@astrale-os/sdk 0.5.0-beta.13 → 0.5.0-beta.131

package/dist/execution/invocation/admission/authentication.js

@@ -0,0 +1,153 @@
+import { grant, issuer } from '../../../platform/auth/index.js';
+import { bindSession } from '../../../platform/client/session/index.js';
+import { NodeId } from '../../../platform/graph/node/index.js';
+import { protocolError } from '../result/index.js';
+import { requireVia } from './authority.js';
+const ANONYMOUS = Object.freeze({
+    caller: Object.freeze({ kind: 'anonymous' }),
+    kernel: null,
+    graph: null,
+    close() { },
+});
+export async function authentication(callable, request, release, domain, authority) {
+    const credential = request.credential;
+    if (callable.auth === 'anonymous' && credential === undefined)
+        return ANONYMOUS;
+    if (credential === undefined) {
+        throw protocolError('AUTH_MISSING', 'Authentication is required.');
+    }
+    if (typeof credential !== 'string')
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    const authenticated = await authority.authenticate({
+        credential,
+        via: requireVia(request),
+        publication: release.publication,
+        domain,
+        context: request.context,
+    });
+    let close;
+    try {
+        close = captureClose(authenticated);
+        if (authenticated === null ||
+            typeof authenticated !== 'object' ||
+            Array.isArray(authenticated) ||
+            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
+        }
+        const caller = admitCaller(authenticated.caller);
+        const graphInput = admitGraph(authenticated.graph);
+        const graph = Object.freeze({
+            caller: bindSession(graphInput.caller),
+            self: bindSession(graphInput.self),
+            union: bindSession(graphInput.union),
+        });
+        return Object.freeze({ caller, graph, close });
+    }
+    catch (cause) {
+        if (close === undefined)
+            invalid(cause);
+        try {
+            close();
+        }
+        catch (cleanup) {
+            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        }
+        invalid(cause);
+    }
+}
+function admitGraph(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        !Object.hasOwn(input, 'caller') ||
+        !Object.hasOwn(input, 'self') ||
+        !Object.hasOwn(input, 'union') ||
+        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self' && key !== 'union')) {
+        invalid();
+    }
+    return input;
+}
+function captureClose(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    const operation = Reflect.get(input, 'close');
+    return typeof operation === 'function' ? operation.bind(input) : undefined;
+}
+function admitCaller(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (!Object.hasOwn(input, 'kind') ||
+        !Object.hasOwn(input, 'principal') ||
+        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.get(input, 'kind') !== 'authenticated') {
+        invalid();
+    }
+    const principal = NodeId(Reflect.get(input, 'principal'));
+    const authority = grant.accept(Reflect.get(input, 'authority'));
+    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
+    const caller = {
+        kind: 'authenticated',
+        get identity() {
+            if (authority.expr.kind !== 'identity') {
+                throw new TypeError('Caller authority does not resolve to one exact Identity.');
+            }
+            return authority.expr.id;
+        },
+        principal,
+        authority,
+        authentication,
+    };
+    Object.defineProperty(caller, 'identity', { enumerable: false });
+    return Object.freeze(caller);
+}
+function admitEvidence(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const required = ['method', 'issuer', 'subject'];
+    const optional = ['audience', 'keyId', 'issuedAt', 'notBefore', 'expiresAt'];
+    const allowed = new Set([...required, ...optional]);
+    if (required.some((key) => !Object.hasOwn(input, key)) ||
+        Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !allowed.has(key))) {
+        invalid();
+    }
+    const method = Reflect.get(input, 'method');
+    const evidenceIssuer = Reflect.get(input, 'issuer');
+    const subject = Reflect.get(input, 'subject');
+    const audience = Reflect.get(input, 'audience');
+    const keyId = Reflect.get(input, 'keyId');
+    const issuedAt = Reflect.get(input, 'issuedAt');
+    const notBefore = Reflect.get(input, 'notBefore');
+    const expiresAt = Reflect.get(input, 'expiresAt');
+    if (method !== 'jwt' ||
+        !issuer.is(evidenceIssuer) ||
+        typeof subject !== 'string' ||
+        subject.length === 0 ||
+        (audience !== undefined &&
+            (!Array.isArray(audience) || audience.some((value) => typeof value !== 'string'))) ||
+        (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0)) ||
+        !optionalTime(issuedAt) ||
+        !optionalTime(notBefore) ||
+        !optionalTime(expiresAt)) {
+        invalid();
+    }
+    return Object.freeze({
+        method,
+        issuer: evidenceIssuer,
+        subject,
+        ...(audience === undefined ? {} : { audience: Object.freeze([...audience]) }),
+        ...(keyId === undefined ? {} : { keyId }),
+        ...(issuedAt === undefined ? {} : { issuedAt }),
+        ...(notBefore === undefined ? {} : { notBefore }),
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+    });
+}
+function optionalTime(input) {
+    return input === undefined || (typeof input === 'number' && Number.isFinite(input));
+}
+function invalid(cause) {
+    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
+}

package/dist/execution/invocation/admission/authority.d.ts

@@ -0,0 +1,34 @@
+import type * as invocation from '@astrale-os/kernel-protocol/invocation';
+import type * as publication from '@astrale-os/kernel-protocol/publication';
+import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
+import type { AuthenticatedCaller } from '../../../application/action/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+export interface InvocationAdmissionInput {
+    readonly call: invocation.Call;
+    readonly credential?: string;
+    readonly via: invocation.Via;
+    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface InvocationAuthenticationInput {
+    readonly credential: string;
+    readonly via: invocation.Via;
+    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+/** Authenticated capabilities before the SDK admits and derives application caller context. */
+export interface AuthenticatedInvocation {
+    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
+    readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+    close(): void;
+}
+export interface InvocationAuthority {
+    admit(input: InvocationAdmissionInput): Promise<unknown>;
+    authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+}
+/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+export declare function authority(input: InvocationAuthority): InvocationAuthority;
+export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -0,0 +1,23 @@
+import { protocolError } from '../result/index.js';
+/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+export function authority(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+        invalid();
+    }
+    const receiver = Object.freeze({ ...input });
+    return Object.freeze({
+        admit: receiver.admit.bind(receiver),
+        authenticate: receiver.authenticate.bind(receiver),
+    });
+}
+export function requireVia(request) {
+    if (request.via === undefined) {
+        throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');
+    }
+    return request.via;
+}
+function invalid() {
+    throw new TypeError('Invocation authority is invalid.');
+}

package/dist/execution/invocation/admission/index.d.ts

@@ -0,0 +1,5 @@
+export { authority, requireVia } from './authority.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
+export { authentication, type InvocationAuthentication } from './authentication.js';
+export { input } from './input.js';
+export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -0,0 +1,4 @@
+export { authority, requireVia } from './authority.js';
+export { authentication } from './authentication.js';
+export { input } from './input.js';
+export { target } from './target.js';

package/dist/execution/invocation/admission/input.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedCallable } from '../../../application/action/index.js';
+export declare function input(callable: ResolvedCallable, value: unknown): void;

package/dist/execution/invocation/admission/input.js

@@ -0,0 +1,4 @@
+import { validateInput } from '../result/index.js';
+export function input(callable, value) {
+    validateInput(callable, value);
+}

package/dist/execution/invocation/admission/target.d.ts

@@ -0,0 +1,8 @@
+import type { NodePath } from '../../../platform/graph/path/index.js';
+import type { Key as SemanticKey } from '../../../platform/schema/index.js';
+export interface InvocationTarget {
+    readonly callable: SemanticKey.Callable;
+    readonly receiver?: NodePath;
+}
+/** Admit the portable target selected by the execution Identity owner. */
+export declare function target(input: unknown): InvocationTarget;

package/dist/execution/invocation/admission/target.js

@@ -0,0 +1,30 @@
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { NodePath as acceptNodePath } from '../../../platform/graph/path/index.js';
+import { InvocationDefect } from '../result/index.js';
+/** Admit the portable target selected by the execution Identity owner. */
+export function target(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const value = input;
+    if (!Object.hasOwn(value, 'callable') ||
+        Reflect.ownKeys(value).some((key) => key !== 'callable' && key !== 'receiver') ||
+        typeof value.callable !== 'string') {
+        invalid();
+    }
+    let callable;
+    let receiver;
+    try {
+        callable = Key(value.callable);
+        callableAddress(callable);
+        receiver = value.receiver === undefined ? undefined : acceptNodePath(value.receiver);
+    }
+    catch (cause) {
+        throw new InvocationDefect('INVOCATION_TARGET_INVALID', 'Invocation target is invalid.', {
+            cause,
+        });
+    }
+    return Object.freeze({ callable, ...(receiver === undefined ? {} : { receiver }) });
+}
+function invalid() {
+    throw new InvocationDefect('INVOCATION_TARGET_INVALID', 'Invocation target is invalid.');
+}

package/dist/execution/invocation/dependency/bind.d.ts

@@ -0,0 +1,5 @@
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+/** Bind each explicit authority to its admitted session; metadata remains inert. */
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>): HandlerDependencies<D>;

package/dist/execution/invocation/dependency/bind.js

@@ -0,0 +1,68 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { reference } from '../../../platform/client/session/index.js';
+import { NodeId } from '../../../platform/graph/node/index.js';
+import { Path } from '../../../platform/graph/path/index.js';
+/** Bind each explicit authority to its admitted session; metadata remains inert. */
+export function bindDependencies(domain, sessions) {
+    const dependencies = Object.create(null);
+    for (const [alias, dependency] of Object.entries(domain.dependencies)) {
+        if (dependency.origin === 'kernel.astrale.ai')
+            continue;
+        dependencies[alias] = Object.freeze({
+            caller: bindDependency(dependency, sessions.caller),
+            self: bindDependency(dependency, sessions.self),
+            union: bindDependency(dependency, sessions.union),
+        });
+    }
+    return Object.freeze(dependencies);
+}
+function bindDependency(dependency, session) {
+    const invoke = session.invoke.bind(session);
+    return Object.freeze({
+        async invoke(select, ...args) {
+            if (typeof select !== 'function')
+                invalid();
+            const selected = select(dependency);
+            if (selected === null ||
+                typeof selected !== 'object' ||
+                !('key' in selected) ||
+                typeof selected.key !== 'string')
+                invalid();
+            const callable = dependency.callable(selected.key);
+            if (callable !== selected || Key.origin(callable.key) !== dependency.origin)
+                invalid();
+            if ('owner' in callable && (!callable.executable || !ownMethod(dependency, callable)))
+                invalid();
+            if ('owner' in callable && !callable.static) {
+                if (args.length < 2 || args.length > 3 || typeof args[0] !== 'string')
+                    invalid();
+                const instance = Path.id(NodeId(args[0]));
+                return invoke(reference(dependency, callable)(instance), args[1], options(args[2]));
+            }
+            if (args.length < 1 || args.length > 2)
+                invalid();
+            return invoke(reference(dependency, callable), args[0], options(args[1]));
+        },
+    });
+}
+function ownMethod(domain, callable) {
+    const owner = Object.values(domain.classes).find((value) => value === callable.owner);
+    if (owner === undefined)
+        return false;
+    const methods = callable.static ? owner.self.static.methods : owner.self.methods;
+    return methods.get(callable.key) === callable;
+}
+function options(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        Reflect.ownKeys(value).some((key) => key !== 'timeoutMs' && key !== 'idempotencyKey'))
+        invalid();
+    // Canonical ClientSession admits option values and clamps them to the parent lifetime.
+    return value;
+}
+function invalid() {
+    throw new TypeError('Dependency invocation requires one owned executable callable, its input, and valid instance/options.');
+}

package/dist/execution/invocation/dependency/index.d.ts

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dependency/index.js

@@ -0,0 +1 @@
+export { bindDependencies } from './bind.js';

package/dist/execution/invocation/dispatch/action.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeAction } from '../../../application/runtime/actions.js';
+import type { DispatchContext } from './context.js';
+export declare function action(selected: RuntimeAction, context: DispatchContext): Promise<unknown>;

package/dist/execution/invocation/dispatch/action.js

@@ -0,0 +1,20 @@
+import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
+import { protocolError } from '../result/index.js';
+export async function action(selected, context) {
+    const complete = Object.freeze({
+        ...context,
+        error: declaredErrorFactory(selected.definition),
+    });
+    try {
+        return await selected.definition.run(complete);
+    }
+    catch (cause) {
+        const declared = declaredErrorOf(cause, selected.definition);
+        if (declared === undefined)
+            throw cause;
+        throw protocolError(declared.family, declared.message, {
+            code: declared.code,
+            details: declared.details,
+        });
+    }
+}

package/dist/execution/invocation/dispatch/context.d.ts

@@ -0,0 +1,23 @@
+import type { HandlerRequest } from '@astrale-os/kernel-server';
+import type { ActionExecution, Caller, DomainGraphExecutors, DomainKernelSessions } from '../../../application/action/index.js';
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
+import type { MutationExecutor } from '../../../application/mutation/index.js';
+import type { QueryExecutor } from '../../../application/query/index.js';
+import type { NodeId } from '../../../platform/graph/node/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+import type { InitializedRuntime } from '../../runtime/index.js';
+import type { InvocationAuthentication } from '../admission/index.js';
+export interface DispatchContext {
+    readonly domain: Domain;
+    readonly input: unknown;
+    readonly caller: Caller;
+    readonly dependencies: HandlerDependencies<Domain> | null;
+    readonly kernel: DomainKernelSessions | null;
+    readonly graph: DomainGraphExecutors | null;
+    readonly query?: QueryExecutor;
+    readonly mutate?: MutationExecutor;
+    readonly integrations: Readonly<Record<string, unknown>>;
+    readonly execution: ActionExecution;
+    readonly self?: NodeId;
+}
+export declare function context(request: HandlerRequest, runtime: InitializedRuntime, authentication: InvocationAuthentication, self: NodeId | undefined): DispatchContext;

package/dist/execution/invocation/dispatch/context.js

@@ -0,0 +1,64 @@
+import { bindMutation } from '../../../application/mutation/execution/executor.js';
+import { bindQuery } from '../../../application/query/execution/executor.js';
+import { bindDependencies } from '../dependency/index.js';
+import { clients } from '../integration/index.js';
+export function context(request, runtime, authentication, self) {
+    const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
+    const execution = Object.freeze({
+        signal: request.context.execution.signal,
+        deadline: request.context.execution.deadline,
+        ...(request.context.idempotencyKey === undefined
+            ? {}
+            : { idempotencyKey: request.context.idempotencyKey }),
+        background: request.context.background,
+        sleep: request.context.sleep,
+        ...(request.context.request === undefined ? {} : { request: request.context.request }),
+    });
+    return Object.freeze({
+        domain: runtime.loaded.domain,
+        input: request.call.input,
+        caller: authentication.caller,
+        kernel: authentication.graph === null
+            ? null
+            : Object.freeze({
+                ...authentication.graph.self,
+                ...authentication.graph,
+            }),
+        dependencies: authentication.graph === null
+            ? null
+            : bindDependencies(runtime.loaded.domain, authentication.graph),
+        graph,
+        ...(graph === null
+            ? {}
+            : {
+                query: graph.self.query,
+                mutate: graph.self.mutate,
+            }),
+        integrations: clients(runtime, request.context, authentication.graph === null
+            ? null
+            : {
+                caller: authentication.graph.caller,
+                self: authentication.graph.self,
+                ...(authentication.caller.authentication.expiresAt === undefined
+                    ? {}
+                    : {
+                        expiresAt: authentication.caller.authentication.expiresAt,
+                    }),
+            }),
+        execution,
+        ...(self === undefined ? {} : { self }),
+    });
+}
+function bindGraph(clients, domain) {
+    const bind = (client) => Object.freeze({
+        query: bindQuery(client, domain),
+        mutate: bindMutation(client, domain),
+    });
+    const self = bind(clients.self);
+    return Object.freeze({
+        ...self,
+        caller: bind(clients.caller),
+        self,
+        union: bind(clients.union),
+    });
+}

package/dist/execution/invocation/dispatch/index.d.ts

@@ -0,0 +1,5 @@
+export { action } from './action.js';
+export { context, type DispatchContext } from './context.js';
+export { receiver } from './receiver.js';
+export { requireSelected, select, type SelectedInvocation } from './select.js';
+export { workflow } from './workflow.js';

package/dist/execution/invocation/dispatch/index.js

@@ -0,0 +1,5 @@
+export { action } from './action.js';
+export { context } from './context.js';
+export { receiver } from './receiver.js';
+export { requireSelected, select } from './select.js';
+export { workflow } from './workflow.js';

package/dist/execution/invocation/dispatch/receiver.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedCallable } from '../../../application/action/index.js';
+import type { NodeId } from '../../../platform/graph/node/index.js';
+import type { InvocationTarget } from '../admission/target.js';
+export declare function receiver(callable: ResolvedCallable, target: InvocationTarget): NodeId | undefined;

package/dist/execution/invocation/dispatch/receiver.js

@@ -0,0 +1,18 @@
+import { NodeId as acceptNodeId } from '../../../platform/graph/node/index.js';
+import { Path } from '../../../platform/graph/path/index.js';
+import { InvocationDefect } from '../result/index.js';
+export function receiver(callable, target) {
+    const instance = 'owner' in callable && callable.static === false;
+    if (instance !== (target.receiver !== undefined)) {
+        throw new InvocationDefect('INVOCATION_TARGET_INVALID', instance
+            ? 'Instance Action or Workflow requires a receiver.'
+            : 'Receiver-free Action or Workflow forbids a receiver.');
+    }
+    if (target.receiver === undefined)
+        return undefined;
+    const path = Path.from(target.receiver);
+    if (!('id' in path)) {
+        throw new InvocationDefect('INVOCATION_TARGET_INVALID', 'Instance Action or Workflow receiver must be one canonical Node id.');
+    }
+    return acceptNodeId(path.id);
+}

package/dist/execution/invocation/dispatch/select.d.ts

@@ -0,0 +1,10 @@
+import type { RuntimeImplementation, RuntimeRegistry } from '../../../application/runtime/index.js';
+import type { NodeId } from '../../../platform/graph/node/index.js';
+import type { InvocationTarget } from '../admission/target.js';
+export interface SelectedInvocation {
+    readonly target: InvocationTarget;
+    readonly implementation: RuntimeImplementation;
+    readonly self?: NodeId;
+}
+export declare function select(registry: RuntimeRegistry, target: InvocationTarget): SelectedInvocation | undefined;
+export declare function requireSelected(registry: RuntimeRegistry, target: InvocationTarget): SelectedInvocation;

package/dist/execution/invocation/dispatch/select.js

@@ -0,0 +1,20 @@
+import { InvocationDefect } from '../result/index.js';
+import { receiver } from './receiver.js';
+export function select(registry, target) {
+    const implementation = registry.implementations.find(({ callable }) => callable.key === target.callable);
+    if (implementation === undefined)
+        return undefined;
+    const self = receiver(implementation.callable, target);
+    return Object.freeze({
+        target,
+        implementation,
+        ...(self === undefined ? {} : { self }),
+    });
+}
+export function requireSelected(registry, target) {
+    const selected = select(registry, target);
+    if (selected === undefined) {
+        throw new InvocationDefect('INVOCATION_HANDLER_INVALID', 'Invocation target has no local Action or Workflow implementation.');
+    }
+    return selected;
+}

package/dist/execution/invocation/dispatch/workflow.d.ts

@@ -0,0 +1,4 @@
+import type { RuntimeWorkflow } from '../../../application/runtime/workflows.js';
+import type { WorkflowRunner } from '../../../application/workflow/runner/index.js';
+import type { DispatchContext } from './context.js';
+export declare function workflow(selected: RuntimeWorkflow, context: DispatchContext, runner: WorkflowRunner): Promise<unknown>;

package/dist/execution/invocation/dispatch/workflow.js

@@ -0,0 +1,24 @@
+import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
+import { protocolError } from '../result/index.js';
+export async function workflow(selected, context, runner) {
+    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
+        throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
+    }
+    const complete = Object.freeze({
+        ...context,
+        caller: context.caller,
+        error: declaredErrorFactory(selected.definition),
+    });
+    try {
+        return await runner.run(selected.definition, complete);
+    }
+    catch (cause) {
+        const declared = declaredErrorOf(cause, selected.definition);
+        if (declared === undefined)
+            throw cause;
+        throw protocolError(declared.family, declared.message, {
+            code: declared.code,
+            details: declared.details,
+        });
+    }
+}

package/dist/execution/invocation/handler.d.ts

@@ -0,0 +1,7 @@
+import type { Handler } from '@astrale-os/kernel-server';
+import type { InvocationInput } from './invocation.js';
+export type HandlerInput = Omit<InvocationInput, 'workflows'> & {
+    readonly workflows?: InvocationInput['workflows'];
+};
+/** Compose one ready semantic Handler below Kernel Server transport ownership. */
+export declare function createHandler(input: HandlerInput): Handler;

package/dist/execution/invocation/handler.js

@@ -0,0 +1,37 @@
+import { createInlineWorkflowRunner } from '../../application/workflow/runner/index.js';
+import { authority } from './admission/index.js';
+import { invoke } from './invocation.js';
+import { projectError } from './result/index.js';
+/** Compose one ready semantic Handler below Kernel Server transport ownership. */
+export function createHandler(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (!Object.hasOwn(input, 'runtime') ||
+        !Object.hasOwn(input, 'authority') ||
+        Reflect.ownKeys(input).some((key) => key !== 'runtime' && key !== 'authority' && key !== 'workflows')) {
+        invalid();
+    }
+    const capturedAuthority = authority(input.authority);
+    const workflows = input.workflows ?? createInlineWorkflowRunner();
+    if (workflows === null || typeof workflows !== 'object' || typeof workflows.run !== 'function') {
+        invalid();
+    }
+    const capturedWorkflows = Object.freeze({ run: workflows.run.bind(workflows) });
+    return Object.freeze({
+        async dispatch(request) {
+            try {
+                return await invoke(request, {
+                    runtime: input.runtime,
+                    authority: capturedAuthority,
+                    workflows: capturedWorkflows,
+                });
+            }
+            catch (cause) {
+                throw projectError(cause);
+            }
+        },
+    });
+}
+function invalid() {
+    throw new TypeError('Invocation Handler input is invalid.');
+}

package/dist/execution/invocation/index.d.ts

@@ -0,0 +1,5 @@
+export { createHandler, type HandlerInput } from './handler.js';
+export { invoke, type InvocationInput } from './invocation.js';
+export type * from './admission/index.js';
+export { InvocationDefect, InvocationError } from './result/index.js';
+export type { InvocationDefectCode, InvocationErrorCode } from './result/index.js';

package/dist/execution/invocation/index.js

@@ -0,0 +1,3 @@
+export { createHandler } from './handler.js';
+export { invoke } from './invocation.js';
+export { InvocationDefect, InvocationError } from './result/index.js';

package/dist/execution/invocation/integration/authentication.d.ts

@@ -0,0 +1,5 @@
+import type { InvocationContext } from '@astrale-os/kernel-server';
+import type { IntegrationAuthentication } from '../../../application/integration/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+/** Capture only self mint, bounded by this invocation's verified credential horizon. */
+export declare function bindIntegrationAuthentication(context: InvocationContext, self: BoundClientSession, expiresAt?: number): IntegrationAuthentication;