ||
+        input.byteLength > REGISTER_REQUEST_LIMITS.credentialBytes) {
+        invalid(path, `Credential must contain 1-${REGISTER_REQUEST_LIMITS.credentialBytes} bytes`);
+    }
+    return input.slice();
+}
+function publicJwk(input, path) {
+    try {
+        return acceptPublic(input);
+    }
+    catch (cause) {
+        invalid(path, 'Expected a thumbprintable public JWK', cause);
+    }
+}
+function exact(input, expected, path) {
+    const actual = Object.keys(input).sort(compare);
+    const wanted = [...expected].sort(compare);
+    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+        invalid(path, `Expected exactly ${expected.join(', ')}`);
+    }
+}
+function isRecord(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input);
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function invalid(path, message, cause) {
+    throw new AuthValueError('AUTH_REGISTER_REQUEST_INVALID', message, path, cause === undefined ? undefined : { cause });
+}

package/dist/auth/register/request/index.d.ts

@@ -0,0 +1,3 @@
+export { accept } from './admission.js';
+export { isSelfIssuer, selfIssuer } from './self-issuer.js';
+export type { IdentityRegistration, RegisterRequest } from './request.js';

package/dist/auth/{provision → register}/request/index.js

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export { isSelfIssuer, selfIssuer } from './self-issuer.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/register/request/limits.d.ts

@@ -0,0 +1,6 @@
+export declare const REGISTER_REQUEST_LIMITS: Readonly<{
+    credentialBytes: number;
+    idempotencyKeyBytes: 1024;
+    idempotencyKeyCharacters: 256;
+    identities: 256;
+}>;

package/dist/auth/register/request/limits.js

@@ -0,0 +1,6 @@
+export const REGISTER_REQUEST_LIMITS = Object.freeze({
+    credentialBytes: 64 * 1024,
+    idempotencyKeyBytes: 1_024,
+    idempotencyKeyCharacters: 256,
+    identities: 256,
+});

package/dist/auth/register/request/request.d.ts

@@ -0,0 +1,19 @@
+import type { CredentialInput } from '../../credential/input/index.js';
+import type { IdentityId } from '../../identity/index.js';
+import type { JsonWebKey } from '../../jwk/index.js';
+export type IdentityRegistration = {
+    readonly id: IdentityId;
+    readonly mode: 'external';
+    readonly credential: CredentialInput;
+    readonly publicKey?: never;
+} | {
+    readonly id: IdentityId;
+    readonly mode: 'self';
+    readonly publicKey: JsonWebKey;
+    readonly credential: CredentialInput;
+};
+/** Claim credential-evidenced Authentication for existing Identity-bearing Nodes. */
+export interface RegisterRequest {
+    readonly idempotencyKey: string;
+    readonly identities: readonly [IdentityRegistration, ...IdentityRegistration[]];
+}

package/dist/auth/register/request/request.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/{provision → register}/request/self-issuer.d.ts

@@ -1,7 +1,6 @@
 import type { IssuerId } from '../../issuer/index.js';
 import type { JsonWebKey } from '../../jwk/index.js';
-/** Build the hosted issuer controlled by one self-provisioned public key. */
+/** Build the hosted issuer controlled by one self-registered public key. */
 export declare function selfIssuer(kernel: IssuerId, publicKey: JsonWebKey): Promise<IssuerId>;
 /** Whether an issuer is one exact key-bound issuer hosted by this Kernel. */
 export declare function isSelfIssuer(kernel: IssuerId, candidate: IssuerId): boolean;
-//# sourceMappingURL=self-issuer.d.ts.map

package/dist/auth/{provision → register}/request/self-issuer.js

@@ -1,6 +1,6 @@
 import { accept as acceptIssuer } from '../../issuer/index.js';
 import { thumbprint } from '../../jwk/index.js';
-/** Build the hosted issuer controlled by one self-provisioned public key. */
+/** Build the hosted issuer controlled by one self-registered public key. */
 export async function selfIssuer(kernel, publicKey) {
     const base = String(kernel).replace(/\/+$/u, '');
     return acceptIssuer(`${base}/iss/${await thumbprint(publicKey)}`);
@@ -11,4 +11,3 @@ export function isSelfIssuer(kernel, candidate) {
     const prefix = `${base}/iss/`;
     return candidate.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/u.test(candidate.slice(prefix.length));
 }
-//# sourceMappingURL=self-issuer.js.map

package/dist/auth/register/result/index.d.ts

@@ -0,0 +1 @@
+export type { RegisteredIdentity, RegisterResult } from './result.js';

package/dist/auth/register/result/index.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/register/result/result.d.ts

@@ -0,0 +1,10 @@
+import type { IdentityId, Subject } from '../../identity/index.js';
+import type { IssuerId } from '../../issuer/index.js';
+export interface RegisteredIdentity {
+    readonly id: IdentityId;
+    readonly iss: IssuerId;
+    readonly sub: Subject;
+}
+export interface RegisterResult {
+    readonly identities: readonly [RegisteredIdentity, ...RegisteredIdentity[]];
+}

package/dist/auth/register/result/result.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/trust/configuration/admission.d.ts

@@ -1,4 +1,3 @@
 import type { AuthenticationTrust } from './configuration.js';
 /** Admit immutable ordered credential trust configuration. */
 export declare function accept(input: unknown): AuthenticationTrust;
-//# sourceMappingURL=admission.d.ts.map

package/dist/auth/trust/configuration/admission.js

@@ -1,5 +1,5 @@
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { AuthValueError } from '../../error/index.js';
+import { AuthValueError } from '../../error.js';
 import { admitPatternSet } from './pattern.js';
 const MAX_RULES = 256;
 /** Admit immutable ordered credential trust configuration. */
@@ -74,4 +74,3 @@ function fields(input, allowed, path) {
 function invalid(path, message) {
     throw new AuthValueError('AUTHENTICATION_TRUST_INVALID', message, path);
 }
-//# sourceMappingURL=admission.js.map

package/dist/auth/trust/configuration/configuration.d.ts

@@ -44,4 +44,3 @@ export interface AuthenticationTrust {
     readonly default: TrustDecision;
     readonly rules?: readonly TrustRule[];
 }
-//# sourceMappingURL=configuration.d.ts.map

package/dist/auth/trust/configuration/configuration.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=configuration.js.map

package/dist/auth/trust/configuration/index.d.ts

@@ -1,3 +1,2 @@
 export { accept } from './admission.js';
 export type { AuthenticationTrust, StringPatternSet, TrustDecision, TrustRule, } from './configuration.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/trust/configuration/index.js

@@ -1,2 +1 @@
 export { accept } from './admission.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/trust/configuration/pattern.d.ts

@@ -1,4 +1,3 @@
 import type * as portable from '@astrale-os/kernel-dsl/value';
 import type { StringPatternSet } from './configuration.js';
 export declare function admitPatternSet(input: portable.Value, path: string, invalid: (path: string, message: string) => never): StringPatternSet;
-//# sourceMappingURL=pattern.d.ts.map

package/dist/auth/trust/configuration/pattern.js

@@ -40,4 +40,3 @@ function hasControl(input) {
     }
     return false;
 }
-//# sourceMappingURL=pattern.js.map

package/dist/auth/trust/decision/decision.d.ts

@@ -10,4 +10,3 @@ export interface AuthenticationCandidate {
 }
 /** Evaluate one admitted credential candidate through ordered first-match trust. */
 export declare function decide(trust: AuthenticationTrust, candidate: AuthenticationCandidate): TrustDecision;
-//# sourceMappingURL=decision.d.ts.map

package/dist/auth/trust/decision/decision.js

@@ -13,4 +13,3 @@ export function decide(trust, candidate) {
 function matchesMethod(methods, value) {
     return methods === undefined || methods.includes(value);
 }
-//# sourceMappingURL=decision.js.map

package/dist/auth/trust/decision/index.d.ts

@@ -1,3 +1,2 @@
 export { decide } from './decision.js';
 export type { AuthenticationCandidate } from './decision.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/trust/decision/index.js

@@ -1,2 +1 @@
 export { decide } from './decision.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/trust/decision/pattern.d.ts

@@ -1,4 +1,3 @@
 import type { StringPatternSet } from '../configuration/index.js';
 /** Match one already-admitted pattern set for the pure trust decision. */
 export declare function matchesPatternSet(patterns: StringPatternSet | undefined, value: string | undefined): boolean;
-//# sourceMappingURL=pattern.d.ts.map

package/dist/auth/trust/decision/pattern.js

@@ -17,4 +17,3 @@ function compileGlob(glob) {
         .join('.*');
     return new RegExp(`^${escaped}$`);
 }
-//# sourceMappingURL=pattern.js.map

package/dist/auth/trust/index.d.ts

@@ -2,4 +2,3 @@ export { accept } from './configuration/index.js';
 export type { AuthenticationTrust, StringPatternSet, TrustDecision, TrustRule, } from './configuration/index.js';
 export { decide } from './decision/index.js';
 export type { AuthenticationCandidate } from './decision/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/trust/index.js

@@ -1,3 +1,2 @@
 export { accept } from './configuration/index.js';
 export { decide } from './decision/index.js';
-//# sourceMappingURL=index.js.map

package/dist/{domain/callable/contract/invocation → callable/contract}/call.d.ts

@@ -1,5 +1,4 @@
-import type { InputOf } from '../input/index.js';
-import type { OutputOf } from '../output/index.js';
+import type { InputOf } from './input.js';
+import type { OutputOf } from './output.js';
 /** One receiver-bound call projected by a client-supplied MethodBinder. */
 export type CallOf<Value> = (input: InputOf<Value>) => OutputOf<Value> | PromiseLike<OutputOf<Value>>;
-//# sourceMappingURL=call.d.ts.map

package/dist/callable/contract/call.js

@@ -0,0 +1 @@
+export {};

package/dist/callable/contract/index.d.ts

@@ -0,0 +1,5 @@
+export type { CallOf } from './call.js';
+export type { InputOf } from './input.js';
+export type { BinaryOutput, BufferedBinaryResult, OutputContractOf, OutputOf, StreamingBinaryResult, TypedCallableOutput, } from './output.js';
+export type { CallableSignature } from './signature.js';
+export type { Callable, SignatureOf } from './witness.js';

package/dist/callable/contract/index.js

@@ -0,0 +1 @@
+export {};

package/dist/callable/contract/input.d.ts

@@ -0,0 +1,2 @@
+import type { SignatureOf } from './witness.js';
+export type InputOf<Value> = SignatureOf<Value>['input'];

package/dist/callable/contract/input.js

@@ -0,0 +1 @@
+export {};

package/dist/{domain/callable/contract/output → callable/contract}/output.d.ts

@@ -1,5 +1,17 @@
-import type { SignatureOf } from '../index.js';
-import type { BinaryResult } from './binary.js';
+import type { SignatureOf } from './witness.js';
+export interface BufferedBinaryResult {
+    readonly body: Uint8Array;
+    readonly mediaType: string;
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface StreamingBinaryResult {
+    readonly body: AsyncIterable<Uint8Array>;
+    readonly mediaType: string;
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export type BinaryOutput = BufferedBinaryResult | StreamingBinaryResult;
 /** Output modes retained by a rich callable declaration. */
 export type TypedCallableOutput = {
     readonly mode: 'value';
@@ -20,5 +32,4 @@ export type OutputOf<Value> = OutputContractOf<Value> extends infer Output exten
     readonly item: infer Item;
 } ? AsyncIterable<Item> : Output extends {
     readonly mode: 'binary';
-} ? BinaryResult : never : never;
-//# sourceMappingURL=output.d.ts.map
+} ? BinaryOutput : never : never;

package/dist/callable/contract/output.js

@@ -0,0 +1 @@
+export {};

package/dist/{domain/callable → callable}/contract/signature.d.ts

@@ -1,6 +1,5 @@
-import type { TypedCallableOutput } from './output/index.js';
+import type { TypedCallableOutput } from './output.js';
 export interface CallableSignature<out Input = unknown, out Output extends TypedCallableOutput = TypedCallableOutput> {
     readonly input: Input;
     readonly output: Output;
 }
-//# sourceMappingURL=signature.d.ts.map

package/dist/callable/contract/signature.js

@@ -0,0 +1 @@
+export {};

package/dist/{domain/callable → callable}/contract/witness.d.ts

@@ -6,4 +6,3 @@ export interface Callable<out Signature extends CallableSignature = CallableSign
 }
 export type SignatureOf<Value> = Value extends Callable<infer Signature extends CallableSignature> ? Signature : never;
 export {};
-//# sourceMappingURL=witness.d.ts.map

package/dist/callable/contract/witness.js

@@ -0,0 +1 @@
+export {};

package/dist/callable/index.d.ts

@@ -0,0 +1,2 @@
+export type { BinaryOutput, BufferedBinaryResult, Callable, CallableSignature, CallOf, InputOf, OutputContractOf, OutputOf, SignatureOf, StreamingBinaryResult, TypedCallableOutput, } from './contract/index.js';
+export { Target, targetPath, type Call, type CallableResult } from './invocation/index.js';

package/dist/callable/index.js

@@ -0,0 +1 @@
+export { Target, targetPath } from './invocation/index.js';

package/dist/callable/invocation/call.d.ts

@@ -0,0 +1,23 @@
+import type { Key, Revision } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { Value } from '@astrale-os/kernel-dsl/value';
+import { type NodePath } from '@astrale-os/kernel-core/path';
+/**
+ * One declaration, optionally bound to an instance and to the caller's expectation of it: the
+ * declaring Domain revision, or the fingerprint of the callable meaning it compiled against.
+ */
+export type Target = {
+    readonly callable: Key.Callable;
+    readonly instance?: NodePath;
+    /** @deprecated Pin the callable meaning with `fingerprint`; revision pinning will be removed. */
+    readonly revision?: Revision;
+    readonly fingerprint?: `sha256:${string}`;
+};
+/** Capture a structured invocation target at a representation boundary. */
+export declare function Target(input: Target): Target;
+/** Project an admitted target to its canonical graph path without discarding the original Call. */
+export declare function targetPath(target: NodePath | Target): NodePath;
+/** One canonical callable invocation meaning, independent of its carrier. */
+export interface Call {
+    readonly target: NodePath | Target;
+    readonly input: Value;
+}

package/dist/callable/invocation/call.js

@@ -0,0 +1,47 @@
+import { Path } from '@astrale-os/kernel-core/path';
+import { callableAddress, patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+const FINGERPRINT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+/** Capture a structured invocation target at a representation boundary. */
+export function Target(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((field) => !['callable', 'instance', 'revision', 'fingerprint'].includes(String(field)))) {
+        throw new TypeError('Invocation Target must contain only callable, instance, revision and fingerprint.');
+    }
+    const callable = input.callable;
+    const coordinate = callableAddress(callable);
+    const revision = input.revision;
+    if (revision !== undefined &&
+        (typeof revision !== 'string' || !patterns.revision.test(revision))) {
+        throw new TypeError('Invocation Target revision is invalid.');
+    }
+    const fingerprint = input.fingerprint;
+    if (fingerprint !== undefined &&
+        (typeof fingerprint !== 'string' || !FINGERPRINT_PATTERN.test(fingerprint))) {
+        throw new TypeError('Invocation Target fingerprint is invalid.');
+    }
+    const suppliedInstance = input.instance;
+    const instance = suppliedInstance === undefined ? undefined : Path.parse(suppliedInstance);
+    if (instance !== undefined &&
+        (coordinate.kind !== 'method' || instance.ast.steps.at(-1)?.kind === 'method')) {
+        throw new TypeError('Only an instance Method target can carry a node instance path.');
+    }
+    return Object.freeze({
+        callable,
+        ...(instance === undefined ? {} : { instance: instance.raw }),
+        ...(revision === undefined ? {} : { revision }),
+        ...(fingerprint === undefined ? {} : { fingerprint }),
+    });
+}
+/** Project an admitted target to its canonical graph path without discarding the original Call. */
+export function targetPath(target) {
+    if (typeof target === 'string')
+        return target;
+    const coordinate = callableAddress(target.callable);
+    if (coordinate.kind === 'function')
+        return Path.project(coordinate).raw;
+    return target.instance === undefined
+        ? Path.staticMethod(Path.project(coordinate.owner), coordinate.name).raw
+        : Path.instanceMethod(Path.parse(target.instance), target.callable).raw;
+}

package/dist/callable/invocation/index.d.ts

@@ -0,0 +1,2 @@
+export { Target, targetPath, type Call } from './call.js';
+export type { CallableResult } from './result.js';

package/dist/callable/invocation/index.js

@@ -0,0 +1 @@
+export { Target, targetPath } from './call.js';

package/dist/{domain/callable → callable}/invocation/result.d.ts

@@ -1,6 +1,6 @@
-import type { BinaryResult } from '../contract/output/index.js';
+import type { BinaryOutput } from '../contract/index.js';
 /** Successful callable output modes parameterized by the owner's stream capability. */
-export type Result<Output, Stream extends AsyncIterable<Output>> = {
+export type CallableResult<Output, Stream extends AsyncIterable<Output>> = {
     readonly kind: 'value';
     readonly value: Output;
 } | {
@@ -8,6 +8,5 @@ export type Result<Output, Stream extends AsyncIterable<Output>> = {
     readonly stream: Stream;
 } | {
     readonly kind: 'binary';
-    readonly value: BinaryResult;
+    readonly value: BinaryOutput;
 };
-//# sourceMappingURL=result.d.ts.map

package/dist/callable/invocation/result.js

@@ -0,0 +1 @@
+export {};

package/dist/dns-label.d.ts

@@ -1,4 +1,3 @@
-import { z } from 'zod';
 /**
  * Canonical RFC 1035 §2.3.4 DNS label: lowercase alphanumeric + hyphen, no
  * leading/trailing hyphen, 1–63 characters.
@@ -22,5 +21,4 @@ export declare function assertDnsLabel(value: string, name: string): void;
  * instance id / public slug so non-DNS-safe values are rejected at parse time
  * (the `.max(63)`/`.min(1)` give clear length errors before the regex check).
  */
-export declare const dnsLabelSchema: z.ZodString;
-//# sourceMappingURL=dns-label.d.ts.map
+export declare const dnsLabelSchema: import("zod").ZodString;

package/dist/dns-label.js

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { string } from 'zod';
 /**
  * Canonical RFC 1035 §2.3.4 DNS label: lowercase alphanumeric + hyphen, no
  * leading/trailing hyphen, 1–63 characters.
@@ -28,9 +28,7 @@ export function assertDnsLabel(value, name) {
  * instance id / public slug so non-DNS-safe values are rejected at parse time
  * (the `.max(63)`/`.min(1)` give clear length errors before the regex check).
  */
-export const dnsLabelSchema = z
-    .string()
+export const dnsLabelSchema = string()
     .min(1)
     .max(63)
     .regex(DNS_LABEL_RE, 'must be a lowercase DNS label [a-z0-9-], ≤63 chars, no leading/trailing hyphen');
-//# sourceMappingURL=dns-label.js.map

package/dist/events/envelope.d.ts

@@ -17,4 +17,3 @@ export type EventEnvelope<T extends EventTopic = EventTopic> = {
     payload: PayloadFor<T>;
     metadata: EventMetadata;
 };
-//# sourceMappingURL=envelope.d.ts.map

package/dist/events/envelope.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=envelope.js.map

package/dist/events/ids.d.ts

@@ -6,4 +6,3 @@ export type SubscriptionId = string & {
     readonly __subscriptionId: true;
 };
 export declare const SubscriptionId: (id: string) => SubscriptionId;
-//# sourceMappingURL=ids.d.ts.map

package/dist/events/ids.js

@@ -1,3 +1,2 @@
 export const EventId = (id) => id;
 export const SubscriptionId = (id) => id;
-//# sourceMappingURL=ids.js.map