@astrale-os/sdk 0.6.0-beta.12 → 0.6.0-beta.14

package/dist/deployment/verify/readiness/identity.js

@@ -1,10 +1,10 @@
 import { issuer } from '@astrale-os/kernel-protocol';
 const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
 /** Verify issuer discovery and at least one admitted signing key at the serving identity. */
-export async function verifyIdentity(addressing, options = {}) {
+export async function verifyIdentity(serving, options = {}) {
     const fetcher = options.fetch ?? globalThis.fetch;
-    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
-    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const configurationUrl = new URL(issuer.paths(serving).configuration, serving);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), serving);
     const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
     if (keys.keys.length === 0)
         throw new Error('Serving issuer publishes no signing keys.');

package/dist/deployment/verify/readiness/index.d.ts

@@ -1,10 +1,14 @@
-import type { Release } from '../../release/legacy/index.js';
-import type { ReadinessFetch } from './publication.js';
+import type { Release } from '../../release/index.js';
+import type * as legacy from '../../release/legacy/index.js';
+import type { ReadinessOptions } from './fetch.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication, type ReadinessFetch } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
-export declare function readiness(release: Release, options?: {
-    readonly fetch?: ReadinessFetch;
-    readonly signal?: AbortSignal;
-}): Promise<void>;
+export type { ReadinessFetch, ReadinessOptions } from './fetch.js';
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
+export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,10 +1,21 @@
 import { verifyIdentity } from './identity.js';
-import { verifyPublication } from './publication.js';
+import { verifyPublication } from './legacy/index.js';
+import { verifyRelease } from './release.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
 export async function readiness(release, options = {}) {
+    if (release.kind === 'release') {
+        await verifyRelease(release, options);
+        await verifyIdentity(release.url, options);
+        return;
+    }
     await verifyPublication(release, options);
-    await verifyIdentity(release.addressing, options);
+    await verifyIdentity(release.addressing.issuer, options);
 }

package/dist/deployment/verify/readiness/legacy/index.d.ts

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/index.js

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/publication.d.ts

@@ -0,0 +1,12 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type * as legacy from '../../../release/legacy/index.js';
+import type { ReadinessOptions } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare and adapter-astrale (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export declare function verifyPublication(release: legacy.Release, options?: ReadinessOptions): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/legacy/publication.js

@@ -0,0 +1,23 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare and adapter-astrale (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.publicUrl);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/deployment/verify/readiness/release.d.ts

@@ -0,0 +1,8 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Release } from '../../release/index.js';
+import type { ReadinessOptions } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export declare function verifyRelease(expected: Release, options?: ReadinessOptions): Promise<release.DomainRelease>;

package/dist/deployment/verify/readiness/release.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export async function verifyRelease(expected, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const releaseUrl = release.url(expected.url);
+    const response = await fetchRequired(fetcher, releaseUrl, options.signal);
+    const deployed = release.accept(JSON.parse(await text(response, releaseUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!release.matchesReference(deployed, release.reference(expected.document))) {
+        throw new Error('Live release differs from the expected Release.');
+    }
+    if (deployed.build.digest !== expected.buildDigest) {
+        throw new Error('Live release build digest differs from the expected build.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    release.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/execution/identity/authentication.d.ts

@@ -1,10 +1,17 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
+import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
 import type { AuthenticatedInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 import { ClientSession } from '../../platform/client/session/index.js';
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export declare const DEFAULT_ROUTE_AGE_MS = 60000;
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
     readonly issuer: IssuerId;
@@ -26,5 +33,6 @@ export declare function executorSession(kernel: IssuerId, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): ClientSession;
-export declare function acceptResolvedDelegation(input: unknown): Grant;
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
+export declare function acceptResolvedDelegation(input: unknown): IdentityId;
 export type { VerificationBasis };

package/dist/execution/identity/authentication.js

@@ -10,7 +10,13 @@ import { projectError, protocolError } from '../invocation/result/index.js';
 import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, selfIdentity, signDomainCallback, } from './callback.js';
 import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, httpIssuer, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export const DEFAULT_ROUTE_AGE_MS = 60_000;
 export async function admit(request, configuration) {
     const execution = request.context.execution;
     requireLive(execution);
@@ -54,12 +60,10 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
     const sessions = Object.freeze({
         caller: session(expressions.caller),
         self: session(expressions.self),
-        union: session(expressions.union),
     });
     const graph = Object.freeze({
         caller: bindSession(sessions.caller, execution),
         self: bindSession(sessions.self, execution),
-        union: bindSession(sessions.union, execution),
     });
     let closed = false;
     return Object.freeze({
@@ -71,7 +75,6 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
             closed = true;
             sessions.caller.close();
             sessions.self.close();
-            sessions.union.close();
         },
     });
 }
@@ -122,7 +125,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         if (proof.verified.sub !== context.verified.sub) {
             throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
         }
-        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
+        const identity = acceptResolvedDelegation(proof.verified.claims.delegation);
         let principal;
         try {
             principal = NodeId(context.verified.sub);
@@ -136,7 +139,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             caller: Object.freeze({
                 kind: 'authenticated',
                 principal,
-                authority,
+                identity,
                 authentication: credential.evidence(context),
             }),
         });
@@ -147,6 +150,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             throw protocolError('BACKEND_UNAVAILABLE', 'Credential issuer is unavailable.');
         }
         if (cause instanceof CredentialRejected ||
+            cause instanceof AuthValueError ||
             cause instanceof joseErrors.JOSEError ||
             cause instanceof protocolErrors.ProtocolError) {
             throw protocolError('AUTH_INVALID', 'Credential is invalid.');
@@ -154,6 +158,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         throw cause;
     }
 }
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
 export function acceptResolvedDelegation(input) {
     if (input === null ||
         typeof input !== 'object' ||
@@ -164,5 +169,14 @@ export function acceptResolvedDelegation(input) {
         Reflect.get(input, 'v') !== 1) {
         throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected resolved delegation.');
     }
-    return grant.accept({ expr: Reflect.get(input, 'expr') });
+    const raw = Reflect.get(input, 'expr');
+    // grant.accept collapses duplicate operands (union(X, X) becomes X), so the leaf is checked as sent.
+    if (raw === null || typeof raw !== 'object' || Reflect.get(raw, 'kind') !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    const { expr } = grant.accept({ expr: raw });
+    if (expr.kind !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    return expr.id;
 }

package/dist/execution/identity/callback.d.ts

@@ -7,13 +7,13 @@ export interface SignedCallback {
     readonly expiresAt: number;
     readonly delegateTtlSeconds: number;
 }
-export type CallbackGrantMode = 'caller' | 'self' | 'union';
+export type CallbackMode = 'caller' | 'self';
 /** The Domain's own authority, independent of any caller. */
 export declare const selfIdentity: Readonly<{
     kind: 'identity';
     self: true;
 }>;
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export declare function callbackIdentities(nested: string | Uint8Array): Readonly<{
     caller: Readonly<{
         kind: 'identity';
@@ -23,16 +23,6 @@ export declare function callbackIdentities(nested: string | Uint8Array): Readonl
         kind: 'identity';
         self: true;
     }>;
-    union: Readonly<{
-        kind: 'union';
-        operands: readonly (Readonly<{
-            kind: 'identity';
-            self: true;
-        }> | Readonly<{
-            kind: 'identity';
-            credential: string | Uint8Array<ArrayBufferLike>;
-        }>)[];
-    }>;
 }>;
 export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
     readonly deadline: number;

package/dist/execution/identity/callback.js

@@ -6,17 +6,11 @@ export const maximumCallbackDelegationTtlSeconds = 60;
 const CALLBACK_DELEGATION_SKEW_SECONDS = 5;
 /** The Domain's own authority, independent of any caller. */
 export const selfIdentity = Object.freeze({ kind: 'identity', self: true });
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export function callbackIdentities(nested) {
-    const caller = Object.freeze({ kind: 'identity', credential: nested });
-    const self = selfIdentity;
     return Object.freeze({
-        caller,
-        self,
-        union: Object.freeze({
-            kind: 'union',
-            operands: Object.freeze([self, caller]),
-        }),
+        caller: Object.freeze({ kind: 'identity', credential: nested }),
+        self: selfIdentity,
     });
 }
 export async function signDomainCallback(signing, issuer, subject, audience, execution) {

package/dist/execution/identity/delivery.d.ts

@@ -1,6 +1,13 @@
-import type { publication as serverPublication } from '@astrale-os/kernel-server';
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type { release as serverRelease } from '@astrale-os/kernel-server';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;
+type Served = release.DomainRelease | release.legacy.Publication;
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
+export {};

package/dist/execution/identity/delivery.js

@@ -1,34 +1,61 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export function publicationDelivery(signing, issuer, subject, deployed) {
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export function releaseDelivery(signing, issuer, subject, deployed) {
+    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publication.delivery.PURPOSE,
+            if (request.version === 1) {
+                const attestation = await attest(signing, issuer, subject, request.kernel, {
+                    purpose: release.legacy.delivery.PURPOSE,
+                    nonce: request.nonce,
+                    etag: projection.etag,
+                    schemaRevision: projection.schema.revision,
+                });
+                context.signal.throwIfAborted();
+                return release.legacy.delivery.accept({
+                    format: 'astrale.domain.delivery',
+                    version: 1,
+                    publication: projection,
+                    attestation,
+                });
+            }
+            if (deployed.version !== 4) {
+                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
+            }
+            const attestation = await attest(signing, issuer, subject, request.kernel, {
+                purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,
-                etag: deployed.etag,
+                release: deployed.digest,
                 schemaRevision: deployed.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(issuer)
-                .setSubject(subject)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
-                .sign(await signing.privateKey);
+            });
             context.signal.throwIfAborted();
-            return publication.delivery.accept({
+            return release.delivery.accept({
                 format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed,
+                version: 2,
+                release: deployed,
                 attestation,
             });
         },
     });
 }
+async function attest(signing, issuer, subject, kernel, claims) {
+    const now = Math.floor(Date.now() / 1_000);
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(kernel)
+        .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/identity.d.ts

@@ -1,6 +1,6 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type * as publicationProtocol from '@astrale-os/kernel-protocol/release/legacy';
-import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type * as releaseProtocol from '@astrale-os/kernel-protocol/release';
+import type { Issuer, exchange, release } from '@astrale-os/kernel-server';
 import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
 import type { ClientSession } from '../../platform/client/session/index.js';
 import type { InvocationAuthority } from '../invocation/index.js';
@@ -10,7 +10,11 @@ import type { IdentityNetworkPolicy } from './jwks.js';
 export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
-    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+    /**
+     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
+     * over its frozen v3 projection, or v1 over a stable target's Publication.
+     */
+    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
     /**
      * The Domain's own authority toward one Kernel for work no caller credential carries, such as a
      * durable run. Required to serve durable Workflows; the caller closes the Session.

package/dist/execution/identity/identity.js

@@ -1,5 +1,5 @@
 import { admit, authenticate, executorSession } from './authentication.js';
-import { publicationDelivery } from './delivery.js';
+import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
@@ -49,7 +49,7 @@ export function createIdentity(input) {
             ? {}
             : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
         ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
-        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        delivery: (served) => releaseDelivery(material, issuer, input.subject, served),
         admit: (request) => admit(request, configuration),
         executor: (kernel, execution) => executorSession(kernel, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,6 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { AnonymousCaller, AuthenticatedCaller, ResolvedCallable } from '../../../application/action/index.js';
-import type { Release } from '../../../deployment/release/legacy/index.js';
+import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
@@ -9,9 +8,5 @@ export interface AnonymousInvocation {
     readonly graph: null;
     close(): void;
 }
-interface AdmittedAuthenticatedInvocation extends Omit<AuthenticatedInvocation, 'caller'> {
-    readonly caller: AuthenticatedCaller;
-}
-export type InvocationAuthentication = AnonymousInvocation | AdmittedAuthenticatedInvocation;
-export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
-export {};
+export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -1,4 +1,4 @@
-import { grant, issuer } from '../../../platform/auth/index.js';
+import { issuer } from '../../../platform/auth/index.js';
 import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
@@ -9,7 +9,7 @@ const ANONYMOUS = Object.freeze({
     graph: null,
     close() { },
 });
-export async function authentication(callable, request, release, domain, authority) {
+export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
     if (callable.auth === 'anonymous' && credential === undefined)
         return ANONYMOUS;
@@ -21,7 +21,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });
@@ -40,7 +39,6 @@ export async function authentication(callable, request, release, domain, authori
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
-            union: bindSession(graphInput.union),
         });
         return Object.freeze({ caller, graph, close });
     }
@@ -62,8 +60,7 @@ function admitGraph(input) {
         Array.isArray(input) ||
         !Object.hasOwn(input, 'caller') ||
         !Object.hasOwn(input, 'self') ||
-        !Object.hasOwn(input, 'union') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self' && key !== 'union')) {
+        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self')) {
         invalid();
     }
     return input;
@@ -79,29 +76,18 @@ function admitCaller(input) {
         invalid();
     if (!Object.hasOwn(input, 'kind') ||
         !Object.hasOwn(input, 'principal') ||
-        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'identity') ||
         !Object.hasOwn(input, 'authentication') ||
-        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'identity' && key !== 'authentication') ||
         Reflect.get(input, 'kind') !== 'authenticated') {
         invalid();
     }
-    const principal = NodeId(Reflect.get(input, 'principal'));
-    const authority = grant.accept(Reflect.get(input, 'authority'));
-    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
-    const caller = {
+    return Object.freeze({
         kind: 'authenticated',
-        get identity() {
-            if (authority.expr.kind !== 'identity') {
-                throw new TypeError('Caller authority does not resolve to one exact Identity.');
-            }
-            return authority.expr.id;
-        },
-        principal,
-        authority,
-        authentication,
-    };
-    Object.defineProperty(caller, 'identity', { enumerable: false });
-    return Object.freeze(caller);
+        identity: NodeId(Reflect.get(input, 'identity')),
+        principal: NodeId(Reflect.get(input, 'principal')),
+        authentication: admitEvidence(Reflect.get(input, 'authentication')),
+    });
 }
 function admitEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/release/legacy';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -8,28 +7,35 @@ export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
-    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
-    readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+    readonly caller: AuthenticatedCaller;
+    readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
 }
 /** Capture the execution Identity capability and receiver-bind both privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;

package/dist/execution/invocation/admission/authority.js

@@ -12,7 +12,11 @@ export function authority(input) {
         authenticate: receiver.authenticate.bind(receiver),
     });
 }
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');

package/dist/execution/invocation/dependency/bind.d.ts

@@ -2,4 +2,4 @@ import type { HandlerDependencies } from '../../../application/dependency/index.
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
-export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;

package/dist/execution/invocation/dependency/bind.js

@@ -12,7 +12,6 @@ export function bindDependencies(domain, sessions) {
         dependencies[alias] = Object.freeze({
             caller: bindDependency(dependency, sessions.caller),
             self: bindDependency(dependency, sessions.self),
-            union: bindDependency(dependency, sessions.union),
         });
     }
     return Object.freeze(dependencies);