@astrale-os/sdk 0.6.0-beta.23 → 0.6.0-beta.25

package/dist/deployment/release/served/views.js

@@ -8,7 +8,6 @@ export function views(build, addressing) {
         view: route.view,
         href: new URL(route.path.replace(/^\//u, ''), base).href,
         handshake: route.handshake,
-        ...(route.iframe === undefined ? {} : { iframe: route.iframe }),
         ...(route.host === undefined ? {} : { host: route.host }),
     })));
 }

package/dist/deployment/verify/index.d.ts

@@ -1,5 +1,3 @@
-export { preflight as verifyPreflight } from './preflight/index.js';
-export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
-export type { BundleInput, PreflightInput } from './preflight/index.js';
-export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';
+export type { BundleInput } from './preflight/index.js';
+export { readiness as verifyReadiness, readinessPaths } from './readiness/index.js';

package/dist/deployment/verify/index.js

@@ -1,4 +1,2 @@
-export { preflight as verifyPreflight } from './preflight/index.js';
-export { isPreparedArtifact } from './preflight/index.js';
 export { bundle as verifyBundle, isBundle, uploadedBuild as verifyUploadedBuild, } from './preflight/index.js';
-export { readiness as verifyReadiness, readinessPaths, verifyDeployment, } from './readiness/index.js';
+export { readiness as verifyReadiness, readinessPaths } from './readiness/index.js';

package/dist/deployment/verify/preflight/index.d.ts

@@ -1,14 +1,2 @@
-import type { ArtifactSource, PreparedArtifact } from '../../adapter/legacy/index.js';
-import type { Build } from '../../build/index.js';
-import type { ResolvedRuntimeReference } from '../../runtime/index.js';
-export { artifact, isPreparedArtifact } from './artifact.js';
 export { bundle, isBundle, uploadedBuild, type BundleInput } from './bundle.js';
 export { build } from './build.js';
-export { publication } from './publication.js';
-export interface PreflightInput<BuildValue extends Build = Build> {
-    readonly build: BuildValue;
-    readonly runtime: ResolvedRuntimeReference;
-    readonly source: ArtifactSource;
-}
-/** Admit exact deployment material before any provider mutation. */
-export declare function preflight<const BuildValue extends Build>(input: PreflightInput<BuildValue>): PreparedArtifact<BuildValue>;

package/dist/deployment/verify/preflight/index.js

@@ -1,14 +1,2 @@
-import { artifact } from './artifact.js';
-import { build as verifyBuild } from './build.js';
-import { publication as verifyPublication } from './publication.js';
-export { artifact, isPreparedArtifact } from './artifact.js';
 export { bundle, isBundle, uploadedBuild } from './bundle.js';
 export { build } from './build.js';
-export { publication } from './publication.js';
-/** Admit exact deployment material before any provider mutation. */
-export function preflight(input) {
-    verifyBuild(input.build);
-    const prepared = artifact(input.build, input.runtime, input.source);
-    verifyPublication(prepared);
-    return prepared;
-}

package/dist/deployment/verify/readiness/index.d.ts

@@ -1,15 +1,11 @@
 import type { Release } from '../../release/index.js';
-import type * as legacy from '../../release/legacy/index.js';
 import type { ReadinessOptions } from './fetch.js';
-export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
 export type { ReadinessFetch, ReadinessOptions } from './fetch.js';
-export { verifyPublication } from './legacy/index.js';
 export { verifyRelease } from './release.js';
 /**
  * Read-only verification of one exact live Release and its serving identity: an immutable
- * deployment's `release.json` (release digest and build digest), or a stable target's
- * `domain.json` (deprecated, `legacy/`).
+ * deployment's release.json (release digest and build digest).
  */
 /**
  * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
@@ -18,4 +14,4 @@ export { verifyRelease } from './release.js';
  * deployment probes these.
  */
 export declare function readinessPaths(deployed: Release): readonly string[];
-export declare function readiness(release: Release | legacy.Release, options?: ReadinessOptions): Promise<void>;
+export declare function readiness(release: Release, options?: ReadinessOptions): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -1,16 +1,12 @@
 import { issuer } from '@astrale-os/kernel-protocol';
 import * as release from '@astrale-os/kernel-protocol/release';
 import { verifyIdentity } from './identity.js';
-import { verifyPublication } from './legacy/index.js';
 import { verifyRelease } from './release.js';
-export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication } from './legacy/index.js';
 export { verifyRelease } from './release.js';
 /**
  * Read-only verification of one exact live Release and its serving identity: an immutable
- * deployment's `release.json` (release digest and build digest), or a stable target's
- * `domain.json` (deprecated, `legacy/`).
+ * deployment's release.json (release digest and build digest).
  */
 /**
  * The local paths `readiness` reads of one immutable deployment, each answering 200 once the
@@ -28,11 +24,6 @@ export function readinessPaths(deployed) {
     ]);
 }
 export async function readiness(release, options = {}) {
-    if (release.kind === 'release') {
-        await verifyRelease(release, options);
-        await verifyIdentity(release.url, options);
-        return;
-    }
-    await verifyPublication(release, options);
-    await verifyIdentity(release.addressing.issuer, options);
+    await verifyRelease(release, options);
+    await verifyIdentity(release.url, options);
 }

package/dist/deployment/worker/response.d.ts

@@ -84,10 +84,7 @@ export type WorkerDeploymentResult = {
     };
     readonly deployment: WorkerDeploymentSummary;
 } | WorkerDeploymentRejection;
-/**
- * Admit the answer of a host's `hosting`: its routing domain. The `addressing: 'opaque'` an older
- * Services answers beside it is admitted and dropped: every Service name is opaque.
- */
+/** Admit the answer of a host's `hosting`: exactly its routing domain. */
 export declare function decodeWorkerHosting(input: unknown): WorkerHostingV1;
 /**
  * Admit the answer of a deploy exactly: a deployment whose state reports the secret state it

package/dist/deployment/worker/response.js

@@ -23,18 +23,12 @@ const SECRETS_BY_STATE = Object.freeze({
     created: Object.freeze(['bound']),
     reused: Object.freeze(['updated', 'unchanged']),
 });
-/**
- * Admit the answer of a host's `hosting`: its routing domain. The `addressing: 'opaque'` an older
- * Services answers beside it is admitted and dropped: every Service name is opaque.
- */
+/** Admit the answer of a host's `hosting`: exactly its routing domain. */
 export function decodeWorkerHosting(input) {
-    const value = exact(input, ['routingDomain'], ['addressing'], 'hosting');
+    const value = exact(input, ['routingDomain'], [], 'hosting');
     if (typeof value.routingDomain !== 'string' || !isDnsName(value.routingDomain)) {
         invalid('hosting', 'routingDomain');
     }
-    if (value.addressing !== undefined && value.addressing !== 'opaque') {
-        invalid('hosting', 'addressing');
-    }
     return Object.freeze({ routingDomain: value.routingDomain });
 }
 /**

package/dist/execution/identity/authentication.d.ts

@@ -1,6 +1,6 @@
 import type { Fetch } from '@astrale-os/kernel-client';
 import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
-import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { AuthenticatedInvocation, SelfInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
@@ -26,6 +26,15 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export declare function selfInvocation(kernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): SelfInvocation;
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/authentication.js

@@ -78,6 +78,27 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         },
     });
 }
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export function selfInvocation(kernel, execution, configuration) {
+    requireLive(execution);
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    const session = callbackSession(admitted, selfIdentity, undefined, execution, configuration);
+    let closed = false;
+    return Object.freeze({
+        graph: Object.freeze({ self: bindSession(session, execution) }),
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            session.close();
+        },
+    });
+}
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/delivery.d.ts

@@ -2,12 +2,7 @@ import type { release as serverRelease } from '@astrale-os/kernel-server';
 import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-type Served = release.DomainRelease | release.legacy.Publication;
 /**
- * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
- * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
- * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
- * deprecated v1 request. A stable target's Publication answers v1 only.
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
  */
-export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
-export {};
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: release.DomainRelease): serverRelease.delivery.Provider;

package/dist/execution/identity/delivery.js

@@ -2,34 +2,12 @@ import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
 /**
- * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
- * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
- * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
- * deprecated v1 request. A stable target's Publication answers v1 only.
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
  */
 export function releaseDelivery(signing, issuer, subject, deployed) {
-    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            if (request.version === 1) {
-                const attestation = await attest(signing, issuer, subject, request.kernel, {
-                    purpose: release.legacy.delivery.PURPOSE,
-                    nonce: request.nonce,
-                    etag: projection.etag,
-                    schemaRevision: projection.schema.revision,
-                });
-                context.signal.throwIfAborted();
-                return release.legacy.delivery.accept({
-                    format: 'astrale.domain.delivery',
-                    version: 1,
-                    publication: projection,
-                    attestation,
-                });
-            }
-            if (deployed.version !== 4) {
-                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
-            }
             const attestation = await attest(signing, issuer, subject, request.kernel, {
                 purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,

package/dist/execution/identity/identity.d.ts

@@ -12,10 +12,9 @@ export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
     /**
-     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
-     * over its frozen v3 projection, or v1 over a stable target's Publication.
+     * Delivery v2 for the exact release this deployment serves.
      */
-    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
+    delivery(served: releaseProtocol.DomainRelease): release.delivery.Provider;
     /**
      * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`
      * (`ctx.execution.id`), which no caller credential carries; its credentials name `executionId` in

package/dist/execution/identity/identity.js

@@ -1,4 +1,4 @@
-import { admit, authenticate, executorSession } from './authentication.js';
+import { admit, authenticate, executorSession, selfInvocation } from './authentication.js';
 import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
@@ -53,6 +53,7 @@ export function createIdentity(input) {
         admit: (request) => admit(request, configuration),
         executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+        self: async (request) => selfInvocation(request.via.issuer, request.context.execution, configuration),
     });
 }
 export function identity(input) {
@@ -68,6 +69,7 @@ export function identity(input) {
         'delivery',
         'admit',
         'authenticate',
+        'self',
         'executor',
     ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
@@ -77,6 +79,7 @@ export function identity(input) {
         typeof input.delivery !== 'function' ||
         typeof input.admit !== 'function' ||
         typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function' ||
         (input.executor !== undefined && typeof input.executor !== 'function')) {
         invalid();
     }
@@ -95,6 +98,7 @@ export function identity(input) {
         delivery: receiver.delivery.bind(receiver),
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
         ...(receiver.executor === undefined ? {} : { executor: receiver.executor.bind(receiver) }),
     });
 }

package/dist/execution/index.d.ts

@@ -1,7 +1,5 @@
 export { serve } from './serve.js';
 export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
 export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
-export type { InvocationErrorCode } from './invocation/index.js';
 export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
-export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,4 +1,3 @@
 export { serve } from './serve.js';
 export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
-export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,12 +1,15 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
 import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
-import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
-export interface AnonymousInvocation {
+import type { AuthenticatedInvocation, InvocationAuthority, SelfInvocation } from './authority.js';
+/** A call without a credential: no caller, and the installed Domain's own capabilities. */
+export interface AnonymousInvocation extends SelfInvocation {
     readonly caller: AnonymousCaller;
-    readonly kernel: null;
-    readonly graph: null;
-    close(): void;
 }
 export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+/**
+ * The sessions one invocation holds toward its source Kernel: the Domain's own always, its
+ * caller's only when the call carried a credential.
+ */
+export type InvocationSessions = InvocationAuthentication['graph'];
 export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -3,16 +3,12 @@ import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
-const ANONYMOUS = Object.freeze({
-    caller: Object.freeze({ kind: 'anonymous' }),
-    kernel: null,
-    graph: null,
-    close() { },
-});
+const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
 export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined)
-        return ANONYMOUS;
+    if (callable.auth === 'anonymous' && credential === undefined) {
+        return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
+    }
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }
@@ -35,7 +31,7 @@ export async function authentication(callable, request, domain, authority) {
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
-        const graphInput = admitGraph(authenticated.graph);
+        const graphInput = admitGraph(authenticated.graph, ['caller', 'self']);
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
@@ -43,24 +39,46 @@ export async function authentication(callable, request, domain, authority) {
         return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
-        if (close === undefined)
-            invalid(cause);
-        try {
-            close();
-        }
-        catch (cleanup) {
-            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        rejectClosing(close, cause);
+    }
+}
+/** Admit the Domain's own capabilities for a call that carries no credential. */
+function anonymous(own) {
+    let close;
+    try {
+        close = captureClose(own);
+        if (own === null ||
+            typeof own !== 'object' ||
+            Array.isArray(own) ||
+            Reflect.ownKeys(own).some((key) => key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
         }
+        const graph = Object.freeze({ self: bindSession(admitGraph(own.graph, ['self']).self) });
+        return Object.freeze({ caller: ANONYMOUS, graph, close });
+    }
+    catch (cause) {
+        rejectClosing(close, cause);
+    }
+}
+/** Release whatever the authority opened before refusing its invalid capabilities. */
+function rejectClosing(close, cause) {
+    if (close === undefined)
         invalid(cause);
+    try {
+        close();
+    }
+    catch (cleanup) {
+        throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid capabilities and cleanup failed.');
     }
+    invalid(cause);
 }
-function admitGraph(input) {
+function admitGraph(input, modes) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        !Object.hasOwn(input, 'caller') ||
-        !Object.hasOwn(input, 'self') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self')) {
+        modes.some((mode) => !Object.hasOwn(input, mode)) ||
+        Reflect.ownKeys(input).some((key) => !modes.includes(key))) {
         invalid();
     }
     return input;
@@ -134,6 +152,6 @@ function optionalTime(input) {
     return input === undefined || (typeof input === 'number' && Number.isFinite(input));
 }
 function invalid(cause) {
-    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    const message = 'Invocation authority returned invalid capabilities.';
     throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
 }

package/dist/execution/invocation/admission/authority.d.ts

@@ -6,13 +6,18 @@ import type { Domain } from '../../../platform/schema/index.js';
 export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
-    readonly via: invocation.Via | invocation.PublicationVia;
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
-    readonly via: invocation.Via | invocation.PublicationVia;
+    readonly via: invocation.Via;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface InvocationSelfInput {
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
@@ -22,6 +27,11 @@ export interface AuthenticatedInvocation {
     readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
     close(): void;
 }
+/** The Domain's own capabilities, before the SDK admits them for a call without a credential. */
+export interface SelfInvocation {
+    readonly graph: Readonly<Record<'self', BoundClientSession>>;
+    close(): void;
+}
 export interface InvocationAuthority {
     /**
      * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
@@ -30,12 +40,17 @@ export interface InvocationAuthority {
      */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+    /**
+     * The Domain's own authority toward the source Kernel, for an admitted call to an `anonymous`
+     * callable that carries no credential: its handler acts as the installed Domain, never as a
+     * caller.
+     */
+    self(input: InvocationSelfInput): Promise<SelfInvocation>;
 }
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served
- * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
- * (a release's exact projection, or a stable target's Publication).
+ * snapshot: the exact ReleaseRef of this immutable deployment.
  */
-export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;
+export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -1,21 +1,23 @@
 import { protocolError } from '../result/index.js';
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export function authority(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+    if (typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function') {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
     return Object.freeze({
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
     });
 }
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served
- * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
- * (a release's exact projection, or a stable target's Publication).
+ * snapshot: the exact ReleaseRef of this immutable deployment.
  */
 export function requireVia(request) {
     if (request.via === undefined) {

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,5 @@
 export { authority, requireVia } from './authority.js';
-export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
-export { authentication, type InvocationAuthentication } from './authentication.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
+export { authentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
 export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,4 @@
 export { authority, requireVia } from './authority.js';
-export { authentication } from './authentication.js';
+export { authentication, } from './authentication.js';
 export { input } from './input.js';
 export { target } from './target.js';

package/dist/execution/invocation/dependency/bind.d.ts

@@ -1,5 +1,7 @@
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
+import type { InvocationSessions } from '../admission/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
 export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: InvocationSessions): HandlerDependencies<D> | HandlerDependencies<D, 'self'>;

package/dist/execution/invocation/dependency/bind.js

@@ -3,14 +3,13 @@ import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
 import { reference } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { Path } from '../../../platform/graph/path/index.js';
-/** Bind each explicit authority to its admitted session; metadata remains inert. */
 export function bindDependencies(domain, sessions) {
     const dependencies = Object.create(null);
     for (const [alias, dependency] of Object.entries(domain.dependencies)) {
         if (dependency.origin === 'kernel.astrale.ai')
             continue;
         dependencies[alias] = Object.freeze({
-            caller: bindDependency(dependency, sessions.caller),
+            ...('caller' in sessions ? { caller: bindDependency(dependency, sessions.caller) } : {}),
             self: bindDependency(dependency, sessions.self),
         });
     }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -12,11 +12,11 @@ export interface DispatchContext {
     readonly input: unknown;
     readonly body?: ActionBinaryInput;
     readonly caller: Caller;
-    readonly dependencies: HandlerDependencies<Domain> | null;
-    readonly kernel: DomainKernelSessions | null;
-    readonly graph: DomainGraphExecutors | null;
-    readonly query?: QueryExecutor;
-    readonly mutate?: MutationExecutor;
+    readonly dependencies: HandlerDependencies<Domain> | HandlerDependencies<Domain, 'self'>;
+    readonly kernel: DomainKernelSessions | DomainKernelSessions<'self'>;
+    readonly graph: DomainGraphExecutors | DomainGraphExecutors<Domain, 'self'>;
+    readonly query: QueryExecutor;
+    readonly mutate: MutationExecutor;
     readonly integrations: Readonly<Record<string, unknown>>;
     readonly execution: ActionExecution;
     readonly self?: NodeId;