@astrale-os/sdk 0.6.0-beta.35 → 0.6.0-beta.36

package/README.md

@@ -73,6 +73,16 @@ on the Kernel's workflow engine: a call returns its `K.Execution` at once, and t
 restarts with journaled Steps, durable timers and signals. Serve it with `serve({ durable })`. See
 [the durable Workflow guide](docs/durable-workflows.md).
 
+## Admission age
+
+A callable declared with `admission: { maxAge: <seconds> }` (1 to 300) lets its deployment reuse an
+admission the source Kernel granted, for the same Kernel, caller, target and Policy-read input fields,
+while it is younger than that age: such a call skips its `Function.admit` round trip. Revocation then
+reaches it within that age. Credential verification, the release pin and input validation still run
+on every call. Admissions are kept in the deployment cache, `serve({ cache })`: a memory cache by
+default, the Cache API on Cloudflare, and none with `cache: false`. See
+[the admission age guide](docs/admission-age.md).
+
 ## Node Class icons
 
 Every Node Class authored through the SDK must explicitly declare a self-contained SVG icon.

package/dist/execution/cache/cache.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Disposable entries one deployment keeps across its requests, and across its isolates where the
+ * platform shares them. An entry may vanish at any time and never outlives its expiry. A reader
+ * treats a failed or late read as a miss, so nothing that must persist or be coordinated belongs
+ * here: every consumer stays correct when the cache keeps nothing.
+ */
+export interface DeploymentCache {
+    /** The value kept under `key`, or undefined when it expired, vanished or was never kept. */
+    get(key: string): Promise<string | undefined>;
+    /**
+     * Keep `value` under `key` until `expiresAt` (Unix milliseconds) at the latest. The cache may
+     * drop it sooner, or not keep it at all.
+     */
+    put(key: string, value: string, expiresAt: number): Promise<void>;
+}
+/** Capture a caller-supplied cache, receiver-bound, after checking its shape. */
+export declare function deploymentCache(input: DeploymentCache): DeploymentCache;

package/dist/execution/cache/cache.js

@@ -0,0 +1,11 @@
+/** Capture a caller-supplied cache, receiver-bound, after checking its shape. */
+export function deploymentCache(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        typeof input.get !== 'function' ||
+        typeof input.put !== 'function') {
+        throw new TypeError('Deployment cache is invalid.');
+    }
+    return Object.freeze({ get: input.get.bind(input), put: input.put.bind(input) });
+}

package/dist/execution/cache/index.d.ts

@@ -0,0 +1,2 @@
+export { deploymentCache, type DeploymentCache } from './cache.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, type MemoryCacheOptions } from './memory.js';

package/dist/execution/cache/index.js

@@ -0,0 +1,2 @@
+export { deploymentCache } from './cache.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache } from './memory.js';

package/dist/execution/cache/memory.d.ts

@@ -0,0 +1,13 @@
+import type { DeploymentCache } from './cache.js';
+/** Entries one memory cache keeps by default before it evicts the least recently used. */
+export declare const DEFAULT_MEMORY_CACHE_ENTRIES = 1024;
+export interface MemoryCacheOptions {
+    /** Most entries kept at once; the least recently used is evicted first. */
+    readonly maximumEntries?: number;
+}
+/**
+ * A deployment cache held in this process or isolate: bounded, least recently used first out, and
+ * an entry is gone at its expiry. It keeps values only, never a pending operation, so no request
+ * waits on another's I/O.
+ */
+export declare function memoryCache(options?: MemoryCacheOptions, now?: () => number): DeploymentCache;

package/dist/execution/cache/memory.js

@@ -0,0 +1,48 @@
+/** Entries one memory cache keeps by default before it evicts the least recently used. */
+export const DEFAULT_MEMORY_CACHE_ENTRIES = 1_024;
+/**
+ * A deployment cache held in this process or isolate: bounded, least recently used first out, and
+ * an entry is gone at its expiry. It keeps values only, never a pending operation, so no request
+ * waits on another's I/O.
+ */
+export function memoryCache(options = {}, now = Date.now) {
+    if (options === null || typeof options !== 'object' || Array.isArray(options))
+        invalid();
+    const maximum = options.maximumEntries ?? DEFAULT_MEMORY_CACHE_ENTRIES;
+    if (!Number.isSafeInteger(maximum) || maximum < 1) {
+        throw new TypeError('Memory cache maximumEntries must be a positive integer.');
+    }
+    const entries = new Map();
+    return Object.freeze({
+        async get(key) {
+            if (typeof key !== 'string')
+                invalid();
+            const entry = entries.get(key);
+            if (entry === undefined)
+                return undefined;
+            entries.delete(key);
+            if (entry.expiresAt <= now())
+                return undefined;
+            entries.set(key, entry);
+            return entry.value;
+        },
+        async put(key, value, expiresAt) {
+            if (typeof key !== 'string' || typeof value !== 'string' || !Number.isFinite(expiresAt)) {
+                invalid();
+            }
+            entries.delete(key);
+            if (expiresAt <= now())
+                return;
+            while (entries.size >= maximum) {
+                const oldest = entries.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                entries.delete(oldest);
+            }
+            entries.set(key, Object.freeze({ value, expiresAt }));
+        },
+    });
+}
+function invalid() {
+    throw new TypeError('Memory cache input is invalid.');
+}

package/dist/execution/index.d.ts

@@ -1,5 +1,6 @@
 export { serve } from './serve.js';
 export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, type DeploymentCache, type MemoryCacheOptions, } from './cache/index.js';
 export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
 export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
 export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,3 +1,4 @@
 export { serve } from './serve.js';
+export { DEFAULT_MEMORY_CACHE_ENTRIES, memoryCache, } from './cache/index.js';
 export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
 export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/invocation/admission/age.d.ts

@@ -0,0 +1,57 @@
+import type * as invocation from '@astrale-os/kernel-protocol/invocation';
+import type { RuntimeRegistry } from '../../../application/runtime/index.js';
+import type { DeploymentCache } from '../../cache/index.js';
+import type { Admission, InvocationTarget } from './target.js';
+/**
+ * How long reading a kept admission may take before the call asks its Kernel instead. Reads of a
+ * shared platform cache answer in single-digit milliseconds; `Function.admit` costs tens.
+ */
+export declare const ADMISSION_RECALL_TIMEOUT_MS = 30;
+/** The callables a call can be admitted to, when one of them declares an admission age. */
+export interface AdmissionScope {
+    /** Keys of the implementations the call target names: an admission to any other is not kept. */
+    readonly callables: ReadonlySet<string>;
+    /** The input fields their Policies read, the only part of the input an admission depends on. */
+    readonly fields: readonly string[];
+}
+/**
+ * Whose admission one call asks for: the source Kernel, the release this deployment serves, and
+ * the caller its credential proved, verified here before any kept admission is read.
+ */
+export interface AdmissionPartition {
+    readonly kernel: string;
+    readonly release: string;
+    /** Absent for a call that carries no credential. */
+    readonly caller?: {
+        readonly principal: string;
+        readonly identity: string;
+    };
+}
+/**
+ * The scope of a call whose target names, before the graph is read, implementations of which one
+ * declares an admission age. Undefined otherwise: a target that names no local implementation (a
+ * callable Node id, a path ending in a traversal), only callables without an age, or a durable
+ * Workflow, which runs only as a Kernel Execution. The Path language dispatches exactly, so a named
+ * target selects one declaration; the fields are still the union over every implementation named.
+ */
+export declare function admissionScope(registry: RuntimeRegistry, call: invocation.Call): AdmissionScope | undefined;
+/** Whether any implementation of this registry declares an admission age. */
+export declare function declaresAdmissionAge(registry: RuntimeRegistry): boolean;
+/**
+ * The cache key of one call's admission: a SHA-256 over the source Kernel, the served release, the
+ * verified principal and caller, the canonical call target (receiver included) and the input
+ * projected on the fields its Policy reads. A missing field differs from `null`, object keys are
+ * sorted at every depth, and no other part of the input enters the key.
+ */
+export declare function admissionKey(scope: AdmissionScope, partition: AdmissionPartition, call: invocation.Call): Promise<string>;
+/**
+ * The target of an admission this deployment kept under `key`, while it is younger than the age it
+ * carried. A missing, expired, malformed, out-of-scope, failed or late read is a miss.
+ */
+export declare function recallAdmission(cache: DeploymentCache, key: string, scope: AdmissionScope): Promise<InvocationTarget | undefined>;
+/**
+ * Keep a successful admission that carries an age, until `sentAt` plus that age, `sentAt` being when
+ * `Function.admit` was asked. Written in the background: the call never waits on the cache, and a
+ * cache that fails to keep it only costs a later call its admission round trip.
+ */
+export declare function keepAdmission(cache: DeploymentCache, key: string, scope: AdmissionScope, admitted: Admission, sentAt: number, background: (task: () => PromiseLike<unknown>) => void): void;

package/dist/execution/invocation/admission/age.js

@@ -0,0 +1,208 @@
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { admissionInputFields, MAXIMUM_ADMISSION_AGE_SECONDS, } from '@astrale-os/kernel-dsl/v1/language';
+import { Path } from '../../../platform/graph/path/index.js';
+import { target as acceptTarget } from './target.js';
+/**
+ * How long reading a kept admission may take before the call asks its Kernel instead. Reads of a
+ * shared platform cache answer in single-digit milliseconds; `Function.admit` costs tens.
+ */
+export const ADMISSION_RECALL_TIMEOUT_MS = 30;
+/** Version of the key and entry encodings below; a change makes every kept admission a miss. */
+const ENCODING = 'astrale.admission/1';
+const ENTRY_FIELDS = new Set(['v', 'callable', 'receiver', 'expiresAt']);
+/**
+ * The scope of a call whose target names, before the graph is read, implementations of which one
+ * declares an admission age. Undefined otherwise: a target that names no local implementation (a
+ * callable Node id, a path ending in a traversal), only callables without an age, or a durable
+ * Workflow, which runs only as a Kernel Execution. The Path language dispatches exactly, so a named
+ * target selects one declaration; the fields are still the union over every implementation named.
+ */
+export function admissionScope(registry, call) {
+    const names = declarationsNamedBy(call.target);
+    const named = registry.implementations.filter(({ callable }) => names(callable.key));
+    if (named.every(({ callable }) => callable.admission === undefined))
+        return undefined;
+    if (named.some((implementation) => implementation.kind === 'workflow' && implementation.durable)) {
+        return undefined;
+    }
+    const fields = new Set();
+    for (const { callable } of named) {
+        for (const field of admissionInputFields(callable.policy))
+            fields.add(field);
+    }
+    return Object.freeze({
+        callables: new Set(named.map(({ callable }) => callable.key)),
+        fields: Object.freeze([...fields].sort()),
+    });
+}
+/** Whether any implementation of this registry declares an admission age. */
+export function declaresAdmissionAge(registry) {
+    return registry.implementations.some(({ callable }) => callable.admission !== undefined);
+}
+/**
+ * The cache key of one call's admission: a SHA-256 over the source Kernel, the served release, the
+ * verified principal and caller, the canonical call target (receiver included) and the input
+ * projected on the fields its Policy reads. A missing field differs from `null`, object keys are
+ * sorted at every depth, and no other part of the input enters the key.
+ */
+export async function admissionKey(scope, partition, call) {
+    const encoded = JSON.stringify([
+        ENCODING,
+        partition.kernel,
+        partition.release,
+        partition.caller?.principal ?? null,
+        partition.caller?.identity ?? null,
+        canonical(call.target),
+        projection(call.input, scope.fields),
+    ]);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(encoded));
+    return `admission/${hex(new Uint8Array(digest))}`;
+}
+/**
+ * The target of an admission this deployment kept under `key`, while it is younger than the age it
+ * carried. A missing, expired, malformed, out-of-scope, failed or late read is a miss.
+ */
+export async function recallAdmission(cache, key, scope) {
+    const value = await boundedRead(cache, key);
+    return value === undefined ? undefined : keptTarget(value, scope, Date.now());
+}
+/**
+ * Keep a successful admission that carries an age, until `sentAt` plus that age, `sentAt` being when
+ * `Function.admit` was asked. Written in the background: the call never waits on the cache, and a
+ * cache that fails to keep it only costs a later call its admission round trip.
+ */
+export function keepAdmission(cache, key, scope, admitted, sentAt, background) {
+    if (admitted.maxAge === undefined || !scope.callables.has(admitted.target.callable))
+        return;
+    const expiresAt = sentAt + admitted.maxAge * 1000;
+    const value = JSON.stringify({
+        v: 1,
+        callable: admitted.target.callable,
+        ...(admitted.target.receiver === undefined ? {} : { receiver: admitted.target.receiver }),
+        expiresAt,
+    });
+    try {
+        background(async () => {
+            try {
+                await cache.put(key, value, expiresAt);
+            }
+            catch {
+                // A cache that cannot keep this admission leaves the next call to its Kernel.
+            }
+        });
+    }
+    catch {
+        // A Server that no longer accepts background work keeps nothing; the call is unaffected.
+    }
+}
+function keptTarget(value, scope, now) {
+    let entry;
+    try {
+        entry = JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(entry) || Reflect.ownKeys(entry).some((key) => !ENTRY_FIELDS.has(key))) {
+        return undefined;
+    }
+    const { v, callable, receiver, expiresAt } = entry;
+    if (v !== 1 ||
+        typeof callable !== 'string' ||
+        !scope.callables.has(callable) ||
+        typeof expiresAt !== 'number' ||
+        !Number.isSafeInteger(expiresAt) ||
+        expiresAt <= now ||
+        expiresAt > now + MAXIMUM_ADMISSION_AGE_SECONDS * 1000) {
+        return undefined;
+    }
+    try {
+        return acceptTarget({ callable, ...(receiver === undefined ? {} : { receiver }) });
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One read bounded in time; a cache error is a miss. No pending read is shared across calls. */
+async function boundedRead(cache, key) {
+    let timer;
+    const read = Promise.resolve()
+        .then(() => cache.get(key))
+        .then((value) => (typeof value === 'string' ? value : undefined), () => undefined);
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(undefined), ADMISSION_RECALL_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([read, late]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/** The declarations `target` names before the graph is read, as a test on a callable key. */
+function declarationsNamedBy(target) {
+    if (typeof target !== 'string')
+        return (key) => target.callable === key;
+    let path;
+    try {
+        path = Path.parse(target);
+    }
+    catch {
+        return () => false;
+    }
+    const { anchor, steps } = path.ast;
+    const last = steps.at(-1);
+    const first = steps[0];
+    return (key) => {
+        const coordinate = callableAddress(key);
+        if (coordinate.kind === 'method') {
+            if (last?.kind !== 'method' || last.name !== coordinate.name)
+                return false;
+            if (last.dispatch === 'instance')
+                return last.class === Key.of(coordinate.owner);
+            return (anchor.kind === 'domain' &&
+                anchor.origin === coordinate.owner.origin &&
+                steps.length === 2 &&
+                first?.kind === 'projection' &&
+                first.projection.kind === 'class' &&
+                first.projection.name === coordinate.owner.name);
+        }
+        return (anchor.kind === 'domain' &&
+            anchor.origin === coordinate.origin &&
+            steps.length === 1 &&
+            first?.kind === 'projection' &&
+            first.projection.kind === 'function' &&
+            first.projection.name === coordinate.name);
+    };
+}
+/** The input on the fields a Policy reads: each present field with its value, or its name alone. */
+function projection(input, fields) {
+    if (fields.length === 0)
+        return [];
+    if (!isRecord(input))
+        return ['other'];
+    return [
+        'object',
+        ...fields.map((field) => Object.hasOwn(input, field) ? [field, canonical(input[field])] : [field]),
+    ];
+}
+/** Canonical JSON text of a portable value: object keys sorted at every depth. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const object = value;
+        return `{${Object.keys(object)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(object[key])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function isRecord(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input);
+}
+function hex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}

package/dist/execution/invocation/admission/authentication.d.ts

@@ -13,3 +13,5 @@ export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvoca
  */
 export type InvocationSessions = InvocationAuthentication['graph'];
 export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+/** Verify the credential a call carries and admit the caller it proves, whatever the callable. */
+export declare function credentialAuthentication(request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<AuthenticatedInvocation>;

package/dist/execution/invocation/admission/authentication.js

@@ -5,10 +5,14 @@ import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
 const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
 export async function authentication(callable, request, domain, authority) {
-    const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined) {
+    if (callable.auth === 'anonymous' && request.credential === undefined) {
         return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
     }
+    return credentialAuthentication(request, domain, authority);
+}
+/** Verify the credential a call carries and admit the caller it proves, whatever the callable. */
+export async function credentialAuthentication(request, domain, authority) {
+    const credential = request.credential;
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,6 @@
+export { ADMISSION_RECALL_TIMEOUT_MS, admissionKey, admissionScope, declaresAdmissionAge, keepAdmission, recallAdmission, type AdmissionPartition, type AdmissionScope, } from './age.js';
 export { authority, requireVia } from './authority.js';
 export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
-export { authentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
+export { authentication, credentialAuthentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
-export { target, type InvocationTarget } from './target.js';
+export { admission, target, type Admission, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,5 @@
+export { ADMISSION_RECALL_TIMEOUT_MS, admissionKey, admissionScope, declaresAdmissionAge, keepAdmission, recallAdmission, } from './age.js';
 export { authority, requireVia } from './authority.js';
-export { authentication, } from './authentication.js';
+export { authentication, credentialAuthentication, } from './authentication.js';
 export { input } from './input.js';
-export { target } from './target.js';
+export { admission, target } from './target.js';

package/dist/execution/invocation/admission/target.d.ts

@@ -4,5 +4,16 @@ export interface InvocationTarget {
     readonly callable: SemanticKey.Callable;
     readonly receiver?: NodePath;
 }
+/** The source Kernel's answer to `Function.admit`. */
+export interface Admission {
+    readonly target: InvocationTarget;
+    /**
+     * How long, in seconds from when it was asked, this deployment may reuse the admission: the
+     * callable's declared admission age bounded by the Kernel cap. Absent: this call only.
+     */
+    readonly maxAge?: number;
+}
+/** Admit the `Function.admit` answer: the selected target and the admission age it carries. */
+export declare function admission(input: unknown): Admission;
 /** Admit the portable target selected by the execution Identity owner. */
 export declare function target(input: unknown): InvocationTarget;

package/dist/execution/invocation/admission/target.js

@@ -1,11 +1,25 @@
 import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isAdmissionMaxAge } from '@astrale-os/kernel-dsl/v1/language';
 import { NodePath as acceptNodePath } from '../../../platform/graph/path/index.js';
 import { InvocationDefect } from '../result/index.js';
+/** Admit the `Function.admit` answer: the selected target and the admission age it carries. */
+export function admission(input) {
+    const value = record(input);
+    if (Reflect.ownKeys(value).some((key) => key !== 'callable' && key !== 'receiver' && key !== 'maxAge')) {
+        invalid();
+    }
+    const { maxAge } = value;
+    if (maxAge !== undefined && !isAdmissionMaxAge(maxAge))
+        invalid();
+    const selected = target({
+        callable: value.callable,
+        ...(value.receiver === undefined ? {} : { receiver: value.receiver }),
+    });
+    return Object.freeze({ target: selected, ...(maxAge === undefined ? {} : { maxAge }) });
+}
 /** Admit the portable target selected by the execution Identity owner. */
 export function target(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        invalid();
-    const value = input;
+    const value = record(input);
     if (!Object.hasOwn(value, 'callable') ||
         Reflect.ownKeys(value).some((key) => key !== 'callable' && key !== 'receiver') ||
         typeof value.callable !== 'string') {
@@ -25,6 +39,11 @@ export function target(input) {
     }
     return Object.freeze({ callable, ...(receiver === undefined ? {} : { receiver }) });
 }
+function record(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    return input;
+}
 function invalid() {
     throw new InvocationDefect('INVOCATION_TARGET_INVALID', 'Invocation target is invalid.');
 }

package/dist/execution/invocation/handler.js

@@ -1,5 +1,6 @@
 import { createInlineWorkflowRunner } from '../../application/workflow/runner/index.js';
-import { authority } from './admission/index.js';
+import { deploymentCache } from '../cache/index.js';
+import { authority, declaresAdmissionAge } from './admission/index.js';
 import { invoke } from './invocation.js';
 import { projectError } from './result/index.js';
 /** Compose one ready semantic Handler below Kernel Server transport ownership. */
@@ -8,7 +9,7 @@ export function createHandler(input) {
         invalid();
     if (!Object.hasOwn(input, 'runtime') ||
         !Object.hasOwn(input, 'authority') ||
-        Reflect.ownKeys(input).some((key) => key !== 'runtime' && key !== 'authority' && key !== 'workflows')) {
+        Reflect.ownKeys(input).some((key) => key !== 'runtime' && key !== 'authority' && key !== 'workflows' && key !== 'cache')) {
         invalid();
     }
     const capturedAuthority = authority(input.authority);
@@ -17,6 +18,10 @@ export function createHandler(input) {
         invalid();
     }
     const capturedWorkflows = Object.freeze({ run: workflows.run.bind(workflows) });
+    // A Domain whose callables declare no admission age never reads its cache.
+    const cache = input.cache === undefined || !declaresAdmissionAge(input.runtime.loaded.registry)
+        ? undefined
+        : deploymentCache(input.cache);
     return Object.freeze({
         async dispatch(request) {
             try {
@@ -24,6 +29,7 @@ export function createHandler(input) {
                     runtime: input.runtime,
                     authority: capturedAuthority,
                     workflows: capturedWorkflows,
+                    ...(cache === undefined ? {} : { cache }),
                 });
             }
             catch (cause) {

package/dist/execution/invocation/invocation.d.ts

@@ -1,10 +1,16 @@
 import type { HandlerRequest, HandlerResult } from '@astrale-os/kernel-server';
 import type { WorkflowRunner } from '../../application/workflow/runner/index.js';
+import type { DeploymentCache } from '../cache/index.js';
 import type { InitializedRuntime } from '../runtime/index.js';
 import type { InvocationAuthority } from './admission/index.js';
 export interface InvocationInput {
     readonly runtime: InitializedRuntime;
     readonly authority: InvocationAuthority;
     readonly workflows: WorkflowRunner;
+    /**
+     * Where admissions of callables that declare an admission age are kept for the next calls. Absent:
+     * every call is admitted by its source Kernel.
+     */
+    readonly cache?: DeploymentCache;
 }
 export declare function invoke(request: HandlerRequest, inputConfig: InvocationInput): Promise<HandlerResult>;

package/dist/execution/invocation/invocation.js

@@ -1,6 +1,6 @@
 import * as errors from '@astrale-os/kernel-protocol/errors';
 import * as release from '@astrale-os/kernel-protocol/release';
-import { authentication, input, requireVia, target } from './admission/index.js';
+import { admission as acceptAdmission, admissionKey, admissionScope, authentication, credentialAuthentication, input, keepAdmission, recallAdmission, requireVia, } from './admission/index.js';
 import { action, context, select, workflow } from './dispatch/index.js';
 import { active, settle } from './lifecycle/index.js';
 import { project, protocolError } from './result/index.js';
@@ -15,27 +15,102 @@ export async function invoke(request, inputConfig) {
     if (request.credential !== undefined && typeof request.credential !== 'string') {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const admitted = await admit(inputConfig.authority, {
+    const admission = {
         call: request.call,
         ...(request.credential === undefined ? {} : { credential: request.credential }),
         via: requireVia(request),
         domain: inputConfig.runtime.loaded.domain,
         context: request.context,
-    });
-    if (admitted === undefined)
-        return MISS;
-    const selected = select(inputConfig.runtime.loaded.registry, admitted);
-    if (selected === undefined)
-        return MISS;
-    if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
-        // The Kernel records a durable call as an Execution and runs it on the engine; running it
-        // inline here would silently drop durability.
-        throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
+    };
+    const { cache } = inputConfig;
+    const scope = cache === undefined
+        ? undefined
+        : admissionScope(inputConfig.runtime.loaded.registry, request.call);
+    if (cache === undefined || scope === undefined) {
+        return dispatchAdmitted(request, inputConfig, await admittedTarget(inputConfig, admission));
+    }
+    // The caller is verified before any kept admission is read: an unproven credential never learns
+    // whether another caller's admission is kept. A credential this verification refuses is decided
+    // as without a cache, the Kernel's admission first.
+    let established;
+    if (request.credential !== undefined) {
+        try {
+            established = await credentialAuthentication(request, inputConfig.runtime.loaded.domain, inputConfig.authority);
+        }
+        catch {
+            return dispatchAdmitted(request, inputConfig, await admittedTarget(inputConfig, admission));
+        }
+    }
+    let admitted;
+    try {
+        admitted = await recallOrAdmit(cache, scope, admission, inputConfig, established);
+    }
+    catch (cause) {
+        established?.close();
+        throw cause;
     }
-    input(selected.implementation.callable, request.call.input, request.context.binary);
-    const admittedAuthentication = await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
-    const close = once(admittedAuthentication.close);
+    return dispatchAdmitted(request, inputConfig, admitted, established);
+}
+/**
+ * The admission of a call whose callable declares an admission age: one this deployment kept while
+ * it is younger than the age it carried, else the source Kernel's, kept for the calls that follow.
+ */
+async function recallOrAdmit(cache, scope, admission, inputConfig, established) {
+    let key;
+    try {
+        key = await admissionKey(scope, {
+            kernel: admission.via.issuer,
+            release: inputConfig.runtime.loaded.release.document.digest,
+            ...(established === undefined
+                ? {}
+                : {
+                    caller: {
+                        principal: established.caller.principal,
+                        identity: established.caller.identity,
+                    },
+                }),
+        }, admission.call);
+    }
+    catch {
+        // Without a key nothing is kept or read: the Kernel admits this call.
+        return admittedTarget(inputConfig, admission);
+    }
+    const kept = await recallAdmission(cache, key, scope);
+    if (kept !== undefined)
+        return kept;
+    const sentAt = Date.now();
+    const admitted = await admit(inputConfig.authority, admission);
+    if (admitted === undefined)
+        return undefined;
+    keepAdmission(cache, key, scope, admitted, sentAt, admission.context.background);
+    return admitted.target;
+}
+/** The target the source Kernel admits, or undefined when it no longer places the call here. */
+async function admittedTarget(inputConfig, admission) {
+    return (await admit(inputConfig.authority, admission))?.target;
+}
+/** Run the admitted target: everything after admission, identical however it was admitted. */
+async function dispatchAdmitted(request, inputConfig, admitted, established) {
+    let admittedAuthentication = established;
+    let close = established === undefined ? undefined : once(established.close);
     try {
+        if (admitted === undefined) {
+            close?.();
+            return MISS;
+        }
+        const selected = select(inputConfig.runtime.loaded.registry, admitted);
+        if (selected === undefined) {
+            close?.();
+            return MISS;
+        }
+        if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
+            // The Kernel records a durable call as an Execution and runs it on the engine; running it
+            // inline here would silently drop durability.
+            throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
+        }
+        input(selected.implementation.callable, request.call.input, request.context.binary);
+        admittedAuthentication ??= await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
+        close ??= once(admittedAuthentication.close);
         active(request.context);
         const dispatchContext = context(request, inputConfig.runtime, admittedAuthentication, selected.self);
         const output = selected.implementation.kind === 'action'
@@ -44,7 +119,7 @@ export async function invoke(request, inputConfig) {
         return settle(project(selected.implementation.callable, output), close);
     }
     catch (cause) {
-        close();
+        close?.();
         throw cause;
     }
 }
@@ -64,7 +139,7 @@ async function admit(authority, admission) {
             return undefined;
         throw cause;
     }
-    return target(admitted);
+    return acceptAdmission(admitted);
 }
 function refusedAsMiss(cause) {
     return (cause instanceof errors.ProtocolError &&

package/dist/execution/serve.d.ts

@@ -2,6 +2,7 @@ import type { ServerCloseOptions } from '@astrale-os/kernel-server';
 import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../application/runtime/index.js';
 import type { WorkflowRunner } from '../application/workflow/runner/index.js';
+import type { DeploymentCache } from './cache/index.js';
 import type { Identity } from './identity/index.js';
 import type { ReleaseLoader } from './service/index.js';
 import type { ServiceServerOptions } from './service/index.js';
@@ -18,6 +19,13 @@ export interface ServeInput<Environment, RuntimeValue extends Runtime, RuntimeEn
     readonly server: ServiceServerOptions;
     readonly delivery?: (environment: Environment) => release.delivery.Provider | undefined;
     readonly workflows?: WorkflowRunner;
+    /**
+     * The deployment's cache of disposable entries, created once with the Service. It keeps the
+     * admissions of callables whose Schema declares an admission age, so that a call within that age
+     * skips its `Function.admit` round trip. Defaults to a bounded memory cache of this process or
+     * isolate; `false` keeps nothing, and every call is admitted by its source Kernel.
+     */
+    readonly cache?: ((environment: Environment) => DeploymentCache) | false;
     /**
      * Serve durable Workflows to the workflow engine; required when the Release declares any.
      * Undefined for an environment that names no engine: engine requests are then refused.

package/dist/execution/serve.js

@@ -1,3 +1,4 @@
+import { memoryCache } from './cache/index.js';
 import { createService } from './service/index.js';
 /** Create one provider-neutral Fetch entrypoint around a lazily initialized current Service. */
 export function serve(input) {
@@ -11,6 +12,9 @@ export function serve(input) {
             return service;
         if (typeof input.identity !== 'function')
             invalid();
+        if (input.cache !== undefined && input.cache !== false && typeof input.cache !== 'function') {
+            invalid();
+        }
         const runtimeEnvironment = input.initialize === undefined
             ? environment
             : input.initialize(environment);
@@ -22,6 +26,9 @@ export function serve(input) {
             server: input.server,
             ...(input.delivery === undefined ? {} : { delivery: input.delivery(environment) }),
             ...(input.workflows === undefined ? {} : { workflows: input.workflows }),
+            ...(input.cache === false
+                ? {}
+                : { cache: input.cache === undefined ? memoryCache() : input.cache(environment) }),
             ...(input.durable === undefined
                 ? {}
                 : { durable: (request) => input.durable(environment, request) }),

package/dist/execution/service/create.js

@@ -54,6 +54,7 @@ export function createService(input) {
             runtime,
             authority: selectedIdentity,
             ...(input.workflows === undefined ? {} : { workflows: input.workflows }),
+            ...(input.cache === undefined ? {} : { cache: input.cache }),
         }));
         running = Object.freeze({ release, runtime, server });
         if (!state.accepting)

package/dist/execution/service/service.d.ts

@@ -2,6 +2,7 @@ import type { ApplicationHost, ServerCloseOptions, ServerOptions } from '@astral
 import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../../application/runtime/index.js';
 import type { WorkflowRunner } from '../../application/workflow/runner/index.js';
+import type { DeploymentCache } from '../cache/index.js';
 import type { Identity } from '../identity/index.js';
 import type { ServedRelease } from '../runtime/index.js';
 import type { DurableServing, DurableServingProvider } from '../workflows/index.js';
@@ -18,6 +19,11 @@ export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtim
      */
     readonly delivery?: release.delivery.Provider;
     readonly workflows?: WorkflowRunner;
+    /**
+     * Where admissions of callables that declare an admission age are kept for the next calls.
+     * Absent: every call is admitted by its source Kernel.
+     */
+    readonly cache?: DeploymentCache;
     /**
      * Serve the Release's durable Workflows. A provider is resolved on the first engine request,
      * shared by concurrent requests, and retried after initialization fails.

package/dist/platform/schema/index.d.ts

@@ -18,7 +18,7 @@ export type { ClassIcon } from './class-icon.js';
 export type { StoredPropertyInputOf } from './property-input.js';
 export type { CallablePolicyBuilder, CallablePolicyContext, ClassRuleBuilder, ClassRuleContext, PolicyCheckContext, CallableProjection, AuthoredMethodProjection, AuthoredPropertyProjection, ClassIdentityProjection, ClassOwnerProjection, CoreEdge, CoreEndpoint, CoreNode, DefinedSchema, DirectedEdgeClass, ClassReferenceProjection, ClassProjection, FunctionProjection, EdgeClass, Function, Method, MethodProjection, Lazy, NodeClass, Policy, PolicyExistsContext, PolicyNodeBinder, PolicyPatternContext, Property, PropertyProjection, ResolvedDomainOfInput, View, } from '@astrale-os/kernel-dsl/v1/builder';
 export type { Array, Object, Value } from '@astrale-os/kernel-dsl/value';
-export type { CallableExecution, ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, PropertyImmutability, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
+export type { CallableAdmission, CallableExecution, ClassKind, DirectedEdgeContract, EdgeClassPolicies, NodeClassDefinition, PolicyCheckObject, PolicyObjectRef, PropertyFacet, PropertyImmutability, StateTopology, UndirectedEdgeContract, } from '@astrale-os/kernel-dsl/v1/language';
 export type { DomainSchema } from '@astrale-os/kernel-dsl/v1/schema';
 /** Kernel-owned Schema values used by authored product Schemas and graph operations. */
 export { AuthorityOperationOrder, AuthorityOperations, AuthorityRelations, KernelRootFunctions, OperationCore, operationOf, } from '@astrale-os/kernel-core/schema';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.35",
+  "version": "0.6.0-beta.36",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -257,11 +257,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "1.0.0-beta.11",
-    "@astrale-os/kernel-core": "1.0.0-beta.9",
-    "@astrale-os/kernel-dsl": "1.0.0-beta.4",
-    "@astrale-os/kernel-protocol": "1.0.0-beta.9",
-    "@astrale-os/kernel-server": "1.0.0-beta.9",
+    "@astrale-os/kernel-client": "1.0.0-beta.12",
+    "@astrale-os/kernel-core": "1.0.0-beta.10",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.5",
+    "@astrale-os/kernel-protocol": "1.0.0-beta.10",
+    "@astrale-os/kernel-server": "1.0.0-beta.10",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",