ankka 0.7.1 → 0.8.0

package/dist/_proto/ankka/protocol/v1/discovery_pb.d.ts

@@ -1,5 +1,5 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { EmptySchema } from "./payload_pb.ts";
+import type { Empty, EmptySchema } from "./payload_pb.ts";
 import type { Message, UnknownEnum } from "@bufbuild/protobuf";
 /**
  * Describes the file ankka/protocol/v1/discovery.proto.
@@ -441,6 +441,12 @@ export type Endpoint = Message<"ankka.protocol.v1.Endpoint"> & {
      * @generated from field: repeated ankka.protocol.v1.Route routes = 4;
      */
     routes: Route[];
+    /**
+     * Read only when `acl` is CALLERS: the callers admitted, any one of which suffices (protocol 1.1).
+     *
+     * @generated from field: repeated ankka.protocol.v1.CallerMatcher allow_callers = 5;
+     */
+    allowCallers: CallerMatcher[];
 };
 /**
  * Describes the message ankka.protocol.v1.Endpoint.
@@ -463,6 +469,10 @@ export declare const Endpoint_Acl: {
      * @generated from enum value: AUTHENTICATED = 2;
      */
     readonly AUTHENTICATED: 2;
+    /**
+     * @generated from enum value: CALLERS = 3;
+     */
+    readonly CALLERS: 3;
 };
 /**
  * @generated from enum ankka.protocol.v1.Endpoint.Acl
@@ -472,6 +482,67 @@ export type Endpoint_Acl = (typeof Endpoint_Acl)[keyof typeof Endpoint_Acl] | Un
  * Describes the enum ankka.protocol.v1.Endpoint.Acl.
  */
 export declare const Endpoint_AclSchema: GenEnum<Endpoint_Acl>;
+/**
+ * One kind of caller a CALLERS acl admits. A named service with no project means this service's own.
+ *
+ * @generated from message ankka.protocol.v1.CallerMatcher
+ */
+export type CallerMatcher = Message<"ankka.protocol.v1.CallerMatcher"> & {
+    /**
+     * @generated from oneof ankka.protocol.v1.CallerMatcher.kind
+     */
+    kind: {
+        /**
+         * @generated from field: ankka.protocol.v1.Empty internet = 1;
+         */
+        value: Empty;
+        case: "internet";
+    } | {
+        /**
+         * @generated from field: ankka.protocol.v1.NamedService service = 2;
+         */
+        value: NamedService;
+        case: "service";
+    } | {
+        /**
+         * @generated from field: ankka.protocol.v1.Empty any_in_project = 3;
+         */
+        value: Empty;
+        case: "anyInProject";
+    } | {
+        /**
+         * @generated from field: ankka.protocol.v1.Empty self = 4;
+         */
+        value: Empty;
+        case: "self";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message ankka.protocol.v1.CallerMatcher.
+ * Use `create(CallerMatcherSchema)` to create a new message.
+ */
+export declare const CallerMatcherSchema: GenMessage<CallerMatcher>;
+/**
+ * @generated from message ankka.protocol.v1.NamedService
+ */
+export type NamedService = Message<"ankka.protocol.v1.NamedService"> & {
+    /**
+     * @generated from field: optional string project = 1;
+     */
+    project?: string | undefined;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+};
+/**
+ * Describes the message ankka.protocol.v1.NamedService.
+ * Use `create(NamedServiceSchema)` to create a new message.
+ */
+export declare const NamedServiceSchema: GenMessage<NamedService>;
 /**
  * @generated from message ankka.protocol.v1.Route
  */
@@ -512,6 +583,12 @@ export type Route = Message<"ankka.protocol.v1.Route"> & {
      * @generated from field: optional ankka.protocol.v1.Endpoint.Acl acl = 6;
      */
     acl?: Endpoint_Acl | undefined;
+    /**
+     * The route's own callers, read only when its `acl` is CALLERS.
+     *
+     * @generated from field: repeated ankka.protocol.v1.CallerMatcher allow_callers = 7;
+     */
+    allowCallers: CallerMatcher[];
 };
 /**
  * Describes the message ankka.protocol.v1.Route.

package/dist/_proto/ankka/protocol/v1/discovery_pb.js

@@ -5,7 +5,7 @@ import { file_ankka_protocol_v1_payload } from "./payload_pb.js";
 /**
  * Describes the file ankka/protocol/v1/discovery.proto.
  */
-export const file_ankka_protocol_v1_discovery = /*@__PURE__*/ fileDesc("CiFhbmtrYS9wcm90b2NvbC92MS9kaXNjb3ZlcnkucHJvdG8SEWFua2thLnByb3RvY29sLnYxIkAKC1NpZGVjYXJJbmZvEhgKEHByb3RvY29sX3ZlcnNpb24YASABKAkSFwoPcnVudGltZV92ZXJzaW9uGAIgASgJIqsBCgRTcGVjEhgKEHByb3RvY29sX3ZlcnNpb24YASABKAkSJwoDc2RrGAIgASgLMhouYW5ra2EucHJvdG9jb2wudjEuU2RrSW5mbxIwCgpjb21wb25lbnRzGAMgAygLMhwuYW5ra2EucHJvdG9jb2wudjEuQ29tcG9uZW50Ei4KCWVuZHBvaW50cxgEIAMoCzIbLmFua2thLnByb3RvY29sLnYxLkVuZHBvaW50IigKB1Nka0luZm8SDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJIvoDCglDb21wb25lbnQSJQoEa2luZBgBIAEoDjIXLmFua2thLnByb3RvY29sLnYxLktpbmQSCgoCaWQYAiABKAkSLAoIaGFuZGxlcnMYAyADKAsyGi5hbmtrYS5wcm90b2NvbC52MS5IYW5kbGVyEj4KDWV2ZW50X3NvdXJjZWQYCiABKAsyJS5hbmtrYS5wcm90b2NvbC52MS5FdmVudFNvdXJjZWREZXRhaWxIABI2CglrZXlfdmFsdWUYCyABKAsyIS5hbmtrYS5wcm90b2NvbC52MS5LZXlWYWx1ZURldGFpbEgAEjUKCHdvcmtmbG93GAwgASgLMiEuYW5ra2EucHJvdG9jb2wudjEuV29ya2Zsb3dEZXRhaWxIABItCgR2aWV3GA0gASgLMh0uYW5ra2EucHJvdG9jb2wudjEuVmlld0RldGFpbEgAEjUKCGNvbnN1bWVyGA4gASgLMiEuYW5ra2EucHJvdG9jb2wudjEuQ29uc3VtZXJEZXRhaWxIABI8Cgx0aW1lZF9hY3Rpb24YDyABKAsyJC5hbmtrYS5wcm90b2NvbC52MS5UaW1lZEFjdGlvbkRldGFpbEgAEi8KBWFnZW50GBAgASgLMh4uYW5ra2EucHJvdG9jb2wudjEuQWdlbnREZXRhaWxIAEIICgZkZXRhaWwiPQoHSGFuZGxlchIMCgRuYW1lGAEgASgJEhEKCXJlYWRfb25seRgCIAEoCBIRCglzdHJlYW1pbmcYAyABKAgiLAoSRXZlbnRTb3VyY2VkRGV0YWlsEhYKDnNuYXBzaG90X2V2ZXJ5GAEgASgFIhAKDktleVZhbHVlRGV0YWlsIv8ECg5Xb3JrZmxvd0RldGFpbBINCgVzdGVwcxgBIAMoCRJBCghzZXR0aW5ncxgCIAEoCzIqLmFua2thLnByb3RvY29sLnYxLldvcmtmbG93RGV0YWlsLlNldHRpbmdzSACIAQEaowIKCFNldHRpbmdzEhsKDnRpbWVvdXRfbWlsbGlzGAEgASgDSACIAQESKAobZGVmYXVsdF9zdGVwX3RpbWVvdXRfbWlsbGlzGAIgASgDSAGIAQESSQoQZGVmYXVsdF9yZWNvdmVyeRgDIAEoCzIqLmFua2thLnByb3RvY29sLnYxLldvcmtmbG93RGV0YWlsLlJlY292ZXJ5SAKIAQESPQoFc3RlcHMYBCADKAsyLi5hbmtrYS5wcm90b2NvbC52MS5Xb3JrZmxvd0RldGFpbC5TdGVwU2V0dGluZ3NCEQoPX3RpbWVvdXRfbWlsbGlzQh4KHF9kZWZhdWx0X3N0ZXBfdGltZW91dF9taWxsaXNCEwoRX2RlZmF1bHRfcmVjb3ZlcnkanAEKDFN0ZXBTZXR0aW5ncxIMCgRzdGVwGAEgASgJEhsKDnRpbWVvdXRfbWlsbGlzGAIgASgDSACIAQESQQoIcmVjb3ZlcnkYAyABKAsyKi5hbmtrYS5wcm90b2NvbC52MS5Xb3JrZmxvd0RldGFpbC5SZWNvdmVyeUgBiAEBQhEKD190aW1lb3V0X21pbGxpc0ILCglfcmVjb3ZlcnkaSQoIUmVjb3ZlcnkSEwoLbWF4X3JldHJpZXMYASABKAUSGAoLZmFpbG92ZXJfdG8YAiABKAlIAIgBAUIOCgxfZmFpbG92ZXJfdG9CCwoJX3NldHRpbmdzIqMBCgZTb3VyY2USOwoJY29tcG9uZW50GAEgASgLMiYuYW5ra2EucHJvdG9jb2wudjEuU291cmNlLkNvbXBvbmVudFJlZkgAEg8KBXRvcGljGAIgASgJSAAaQQoMQ29tcG9uZW50UmVmEiUKBGtpbmQYASABKA4yFy5hbmtrYS5wcm90b2NvbC52MS5LaW5kEgoKAmlkGAIgASgJQggKBnNvdXJjZSJeCgpWaWV3RGV0YWlsEikKBnNvdXJjZRgBIAEoCzIZLmFua2thLnByb3RvY29sLnYxLlNvdXJjZRIUCgxyb3dfbWFuaWZlc3QYAiABKAkSDwoHcXVlcmllcxgDIAMoCSJlCg5Db25zdW1lckRldGFpbBIpCgZzb3VyY2UYASABKAsyGS5hbmtrYS5wcm90b2NvbC52MS5Tb3VyY2USGAoLcHJvZHVjZXNfdG8YAiABKAlIAIgBAUIOCgxfcHJvZHVjZXNfdG8iEwoRVGltZWRBY3Rpb25EZXRhaWwidAoLQWdlbnREZXRhaWwSDAoEcm9sZRgBIAEoCRIbChNtYXhfdG9vbF9jYWxsX3N0ZXBzGAIgASgFEiYKBXRvb2xzGAMgAygLMhcuYW5ra2EucHJvdG9jb2wudjEuVG9vbBISCgpndWFyZHJhaWxzGAQgAygJIkQKBFRvb2wSDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIZChFpbnB1dF9zY2hlbWFfanNvbhgDIAEoCSK1AQoIRW5kcG9pbnQSCgoCaWQYASABKAkSDgoGcHJlZml4GAIgASgJEiwKA2FjbBgDIAEoDjIfLmFua2thLnByb3RvY29sLnYxLkVuZHBvaW50LkFjbBIoCgZyb3V0ZXMYBCADKAsyGC5hbmtrYS5wcm90b2NvbC52MS5Sb3V0ZSI1CgNBY2wSDQoJQUxMT1dfQUxMEAASDAoIREVOWV9BTEwQARIRCg1BVVRIRU5USUNBVEVEEAIilQEKBVJvdXRlEgoKAmlkGAEgASgJEg4KBm1ldGhvZBgCIAEoCRIQCgh0ZW1wbGF0ZRgDIAEoCRIQCghoYXNfYm9keRgEIAEoCBIRCglzdHJlYW1pbmcYBSABKAgSMQoDYWNsGAYgASgOMh8uYW5ra2EucHJvdG9jb2wudjEuRW5kcG9pbnQuQWNsSACIAQFCBgoEX2FjbCIaCgdQcm9ibGVtEg8KB21lc3NhZ2UYASABKAkqeQoES2luZBIYChRFVkVOVF9TT1VSQ0VEX0VOVElUWRAAEhQKEEtFWV9WQUxVRV9FTlRJVFkQARIMCghXT1JLRkxPVxACEggKBFZJRVcQAxIMCghDT05TVU1FUhAEEhAKDFRJTUVEX0FDVElPThAFEgkKBUFHRU5UEAYylQEKCURpc2NvdmVyeRJDCghEaXNjb3ZlchIeLmFua2thLnByb3RvY29sLnYxLlNpZGVjYXJJbmZvGhcuYW5ra2EucHJvdG9jb2wudjEuU3BlYxJDCgtSZXBvcnRFcnJvchIaLmFua2thLnByb3RvY29sLnYxLlByb2JsZW0aGC5hbmtrYS5wcm90b2NvbC52MS5FbXB0eWIGcHJvdG8z", [file_ankka_protocol_v1_payload]);
+export const file_ankka_protocol_v1_discovery = /*@__PURE__*/ fileDesc("CiFhbmtrYS9wcm90b2NvbC92MS9kaXNjb3ZlcnkucHJvdG8SEWFua2thLnByb3RvY29sLnYxIkAKC1NpZGVjYXJJbmZvEhgKEHByb3RvY29sX3ZlcnNpb24YASABKAkSFwoPcnVudGltZV92ZXJzaW9uGAIgASgJIqsBCgRTcGVjEhgKEHByb3RvY29sX3ZlcnNpb24YASABKAkSJwoDc2RrGAIgASgLMhouYW5ra2EucHJvdG9jb2wudjEuU2RrSW5mbxIwCgpjb21wb25lbnRzGAMgAygLMhwuYW5ra2EucHJvdG9jb2wudjEuQ29tcG9uZW50Ei4KCWVuZHBvaW50cxgEIAMoCzIbLmFua2thLnByb3RvY29sLnYxLkVuZHBvaW50IigKB1Nka0luZm8SDAoEbmFtZRgBIAEoCRIPCgd2ZXJzaW9uGAIgASgJIvoDCglDb21wb25lbnQSJQoEa2luZBgBIAEoDjIXLmFua2thLnByb3RvY29sLnYxLktpbmQSCgoCaWQYAiABKAkSLAoIaGFuZGxlcnMYAyADKAsyGi5hbmtrYS5wcm90b2NvbC52MS5IYW5kbGVyEj4KDWV2ZW50X3NvdXJjZWQYCiABKAsyJS5hbmtrYS5wcm90b2NvbC52MS5FdmVudFNvdXJjZWREZXRhaWxIABI2CglrZXlfdmFsdWUYCyABKAsyIS5hbmtrYS5wcm90b2NvbC52MS5LZXlWYWx1ZURldGFpbEgAEjUKCHdvcmtmbG93GAwgASgLMiEuYW5ra2EucHJvdG9jb2wudjEuV29ya2Zsb3dEZXRhaWxIABItCgR2aWV3GA0gASgLMh0uYW5ra2EucHJvdG9jb2wudjEuVmlld0RldGFpbEgAEjUKCGNvbnN1bWVyGA4gASgLMiEuYW5ra2EucHJvdG9jb2wudjEuQ29uc3VtZXJEZXRhaWxIABI8Cgx0aW1lZF9hY3Rpb24YDyABKAsyJC5hbmtrYS5wcm90b2NvbC52MS5UaW1lZEFjdGlvbkRldGFpbEgAEi8KBWFnZW50GBAgASgLMh4uYW5ra2EucHJvdG9jb2wudjEuQWdlbnREZXRhaWxIAEIICgZkZXRhaWwiPQoHSGFuZGxlchIMCgRuYW1lGAEgASgJEhEKCXJlYWRfb25seRgCIAEoCBIRCglzdHJlYW1pbmcYAyABKAgiLAoSRXZlbnRTb3VyY2VkRGV0YWlsEhYKDnNuYXBzaG90X2V2ZXJ5GAEgASgFIhAKDktleVZhbHVlRGV0YWlsIv8ECg5Xb3JrZmxvd0RldGFpbBINCgVzdGVwcxgBIAMoCRJBCghzZXR0aW5ncxgCIAEoCzIqLmFua2thLnByb3RvY29sLnYxLldvcmtmbG93RGV0YWlsLlNldHRpbmdzSACIAQEaowIKCFNldHRpbmdzEhsKDnRpbWVvdXRfbWlsbGlzGAEgASgDSACIAQESKAobZGVmYXVsdF9zdGVwX3RpbWVvdXRfbWlsbGlzGAIgASgDSAGIAQESSQoQZGVmYXVsdF9yZWNvdmVyeRgDIAEoCzIqLmFua2thLnByb3RvY29sLnYxLldvcmtmbG93RGV0YWlsLlJlY292ZXJ5SAKIAQESPQoFc3RlcHMYBCADKAsyLi5hbmtrYS5wcm90b2NvbC52MS5Xb3JrZmxvd0RldGFpbC5TdGVwU2V0dGluZ3NCEQoPX3RpbWVvdXRfbWlsbGlzQh4KHF9kZWZhdWx0X3N0ZXBfdGltZW91dF9taWxsaXNCEwoRX2RlZmF1bHRfcmVjb3ZlcnkanAEKDFN0ZXBTZXR0aW5ncxIMCgRzdGVwGAEgASgJEhsKDnRpbWVvdXRfbWlsbGlzGAIgASgDSACIAQESQQoIcmVjb3ZlcnkYAyABKAsyKi5hbmtrYS5wcm90b2NvbC52MS5Xb3JrZmxvd0RldGFpbC5SZWNvdmVyeUgBiAEBQhEKD190aW1lb3V0X21pbGxpc0ILCglfcmVjb3ZlcnkaSQoIUmVjb3ZlcnkSEwoLbWF4X3JldHJpZXMYASABKAUSGAoLZmFpbG92ZXJfdG8YAiABKAlIAIgBAUIOCgxfZmFpbG92ZXJfdG9CCwoJX3NldHRpbmdzIqMBCgZTb3VyY2USOwoJY29tcG9uZW50GAEgASgLMiYuYW5ra2EucHJvdG9jb2wudjEuU291cmNlLkNvbXBvbmVudFJlZkgAEg8KBXRvcGljGAIgASgJSAAaQQoMQ29tcG9uZW50UmVmEiUKBGtpbmQYASABKA4yFy5hbmtrYS5wcm90b2NvbC52MS5LaW5kEgoKAmlkGAIgASgJQggKBnNvdXJjZSJeCgpWaWV3RGV0YWlsEikKBnNvdXJjZRgBIAEoCzIZLmFua2thLnByb3RvY29sLnYxLlNvdXJjZRIUCgxyb3dfbWFuaWZlc3QYAiABKAkSDwoHcXVlcmllcxgDIAMoCSJlCg5Db25zdW1lckRldGFpbBIpCgZzb3VyY2UYASABKAsyGS5hbmtrYS5wcm90b2NvbC52MS5Tb3VyY2USGAoLcHJvZHVjZXNfdG8YAiABKAlIAIgBAUIOCgxfcHJvZHVjZXNfdG8iEwoRVGltZWRBY3Rpb25EZXRhaWwidAoLQWdlbnREZXRhaWwSDAoEcm9sZRgBIAEoCRIbChNtYXhfdG9vbF9jYWxsX3N0ZXBzGAIgASgFEiYKBXRvb2xzGAMgAygLMhcuYW5ra2EucHJvdG9jb2wudjEuVG9vbBISCgpndWFyZHJhaWxzGAQgAygJIkQKBFRvb2wSDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIZChFpbnB1dF9zY2hlbWFfanNvbhgDIAEoCSL7AQoIRW5kcG9pbnQSCgoCaWQYASABKAkSDgoGcHJlZml4GAIgASgJEiwKA2FjbBgDIAEoDjIfLmFua2thLnByb3RvY29sLnYxLkVuZHBvaW50LkFjbBIoCgZyb3V0ZXMYBCADKAsyGC5hbmtrYS5wcm90b2NvbC52MS5Sb3V0ZRI3Cg1hbGxvd19jYWxsZXJzGAUgAygLMiAuYW5ra2EucHJvdG9jb2wudjEuQ2FsbGVyTWF0Y2hlciJCCgNBY2wSDQoJQUxMT1dfQUxMEAASDAoIREVOWV9BTEwQARIRCg1BVVRIRU5USUNBVEVEEAISCwoHQ0FMTEVSUxADItcBCg1DYWxsZXJNYXRjaGVyEiwKCGludGVybmV0GAEgASgLMhguYW5ra2EucHJvdG9jb2wudjEuRW1wdHlIABIyCgdzZXJ2aWNlGAIgASgLMh8uYW5ra2EucHJvdG9jb2wudjEuTmFtZWRTZXJ2aWNlSAASMgoOYW55X2luX3Byb2plY3QYAyABKAsyGC5hbmtrYS5wcm90b2NvbC52MS5FbXB0eUgAEigKBHNlbGYYBCABKAsyGC5hbmtrYS5wcm90b2NvbC52MS5FbXB0eUgAQgYKBGtpbmQiPgoMTmFtZWRTZXJ2aWNlEhQKB3Byb2plY3QYASABKAlIAIgBARIMCgRuYW1lGAIgASgJQgoKCF9wcm9qZWN0Is4BCgVSb3V0ZRIKCgJpZBgBIAEoCRIOCgZtZXRob2QYAiABKAkSEAoIdGVtcGxhdGUYAyABKAkSEAoIaGFzX2JvZHkYBCABKAgSEQoJc3RyZWFtaW5nGAUgASgIEjEKA2FjbBgGIAEoDjIfLmFua2thLnByb3RvY29sLnYxLkVuZHBvaW50LkFjbEgAiAEBEjcKDWFsbG93X2NhbGxlcnMYByADKAsyIC5hbmtrYS5wcm90b2NvbC52MS5DYWxsZXJNYXRjaGVyQgYKBF9hY2wiGgoHUHJvYmxlbRIPCgdtZXNzYWdlGAEgASgJKnkKBEtpbmQSGAoURVZFTlRfU09VUkNFRF9FTlRJVFkQABIUChBLRVlfVkFMVUVfRU5USVRZEAESDAoIV09SS0ZMT1cQAhIICgRWSUVXEAMSDAoIQ09OU1VNRVIQBBIQCgxUSU1FRF9BQ1RJT04QBRIJCgVBR0VOVBAGMpUBCglEaXNjb3ZlcnkSQwoIRGlzY292ZXISHi5hbmtrYS5wcm90b2NvbC52MS5TaWRlY2FySW5mbxoXLmFua2thLnByb3RvY29sLnYxLlNwZWMSQwoLUmVwb3J0RXJyb3ISGi5hbmtrYS5wcm90b2NvbC52MS5Qcm9ibGVtGhguYW5ra2EucHJvdG9jb2wudjEuRW1wdHliBnByb3RvMw", [file_ankka_protocol_v1_payload]);
 /**
  * Describes the message ankka.protocol.v1.SidecarInfo.
  * Use `create(SidecarInfoSchema)` to create a new message.
@@ -117,21 +117,35 @@ export const Endpoint_Acl = {
      * @generated from enum value: AUTHENTICATED = 2;
      */
     AUTHENTICATED: 2,
+    /**
+     * @generated from enum value: CALLERS = 3;
+     */
+    CALLERS: 3,
 };
 /**
  * Describes the enum ankka.protocol.v1.Endpoint.Acl.
  */
 export const Endpoint_AclSchema = /*@__PURE__*/ enumDesc(file_ankka_protocol_v1_discovery, 14, 0);
+/**
+ * Describes the message ankka.protocol.v1.CallerMatcher.
+ * Use `create(CallerMatcherSchema)` to create a new message.
+ */
+export const CallerMatcherSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 15);
+/**
+ * Describes the message ankka.protocol.v1.NamedService.
+ * Use `create(NamedServiceSchema)` to create a new message.
+ */
+export const NamedServiceSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 16);
 /**
  * Describes the message ankka.protocol.v1.Route.
  * Use `create(RouteSchema)` to create a new message.
  */
-export const RouteSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 15);
+export const RouteSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 17);
 /**
  * Describes the message ankka.protocol.v1.Problem.
  * Use `create(ProblemSchema)` to create a new message.
  */
-export const ProblemSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 16);
+export const ProblemSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_discovery, 18);
 /**
  * @generated from enum ankka.protocol.v1.Kind
  */

package/dist/_proto/ankka/protocol/v1/endpoint_pb.d.ts

@@ -57,6 +57,13 @@ export type HttpRequest = Message<"ankka.protocol.v1.HttpRequest"> & {
      * @generated from field: ankka.protocol.v1.Metadata metadata = 9;
      */
     metadata?: Metadata | undefined;
+    /**
+     * Which workload sent the request, as the platform established it from the client certificate
+     * (protocol 1.1). Absent from a sidecar that predates it, which a process reads as local.
+     *
+     * @generated from field: optional ankka.protocol.v1.Caller caller = 10;
+     */
+    caller?: Caller | undefined;
 };
 /**
  * Describes the message ankka.protocol.v1.HttpRequest.
@@ -81,6 +88,62 @@ export type HttpRequest_Pair = Message<"ankka.protocol.v1.HttpRequest.Pair"> & {
  * Use `create(HttpRequest_PairSchema)` to create a new message.
  */
 export declare const HttpRequest_PairSchema: GenMessage<HttpRequest_Pair>;
+/**
+ * The gateway (the internet), a named service of this installation, or — outside a cluster — the
+ * local machine. Never taken from anything the request says about itself.
+ *
+ * @generated from message ankka.protocol.v1.Caller
+ */
+export type Caller = Message<"ankka.protocol.v1.Caller"> & {
+    /**
+     * @generated from oneof ankka.protocol.v1.Caller.kind
+     */
+    kind: {
+        /**
+         * @generated from field: ankka.protocol.v1.Empty gateway = 1;
+         */
+        value: Empty;
+        case: "gateway";
+    } | {
+        /**
+         * @generated from field: ankka.protocol.v1.ServiceCaller service = 2;
+         */
+        value: ServiceCaller;
+        case: "service";
+    } | {
+        /**
+         * @generated from field: ankka.protocol.v1.Empty local = 3;
+         */
+        value: Empty;
+        case: "local";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message ankka.protocol.v1.Caller.
+ * Use `create(CallerSchema)` to create a new message.
+ */
+export declare const CallerSchema: GenMessage<Caller>;
+/**
+ * @generated from message ankka.protocol.v1.ServiceCaller
+ */
+export type ServiceCaller = Message<"ankka.protocol.v1.ServiceCaller"> & {
+    /**
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * @generated from field: string name = 2;
+     */
+    name: string;
+};
+/**
+ * Describes the message ankka.protocol.v1.ServiceCaller.
+ * Use `create(ServiceCallerSchema)` to create a new message.
+ */
+export declare const ServiceCallerSchema: GenMessage<ServiceCaller>;
 /**
  * @generated from message ankka.protocol.v1.Principal
  */

package/dist/_proto/ankka/protocol/v1/endpoint_pb.js

@@ -7,7 +7,7 @@ import { file_ankka_protocol_v1_payload } from "./payload_pb.js";
 /**
  * Describes the file ankka/protocol/v1/endpoint.proto.
  */
-export const file_ankka_protocol_v1_endpoint = /*@__PURE__*/ fileDesc("CiBhbmtrYS9wcm90b2NvbC92MS9lbmRwb2ludC5wcm90bxIRYW5ra2EucHJvdG9jb2wudjEi7QIKC0h0dHBSZXF1ZXN0EhMKC2VuZHBvaW50X2lkGAEgASgJEhAKCHJvdXRlX2lkGAIgASgJEhEKCXBhdGhfYXJncxgDIAMoCRIyCgVxdWVyeRgEIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXISNAoHaGVhZGVycxgFIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXISFAoMY29udGVudF90eXBlGAYgASgJEgwKBGJvZHkYByABKAwSNAoJcHJpbmNpcGFsGAggASgLMhwuYW5ra2EucHJvdG9jb2wudjEuUHJpbmNpcGFsSACIAQESLQoIbWV0YWRhdGEYCSABKAsyGy5hbmtrYS5wcm90b2NvbC52MS5NZXRhZGF0YRojCgRQYWlyEgwKBG5hbWUYASABKAkSDQoFdmFsdWUYAiABKAlCDAoKX3ByaW5jaXBhbCJ9CglQcmluY2lwYWwSDwoHc3ViamVjdBgBIAEoCRIRCgRuYW1lGAIgASgJSACIAQESEgoFZW1haWwYAyABKAlIAYgBARIWCg5lbWFpbF92ZXJpZmllZBgEIAEoCBINCgVyb2xlcxgFIAMoCUIHCgVfbmFtZUIICgZfZW1haWwiegoJSHR0cFJlcGx5EjMKCHJlc3BvbnNlGAEgASgLMh8uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlc3BvbnNlSAASLQoHZmFpbHVyZRgCIAEoCzIaLmFua2thLnByb3RvY29sLnYxLkZhaWx1cmVIAEIJCgdtZXNzYWdlIngKDEh0dHBSZXNwb25zZRIOCgZzdGF0dXMYASABKAUSFAoMY29udGVudF90eXBlGAIgASgJEgwKBGJvZHkYAyABKAwSNAoHaGVhZGVycxgEIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXIigQEKC1N0cmVhbUZyYW1lEg4KBHRleHQYASABKAlIABItCgljb21wbGV0ZWQYAiABKAsyGC5hbmtrYS5wcm90b2NvbC52MS5FbXB0eUgAEioKBmZhaWxlZBgDIAEoCzIYLmFua2thLnByb3RvY29sLnYxLkVycm9ySABCBwoFZnJhbWUyoAEKBEh0dHASRgoGSGFuZGxlEh4uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlcXVlc3QaHC5hbmtrYS5wcm90b2NvbC52MS5IdHRwUmVwbHkSUAoMSGFuZGxlU3RyZWFtEh4uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlcXVlc3QaHi5hbmtrYS5wcm90b2NvbC52MS5TdHJlYW1GcmFtZTABYgZwcm90bzM", [file_ankka_protocol_v1_payload]);
+export const file_ankka_protocol_v1_endpoint = /*@__PURE__*/ fileDesc("CiBhbmtrYS9wcm90b2NvbC92MS9lbmRwb2ludC5wcm90bxIRYW5ra2EucHJvdG9jb2wudjEiqAMKC0h0dHBSZXF1ZXN0EhMKC2VuZHBvaW50X2lkGAEgASgJEhAKCHJvdXRlX2lkGAIgASgJEhEKCXBhdGhfYXJncxgDIAMoCRIyCgVxdWVyeRgEIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXISNAoHaGVhZGVycxgFIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXISFAoMY29udGVudF90eXBlGAYgASgJEgwKBGJvZHkYByABKAwSNAoJcHJpbmNpcGFsGAggASgLMhwuYW5ra2EucHJvdG9jb2wudjEuUHJpbmNpcGFsSACIAQESLQoIbWV0YWRhdGEYCSABKAsyGy5hbmtrYS5wcm90b2NvbC52MS5NZXRhZGF0YRIuCgZjYWxsZXIYCiABKAsyGS5hbmtrYS5wcm90b2NvbC52MS5DYWxsZXJIAYgBARojCgRQYWlyEgwKBG5hbWUYASABKAkSDQoFdmFsdWUYAiABKAlCDAoKX3ByaW5jaXBhbEIJCgdfY2FsbGVyIp0BCgZDYWxsZXISKwoHZ2F0ZXdheRgBIAEoCzIYLmFua2thLnByb3RvY29sLnYxLkVtcHR5SAASMwoHc2VydmljZRgCIAEoCzIgLmFua2thLnByb3RvY29sLnYxLlNlcnZpY2VDYWxsZXJIABIpCgVsb2NhbBgDIAEoCzIYLmFua2thLnByb3RvY29sLnYxLkVtcHR5SABCBgoEa2luZCIuCg1TZXJ2aWNlQ2FsbGVyEg8KB3Byb2plY3QYASABKAkSDAoEbmFtZRgCIAEoCSJ9CglQcmluY2lwYWwSDwoHc3ViamVjdBgBIAEoCRIRCgRuYW1lGAIgASgJSACIAQESEgoFZW1haWwYAyABKAlIAYgBARIWCg5lbWFpbF92ZXJpZmllZBgEIAEoCBINCgVyb2xlcxgFIAMoCUIHCgVfbmFtZUIICgZfZW1haWwiegoJSHR0cFJlcGx5EjMKCHJlc3BvbnNlGAEgASgLMh8uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlc3BvbnNlSAASLQoHZmFpbHVyZRgCIAEoCzIaLmFua2thLnByb3RvY29sLnYxLkZhaWx1cmVIAEIJCgdtZXNzYWdlIngKDEh0dHBSZXNwb25zZRIOCgZzdGF0dXMYASABKAUSFAoMY29udGVudF90eXBlGAIgASgJEgwKBGJvZHkYAyABKAwSNAoHaGVhZGVycxgEIAMoCzIjLmFua2thLnByb3RvY29sLnYxLkh0dHBSZXF1ZXN0LlBhaXIigQEKC1N0cmVhbUZyYW1lEg4KBHRleHQYASABKAlIABItCgljb21wbGV0ZWQYAiABKAsyGC5hbmtrYS5wcm90b2NvbC52MS5FbXB0eUgAEioKBmZhaWxlZBgDIAEoCzIYLmFua2thLnByb3RvY29sLnYxLkVycm9ySABCBwoFZnJhbWUyoAEKBEh0dHASRgoGSGFuZGxlEh4uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlcXVlc3QaHC5hbmtrYS5wcm90b2NvbC52MS5IdHRwUmVwbHkSUAoMSGFuZGxlU3RyZWFtEh4uYW5ra2EucHJvdG9jb2wudjEuSHR0cFJlcXVlc3QaHi5hbmtrYS5wcm90b2NvbC52MS5TdHJlYW1GcmFtZTABYgZwcm90bzM", [file_ankka_protocol_v1_payload]);
 /**
  * Describes the message ankka.protocol.v1.HttpRequest.
  * Use `create(HttpRequestSchema)` to create a new message.
@@ -18,26 +18,36 @@ export const HttpRequestSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v
  * Use `create(HttpRequest_PairSchema)` to create a new message.
  */
 export const HttpRequest_PairSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 0, 0);
+/**
+ * Describes the message ankka.protocol.v1.Caller.
+ * Use `create(CallerSchema)` to create a new message.
+ */
+export const CallerSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 1);
+/**
+ * Describes the message ankka.protocol.v1.ServiceCaller.
+ * Use `create(ServiceCallerSchema)` to create a new message.
+ */
+export const ServiceCallerSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 2);
 /**
  * Describes the message ankka.protocol.v1.Principal.
  * Use `create(PrincipalSchema)` to create a new message.
  */
-export const PrincipalSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 1);
+export const PrincipalSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 3);
 /**
  * Describes the message ankka.protocol.v1.HttpReply.
  * Use `create(HttpReplySchema)` to create a new message.
  */
-export const HttpReplySchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 2);
+export const HttpReplySchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 4);
 /**
  * Describes the message ankka.protocol.v1.HttpResponse.
  * Use `create(HttpResponseSchema)` to create a new message.
  */
-export const HttpResponseSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 3);
+export const HttpResponseSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 5);
 /**
  * Describes the message ankka.protocol.v1.StreamFrame.
  * Use `create(StreamFrameSchema)` to create a new message.
  */
-export const StreamFrameSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 4);
+export const StreamFrameSchema = /*@__PURE__*/ messageDesc(file_ankka_protocol_v1_endpoint, 6);
 /**
  * @generated from service ankka.protocol.v1.Http
  */

package/dist/context.d.ts

@@ -27,6 +27,19 @@ export interface Principal {
     readonly emailVerified: boolean;
     readonly roles: readonly string[];
 }
+/**
+ * Which workload sent a request, as the platform established it from the client certificate: the gateway
+ * (the internet), a named service, or — outside a cluster, where there is no certificate — the local machine.
+ */
+export type Caller = {
+    readonly kind: "gateway";
+} | {
+    readonly kind: "service";
+    readonly project: string;
+    readonly name: string;
+} | {
+    readonly kind: "local";
+};
 /** Query parameters in request order; a name may repeat. */
 export declare class Query {
     private readonly pairs;
@@ -52,6 +65,8 @@ export interface RequestContext<P = Readonly<Record<string, unknown>>> {
     /** The caller, when the route's access rule is `authenticated`; `null` otherwise. */
     readonly principal: Principal | null;
     readonly metadata: Metadata;
+    /** Which workload sent the request. Always present; see `Caller`. */
+    readonly caller: Caller;
 }
 /** Runs `fn` with `request` as the current request, for the asynchronous work it starts. */
 export declare function withRequest<T>(request: RequestContext, fn: () => T): T;

package/dist/index.d.ts

@@ -18,8 +18,8 @@ export { TimedAction, type TimedActionClass } from "./timedAction.ts";
 export { AgentEffects, type AgentEffect } from "./effects/agent.ts";
 export { Agent, type AgentClass } from "./agent.ts";
 export { Endpoint, type EndpointClass } from "./endpoint.ts";
-export { Acl, HttpProblem, get, post, put, patch, del, sse, type RouteRef, type RouteOptions, type RouteTable, type Params, type ParamNames, type HttpMethod } from "./routes.ts";
-export { type CommandContext, type RequestContext, type Principal, Query, Headers } from "./context.ts";
+export { Acl, Callers, type CallerMatcher, type CallersAcl, HttpProblem, get, post, put, patch, del, sse, type RouteRef, type RouteOptions, type RouteTable, type Params, type ParamNames, type HttpMethod } from "./routes.ts";
+export { type CommandContext, type RequestContext, type Principal, type Caller, Query, Headers } from "./context.ts";
 export { ComponentClient, Calls, TypedCalls, Invocation, Views, Timers, type TimerTarget, type ComponentRef } from "./client.ts";
 export { Ankka, ServiceBuilder, Registry, RegistrationError, type ServiceOptions, type RegisteredComponent, type RegisteredEndpoint, type Source, type RegisteredEventSourced, type RegisteredKeyValue, type RegisteredWorkflow, type RegisteredView, type RegisteredConsumer, type RegisteredTimedAction, type RegisteredAgent, } from "./service.ts";
 export { Server, type ServerOptions } from "./server/server.ts";

package/dist/index.js

@@ -29,7 +29,7 @@ export { TimedAction } from "./timedAction.js";
 export { AgentEffects } from "./effects/agent.js";
 export { Agent } from "./agent.js";
 export { Endpoint } from "./endpoint.js";
-export { Acl, HttpProblem, get, post, put, patch, del, sse } from "./routes.js";
+export { Acl, Callers, HttpProblem, get, post, put, patch, del, sse } from "./routes.js";
 export { Query, Headers } from "./context.js";
 export { ComponentClient, Calls, TypedCalls, Invocation, Views, Timers } from "./client.js";
 export { Ankka, ServiceBuilder, Registry, RegistrationError, } from "./service.js";

package/dist/routes.d.ts

@@ -1,13 +1,49 @@
 import type { Shape } from "./codec.ts";
 import type { RequestContext } from "./context.ts";
 import type { Infer, Schema } from "./schema.ts";
-/** Who may call: everyone, no one, or authenticated callers only. There is no default. */
+/** One kind of caller an `Acl.allowCallers` admits; build one through `Callers`. */
+export type CallerMatcher = {
+    readonly kind: "internet";
+} | {
+    readonly kind: "service";
+    readonly name: string;
+    readonly project?: string;
+} | {
+    readonly kind: "anyInProject";
+} | {
+    readonly kind: "self";
+};
+/**
+ * The callers an endpoint can name: `Acl.allowCallers(Callers.internet, Callers.service("orders"))`. A named
+ * service is in this service's own project unless `project` names another.
+ */
+export declare const Callers: Readonly<{
+    internet: CallerMatcher;
+    anyInProject: CallerMatcher;
+    self: CallerMatcher;
+    service(name: string, options?: {
+        readonly project?: string;
+    }): CallerMatcher;
+}>;
+/** Only the callers named. In a cluster the caller is read from the certificate the platform issued. */
+export interface CallersAcl {
+    readonly kind: "callers";
+    readonly callers: readonly CallerMatcher[];
+}
+/**
+ * Who may call: everyone, no one, authenticated callers only, or only the callers named. There is no default.
+ *
+ * Outside a cluster every caller is `{ kind: "local" }`, and `allowCallers` admits it.
+ */
+export type Acl = "allow-all" | "deny-all" | "authenticated" | CallersAcl;
 export declare const Acl: Readonly<{
-    readonly allowAll: "allow-all";
-    readonly denyAll: "deny-all";
-    readonly authenticated: "authenticated";
+    allowAll: Acl;
+    denyAll: Acl;
+    authenticated: Acl;
+    allowCallers(first: CallerMatcher, ...rest: CallerMatcher[]): Acl;
 }>;
-export type Acl = (typeof Acl)[keyof typeof Acl];
+/** Whether `x` is an access rule: one of the three words, or a non-empty callers rule. */
+export declare function isAcl(x: unknown): x is Acl;
 /** Thrown from a route handler to answer a status other than 200 with a plain-text message. */
 export declare class HttpProblem extends Error {
     readonly status: number;

package/dist/routes.js

@@ -9,12 +9,35 @@
 //
 // `req.params` is typed from the template: "/{cartId}/items" gives { cartId: string }.
 import { isCodec } from "./codec.js";
-/** Who may call: everyone, no one, or authenticated callers only. There is no default. */
+/**
+ * The callers an endpoint can name: `Acl.allowCallers(Callers.internet, Callers.service("orders"))`. A named
+ * service is in this service's own project unless `project` names another.
+ */
+export const Callers = Object.freeze({
+    internet: Object.freeze({ kind: "internet" }),
+    anyInProject: Object.freeze({ kind: "anyInProject" }),
+    self: Object.freeze({ kind: "self" }),
+    service(name, options) {
+        return Object.freeze(options?.project !== undefined ? { kind: "service", name, project: options.project } : { kind: "service", name });
+    },
+});
 export const Acl = Object.freeze({
     allowAll: "allow-all",
     denyAll: "deny-all",
     authenticated: "authenticated",
+    allowCallers(first, ...rest) {
+        return Object.freeze({ kind: "callers", callers: Object.freeze([first, ...rest]) });
+    },
 });
+/** Whether `x` is an access rule: one of the three words, or a non-empty callers rule. */
+export function isAcl(x) {
+    if (x === "allow-all" || x === "deny-all" || x === "authenticated")
+        return true;
+    if (typeof x !== "object" || x === null)
+        return false;
+    const rule = x;
+    return rule.kind === "callers" && Array.isArray(rule.callers) && rule.callers.length > 0;
+}
 /** Thrown from a route handler to answer a status other than 200 with a plain-text message. */
 export class HttpProblem extends Error {
     status;

package/dist/server/http.js

@@ -30,6 +30,18 @@ function principalOf(req) {
         return null;
     return Object.freeze({ subject: p.subject, name: p.name ?? null, email: p.email ?? null, emailVerified: p.emailVerified, roles: Object.freeze([...p.roles]) });
 }
+/** The caller the sidecar established; a sidecar that predates protocol 1.1 sends none, which reads as local. */
+function callerOf(req) {
+    const kind = req.caller?.kind;
+    switch (kind?.case) {
+        case "gateway":
+            return Object.freeze({ kind: "gateway" });
+        case "service":
+            return Object.freeze({ kind: "service", project: kind.value.project, name: kind.value.name });
+        default:
+            return Object.freeze({ kind: "local" });
+    }
+}
 /** A path parameter as its declared schema: strings as they are, scalars through their text codec. */
 function parseParam(name, text, shape) {
     if (!shape)
@@ -82,6 +94,7 @@ export function createHttpDispatcher(ctx) {
                 headers: new Headers(req.headers.map((p) => [p.name, p.value])),
                 principal: principalOf(req),
                 metadata: metadataFromProto(req.metadata),
+                caller: callerOf(req),
             });
             const body = route.body ? codecFor(route.body).decode(req.body) : undefined;
             return { ok: true, prepared: { endpoint, route, instance, request, body } };

package/dist/service.js

@@ -12,7 +12,7 @@ import { Consumer } from "./consumer.js";
 import { TimedAction } from "./timedAction.js";
 import { Agent } from "./agent.js";
 import { Endpoint } from "./endpoint.js";
-import { Acl as AclValues } from "./routes.js";
+import { isAcl } from "./routes.js";
 import { ComponentClient } from "./client.js";
 import { Server } from "./server/server.js";
 import { renderSpec } from "./spec.js";
@@ -347,8 +347,8 @@ function registerEndpoint(cls, problems) {
     if (typeof cls.prefix !== "string" || !cls.prefix.startsWith("/") || (cls.prefix.length > 1 && cls.prefix.endsWith("/"))) {
         fail(`needs a static prefix starting with "/" and not ending with one, not ${JSON.stringify(cls.prefix)}`);
     }
-    if (!Object.values(AclValues).includes(cls.acl)) {
-        fail(`needs a static acl — Acl.allowAll, Acl.denyAll or Acl.authenticated. An unstated access rule is a decision nobody made`);
+    if (!isAcl(cls.acl)) {
+        fail(`needs a static acl — Acl.allowAll, Acl.denyAll, Acl.authenticated or Acl.allowCallers(...). An unstated access rule is a decision nobody made`);
     }
     const routes = new Map();
     const seen = new Map();
@@ -367,7 +367,7 @@ function registerEndpoint(cls, problems) {
             if (other)
                 fail(`routes ${other} and ${id} both declare ${key}`);
             seen.set(key, id);
-            if (r.acl !== undefined && !Object.values(AclValues).includes(r.acl))
+            if (r.acl !== undefined && !isAcl(r.acl))
                 fail(`routes.${id}: unknown acl ${JSON.stringify(r.acl)}`);
             routes.set(id, r);
         }

package/dist/spec.d.ts

@@ -1,7 +1,10 @@
-import { Endpoint_Acl, type Spec } from "./_proto/ankka/protocol/v1/discovery_pb.ts";
+import { type MessageInitShape } from "@bufbuild/protobuf";
+import { Endpoint_Acl, type CallerMatcherSchema, type Spec } from "./_proto/ankka/protocol/v1/discovery_pb.ts";
 import type { Registry } from "./service.ts";
-import { Acl } from "./routes.ts";
-export declare const PROTOCOL_VERSION = "1.0";
+import type { Acl } from "./routes.ts";
+export declare const PROTOCOL_VERSION = "1.1";
 export declare const SDK_NAME = "ankka-typescript";
 export declare function aclToProto(acl: Acl): Endpoint_Acl;
+/** The callers a CALLERS acl names, as discovery carries them; empty for every other rule. */
+export declare function callersToProto(acl: Acl): MessageInitShape<typeof CallerMatcherSchema>[];
 export declare function renderSpec(registry: Registry): Spec;

package/dist/spec.js

@@ -2,22 +2,40 @@
 import { create } from "@bufbuild/protobuf";
 import { Endpoint_Acl, SpecSchema } from "./_proto/ankka/protocol/v1/discovery_pb.js";
 import { kindToProto } from "./kinds.js";
-import { Acl } from "./routes.js";
 import { toJsonSchema } from "./schema.js";
 import { isCodec } from "./codec.js";
 import { VERSION } from "./version.js";
-export const PROTOCOL_VERSION = "1.0";
+export const PROTOCOL_VERSION = "1.1";
 export const SDK_NAME = "ankka-typescript";
 export function aclToProto(acl) {
+    if (typeof acl === "object")
+        return Endpoint_Acl.CALLERS;
     switch (acl) {
-        case Acl.allowAll:
+        case "allow-all":
             return Endpoint_Acl.ALLOW_ALL;
-        case Acl.denyAll:
+        case "deny-all":
             return Endpoint_Acl.DENY_ALL;
-        case Acl.authenticated:
+        case "authenticated":
             return Endpoint_Acl.AUTHENTICATED;
     }
 }
+/** The callers a CALLERS acl names, as discovery carries them; empty for every other rule. */
+export function callersToProto(acl) {
+    if (typeof acl !== "object")
+        return [];
+    return acl.callers.map((m) => {
+        switch (m.kind) {
+            case "internet":
+                return { kind: { case: "internet", value: {} } };
+            case "anyInProject":
+                return { kind: { case: "anyInProject", value: {} } };
+            case "self":
+                return { kind: { case: "self", value: {} } };
+            case "service":
+                return { kind: { case: "service", value: m.project !== undefined ? { name: m.name, project: m.project } : { name: m.name } } };
+        }
+    });
+}
 function handlerInits(handlers) {
     return [...handlers.values()]
         .map((h) => ({ name: h.name, readOnly: h.readOnly, streaming: h.streaming }))
@@ -88,13 +106,14 @@ export function renderSpec(registry) {
         id: e.id,
         prefix: e.prefix,
         acl: aclToProto(e.acl),
+        allowCallers: callersToProto(e.acl),
         routes: [...e.routes.entries()].map(([id, r]) => ({
             id,
             method: r.method,
             template: r.template,
             hasBody: r.body !== undefined,
             streaming: r.streaming,
-            ...(r.acl !== undefined ? { acl: aclToProto(r.acl) } : {}),
+            ...(r.acl !== undefined ? { acl: aclToProto(r.acl), allowCallers: callersToProto(r.acl) } : {}),
         })),
     }));
     return create(SpecSchema, {

package/dist/testkit/integration.js

@@ -223,7 +223,11 @@ export class AnkkaTestKit {
             ...this.#env,
         })
             .withExposedPorts(HTTP_PORT, CALLBACK_PORT)
-            .withWaitStrategy(tc.Wait.forHttp("/_ankka/health", HTTP_PORT).forStatusCode(200))
+            // Both ports, not only the health route: it answers as soon as HTTP is bound, which can be
+            // before the callback server listens, and Docker's port proxy accepts then resets a
+            // connection to a port nothing in the container listens on yet — so a handler's first call
+            // after a restart failed UNAVAILABLE. forListeningPorts checks from inside the container.
+            .withWaitStrategy(tc.Wait.forAll([tc.Wait.forHttp("/_ankka/health", HTTP_PORT).forStatusCode(200), tc.Wait.forListeningPorts()]))
             .withStartupTimeout(this.#readyTimeoutMs)
             .start();
         this.#sidecar = container;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.7.1";
+export declare const VERSION = "0.8.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Written by scripts/proto.ts from package.json; do not edit. 0.0.0 in the tree, the tag's version in a release.
-export const VERSION = "0.7.1";
+export const VERSION = "0.8.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ankka",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Build services on ankka in TypeScript: entities, views, workflows, agents and endpoints hosted by the ankka sidecar.",
   "license": "Apache-2.0",
   "type": "module",