@astrale-os/sdk 0.6.0-beta.24 → 0.6.0-beta.25

package/README.md

@@ -5,10 +5,8 @@ single-step Actions, explicit multi-step Workflows, provider-neutral Integration
 authoring, Domain composition, Deployment, and Execution without exposing DSL callable
 topology in implementation files.
 
-This draft moves the Domain name and entrypoint into its root Schema. The source is rebased on
-current SDK main, but the required canonical Kernel Schema contract is not yet published in the
-pinned dependency cohort. See [the migration and qualification boundary](docs/domain-schema-migration.md)
-before using or releasing this branch.
+The Domain name and optional View entrypoint belong to its root Schema. See
+[the Schema authoring contract](docs/domain-schema-migration.md).
 
 [![CI](https://github.com/astrale-os/sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/astrale-os/sdk/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)
@@ -60,11 +58,13 @@ Install the URL printed by `astrale-domain deploy` on each intended instance.
 
 ## Handler authority and dependencies
 
-Authenticated handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
+Handlers use Domain self authority for `kernel`, `graph`, `query`, and `mutate`.
 `dependencies.directory.caller.invoke(d => d.functions.lookup, input)` calls a direct declared
 dependency on behalf of the incoming caller Identity; `.self` calls it as the executing Domain.
 Explicit `caller` or `self` authority is also available on `kernel` and `graph`; the former
-handler `client` is removed. See [the API and migration guide](docs/handler-dependencies.md).
+handler `client` is removed. A call to an `auth: 'anonymous'` callable that carries no credential
+has no caller: its handler acts as the Domain alone, without the `caller` selections. See
+[the API and migration guide](docs/handler-dependencies.md).
 
 ## Durable Workflows
 

package/dist/application/action/context.d.ts

@@ -47,37 +47,41 @@ export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
     readonly query: QueryExecutor<DomainValue>;
     readonly mutate: MutationExecutor<DomainValue>;
 }
-export type DomainGraphExecutors<DomainValue extends Domain = Domain> = Readonly<DomainGraphExecutor<DomainValue> & Record<'caller' | 'self', DomainGraphExecutor<DomainValue>>>;
+/** Whose authority one Kernel call exercises: the incoming caller's or the installed Domain's. */
+export type AuthorityMode = 'caller' | 'self';
+/**
+ * One value per selectable authority. `self` exists in every invocation; `caller` exists only when
+ * the call carried a credential, so it is absent from a call that carried none.
+ */
+export type AuthoritySelection<Value, Selectable extends AuthorityMode = AuthorityMode> = Readonly<Record<Selectable, Value> & {
+    readonly [Absent in Exclude<AuthorityMode, Selectable>]?: never;
+}>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<DomainGraphExecutor<DomainValue> & AuthoritySelection<DomainGraphExecutor<DomainValue>, Selectable>>;
 /** Self-default Kernel session with one level of explicit authority selection. */
-export type DomainKernelSessions = Readonly<BoundClientSession & Record<'caller' | 'self', BoundClientSession>>;
-type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
-    readonly auth: 'anonymous';
-} ? {
-    readonly caller: AnonymousCaller;
-    readonly dependencies: null;
-    readonly kernel: null;
-    readonly graph: null;
-    readonly query?: never;
-    readonly mutate?: never;
-} | {
-    readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
+export type DomainKernelSessions<Selectable extends AuthorityMode = AuthorityMode> = Readonly<BoundClientSession & AuthoritySelection<BoundClientSession, Selectable>>;
+/** What a handler holds toward the Kernel: the installed Domain authority by default. */
+interface DomainCapabilities<DomainValue extends Domain, Selectable extends AuthorityMode> {
+    readonly dependencies: HandlerDependencies<DomainValue, Selectable>;
+    readonly kernel: DomainKernelSessions<Selectable>;
+    readonly graph: DomainGraphExecutors<DomainValue, Selectable>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly query: QueryExecutor<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly mutate: MutationExecutor<DomainValue>;
-} : {
+}
+/**
+ * A call to an `anonymous` callable that carries no credential has no caller, and its handler acts
+ * as the installed Domain alone. Every other call also selects its authenticated caller.
+ */
+type AuthorityOf<Callable, DomainValue extends Domain> = Callable extends {
+    readonly auth: 'anonymous';
+} ? ({
+    readonly caller: AnonymousCaller;
+} & DomainCapabilities<DomainValue, 'self'>) | ({
     readonly caller: AuthenticatedCaller;
-    readonly dependencies: HandlerDependencies<DomainValue>;
-    readonly kernel: DomainKernelSessions;
-    readonly graph: DomainGraphExecutors<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly query: QueryExecutor<DomainValue>;
-    /** Convenience executor using the installed Domain authority (`graph.self`). */
-    readonly mutate: MutationExecutor<DomainValue>;
-};
+} & DomainCapabilities<DomainValue, AuthorityMode>) : {
+    readonly caller: AuthenticatedCaller;
+} & DomainCapabilities<DomainValue, AuthorityMode>;
 type SelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown, false> ? {
     readonly self: NodeId;
 } : {

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, AuthorityMode, AuthoritySelection, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/dependency/invoker.d.ts

@@ -2,7 +2,7 @@ import type { Binary, Input } from '../../platform/client/index.js';
 import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
-import type { LocalCallable } from '../action/index.js';
+import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
 export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
@@ -22,10 +22,10 @@ export interface DependencyInvoker<D extends Domain> {
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming caller Identity.
- * The canonical Kernel is exposed through context.kernel.
+ * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
+ * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+export type HandlerDependencies<D extends Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Selectable>;
 }>;
 export {};

package/dist/application/integration/operation.d.ts

@@ -19,9 +19,9 @@ export interface IntegrationExecution {
     readonly signal: AbortSignal;
     readonly deadline: number;
     readonly idempotencyKey?: string;
-    /** Exact caller-bound invocation capability; absent for an anonymous invocation. */
+    /** Exact caller-bound invocation capability; absent when the call carried no credential. */
     readonly invoke?: BoundClientSession['invoke'];
-    /** Domain-self transport authentication; absent for an anonymous invocation. */
+    /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
 export interface IntegrationOperation<Input = unknown, Output = unknown> {

package/dist/application/runtime/workflows.d.ts

@@ -9,5 +9,5 @@ export interface RuntimeWorkflow {
     /** Declared `execution: { durable: true }`: runs on the workflow engine, never inline. */
     readonly durable: boolean;
 }
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export declare function admitWorkflows(callables: readonly RuntimeCallable[], input: unknown): readonly RuntimeWorkflow[];

package/dist/application/runtime/workflows.js

@@ -1,6 +1,6 @@
 import { isWorkflow } from '../workflow/index.js';
 import { runtimeCallableAt } from './callables.js';
-/** Associate admitted Workflows with their exact authenticated value callables. */
+/** Associate admitted Workflows with their exact value callables. */
 export function admitWorkflows(callables, input) {
     if (!Array.isArray(input))
         throw new TypeError('Runtime workflows must be an array.');
@@ -16,9 +16,6 @@ export function admitWorkflows(callables, input) {
         if (callable === undefined) {
             throw new TypeError(`Runtime Workflow ${definition.address} is not root-local and executable.`);
         }
-        if (callable.auth === 'anonymous') {
-            throw new TypeError(`Runtime Workflow ${definition.address} must be authenticated.`);
-        }
         if (callable.output.mode !== 'value') {
             throw new TypeError(`Runtime Workflow ${definition.address} must have value output.`);
         }

package/dist/application/workflow/context.d.ts

@@ -4,7 +4,7 @@ import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { DurableCallable, DurableWorkflowContext } from './durable.js';
 import type { WorkflowStep } from './step/index.js';
-/** Multi-step context of one authenticated value-output callable run inside its invocation. */
+/** Multi-step context of one value-output callable run inside its invocation. */
 export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = ActionContext<Callable, DomainValue, Definitions, Errors> & {
     readonly step: WorkflowStep;
 };

package/dist/application/workflow/define.d.ts

@@ -3,7 +3,7 @@ import type { ResolvedDomainOf } from '../action/index.js';
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { CallableAtWorkflowAddress, Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export declare function defineWorkflow<Schema extends schema.DomainSchema, Definitions extends Integrations = Readonly<Record<never, never>>>(): {
     <const Address extends WorkflowAddress<Schema>>(address: Address, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, NoDeclaredErrors>): WorkflowDefinition<Schema, Address, Definitions, NoDeclaredErrors>;
     <const Address extends WorkflowAddress<Schema>, const Errors extends DeclaredErrors = NoDeclaredErrors>(address: Address, options: WorkflowOptions<Errors>, run: Workflow<CallableAtWorkflowAddress<Schema, Address>, Definitions, ResolvedDomainOf<Schema>, Errors>): WorkflowDefinition<Schema, Address, Definitions, Errors>;

package/dist/application/workflow/define.js

@@ -2,7 +2,7 @@ import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { rememberDeclaredErrors } from '../error/index.js';
 const admittedWorkflows = new WeakSet();
 const COMPAT_TOKEN = /^[A-Za-z0-9._~-]{1,64}$/u;
-/** Define one authenticated multi-step value-output implementation by its SDK Action address. */
+/** Define one multi-step value-output implementation by its SDK Action address. */
 export function defineWorkflow() {
     return function define(address, optionsOrRun, possibleRun) {
         acceptWorkflowAddress(address);

package/dist/application/workflow/workflow.d.ts

@@ -3,9 +3,7 @@ import type { ActionAddressOf, ActionOutputOf, CallableAtAddress, LocalCallable,
 import type { DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
 import type { Integrations } from '../integration/index.js';
 import type { WorkflowContext } from './context.js';
-export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? Callable extends {
-    readonly auth: 'anonymous';
-} ? never : CallableOutputOf<Callable> extends {
+export type WorkflowCallable<Callable> = Callable extends ResolvedCallable ? CallableOutputOf<Callable> extends {
     readonly mode: 'value';
 } ? Callable : never : never;
 export type WorkflowAddress<Schema extends schema.DomainSchema> = ActionAddressOf<WorkflowCallable<LocalCallable<ResolvedDomainOf<Schema>>>>;

package/dist/execution/identity/authentication.d.ts

@@ -1,6 +1,6 @@
 import type { Fetch } from '@astrale-os/kernel-client';
 import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
-import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { AuthenticatedInvocation, SelfInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
@@ -26,6 +26,15 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export declare function selfInvocation(kernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): SelfInvocation;
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/authentication.js

@@ -78,6 +78,27 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         },
     });
 }
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export function selfInvocation(kernel, execution, configuration) {
+    requireLive(execution);
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    const session = callbackSession(admitted, selfIdentity, undefined, execution, configuration);
+    let closed = false;
+    return Object.freeze({
+        graph: Object.freeze({ self: bindSession(session, execution) }),
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            session.close();
+        },
+    });
+}
 /**
  * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
  * which no caller credential carries: the run acts as its executor, never as its initiator. Every

package/dist/execution/identity/identity.js

@@ -1,4 +1,4 @@
-import { admit, authenticate, executorSession } from './authentication.js';
+import { admit, authenticate, executorSession, selfInvocation } from './authentication.js';
 import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
@@ -53,6 +53,7 @@ export function createIdentity(input) {
         admit: (request) => admit(request, configuration),
         executor: (kernel, executionId, execution) => executorSession(kernel, executionId, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+        self: async (request) => selfInvocation(request.via.issuer, request.context.execution, configuration),
     });
 }
 export function identity(input) {
@@ -68,6 +69,7 @@ export function identity(input) {
         'delivery',
         'admit',
         'authenticate',
+        'self',
         'executor',
     ]);
     if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
@@ -77,6 +79,7 @@ export function identity(input) {
         typeof input.delivery !== 'function' ||
         typeof input.admit !== 'function' ||
         typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function' ||
         (input.executor !== undefined && typeof input.executor !== 'function')) {
         invalid();
     }
@@ -95,6 +98,7 @@ export function identity(input) {
         delivery: receiver.delivery.bind(receiver),
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
         ...(receiver.executor === undefined ? {} : { executor: receiver.executor.bind(receiver) }),
     });
 }

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,12 +1,15 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
 import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
-import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
-export interface AnonymousInvocation {
+import type { AuthenticatedInvocation, InvocationAuthority, SelfInvocation } from './authority.js';
+/** A call without a credential: no caller, and the installed Domain's own capabilities. */
+export interface AnonymousInvocation extends SelfInvocation {
     readonly caller: AnonymousCaller;
-    readonly kernel: null;
-    readonly graph: null;
-    close(): void;
 }
 export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+/**
+ * The sessions one invocation holds toward its source Kernel: the Domain's own always, its
+ * caller's only when the call carried a credential.
+ */
+export type InvocationSessions = InvocationAuthentication['graph'];
 export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -3,16 +3,12 @@ import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
-const ANONYMOUS = Object.freeze({
-    caller: Object.freeze({ kind: 'anonymous' }),
-    kernel: null,
-    graph: null,
-    close() { },
-});
+const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
 export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined)
-        return ANONYMOUS;
+    if (callable.auth === 'anonymous' && credential === undefined) {
+        return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
+    }
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }
@@ -35,7 +31,7 @@ export async function authentication(callable, request, domain, authority) {
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
-        const graphInput = admitGraph(authenticated.graph);
+        const graphInput = admitGraph(authenticated.graph, ['caller', 'self']);
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
@@ -43,24 +39,46 @@ export async function authentication(callable, request, domain, authority) {
         return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
-        if (close === undefined)
-            invalid(cause);
-        try {
-            close();
-        }
-        catch (cleanup) {
-            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        rejectClosing(close, cause);
+    }
+}
+/** Admit the Domain's own capabilities for a call that carries no credential. */
+function anonymous(own) {
+    let close;
+    try {
+        close = captureClose(own);
+        if (own === null ||
+            typeof own !== 'object' ||
+            Array.isArray(own) ||
+            Reflect.ownKeys(own).some((key) => key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
         }
+        const graph = Object.freeze({ self: bindSession(admitGraph(own.graph, ['self']).self) });
+        return Object.freeze({ caller: ANONYMOUS, graph, close });
+    }
+    catch (cause) {
+        rejectClosing(close, cause);
+    }
+}
+/** Release whatever the authority opened before refusing its invalid capabilities. */
+function rejectClosing(close, cause) {
+    if (close === undefined)
         invalid(cause);
+    try {
+        close();
+    }
+    catch (cleanup) {
+        throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid capabilities and cleanup failed.');
     }
+    invalid(cause);
 }
-function admitGraph(input) {
+function admitGraph(input, modes) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        !Object.hasOwn(input, 'caller') ||
-        !Object.hasOwn(input, 'self') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self')) {
+        modes.some((mode) => !Object.hasOwn(input, mode)) ||
+        Reflect.ownKeys(input).some((key) => !modes.includes(key))) {
         invalid();
     }
     return input;
@@ -134,6 +152,6 @@ function optionalTime(input) {
     return input === undefined || (typeof input === 'number' && Number.isFinite(input));
 }
 function invalid(cause) {
-    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    const message = 'Invocation authority returned invalid capabilities.';
     throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
 }

package/dist/execution/invocation/admission/authority.d.ts

@@ -16,12 +16,22 @@ export interface InvocationAuthenticationInput {
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
+export interface InvocationSelfInput {
+    readonly via: invocation.Via;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
     readonly caller: AuthenticatedCaller;
     readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
     close(): void;
 }
+/** The Domain's own capabilities, before the SDK admits them for a call without a credential. */
+export interface SelfInvocation {
+    readonly graph: Readonly<Record<'self', BoundClientSession>>;
+    close(): void;
+}
 export interface InvocationAuthority {
     /**
      * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
@@ -30,8 +40,14 @@ export interface InvocationAuthority {
      */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+    /**
+     * The Domain's own authority toward the source Kernel, for an admitted call to an `anonymous`
+     * callable that carries no credential: its handler acts as the installed Domain, never as a
+     * caller.
+     */
+    self(input: InvocationSelfInput): Promise<SelfInvocation>;
 }
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served

package/dist/execution/invocation/admission/authority.js

@@ -1,15 +1,18 @@
 import { protocolError } from '../result/index.js';
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export function authority(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+    if (typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function') {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
     return Object.freeze({
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
     });
 }
 /**

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,5 @@
 export { authority, requireVia } from './authority.js';
-export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
-export { authentication, type InvocationAuthentication } from './authentication.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
+export { authentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
 export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,4 @@
 export { authority, requireVia } from './authority.js';
-export { authentication } from './authentication.js';
+export { authentication, } from './authentication.js';
 export { input } from './input.js';
 export { target } from './target.js';

package/dist/execution/invocation/dependency/bind.d.ts

@@ -1,5 +1,7 @@
 import type { HandlerDependencies } from '../../../application/dependency/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
+import type { InvocationSessions } from '../admission/index.js';
 /** Bind each explicit authority to its admitted session; metadata remains inert. */
 export declare function bindDependencies<D extends Domain>(domain: D, sessions: Readonly<Record<'caller' | 'self', BoundClientSession>>): HandlerDependencies<D>;
+export declare function bindDependencies<D extends Domain>(domain: D, sessions: InvocationSessions): HandlerDependencies<D> | HandlerDependencies<D, 'self'>;

package/dist/execution/invocation/dependency/bind.js

@@ -3,14 +3,13 @@ import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
 import { reference } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { Path } from '../../../platform/graph/path/index.js';
-/** Bind each explicit authority to its admitted session; metadata remains inert. */
 export function bindDependencies(domain, sessions) {
     const dependencies = Object.create(null);
     for (const [alias, dependency] of Object.entries(domain.dependencies)) {
         if (dependency.origin === 'kernel.astrale.ai')
             continue;
         dependencies[alias] = Object.freeze({
-            caller: bindDependency(dependency, sessions.caller),
+            ...('caller' in sessions ? { caller: bindDependency(dependency, sessions.caller) } : {}),
             self: bindDependency(dependency, sessions.self),
         });
     }

package/dist/execution/invocation/dispatch/context.d.ts

@@ -12,11 +12,11 @@ export interface DispatchContext {
     readonly input: unknown;
     readonly body?: ActionBinaryInput;
     readonly caller: Caller;
-    readonly dependencies: HandlerDependencies<Domain> | null;
-    readonly kernel: DomainKernelSessions | null;
-    readonly graph: DomainGraphExecutors | null;
-    readonly query?: QueryExecutor;
-    readonly mutate?: MutationExecutor;
+    readonly dependencies: HandlerDependencies<Domain> | HandlerDependencies<Domain, 'self'>;
+    readonly kernel: DomainKernelSessions | DomainKernelSessions<'self'>;
+    readonly graph: DomainGraphExecutors | DomainGraphExecutors<Domain, 'self'>;
+    readonly query: QueryExecutor;
+    readonly mutate: MutationExecutor;
     readonly integrations: Readonly<Record<string, unknown>>;
     readonly execution: ActionExecution;
     readonly self?: NodeId;

package/dist/execution/invocation/dispatch/context.js

@@ -3,7 +3,8 @@ import { bindQuery } from '../../../application/query/execution/executor.js';
 import { bindDependencies } from '../dependency/index.js';
 import { clients } from '../integration/index.js';
 export function context(request, runtime, authentication, self) {
-    const graph = authentication.graph === null ? null : bindGraph(authentication.graph, runtime.loaded.domain);
+    const sessions = authentication.graph;
+    const graph = bindGraph(sessions, runtime.loaded.domain);
     const execution = Object.freeze({
         signal: request.context.execution.signal,
         deadline: request.context.execution.deadline,
@@ -19,46 +20,31 @@ export function context(request, runtime, authentication, self) {
         input: request.call.input,
         ...(request.context.binary === undefined ? {} : { body: request.context.binary }),
         caller: authentication.caller,
-        kernel: authentication.graph === null
-            ? null
-            : Object.freeze({
-                ...authentication.graph.self,
-                ...authentication.graph,
-            }),
-        dependencies: authentication.graph === null
-            ? null
-            : bindDependencies(runtime.loaded.domain, authentication.graph),
+        kernel: Object.freeze({ ...sessions.self, ...sessions }),
+        dependencies: bindDependencies(runtime.loaded.domain, sessions),
         graph,
-        ...(graph === null
-            ? {}
-            : {
-                query: graph.self.query,
-                mutate: graph.self.mutate,
-            }),
-        integrations: clients(runtime, request.context, authentication.graph === null
-            ? null
-            : {
-                caller: authentication.graph.caller,
-                self: authentication.graph.self,
-                ...(authentication.caller.authentication.expiresAt === undefined
-                    ? {}
-                    : {
-                        expiresAt: authentication.caller.authentication.expiresAt,
-                    }),
-            }),
+        query: graph.self.query,
+        mutate: graph.self.mutate,
+        integrations: clients(runtime, request.context, {
+            ...sessions,
+            ...(authentication.caller.kind !== 'authenticated' ||
+                authentication.caller.authentication.expiresAt === undefined
+                ? {}
+                : { expiresAt: authentication.caller.authentication.expiresAt }),
+        }),
         execution,
         ...(self === undefined ? {} : { self }),
     });
 }
-function bindGraph(clients, domain) {
+function bindGraph(sessions, domain) {
     const bind = (client) => Object.freeze({
         query: bindQuery(client, domain),
         mutate: bindMutation(client, domain),
     });
-    const self = bind(clients.self);
+    const self = bind(sessions.self);
     return Object.freeze({
         ...self,
-        caller: bind(clients.caller),
+        ...('caller' in sessions ? { caller: bind(sessions.caller) } : {}),
         self,
     });
 }

package/dist/execution/invocation/dispatch/workflow.js

@@ -1,12 +1,8 @@
 import { declaredErrorFactory, declaredErrorOf } from '../../../application/error/index.js';
 import { protocolError } from '../result/index.js';
 export async function workflow(selected, context, runner) {
-    if (context.caller.kind !== 'authenticated' || context.kernel === null) {
-        throw protocolError('AUTH_MISSING', 'Workflow authentication is required.');
-    }
     const complete = Object.freeze({
         ...context,
-        caller: context.caller,
         error: declaredErrorFactory(selected.definition),
     });
     try {

package/dist/execution/invocation/integration/call.d.ts

@@ -2,7 +2,8 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationInvocationOwner } from '../../../application/integration/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
 export interface IntegrationInvocationSessions {
-    readonly caller: BoundClientSession;
+    /** Absent when the call carried no credential: there is no caller to invoke for. */
+    readonly caller?: BoundClientSession;
     readonly self: BoundClientSession;
     /** Verified incoming carrier expiry, in Unix seconds. */
     readonly expiresAt?: number;

package/dist/execution/invocation/integration/call.js

@@ -3,7 +3,7 @@ import { bindIntegrationAuthentication } from './authentication.js';
 /** One invocation-owned logical Integration call sequence. */
 export function calls(context, sessions = null) {
     const prefix = context.idempotencyKey ?? JSON.stringify([context.invocation.source, context.invocation.id]);
-    const invoke = sessions?.caller.invoke.bind(sessions.caller);
+    const invoke = sessions?.caller?.invoke.bind(sessions.caller);
     const auth = sessions === null
         ? undefined
         : bindIntegrationAuthentication(context, sessions.self, sessions.expiresAt);

package/dist/execution/invocation/integration/clients.d.ts

@@ -2,4 +2,4 @@ import type { InvocationContext } from '@astrale-os/kernel-server';
 import type { IntegrationClients, Integrations } from '../../../application/integration/index.js';
 import type { InitializedRuntime } from '../../runtime/index.js';
 import type { IntegrationInvocationSessions } from './call.js';
-export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions | null): IntegrationClients<Integrations>;
+export declare function clients(runtime: InitializedRuntime, context: InvocationContext, sessions: IntegrationInvocationSessions): IntegrationClients<Integrations>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.24",
+  "version": "0.6.0-beta.25",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -257,11 +257,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.87",
-    "@astrale-os/kernel-core": "0.9.0-beta.66",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.48",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.72",
-    "@astrale-os/kernel-server": "0.5.0-beta.74",
+    "@astrale-os/kernel-client": "0.6.0-beta.88",
+    "@astrale-os/kernel-core": "0.9.0-beta.67",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.49",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.73",
+    "@astrale-os/kernel-server": "0.5.0-beta.75",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -287,6 +287,7 @@
     "husky": "~9.1.7",
     "lint-staged": "~17.3.0",
     "mermaid": "^11.16.1",
+    "miniflare": "5.20260811.1-alpha",
     "oxfmt": "0.63.0",
     "oxlint": "1.78.0",
     "preact": "^10.29.8",
@@ -316,10 +317,10 @@
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
       "oxlint --disable-nested-config --fix",
-      "oxfmt --write"
+      "oxfmt --no-error-on-unmatched-pattern --write"
     ],
     "*.{json,yml,yaml}": [
-      "oxfmt --write"
+      "oxfmt --no-error-on-unmatched-pattern --write"
     ]
   },
   "devEngines": {