@astrale-os/kernel-protocol 0.5.0-beta.70 → 0.5.0-beta.71

package/dist/invocation/delegate.d.ts

@@ -1,15 +1,4 @@
-export declare namespace Delegate {
-    /** One wire leaf; Identity set algebra is not supported. */
-    type Expr = {
-        readonly kind: 'identity';
-        readonly self: true;
-    } | {
-        readonly kind: 'identity';
-        readonly credential: string;
-    };
-}
 export interface Delegate {
     readonly ttlSeconds: number;
-    readonly attenuation?: Delegate.Expr;
 }
 export declare function acceptDelegate(input: unknown): Delegate;

package/dist/invocation/delegate.js

@@ -1,29 +1,12 @@
-import { AuthValueError, grant } from '@astrale-os/kernel-core/auth';
 import { exactDataObject, exactFields, invalid, required } from './admission.js';
-const FIELDS = new Set(['ttlSeconds', 'attenuation']);
+import { withoutSelfAttenuation } from './legacy/delegate.js';
+const FIELDS = new Set(['ttlSeconds']);
 export function acceptDelegate(input) {
-    const object = exactDataObject(input, 'delegate');
+    const object = withoutSelfAttenuation(exactDataObject(input, 'delegate'));
     exactFields(object, FIELDS, 'delegate');
     required(object, ['ttlSeconds'], 'delegate');
     if (!Number.isSafeInteger(object.ttlSeconds) || object.ttlSeconds < 1) {
         invalid('delegate.ttlSeconds must be a positive safe integer');
     }
-    // Omission and `self` both carry the authenticated caller unchanged; nothing else is admitted.
-    let attenuation;
-    if (object.attenuation !== undefined) {
-        try {
-            attenuation = grant.acceptUnresolved({ v: 1, expr: object.attenuation }).expr;
-        }
-        catch (cause) {
-            if (cause instanceof AuthValueError)
-                invalid('delegate.attenuation must be self');
-            throw cause;
-        }
-        if (!('self' in attenuation))
-            invalid('delegate.attenuation must be self');
-    }
-    return Object.freeze({
-        ttlSeconds: object.ttlSeconds,
-        ...(attenuation === undefined ? {} : { attenuation: attenuation }),
-    });
+    return Object.freeze({ ttlSeconds: object.ttlSeconds });
 }

package/dist/invocation/http/index.d.ts

@@ -1,5 +1,5 @@
 export { BINARY_DELIVERY_FIELD, BINARY_HEADERS_FIELD, decodeBinaryHeaderNames, decodeInvocationId, encodeBinaryHeaderNames, encodeInvocationId, isApplicationBinaryHeader, MAXIMUM_INVOCATION_FIELD_BYTES, INVOCATION_FIELD, REQUEST_ID_FIELD, STREAMING_BINARY_DELIVERY, } from './binary.js';
 export { codecForContentType, negotiateResponseCodec } from './negotiation.js';
-export { BINARY_LENGTH_FIELD, BINARY_REQUEST_CONTENT_TYPE, decodeBinaryRequestEnvelope, encodeBinaryRequestEnvelope, MAXIMUM_REQUEST_ENVELOPE_BYTES, REQUEST_ENVELOPE_FIELD, } from './request.js';
+export { BINARY_LENGTH_FIELD, BINARY_REQUEST_CONTENT_TYPE, decodeBinaryLength, decodeBinaryRequestEnvelope, encodeBinaryRequestEnvelope, MAXIMUM_REQUEST_ENVELOPE_BYTES, REQUEST_ENVELOPE_FIELD, } from './request.js';
 export { encodeStreamFrame, LENGTH_PREFIX_V1, STREAM_FRAMING_FIELD } from './stream.js';
 export { BAGGAGE_FIELD, decodeTraceHeaders, encodeTraceHeaders, TRACEPARENT_FIELD, TRACESTATE_FIELD, } from './trace.js';

package/dist/invocation/http/index.js

@@ -1,5 +1,5 @@
 export { BINARY_DELIVERY_FIELD, BINARY_HEADERS_FIELD, decodeBinaryHeaderNames, decodeInvocationId, encodeBinaryHeaderNames, encodeInvocationId, isApplicationBinaryHeader, MAXIMUM_INVOCATION_FIELD_BYTES, INVOCATION_FIELD, REQUEST_ID_FIELD, STREAMING_BINARY_DELIVERY, } from './binary.js';
 export { codecForContentType, negotiateResponseCodec } from './negotiation.js';
-export { BINARY_LENGTH_FIELD, BINARY_REQUEST_CONTENT_TYPE, decodeBinaryRequestEnvelope, encodeBinaryRequestEnvelope, MAXIMUM_REQUEST_ENVELOPE_BYTES, REQUEST_ENVELOPE_FIELD, } from './request.js';
+export { BINARY_LENGTH_FIELD, BINARY_REQUEST_CONTENT_TYPE, decodeBinaryLength, decodeBinaryRequestEnvelope, encodeBinaryRequestEnvelope, MAXIMUM_REQUEST_ENVELOPE_BYTES, REQUEST_ENVELOPE_FIELD, } from './request.js';
 export { encodeStreamFrame, LENGTH_PREFIX_V1, STREAM_FRAMING_FIELD } from './stream.js';
 export { BAGGAGE_FIELD, decodeTraceHeaders, encodeTraceHeaders, TRACEPARENT_FIELD, TRACESTATE_FIELD, } from './trace.js';

package/dist/invocation/http/request.d.ts

@@ -3,6 +3,8 @@ export declare const REQUEST_ENVELOPE_FIELD: 'x-astrale-request';
 export declare const BINARY_LENGTH_FIELD: 'x-astrale-binary-length';
 export declare const BINARY_REQUEST_CONTENT_TYPE: 'application/octet-stream';
 export declare const MAXIMUM_REQUEST_ENVELOPE_BYTES = 8192;
+/** Decode one declared byte count: a canonical unsigned decimal within the safe integer range. */
+export declare function decodeBinaryLength(input: string): number | undefined;
 /** Encode one canonical V2 Request into the binary-request HTTP field. */
 export declare function encodeBinaryRequestEnvelope(input: Request): string;
 /** Decode one bounded base64url JSON V2 Request from the binary-request HTTP field. */

package/dist/invocation/http/request.js

@@ -7,6 +7,14 @@ export const BINARY_REQUEST_CONTENT_TYPE = 'application/octet-stream';
 export const MAXIMUM_REQUEST_ENVELOPE_BYTES = 8_192;
 const BASE64URL = /^[A-Za-z0-9_-]+$/u;
 const MAXIMUM_ENCODED_BYTES = Math.ceil(MAXIMUM_REQUEST_ENVELOPE_BYTES / 3) * 4;
+const DECIMAL = /^(?:0|[1-9][0-9]*)$/u;
+/** Decode one declared byte count: a canonical unsigned decimal within the safe integer range. */
+export function decodeBinaryLength(input) {
+    if (!DECIMAL.test(input))
+        return undefined;
+    const length = Number(input);
+    return Number.isSafeInteger(length) ? length : undefined;
+}
 /** Encode one canonical V2 Request into the binary-request HTTP field. */
 export function encodeBinaryRequestEnvelope(input) {
     const request = decodeRequest(input);

package/dist/invocation/legacy/delegate.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A source `Delegate` may still carry `attenuation` with the self expression
+ * `{ kind: 'identity', self: true }`, the one value published Clients and SDK Workers send. It names
+ * the caller every Delegate preserves anyway, so `acceptDelegate` drops it and returns the same
+ * `Delegate` as without it. Every other value, `undefined` and `null` included, stays refused.
+ *
+ * @deprecated Omit `attenuation`; a Delegate always preserves the authenticated caller (ADR-3).
+ *
+ * Short-term consumers: Domain Workers built with `@astrale-os/sdk` 0.6.0-beta.0 to beta.3, whose
+ * `Function.admit` callback sends it (the Shell v3 Worker included), and callers that pass it in
+ * `delegate` to `@astrale-os/kernel-client` 0.6.0-beta.85 or earlier.
+ *
+ * Removal, in a separate breaking release, once those Workers are redeployed with a later SDK and
+ * every consumer runs a Client that omits the field: delete this file, its call in `../delegate.ts`
+ * and its vectors in INVOCATION-DELEGATE-OMISSION-EVIDENCE.
+ */
+export declare function withoutSelfAttenuation(object: Record<string, unknown>): Record<string, unknown>;

package/dist/invocation/legacy/delegate.js

@@ -0,0 +1,37 @@
+/**
+ * A source `Delegate` may still carry `attenuation` with the self expression
+ * `{ kind: 'identity', self: true }`, the one value published Clients and SDK Workers send. It names
+ * the caller every Delegate preserves anyway, so `acceptDelegate` drops it and returns the same
+ * `Delegate` as without it. Every other value, `undefined` and `null` included, stays refused.
+ *
+ * @deprecated Omit `attenuation`; a Delegate always preserves the authenticated caller (ADR-3).
+ *
+ * Short-term consumers: Domain Workers built with `@astrale-os/sdk` 0.6.0-beta.0 to beta.3, whose
+ * `Function.admit` callback sends it (the Shell v3 Worker included), and callers that pass it in
+ * `delegate` to `@astrale-os/kernel-client` 0.6.0-beta.85 or earlier.
+ *
+ * Removal, in a separate breaking release, once those Workers are redeployed with a later SDK and
+ * every consumer runs a Client that omits the field: delete this file, its call in `../delegate.ts`
+ * and its vectors in INVOCATION-DELEGATE-OMISSION-EVIDENCE.
+ */
+export function withoutSelfAttenuation(object) {
+    if (!Object.hasOwn(object, 'attenuation') || !isSelf(object.attenuation))
+        return object;
+    const { attenuation: _self, ...rest } = object;
+    return rest;
+}
+function isSelf(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    if (Reflect.ownKeys(value).length !== 2)
+        return false;
+    const kind = Object.getOwnPropertyDescriptor(value, 'kind');
+    const self = Object.getOwnPropertyDescriptor(value, 'self');
+    return (kind?.enumerable === true &&
+        kind.value === 'identity' &&
+        self?.enumerable === true &&
+        self.value === true);
+}

package/dist/release/index.d.ts

@@ -9,7 +9,7 @@ export { placeDelivery } from './delivery-declaration.js';
 export type { Authentication as DeliveryAuthentication, Endpoint as DeliveryEndpoint, } from './delivery-endpoint.js';
 export type { BuildDigest, ReleaseDigest, Sha256Digest } from './digest.js';
 export { ReleaseError, type ReleaseErrorCode } from './error.js';
-export type { Manifest } from './manifest.js';
+export type { LocalizedText, Manifest } from './manifest.js';
 export { ClassOperationOrder, admitRequirements, capabilityKeys, validateRequirements, type CapabilityAuthorityRequirements, type CoreCapabilityRequirement, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type Requirements, } from './requirements.js';
 export type { BodyPick, CredentialSource, HttpMethod, HttpRoute, HttpRouteDeclaration, RouteBody, RouteHeaders, SingleCredentialSource, } from './route.js';
 export type { Schema } from './schema.js';

package/dist/release/manifest.d.ts

@@ -1,5 +1,9 @@
 import { type ViewRef } from '@astrale-os/kernel-dsl/v1/addressing';
+/** A display name per language, keyed by a BCP 47 language tag in canonical case (`fr`, `pt-BR`). */
+export type LocalizedText = Readonly<Record<string, string>>;
 export interface Manifest {
+    /** The application's display name, per language. */
+    readonly title?: LocalizedText;
     readonly logo?: string;
     readonly entrypoint?: ViewRef;
 }

package/dist/release/manifest.js

@@ -1,11 +1,19 @@
 import { acceptDefinitionRef } from '@astrale-os/kernel-dsl/v1/addressing';
 import { fail } from './error.js';
 import { exact, record } from './shape.js';
+/** A language, optionally narrowed to a region: `fr`, `en`, `pt-BR`. */
+const LANGUAGE_TAG = /^[a-z]{2,3}(?:-[A-Z]{2})?$/u;
+const MAXIMUM_TITLE_LANGUAGES = 32;
+const MAXIMUM_TITLE_LENGTH = 120;
+// C0 and C1 controls; a display name is one line of text.
+// oxlint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/u;
 export function admitManifest(input) {
     if (input === undefined)
         return undefined;
     const value = record(input, 'RELEASE_INVALID', 'Manifest is invalid.');
-    exact(value, ['logo', 'entrypoint'], 'RELEASE_INVALID');
+    exact(value, ['title', 'logo', 'entrypoint'], 'RELEASE_INVALID');
+    const title = value.title === undefined ? undefined : admitTitle(value.title);
     if (value.logo !== undefined && typeof value.logo !== 'string') {
         fail('RELEASE_INVALID', 'Manifest logo must be a string.');
     }
@@ -24,7 +32,35 @@ export function admitManifest(input) {
         entrypoint = ref;
     }
     return Object.freeze({
+        ...(title === undefined ? {} : { title }),
         ...(value.logo === undefined ? {} : { logo: value.logo }),
         ...(entrypoint === undefined ? {} : { entrypoint }),
     });
 }
+/**
+ * A release is canonical, so a title is admitted exactly as written or refused: never trimmed,
+ * re-cased or truncated, which would make its digest differ from what the author signed.
+ */
+function admitTitle(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Manifest title is invalid.');
+    const languages = Object.keys(value);
+    if (languages.length === 0 || languages.length > MAXIMUM_TITLE_LANGUAGES) {
+        fail('RELEASE_INVALID', 'Manifest title must name between 1 and 32 languages.');
+    }
+    const title = {};
+    for (const language of languages) {
+        if (!LANGUAGE_TAG.test(language)) {
+            fail('RELEASE_INVALID', 'Manifest title languages must be canonical BCP 47 tags.');
+        }
+        const text = value[language];
+        if (typeof text !== 'string' ||
+            text.length === 0 ||
+            text.length > MAXIMUM_TITLE_LENGTH ||
+            text.trim() !== text ||
+            CONTROL.test(text)) {
+            fail('RELEASE_INVALID', 'Manifest title text must be one trimmed line of 1 to 120 characters.');
+        }
+        title[language] = text;
+    }
+    return Object.freeze(title);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-protocol",
-  "version": "0.5.0-beta.70",
+  "version": "0.5.0-beta.71",
   "description": "Portable Astrale invocation, publication, installation, routing, and issuer protocols",
   "license": "Apache-2.0",
   "repository": {
@@ -173,8 +173,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-core": "0.9.0-beta.64",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.46",
+    "@astrale-os/kernel-core": "0.9.0-beta.65",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.47",
     "@noble/hashes": "2.3.0"
   },
   "devDependencies": {