@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.41

package/dist/execution/invocation/admission/age.d.ts

@@ -0,0 +1,57 @@
+import type * as invocation from '@astrale-os/kernel-protocol/invocation';
+import type { RuntimeRegistry } from '../../../application/runtime/index.js';
+import type { DeploymentCache } from '../../cache/index.js';
+import type { Admission, InvocationTarget } from './target.js';
+/**
+ * How long reading a kept admission may take before the call asks its Kernel instead. Reads of a
+ * shared platform cache answer in single-digit milliseconds; `Function.admit` costs tens.
+ */
+export declare const ADMISSION_RECALL_TIMEOUT_MS = 30;
+/** The callables a call can be admitted to, when one of them declares an admission age. */
+export interface AdmissionScope {
+    /** Keys of the implementations the call target names: an admission to any other is not kept. */
+    readonly callables: ReadonlySet<string>;
+    /** The input fields their Policies read, the only part of the input an admission depends on. */
+    readonly fields: readonly string[];
+}
+/**
+ * Whose admission one call asks for: the source Kernel, the release this deployment serves, and
+ * the caller its credential proved, verified here before any kept admission is read.
+ */
+export interface AdmissionPartition {
+    readonly kernel: string;
+    readonly release: string;
+    /** Absent for a call that carries no credential. */
+    readonly caller?: {
+        readonly principal: string;
+        readonly identity: string;
+    };
+}
+/**
+ * The scope of a call whose target names, before the graph is read, implementations of which one
+ * declares an admission age. Undefined otherwise: a target that names no local implementation (a
+ * callable Node id, a path ending in a traversal), only callables without an age, or a durable
+ * Workflow, which runs only as a Kernel Execution. The Path language dispatches exactly, so a named
+ * target selects one declaration; the fields are still the union over every implementation named.
+ */
+export declare function admissionScope(registry: RuntimeRegistry, call: invocation.Call): AdmissionScope | undefined;
+/** Whether any implementation of this registry declares an admission age. */
+export declare function declaresAdmissionAge(registry: RuntimeRegistry): boolean;
+/**
+ * The cache key of one call's admission: a SHA-256 over the source Kernel, the served release, the
+ * verified principal and caller, the canonical call target (receiver included) and the input
+ * projected on the fields its Policy reads. A missing field differs from `null`, object keys are
+ * sorted at every depth, and no other part of the input enters the key.
+ */
+export declare function admissionKey(scope: AdmissionScope, partition: AdmissionPartition, call: invocation.Call): Promise<string>;
+/**
+ * The target of an admission this deployment kept under `key`, while it is younger than the age it
+ * carried. A missing, expired, malformed, out-of-scope, failed or late read is a miss.
+ */
+export declare function recallAdmission(cache: DeploymentCache, key: string, scope: AdmissionScope): Promise<InvocationTarget | undefined>;
+/**
+ * Keep a successful admission that carries an age, until `sentAt` plus that age, `sentAt` being when
+ * `Function.admit` was asked. Written in the background: the call never waits on the cache, and a
+ * cache that fails to keep it only costs a later call its admission round trip.
+ */
+export declare function keepAdmission(cache: DeploymentCache, key: string, scope: AdmissionScope, admitted: Admission, sentAt: number, background: (task: () => PromiseLike<unknown>) => void): void;

package/dist/execution/invocation/admission/age.js

@@ -0,0 +1,208 @@
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { admissionInputFields, MAXIMUM_ADMISSION_AGE_SECONDS, } from '@astrale-os/kernel-dsl/v1/language';
+import { Path } from '../../../platform/graph/path/index.js';
+import { target as acceptTarget } from './target.js';
+/**
+ * How long reading a kept admission may take before the call asks its Kernel instead. Reads of a
+ * shared platform cache answer in single-digit milliseconds; `Function.admit` costs tens.
+ */
+export const ADMISSION_RECALL_TIMEOUT_MS = 30;
+/** Version of the key and entry encodings below; a change makes every kept admission a miss. */
+const ENCODING = 'astrale.admission/1';
+const ENTRY_FIELDS = new Set(['v', 'callable', 'receiver', 'expiresAt']);
+/**
+ * The scope of a call whose target names, before the graph is read, implementations of which one
+ * declares an admission age. Undefined otherwise: a target that names no local implementation (a
+ * callable Node id, a path ending in a traversal), only callables without an age, or a durable
+ * Workflow, which runs only as a Kernel Execution. The Path language dispatches exactly, so a named
+ * target selects one declaration; the fields are still the union over every implementation named.
+ */
+export function admissionScope(registry, call) {
+    const names = declarationsNamedBy(call.target);
+    const named = registry.implementations.filter(({ callable }) => names(callable.key));
+    if (named.every(({ callable }) => callable.admission === undefined))
+        return undefined;
+    if (named.some((implementation) => implementation.kind === 'workflow' && implementation.durable)) {
+        return undefined;
+    }
+    const fields = new Set();
+    for (const { callable } of named) {
+        for (const field of admissionInputFields(callable.policy))
+            fields.add(field);
+    }
+    return Object.freeze({
+        callables: new Set(named.map(({ callable }) => callable.key)),
+        fields: Object.freeze([...fields].sort()),
+    });
+}
+/** Whether any implementation of this registry declares an admission age. */
+export function declaresAdmissionAge(registry) {
+    return registry.implementations.some(({ callable }) => callable.admission !== undefined);
+}
+/**
+ * The cache key of one call's admission: a SHA-256 over the source Kernel, the served release, the
+ * verified principal and caller, the canonical call target (receiver included) and the input
+ * projected on the fields its Policy reads. A missing field differs from `null`, object keys are
+ * sorted at every depth, and no other part of the input enters the key.
+ */
+export async function admissionKey(scope, partition, call) {
+    const encoded = JSON.stringify([
+        ENCODING,
+        partition.kernel,
+        partition.release,
+        partition.caller?.principal ?? null,
+        partition.caller?.identity ?? null,
+        canonical(call.target),
+        projection(call.input, scope.fields),
+    ]);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(encoded));
+    return `admission/${hex(new Uint8Array(digest))}`;
+}
+/**
+ * The target of an admission this deployment kept under `key`, while it is younger than the age it
+ * carried. A missing, expired, malformed, out-of-scope, failed or late read is a miss.
+ */
+export async function recallAdmission(cache, key, scope) {
+    const value = await boundedRead(cache, key);
+    return value === undefined ? undefined : keptTarget(value, scope, Date.now());
+}
+/**
+ * Keep a successful admission that carries an age, until `sentAt` plus that age, `sentAt` being when
+ * `Function.admit` was asked. Written in the background: the call never waits on the cache, and a
+ * cache that fails to keep it only costs a later call its admission round trip.
+ */
+export function keepAdmission(cache, key, scope, admitted, sentAt, background) {
+    if (admitted.maxAge === undefined || !scope.callables.has(admitted.target.callable))
+        return;
+    const expiresAt = sentAt + admitted.maxAge * 1000;
+    const value = JSON.stringify({
+        v: 1,
+        callable: admitted.target.callable,
+        ...(admitted.target.receiver === undefined ? {} : { receiver: admitted.target.receiver }),
+        expiresAt,
+    });
+    try {
+        background(async () => {
+            try {
+                await cache.put(key, value, expiresAt);
+            }
+            catch {
+                // A cache that cannot keep this admission leaves the next call to its Kernel.
+            }
+        });
+    }
+    catch {
+        // A Server that no longer accepts background work keeps nothing; the call is unaffected.
+    }
+}
+function keptTarget(value, scope, now) {
+    let entry;
+    try {
+        entry = JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(entry) || Reflect.ownKeys(entry).some((key) => !ENTRY_FIELDS.has(key))) {
+        return undefined;
+    }
+    const { v, callable, receiver, expiresAt } = entry;
+    if (v !== 1 ||
+        typeof callable !== 'string' ||
+        !scope.callables.has(callable) ||
+        typeof expiresAt !== 'number' ||
+        !Number.isSafeInteger(expiresAt) ||
+        expiresAt <= now ||
+        expiresAt > now + MAXIMUM_ADMISSION_AGE_SECONDS * 1000) {
+        return undefined;
+    }
+    try {
+        return acceptTarget({ callable, ...(receiver === undefined ? {} : { receiver }) });
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One read bounded in time; a cache error is a miss. No pending read is shared across calls. */
+async function boundedRead(cache, key) {
+    let timer;
+    const read = Promise.resolve()
+        .then(() => cache.get(key))
+        .then((value) => (typeof value === 'string' ? value : undefined), () => undefined);
+    const late = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(undefined), ADMISSION_RECALL_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([read, late]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/** The declarations `target` names before the graph is read, as a test on a callable key. */
+function declarationsNamedBy(target) {
+    if (typeof target !== 'string')
+        return (key) => target.callable === key;
+    let path;
+    try {
+        path = Path.parse(target);
+    }
+    catch {
+        return () => false;
+    }
+    const { anchor, steps } = path.ast;
+    const last = steps.at(-1);
+    const first = steps[0];
+    return (key) => {
+        const coordinate = callableAddress(key);
+        if (coordinate.kind === 'method') {
+            if (last?.kind !== 'method' || last.name !== coordinate.name)
+                return false;
+            if (last.dispatch === 'instance')
+                return last.class === Key.of(coordinate.owner);
+            return (anchor.kind === 'domain' &&
+                anchor.origin === coordinate.owner.origin &&
+                steps.length === 2 &&
+                first?.kind === 'projection' &&
+                first.projection.kind === 'class' &&
+                first.projection.name === coordinate.owner.name);
+        }
+        return (anchor.kind === 'domain' &&
+            anchor.origin === coordinate.origin &&
+            steps.length === 1 &&
+            first?.kind === 'projection' &&
+            first.projection.kind === 'function' &&
+            first.projection.name === coordinate.name);
+    };
+}
+/** The input on the fields a Policy reads: each present field with its value, or its name alone. */
+function projection(input, fields) {
+    if (fields.length === 0)
+        return [];
+    if (!isRecord(input))
+        return ['other'];
+    return [
+        'object',
+        ...fields.map((field) => Object.hasOwn(input, field) ? [field, canonical(input[field])] : [field]),
+    ];
+}
+/** Canonical JSON text of a portable value: object keys sorted at every depth. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const object = value;
+        return `{${Object.keys(object)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(object[key])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function isRecord(input) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input);
+}
+function hex(bytes) {
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,17 +1,17 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
-import type { AnonymousCaller, AuthenticatedCaller, ResolvedCallable } from '../../../application/action/index.js';
-import type { Release } from '../../../deployment/release/index.js';
+import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
-import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
-export interface AnonymousInvocation {
+import type { AuthenticatedInvocation, InvocationAuthority, SelfInvocation } from './authority.js';
+/** A call without a credential: no caller, and the installed Domain's own capabilities. */
+export interface AnonymousInvocation extends SelfInvocation {
     readonly caller: AnonymousCaller;
-    readonly kernel: null;
-    readonly graph: null;
-    close(): void;
 }
-interface AdmittedAuthenticatedInvocation extends Omit<AuthenticatedInvocation, 'caller'> {
-    readonly caller: AuthenticatedCaller;
-}
-export type InvocationAuthentication = AnonymousInvocation | AdmittedAuthenticatedInvocation;
-export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
-export {};
+export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+/**
+ * The sessions one invocation holds toward its source Kernel: the Domain's own always, its
+ * caller's only when the call carried a credential.
+ */
+export type InvocationSessions = InvocationAuthentication['graph'];
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+/** Verify the credential a call carries and admit the caller it proves, whatever the callable. */
+export declare function credentialAuthentication(request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<AuthenticatedInvocation>;

package/dist/execution/invocation/admission/authentication.js

@@ -1,18 +1,18 @@
-import { grant, issuer } from '../../../platform/auth/index.js';
+import { issuer } from '../../../platform/auth/index.js';
 import { bindSession } from '../../../platform/client/session/index.js';
 import { NodeId } from '../../../platform/graph/node/index.js';
 import { protocolError } from '../result/index.js';
 import { requireVia } from './authority.js';
-const ANONYMOUS = Object.freeze({
-    caller: Object.freeze({ kind: 'anonymous' }),
-    kernel: null,
-    graph: null,
-    close() { },
-});
-export async function authentication(callable, request, release, domain, authority) {
+const ANONYMOUS = Object.freeze({ kind: 'anonymous' });
+export async function authentication(callable, request, domain, authority) {
+    if (callable.auth === 'anonymous' && request.credential === undefined) {
+        return anonymous(await authority.self({ via: requireVia(request), domain, context: request.context }));
+    }
+    return credentialAuthentication(request, domain, authority);
+}
+/** Verify the credential a call carries and admit the caller it proves, whatever the callable. */
+export async function credentialAuthentication(request, domain, authority) {
     const credential = request.credential;
-    if (callable.auth === 'anonymous' && credential === undefined)
-        return ANONYMOUS;
     if (credential === undefined) {
         throw protocolError('AUTH_MISSING', 'Authentication is required.');
     }
@@ -21,7 +21,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });
@@ -36,34 +35,54 @@ export async function authentication(callable, request, release, domain, authori
             invalid();
         }
         const caller = admitCaller(authenticated.caller);
-        const graphInput = admitGraph(authenticated.graph);
+        const graphInput = admitGraph(authenticated.graph, ['caller', 'self']);
         const graph = Object.freeze({
             caller: bindSession(graphInput.caller),
             self: bindSession(graphInput.self),
-            union: bindSession(graphInput.union),
         });
         return Object.freeze({ caller, graph, close });
     }
     catch (cause) {
-        if (close === undefined)
-            invalid(cause);
-        try {
-            close();
-        }
-        catch (cleanup) {
-            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        rejectClosing(close, cause);
+    }
+}
+/** Admit the Domain's own capabilities for a call that carries no credential. */
+function anonymous(own) {
+    let close;
+    try {
+        close = captureClose(own);
+        if (own === null ||
+            typeof own !== 'object' ||
+            Array.isArray(own) ||
+            Reflect.ownKeys(own).some((key) => key !== 'graph' && key !== 'close') ||
+            close === undefined) {
+            invalid();
         }
+        const graph = Object.freeze({ self: bindSession(admitGraph(own.graph, ['self']).self) });
+        return Object.freeze({ caller: ANONYMOUS, graph, close });
+    }
+    catch (cause) {
+        rejectClosing(close, cause);
+    }
+}
+/** Release whatever the authority opened before refusing its invalid capabilities. */
+function rejectClosing(close, cause) {
+    if (close === undefined)
         invalid(cause);
+    try {
+        close();
+    }
+    catch (cleanup) {
+        throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid capabilities and cleanup failed.');
     }
+    invalid(cause);
 }
-function admitGraph(input) {
+function admitGraph(input, modes) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        !Object.hasOwn(input, 'caller') ||
-        !Object.hasOwn(input, 'self') ||
-        !Object.hasOwn(input, 'union') ||
-        Reflect.ownKeys(input).some((key) => key !== 'caller' && key !== 'self' && key !== 'union')) {
+        modes.some((mode) => !Object.hasOwn(input, mode)) ||
+        Reflect.ownKeys(input).some((key) => !modes.includes(key))) {
         invalid();
     }
     return input;
@@ -79,29 +98,18 @@ function admitCaller(input) {
         invalid();
     if (!Object.hasOwn(input, 'kind') ||
         !Object.hasOwn(input, 'principal') ||
-        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'identity') ||
         !Object.hasOwn(input, 'authentication') ||
-        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'identity' && key !== 'authentication') ||
         Reflect.get(input, 'kind') !== 'authenticated') {
         invalid();
     }
-    const principal = NodeId(Reflect.get(input, 'principal'));
-    const authority = grant.accept(Reflect.get(input, 'authority'));
-    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
-    const caller = {
+    return Object.freeze({
         kind: 'authenticated',
-        get identity() {
-            if (authority.expr.kind !== 'identity') {
-                throw new TypeError('Caller authority does not resolve to one exact Identity.');
-            }
-            return authority.expr.id;
-        },
-        principal,
-        authority,
-        authentication,
-    };
-    Object.defineProperty(caller, 'identity', { enumerable: false });
-    return Object.freeze(caller);
+        identity: NodeId(Reflect.get(input, 'identity')),
+        principal: NodeId(Reflect.get(input, 'principal')),
+        authentication: admitEvidence(Reflect.get(input, 'authentication')),
+    });
 }
 function admitEvidence(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
@@ -148,6 +156,6 @@ function optionalTime(input) {
     return input === undefined || (typeof input === 'number' && Number.isFinite(input));
 }
 function invalid(cause) {
-    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    const message = 'Invocation authority returned invalid capabilities.';
     throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
 }

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/publication';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -8,27 +7,50 @@ export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
     readonly via: invocation.Via;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
     readonly via: invocation.Via;
-    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface InvocationSelfInput {
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 /** Authenticated capabilities before the SDK admits and derives application caller context. */
 export interface AuthenticatedInvocation {
-    readonly caller: Omit<AuthenticatedCaller, 'identity'>;
-    readonly graph: Readonly<Record<'caller' | 'self' | 'union', BoundClientSession>>;
+    readonly caller: AuthenticatedCaller;
+    readonly graph: Readonly<Record<'caller' | 'self', BoundClientSession>>;
+    close(): void;
+}
+/** The Domain's own capabilities, before the SDK admits them for a call without a credential. */
+export interface SelfInvocation {
+    readonly graph: Readonly<Record<'self', BoundClientSession>>;
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+    /**
+     * The Domain's own authority toward the source Kernel, for an admitted call to an `anonymous`
+     * callable that carries no credential: its handler acts as the installed Domain, never as a
+     * caller.
+     */
+    self(input: InvocationSelfInput): Promise<SelfInvocation>;
 }
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact ReleaseRef of this immutable deployment.
+ */
 export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -1,17 +1,24 @@
 import { protocolError } from '../result/index.js';
-/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+/** Capture the execution Identity capability and receiver-bind its privileged operations. */
 export function authority(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
         invalid();
-    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+    if (typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function' ||
+        typeof input.self !== 'function') {
         invalid();
     }
     const receiver = Object.freeze({ ...input });
     return Object.freeze({
         admit: receiver.admit.bind(receiver),
         authenticate: receiver.authenticate.bind(receiver),
+        self: receiver.self.bind(receiver),
     });
 }
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact ReleaseRef of this immutable deployment.
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');

package/dist/execution/invocation/admission/index.d.ts

@@ -1,5 +1,6 @@
+export { ADMISSION_RECALL_TIMEOUT_MS, admissionKey, admissionScope, declaresAdmissionAge, keepAdmission, recallAdmission, type AdmissionPartition, type AdmissionScope, } from './age.js';
 export { authority, requireVia } from './authority.js';
-export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
-export { authentication, type InvocationAuthentication } from './authentication.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, InvocationSelfInput, SelfInvocation, } from './authority.js';
+export { authentication, credentialAuthentication, type AnonymousInvocation, type InvocationAuthentication, type InvocationSessions, } from './authentication.js';
 export { input } from './input.js';
-export { target, type InvocationTarget } from './target.js';
+export { admission, target, type Admission, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -1,4 +1,5 @@
+export { ADMISSION_RECALL_TIMEOUT_MS, admissionKey, admissionScope, declaresAdmissionAge, keepAdmission, recallAdmission, } from './age.js';
 export { authority, requireVia } from './authority.js';
-export { authentication } from './authentication.js';
+export { authentication, credentialAuthentication, } from './authentication.js';
 export { input } from './input.js';
-export { target } from './target.js';
+export { admission, target } from './target.js';

package/dist/execution/invocation/admission/input.d.ts

@@ -1,2 +1,2 @@
-import type { ResolvedCallable } from '../../../application/action/index.js';
-export declare function input(callable: ResolvedCallable, value: unknown): void;
+import type { ResolvedCallable, ActionBinaryInput } from '../../../application/action/index.js';
+export declare function input(callable: ResolvedCallable, value: unknown, binary?: ActionBinaryInput): void;

package/dist/execution/invocation/admission/input.js

@@ -1,4 +1,18 @@
-import { validateInput } from '../result/index.js';
-export function input(callable, value) {
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
+import { validateInput, protocolError } from '../result/index.js';
+export function input(callable, value, binary) {
+    if (isBinaryInput(callable.input)) {
+        if (binary === undefined) {
+            throw protocolError('VALIDATION_ERROR', 'Binary Function request body is required.');
+        }
+        if (!Number.isSafeInteger(binary.length) ||
+            binary.length < 0 ||
+            binary.length > callable.input.maximumBytes) {
+            throw protocolError('LIMIT_EXCEEDED', 'Binary Function request body exceeds its limit.');
+        }
+    }
+    else if (binary !== undefined) {
+        throw protocolError('VALIDATION_ERROR', 'Callable does not accept a binary request body.');
+    }
     validateInput(callable, value);
 }

package/dist/execution/invocation/admission/target.d.ts

@@ -4,5 +4,16 @@ export interface InvocationTarget {
     readonly callable: SemanticKey.Callable;
     readonly receiver?: NodePath;
 }
+/** The source Kernel's answer to `Function.admit`. */
+export interface Admission {
+    readonly target: InvocationTarget;
+    /**
+     * How long, in seconds from when it was asked, this deployment may reuse the admission: the
+     * callable's declared admission age bounded by the Kernel cap. Absent: this call only.
+     */
+    readonly maxAge?: number;
+}
+/** Admit the `Function.admit` answer: the selected target and the admission age it carries. */
+export declare function admission(input: unknown): Admission;
 /** Admit the portable target selected by the execution Identity owner. */
 export declare function target(input: unknown): InvocationTarget;

package/dist/execution/invocation/admission/target.js

@@ -1,11 +1,25 @@
 import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isAdmissionMaxAge } from '@astrale-os/kernel-dsl/v1/language';
 import { NodePath as acceptNodePath } from '../../../platform/graph/path/index.js';
 import { InvocationDefect } from '../result/index.js';
+/** Admit the `Function.admit` answer: the selected target and the admission age it carries. */
+export function admission(input) {
+    const value = record(input);
+    if (Reflect.ownKeys(value).some((key) => key !== 'callable' && key !== 'receiver' && key !== 'maxAge')) {
+        invalid();
+    }
+    const { maxAge } = value;
+    if (maxAge !== undefined && !isAdmissionMaxAge(maxAge))
+        invalid();
+    const selected = target({
+        callable: value.callable,
+        ...(value.receiver === undefined ? {} : { receiver: value.receiver }),
+    });
+    return Object.freeze({ target: selected, ...(maxAge === undefined ? {} : { maxAge }) });
+}
 /** Admit the portable target selected by the execution Identity owner. */
 export function target(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        invalid();
-    const value = input;
+    const value = record(input);
     if (!Object.hasOwn(value, 'callable') ||
         Reflect.ownKeys(value).some((key) => key !== 'callable' && key !== 'receiver') ||
         typeof value.callable !== 'string') {
@@ -25,6 +39,11 @@ export function target(input) {
     }
     return Object.freeze({ callable, ...(receiver === undefined ? {} : { receiver }) });
 }
+function record(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    return input;
+}
 function invalid() {
     throw new InvocationDefect('INVOCATION_TARGET_INVALID', 'Invocation target is invalid.');
 }