@astrale-os/sdk 0.5.0-beta.98 → 0.6.0-beta.0

package/dist/deployment/adapter/index.js

@@ -1 +1 @@
-export { defineAdapter, isAdapter } from './define.js';
+export { defineAdapter, defineDeployment, isAdapter } from './define.js';

package/dist/deployment/adapter/prepare/context.d.ts

@@ -1,15 +1,23 @@
 import type { Build } from '../../build/index.js';
 import type { ResolvedRuntimeReference } from '../../runtime/index.js';
+import type { InstallationTarget } from '../adapter.js';
 export interface PrepareContext<BuildValue extends Build = Build> {
     readonly projectDir: string;
     readonly environment: string;
+    readonly installation?: InstallationTarget;
     /**
-     * Preparation purpose. Development may omit immutable frontend output because
-     * the live provider serves the declared frontend source directly; release
-     * preparation must remain complete. Omitted by older custom callers means
-     * release for compatibility.
+     * Preparation purpose. Remote development and one-shot deployment both
+     * prepare complete release artifacts. Omitted by older custom callers means
+     * release for compatibility during the beta migration.
      */
-    readonly mode?: 'development' | 'release';
+    readonly mode?: 'release';
+    /**
+     * Optional preparation-input observer used by tooling that must rebuild when
+     * an adapter reads authored paths outside the Application/Runtime module graph.
+     */
+    readonly recordSource?: (path: string) => void;
+    /** Parent-owned lifecycle cancellation shared by every preparation process/effect. */
+    readonly signal: AbortSignal;
     readonly build: BuildValue;
     readonly runtime: ResolvedRuntimeReference;
 }

package/dist/deployment/authoring.d.ts

@@ -1,5 +1,5 @@
 export { deploy } from './deploy.js';
-export type { DeploymentInput } from './deploy.js';
+export type { DeploymentInput, LegacyDeployment } from './deploy.js';
 export type { Deployment } from './deployment.js';
 export { runtime } from './runtime/index.js';
 export type { RuntimeReference } from './runtime/index.js';

package/dist/deployment/build/compile.js

@@ -54,24 +54,26 @@ function compileRequirements(domain, input, sourceBundle) {
             throw new TypeError('Class requirement is absent from the dependency closure.');
         }
     }
-    for (const profile of input?.profiles ?? []) {
-        const subject = domain.core.nodes[profile.subject.name];
-        if (profile.subject.origin !== domain.origin || subject === undefined) {
-            throw new TypeError('Capability profile subject must name one local Core Node.');
+    for (const requirement of input?.core ?? []) {
+        const subject = domain.core.nodes[requirement.subject.name];
+        if (requirement.subject.origin !== domain.origin || subject === undefined) {
+            throw new TypeError('Core capability subject must name one local Core Node.');
         }
-        for (const key of profile.functions) {
-            requireDirectDependency(domain, key, 'Capability profile Function');
+        for (const key of requirement.functions) {
+            if (Key.origin(key) !== domain.origin) {
+                requireDirectDependency(domain, key, 'Core capability Function');
+            }
             if (domain.callable(key) === undefined) {
-                throw new TypeError(`Capability profile Function ${key} is absent from the dependency closure.`);
+                throw new TypeError(`Core capability Function ${key} is absent from the dependency closure.`);
             }
         }
-        for (const requirement of profile.classes) {
-            const key = Key.of(requirement.class);
-            if (requirement.class.origin !== domain.origin) {
-                requireDirectDependency(domain, key, 'Capability profile Class');
+        for (const classRequirement of requirement.classes) {
+            const key = Key.of(classRequirement.class);
+            if (classRequirement.class.origin !== domain.origin) {
+                requireDirectDependency(domain, key, 'Core capability Class');
             }
-            if (domain.definition(requirement.class) === undefined) {
-                throw new TypeError('Capability profile Class is absent from the dependency closure.');
+            if (domain.definition(classRequirement.class) === undefined) {
+                throw new TypeError('Core capability Class is absent from the dependency closure.');
             }
         }
     }
@@ -82,14 +84,14 @@ function compileRequirements(domain, input, sourceBundle) {
                 : { functions: input.functions }),
             ...(input === undefined || input.classes.length === 0 ? {} : { classes: input.classes }),
             ...(input?.authority === undefined ? {} : { authority: input.authority }),
-            ...(input === undefined || input.profiles.length === 0
+            ...(input === undefined || input.core.length === 0
                 ? {}
                 : {
-                    profiles: input.profiles.map((profile) => ({
-                        subject: profile.subject,
-                        ...(profile.functions.length === 0 ? {} : { functions: profile.functions }),
-                        ...(profile.classes.length === 0 ? {} : { classes: profile.classes }),
-                        ...(profile.authority === undefined ? {} : { authority: profile.authority }),
+                    core: input.core.map((requirement) => ({
+                        subject: requirement.subject,
+                        ...(requirement.functions.length === 0 ? {} : { functions: requirement.functions }),
+                        ...(requirement.classes.length === 0 ? {} : { classes: requirement.classes }),
+                        ...(requirement.authority === undefined ? {} : { authority: requirement.authority }),
                     })),
                 }),
         },

package/dist/deployment/build/frontend/compilation.d.ts

@@ -1,5 +1,5 @@
 import type { Frontend, FrontendSource } from '../../../application/view/index.js';
-import type { FrontendHandshake, IframeRequirements } from '../../../application/view/index.js';
+import type { FrontendHandshake, IframeRequirements, ViewHostRequirements } from '../../../application/view/index.js';
 import type { Key, ViewRef } from '../../../platform/schema/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 export interface CompiledFrontendRoute {
@@ -8,6 +8,7 @@ export interface CompiledFrontendRoute {
     readonly document: string;
     readonly handshake: FrontendHandshake;
     readonly iframe?: IframeRequirements;
+    readonly host?: ViewHostRequirements;
 }
 export interface FrontendCompilation {
     readonly source: FrontendSource;

package/dist/deployment/build/frontend/compilation.js

@@ -16,6 +16,7 @@ export function compileFrontend(frontend, domain) {
             document: route.document,
             handshake: route.handshake,
             ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
+            ...(route.host === undefined ? {} : { host: route.host }),
         });
     });
     const entrypoint = domain.views[frontend.entrypoint];

package/dist/deployment/build/material.js

@@ -113,20 +113,20 @@ function acceptGeneratedMaterial(input, runtime) {
     const format = input?.format;
     const version = input?.version;
     const material = input?.material;
-    const digest = input?.digest;
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
         format !== 'astrale.sdk.generated-build-material' ||
         version !== 1 ||
-        Reflect.ownKeys(input).some((key) => key !== 'format' && key !== 'version' && key !== 'material' && key !== 'digest') ||
-        digestOf(material) !== digest) {
+        Reflect.ownKeys(input).some((key) => key !== 'format' && key !== 'version' && key !== 'material' && key !== 'digest')) {
         invalid();
     }
     assertMaterialEnvelope(material, runtime);
-    const accepted = deepFreeze({ material });
+    // One traversal seals the whole envelope. `input.material` is the exact `material` value and
+    // every other admitted key holds a primitive, so a second pass would re-walk an already frozen
+    // graph: on a real Domain that is one redundant traversal of every `schema.compiled` node.
     deepFreeze(input);
-    return accepted;
+    return Object.freeze({ material });
 }
 function digestOf(input) {
     try {

package/dist/deployment/deploy.d.ts

@@ -1,14 +1,20 @@
 import type { ApplicationIdentity } from '../application/index.js';
 import type { Adapter } from './adapter/index.js';
-import type { Deployment } from './deployment.js';
 import type { RuntimeReference } from './runtime/index.js';
 type CanonicalAdapter<Value> = Value extends Adapter<infer _Parameters> ? Value : never;
+/** @deprecated Declare Application and Environments directly in defineProject(). */
 export interface DeploymentInput<ApplicationValue extends ApplicationIdentity, AdapterValue extends object> {
     readonly application: ApplicationValue;
     readonly entrypoint: RuntimeReference;
     readonly adapter: CanonicalAdapter<AdapterValue>;
 }
-/** Capture one inert Application, Runtime module reference, and provider Adapter declaration. */
-export declare function deploy<const ApplicationValue extends ApplicationIdentity, const AdapterValue extends object>(input: DeploymentInput<ApplicationValue, AdapterValue>): Deployment<ApplicationValue, AdapterValue>;
-export declare function isDeployment(input: unknown): input is Deployment;
+/** @deprecated Legacy aggregate retained only so tooling can issue an exact migration diagnostic. */
+export interface LegacyDeployment<ApplicationValue extends ApplicationIdentity = ApplicationIdentity, AdapterValue extends object = object> {
+    readonly application: ApplicationValue;
+    readonly entrypoint: RuntimeReference;
+    readonly adapter: AdapterValue;
+}
+/** @deprecated Declare Application and Environments directly in defineProject(). */
+export declare function deploy<const ApplicationValue extends ApplicationIdentity, const AdapterValue extends object>(input: DeploymentInput<ApplicationValue, AdapterValue>): LegacyDeployment<ApplicationValue, AdapterValue>;
+export declare function isLegacyDeployment(input: unknown): input is LegacyDeployment;
 export {};

package/dist/deployment/deploy.js

@@ -1,8 +1,8 @@
 import { isApplication } from '../application/index.js';
 import { isAdapter } from './adapter/index.js';
 import { isRuntimeReference } from './runtime/index.js';
-const admittedDeployments = new WeakSet();
-/** Capture one inert Application, Runtime module reference, and provider Adapter declaration. */
+const legacyDeployments = new WeakSet();
+/** @deprecated Declare Application and Environments directly in defineProject(). */
 export function deploy(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
@@ -20,11 +20,11 @@ export function deploy(input) {
     if (!isAdapter(input.adapter))
         throw new TypeError('Deployment Adapter is not admitted.');
     const deployment = Object.freeze({ ...input });
-    admittedDeployments.add(deployment);
+    legacyDeployments.add(deployment);
     return deployment;
 }
-export function isDeployment(input) {
-    return input !== null && typeof input === 'object' && admittedDeployments.has(input);
+export function isLegacyDeployment(input) {
+    return input !== null && typeof input === 'object' && legacyDeployments.has(input);
 }
 function invalid() {
     throw new TypeError('Deployment must contain exactly application, entrypoint, and adapter.');

package/dist/deployment/deployment.d.ts

@@ -1,6 +1,9 @@
-import type { RuntimeReference } from './runtime/index.js';
-export interface Deployment<ApplicationValue extends object = object, AdapterValue extends object = object> {
-    readonly application: ApplicationValue;
-    readonly entrypoint: RuntimeReference;
-    readonly adapter: AdapterValue;
+import type { Adapter } from './adapter/index.js';
+export interface Deployment<Parameters extends object = object> {
+    readonly kind: 'deployment';
+    readonly adapter: Adapter<Parameters>;
+    readonly parameters: Parameters;
 }
+/** Internal adapter binding boundary used by public provider packages. */
+export declare function captureDeployment<const Parameters extends object>(adapter: Adapter<Parameters>, parameters: Parameters): Deployment<Parameters>;
+export declare function isDeployment(input: unknown): input is Deployment;

package/dist/deployment/deployment.js

@@ -1 +1,10 @@
-export {};
+const deployments = new WeakSet();
+/** Internal adapter binding boundary used by public provider packages. */
+export function captureDeployment(adapter, parameters) {
+    const value = Object.freeze({ kind: 'deployment', adapter, parameters });
+    deployments.add(value);
+    return value;
+}
+export function isDeployment(input) {
+    return input !== null && typeof input === 'object' && deployments.has(input);
+}

package/dist/deployment/index.d.ts

@@ -1,9 +1,10 @@
-export { defineAdapter, isAdapter } from './adapter/index.js';
-export type { Adapter, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DevelopmentContext, DevelopmentInput, DevelopmentOverrides, DevelopmentPlacement, DevelopmentSession, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, } from './adapter/index.js';
+export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
+export type { Adapter, AdapterEnvironmentContext, AdapterInput, AddressingPlan, ArtifactFile, ArtifactSource, DeployContext, DeploymentPhase, DeploymentProgress, DeployResult, FailedDeployResult, MutationKnowledge, PreparedArtifact, PreparedArtifactFile, PrepareContext, ReadyDeployResult, InstallationTarget, } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
 export type { Build, BuildBundle, BuildSchema } from './build/index.js';
-export { deploy, isDeployment } from './deploy.js';
-export type { DeploymentInput } from './deploy.js';
+export { deploy } from './deploy.js';
+export type { DeploymentInput, LegacyDeployment } from './deploy.js';
+export { isDeployment } from './deployment.js';
 export type { Deployment } from './deployment.js';
 export { addressing, assemble, isAddressing, isRelease } from './release/index.js';
 export type { Addressing, Release } from './release/index.js';

package/dist/deployment/index.js

@@ -1,6 +1,7 @@
-export { defineAdapter, isAdapter } from './adapter/index.js';
+export { defineAdapter, defineDeployment, isAdapter } from './adapter/index.js';
 export { compile, isBuild } from './build/index.js';
-export { deploy, isDeployment } from './deploy.js';
+export { deploy } from './deploy.js';
+export { isDeployment } from './deployment.js';
 export { addressing, assemble, isAddressing, isRelease } from './release/index.js';
 export { admit as admitRuntime, resolve as resolveRuntime, runtime } from './runtime/index.js';
 export { verifyDeployment, verifyPreflight, verifyReadiness } from './verify/index.js';

package/dist/deployment/release/addressing.d.ts

@@ -1,7 +1,11 @@
 import type { IssuerId } from '../../platform/auth/index.js';
-/** Intended serving identity, independent of how a provider obtains it. */
+/** Stable Domain identity and public placement, independent of how a provider obtains them. */
 export interface Addressing {
     readonly issuer: IssuerId;
+    /** Public origin serving this Release; the issuer can remain on an older deployment. */
+    readonly publicUrl: IssuerId;
 }
-export declare function addressing(input: string): Addressing;
+export declare function addressing(input: string, options?: {
+    readonly publicUrl?: string;
+}): Addressing;
 export declare function isAddressing(input: unknown): input is Addressing;

package/dist/deployment/release/addressing.js

@@ -1,6 +1,13 @@
 import { issuer } from '../../platform/auth/index.js';
 const admittedAddressing = new WeakSet();
-export function addressing(input) {
+export function addressing(input, options = {}) {
+    const admitted = origin(input);
+    const publicUrl = options.publicUrl === undefined ? admitted : origin(options.publicUrl);
+    const value = Object.freeze({ issuer: admitted, publicUrl });
+    admittedAddressing.add(value);
+    return value;
+}
+function origin(input) {
     let admitted;
     let url;
     try {
@@ -18,9 +25,7 @@ export function addressing(input) {
         url.hash !== '') {
         throw new TypeError('Addressing issuer must be an origin-only absolute HTTP(S) issuer.');
     }
-    const value = Object.freeze({ issuer: admitted });
-    admittedAddressing.add(value);
-    return value;
+    return admitted;
 }
 export function isAddressing(input) {
     return input !== null && typeof input === 'object' && admittedAddressing.has(input);

package/dist/deployment/release/publication/callables.js

@@ -2,7 +2,7 @@ import * as publication from '@astrale-os/kernel-protocol/publication';
 import { invocationPath } from '../invocation.js';
 export function callables(build, addressing) {
     const endpoint = publication.acceptInvocationEndpoints({
-        http: new URL(invocationPath(), addressing.issuer).href,
+        http: new URL(invocationPath(), addressing.publicUrl).href,
     });
     return Object.freeze(build.callables.map((callable) => Object.freeze({ callable, endpoint })));
 }

package/dist/deployment/release/publication/index.d.ts

@@ -2,5 +2,5 @@ export { callables } from './callables.js';
 export { manifest } from './manifest.js';
 export { requirements } from './requirements.js';
 export { routes } from './routes.js';
-export { BUNDLE_PATH, seal, type SealedPublication } from './seal.js';
+export { seal, type SealedPublication } from './seal.js';
 export { views } from './views.js';

package/dist/deployment/release/publication/index.js

@@ -2,5 +2,5 @@ export { callables } from './callables.js';
 export { manifest } from './manifest.js';
 export { requirements } from './requirements.js';
 export { routes } from './routes.js';
-export { BUNDLE_PATH, seal } from './seal.js';
+export { seal } from './seal.js';
 export { views } from './views.js';

package/dist/deployment/release/publication/routes.js

@@ -1,4 +1,4 @@
 import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
 export function routes(build, addressing) {
-    return protocolRoutes.place(build.routes, addressing.issuer);
+    return protocolRoutes.place(build.routes, addressing.publicUrl);
 }

package/dist/deployment/release/publication/seal.d.ts

@@ -2,7 +2,6 @@ import * as publication from '@astrale-os/kernel-protocol/publication';
 import * as protocolRoutes from '@astrale-os/kernel-protocol/routes';
 import type { Build } from '../../build/index.js';
 import type { Addressing } from '../addressing.js';
-export declare const BUNDLE_PATH: '/.well-known/astrale/domain.bundle.json';
 export declare const DELIVERY_PATH: '/install';
 export interface SealedPublication {
     readonly publication: publication.Publication;

package/dist/deployment/release/publication/seal.js

@@ -6,20 +6,19 @@ import { manifest } from './manifest.js';
 import { requirements } from './requirements.js';
 import { routes } from './routes.js';
 import { views } from './views.js';
-export const BUNDLE_PATH = '/.well-known/astrale/domain.bundle.json';
 export const DELIVERY_PATH = '/install';
 export function seal(build, addressing) {
     const root = build.schema.compiled.root;
     const selectedManifest = manifest(build);
     const sealed = publication.seal({
         format: 'astrale.domain.publication',
-        version: 2,
+        version: 3,
         origin: root.origin,
         identity: { issuer: addressing.issuer, subject: root.origin },
         schema: {
             revision: root.revision,
             bundle: {
-                href: new URL(BUNDLE_PATH, addressing.issuer).href,
+                href: publication.bundleUrl(addressing.publicUrl, build.schema.bundle.ref),
                 ref: build.schema.bundle.ref,
             },
         },
@@ -29,12 +28,12 @@ export function seal(build, addressing) {
             callables: callables(build, addressing),
             views: views(build, addressing),
         },
-        delivery: publication.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.issuer, new URL(BUNDLE_PATH, addressing.issuer).href),
+        delivery: publication.placeDelivery({ path: DELIVERY_PATH, authentication: { kind: 'public' } }, addressing.publicUrl, publication.bundleUrl(addressing.publicUrl, build.schema.bundle.ref)),
         routes: routes(build, addressing),
     });
     const { domain } = evidenceOf(build);
     return Object.freeze({
         publication: sealed,
-        routes: protocolRoutes.bind(build.routes, sealed, domain),
+        routes: protocolRoutes.bind(build.routes, sealed, domain, addressing.publicUrl),
     });
 }

package/dist/deployment/release/publication/views.js

@@ -3,11 +3,12 @@ export function views(build, addressing) {
         return Object.freeze([]);
     const base = build.frontend.source.kind === 'external'
         ? `${build.frontend.source.origin}/`
-        : `${addressing.issuer.replace(/\/+$/u, '')}/`;
+        : `${addressing.publicUrl.replace(/\/+$/u, '')}/`;
     return Object.freeze(build.frontend.routes.map((route) => Object.freeze({
         view: route.view,
         href: new URL(route.path.replace(/^\//u, ''), base).href,
         handshake: route.handshake,
         ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
+        ...(route.host === undefined ? {} : { host: route.host }),
     })));
 }

package/dist/deployment/verify/preflight/artifact.js

@@ -89,7 +89,7 @@ function evidenceBytes(build, source) {
             bundle: build.schema.bundle.ref.digest,
             entrypoint: source.entrypoint,
             addressing: source.addressing.kind === 'configured'
-                ? { kind: 'configured', issuer: source.addressing.addressing.issuer }
+                ? { kind: 'configured', ...source.addressing.addressing }
                 : source.addressing,
         })),
     ];

package/dist/deployment/verify/readiness/deployment.js

@@ -50,7 +50,8 @@ function verifyRelease(artifact, release) {
         throw new TypeError('DeployResult Release differs from the PreparedArtifact Build.');
     }
     if (artifact.addressing.kind === 'configured' &&
-        release.addressing.issuer !== artifact.addressing.addressing.issuer) {
+        (release.addressing.issuer !== artifact.addressing.addressing.issuer ||
+            release.addressing.publicUrl !== artifact.addressing.addressing.publicUrl)) {
         throw new TypeError('DeployResult Release differs from configured Addressing.');
     }
     return release;
@@ -102,7 +103,7 @@ function terminal(input) {
 function providerEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    exact(input, ['provider', 'deployment', 'artifact'], ['issuer']);
+    exact(input, ['provider', 'deployment', 'artifact'], ['issuer', 'preflight']);
     if (typeof input.provider !== 'string' ||
         input.provider.length === 0 ||
         input.provider.trim() !== input.provider ||
@@ -110,7 +111,10 @@ function providerEvidence(input) {
         input.deployment.length === 0 ||
         input.deployment.trim() !== input.deployment ||
         typeof input.artifact !== 'string' ||
-        (input.issuer !== undefined && typeof input.issuer !== 'string')) {
+        (input.issuer !== undefined && typeof input.issuer !== 'string') ||
+        (input.preflight !== undefined &&
+            input.preflight !== 'passed' &&
+            input.preflight !== 'unavailable')) {
         invalid();
     }
     return Object.freeze({ ...input });

package/dist/deployment/verify/readiness/identity.js

@@ -21,7 +21,7 @@ async function json(fetcher, url, signal) {
         throw new Error(`GET ${url} exceeded ${MAXIMUM_IDENTITY_BYTES} bytes.`);
     }
     try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes));
     }
     catch (cause) {
         throw new Error(`GET ${url} returned invalid JSON.`, { cause });

package/dist/deployment/verify/readiness/publication.js

@@ -4,7 +4,7 @@ const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
 /** Fetch and verify the exact live Publication and Bundle for one Release. */
 export async function verifyPublication(release, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const publicationUrl = publication.url(release.addressing.issuer);
+    const publicationUrl = publication.url(release.addressing.publicUrl);
     const response = await fetchRequired(fetcher, publicationUrl, options.signal);
     const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_PUBLICATION_BYTES)));
     if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
@@ -33,7 +33,7 @@ async function bounded(response, url, maximum) {
 async function text(response, url, maximum) {
     const bytes = await bounded(response, url, maximum);
     try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes);
     }
     catch (cause) {
         throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });

package/dist/execution/identity/authentication.js

@@ -66,7 +66,6 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
     let closed = false;
     return Object.freeze({
         caller: established.caller,
-        client: graph.caller,
         graph,
         close() {
             if (closed)

package/dist/execution/identity/exchange.d.ts

@@ -3,6 +3,7 @@ import type { IssuerId } from '../../platform/auth/index.js';
 import type { IdentityNetworkPolicy, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 export interface ExchangeOptions {
+    /** Caller-only exchange ceiling in seconds. Defaults to 30 minutes. */
     readonly maximumTtlSeconds?: number;
 }
 export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;

package/dist/execution/identity/exchange.js

@@ -6,7 +6,7 @@ import { protocolError } from '../invocation/result/index.js';
 import { acceptResolvedDelegation } from './authentication.js';
 import { CredentialRejected, IssuerUnavailable } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_MAXIMUM_TTL_SECONDS = 300;
+const DEFAULT_MAXIMUM_TTL_SECONDS = 30 * 60;
 export function maximumExchangeTtl(input) {
     if (input === undefined)
         return DEFAULT_MAXIMUM_TTL_SECONDS;

package/dist/execution/identity/jwks.js

@@ -244,7 +244,7 @@ async function json(response, signal) {
         throw new CredentialRejected('Issuer discovery document exceeds its byte limit.');
     }
     try {
-        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true, ignoreBOM: false }).decode(bytes));
     }
     catch (cause) {
         throw new CredentialRejected('Issuer discovery document is invalid.', cause);

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,14 +1,17 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
+import type { AnonymousCaller, AuthenticatedCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Release } from '../../../deployment/release/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
     readonly caller: AnonymousCaller;
-    readonly client: null;
     readonly kernel: null;
     readonly graph: null;
     close(): void;
 }
-export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+interface AdmittedAuthenticatedInvocation extends Omit<AuthenticatedInvocation, 'caller'> {
+    readonly caller: AuthenticatedCaller;
+}
+export type InvocationAuthentication = AnonymousInvocation | AdmittedAuthenticatedInvocation;
 export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+export {};

package/dist/execution/invocation/admission/authentication.js

@@ -5,7 +5,6 @@ import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
 const ANONYMOUS = Object.freeze({
     caller: Object.freeze({ kind: 'anonymous' }),
-    client: null,
     kernel: null,
     graph: null,
     close() { },
@@ -32,20 +31,18 @@ export async function authentication(callable, request, release, domain, authori
         if (authenticated === null ||
             typeof authenticated !== 'object' ||
             Array.isArray(authenticated) ||
-            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'client' && key !== 'graph' && key !== 'close') ||
+            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'graph' && key !== 'close') ||
             close === undefined) {
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
         const graphInput = admitGraph(authenticated.graph);
-        if (authenticated.client !== graphInput.caller)
-            invalid();
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
             union: bindSession(graphInput.union),
         });
-        return Object.freeze({ caller, client: graph.caller, graph, close });
+        return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
         if (close === undefined)
@@ -91,7 +88,20 @@ function admitCaller(input) {
     const principal = NodeId(Reflect.get(input, 'principal'));
     const authority = grant.accept(Reflect.get(input, 'authority'));
     const authentication = admitEvidence(Reflect.get(input, 'authentication'));
-    return Object.freeze({ kind: 'authenticated', principal, authority, authentication });
+    const caller = {
+        kind: 'authenticated',
+        get identity() {
+            if (authority.expr.kind !== 'identity') {
+                throw new TypeError('Caller authority does not resolve to one exact Identity.');
+            }
+            return authority.expr.id;
+        },
+        principal,
+        authority,
+        authentication,
+    };
+    Object.defineProperty(caller, 'identity', { enumerable: false });
+    return Object.freeze(caller);
 }
 function admitEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))

package/dist/execution/invocation/admission/authority.d.ts

@@ -19,9 +19,9 @@ export interface InvocationAuthenticationInput {
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
+/** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
-    readonly caller: AuthenticatedCaller;
-    readonly client: BoundClientSession;
+    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
     readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
     close(): void;
 }

package/dist/execution/invocation/dependency/bind.d.ts

@@ -0,0 +1,5 @@
+import type { HandlerDependencies } from '../../../application/dependency/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+/** Bind each explicit authority to its admitted session; metadata remains inert. */
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>): HandlerDependencies<D>;