@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/connection/credential.ts

@@ -1,138 +0,0 @@
-import type { Fetch } from '@astrale-os/sdk/client'
-import type { SessionAuth } from '@astrale-os/sdk/client/session'
-
-import { credential, type IssuerId } from '@astrale-os/sdk/auth'
-
-import type { AstraleConfig } from '../lib/config'
-import type { ConnectionOptions, ConnectionTarget } from './target'
-
-import { AstraleError } from '../errors'
-import { remainingCredentialLifetimeSeconds } from '../lib/credential-lifetime'
-import { resolveCredential } from './auth'
-import { createExchangeCredentialResolver } from './exchange'
-import { exchangeCredentialTtlSeconds, invocationCredentialTtlSeconds } from './lifetime'
-import { registrationKeyForTarget } from './target'
-
-const DELEGATION_TTL_SECONDS = 60
-
-export interface SourceCredentialResolver {
-  resolve(audience: IssuerId, signal: AbortSignal): Promise<string>
-}
-
-/** Resolve source authority; an omitted Session delegation preserves exact current authority. */
-export function createConnectionCredential(
-  expectedSourceIssuer: IssuerId,
-  source: SourceCredentialResolver,
-  ttlSeconds = DELEGATION_TTL_SECONDS,
-): SessionAuth {
-  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1) {
-    throw new TypeError('Connection credential ttlSeconds must be a positive safe integer.')
-  }
-  const resolveSource = source.resolve.bind(source)
-  return Object.freeze({
-    ttlSeconds,
-    async resolve(
-      _call: Parameters<SessionAuth['resolve']>[0],
-      signal: Parameters<SessionAuth['resolve']>[1],
-    ) {
-      const resolved = await resolveSource(expectedSourceIssuer, signal)
-      const delegatedTtlSeconds = sourceBoundDelegationTtl(resolved, ttlSeconds)
-      return Object.freeze({
-        credential: resolved,
-        ...(delegatedTtlSeconds === undefined
-          ? {}
-          : { delegate: { ttlSeconds: delegatedTtlSeconds } }),
-      })
-    },
-  })
-}
-
-/** Never request a destination carrier that could outlive its current source bearer. */
-function sourceBoundDelegationTtl(input: string, requestedTtlSeconds: number): number | undefined {
-  try {
-    const expiresAt = credential.inspect(input).claims.exp
-    if (typeof expiresAt !== 'number' || !Number.isSafeInteger(expiresAt)) return undefined
-    const remaining = remainingCredentialLifetimeSeconds(expiresAt)
-    if (remaining < requestedTtlSeconds) {
-      throw new AstraleError(
-        'CREDENTIAL_LIFETIME_INSUFFICIENT',
-        'The selected credential cannot cover the requested command timeout.',
-        `Use a fresh identity session or a shorter --timeout; ${Math.max(0, remaining)} seconds remain but ${requestedTtlSeconds} are required.`,
-      )
-    }
-    return Math.max(1, Math.min(requestedTtlSeconds, remaining))
-  } catch (cause) {
-    if (cause instanceof AstraleError) throw cause
-    // Preserve opaque explicit credentials; the Kernel remains their authority.
-    return undefined
-  }
-}
-
-/** Bind CLI identity state and Core Auth delegation to one Session auth capability. */
-export function createCliCredential(
-  target: ConnectionTarget,
-  options: ConnectionOptions,
-  config: AstraleConfig,
-  fetch: Fetch = globalThis.fetch,
-  timeoutMs = 30_000,
-): SessionAuth | undefined {
-  validateCredentialSelection(options)
-  if (options.anonymous === true) return undefined
-  const authOptions = Object.freeze({
-    ...(options.as === undefined ? {} : { as: options.as }),
-    ...(options.creds === undefined ? {} : { creds: options.creds }),
-    ...(target.defaultIdentity === undefined ? {} : { defaultIdentity: target.defaultIdentity }),
-    minimumRemainingSeconds:
-      target.domainIssuer === undefined
-        ? invocationCredentialTtlSeconds(timeoutMs)
-        : exchangeCredentialTtlSeconds(timeoutMs),
-  })
-  const source: SourceCredentialResolver = {
-    async resolve(audience, signal) {
-      requireLive(signal)
-      const credential = await resolveCredential(
-        authOptions,
-        config,
-        audience,
-        registrationKeyForTarget(target),
-      )
-      requireLive(signal)
-      return credential
-    },
-  }
-  const effective =
-    target.domainIssuer === undefined || options.creds !== undefined
-      ? source
-      : createExchangeCredentialResolver(
-          { ...target, domainIssuer: target.domainIssuer },
-          source,
-          fetch,
-          timeoutMs,
-        )
-  const ttlSeconds = invocationCredentialTtlSeconds(timeoutMs)
-  return createConnectionCredential(target.kernelIssuer, effective, ttlSeconds)
-}
-
-/** Reject contradictory explicit credential selections before identity or network access. */
-export function validateCredentialSelection(options: ConnectionOptions): void {
-  if (options.as !== undefined && options.creds !== undefined) {
-    throw new AstraleError('INVALID_FLAG', '--as cannot be combined with --creds.')
-  }
-  if (options.anonymous !== true) return
-  const conflicting = [
-    ...(options.as === undefined ? [] : ['--as']),
-    ...(options.creds === undefined ? [] : ['--creds']),
-  ]
-  if (conflicting.length === 0) return
-  throw new AstraleError(
-    'INVALID_FLAG',
-    `--anonymous cannot be combined with ${conflicting.join(' or ')}.`,
-  )
-}
-
-function requireLive(signal: AbortSignal): void {
-  if (!signal.aborted) return
-  throw signal.reason instanceof Error
-    ? signal.reason
-    : new DOMException('The operation was aborted.', 'AbortError')
-}

package/src/connection/errors.ts

@@ -1 +0,0 @@
-export { formatKernelError, functionInputIssues, schemaUpgradeHint } from './failure'

package/src/connection/exchange.ts

@@ -1,394 +0,0 @@
-import type { IssuerId } from '@astrale-os/sdk/auth'
-import type { Fetch } from '@astrale-os/sdk/client'
-
-import { createAuth } from '@astrale-os/sdk/auth'
-import { credential, exchange as exchangeProtocol, grant } from '@astrale-os/sdk/auth'
-import { call, Client } from '@astrale-os/sdk/client'
-
-import type { SourceCredentialResolver } from './credential'
-import type { ConnectionTarget } from './target'
-
-import { AstraleError } from '../errors'
-import { remainingCredentialLifetimeSeconds } from '../lib/credential-lifetime'
-import { ExchangeCredentialCache } from '../state/exchange-credentials'
-import { cachedCredentialTtlSeconds, exchangeCredentialTtlSeconds } from './lifetime'
-
-const MAXIMUM_RESPONSE_BYTES = 256 * 1024
-
-/** Exchange exact authenticated User authority for a Domain bearer bound to this Kernel. */
-export function createExchangeCredentialResolver(
-  target: ConnectionTarget & { readonly domainIssuer: IssuerId },
-  source: SourceCredentialResolver,
-  fetch: Fetch,
-  timeoutMs: number,
-  cache = new ExchangeCredentialCache(),
-): SourceCredentialResolver {
-  requireExchangeTransport(target)
-  const cacheTtlSeconds = cachedCredentialTtlSeconds(timeoutMs)
-  const exchangeTtlSeconds = exchangeCredentialTtlSeconds(timeoutMs)
-  return Object.freeze({
-    async resolve(kernelIssuer: IssuerId, signal: AbortSignal): Promise<string> {
-      requireLive(signal)
-      const sourceToken = await source.resolve(kernelIssuer, signal)
-      const sourceIdentity = sourceCacheIdentity(sourceToken)
-      requireLive(signal)
-
-      return await cache.getOrRefresh(
-        Object.freeze({
-          kernelIssuer,
-          domainIssuer: target.domainIssuer,
-          sourceIssuer: sourceIdentity.issuer,
-          sourceSubject: sourceIdentity.subject,
-        }),
-        cacheTtlSeconds,
-        async () => {
-          const delegationTtlSeconds = delegationLifetime(sourceToken, exchangeTtlSeconds)
-          const client = new Client({ url: `${kernelIssuer}/invoke`, fetch, timeoutMs })
-          try {
-            const authenticated = client.as(sourceToken)
-            const auth = createAuth(async (path, input, options) => {
-              const result = await authenticated.call(call(path, input), {
-                ...options,
-                delegate: { ttlSeconds: delegationTtlSeconds },
-              })
-              return result.value
-            })
-            const user = await auth.whoami({ signal })
-            let envelope: string | undefined
-            for (let attempt = 0; attempt < 3; attempt += 1) {
-              try {
-                envelope = await auth.delegate(
-                  user.id,
-                  {
-                    audience: target.domainIssuer,
-                    ttlSeconds: delegationTtlSeconds,
-                    attenuation: { kind: 'identity', self: true },
-                  },
-                  { signal },
-                )
-                break
-              } catch (cause) {
-                if (attempt === 2 || !unknownFunctionOutcome(cause)) throw cause
-              }
-            }
-            if (envelope === undefined) throw new Error('Token delegation returned no credential.')
-            return {
-              ...(await exchange(
-                target.domainIssuer,
-                kernelIssuer,
-                envelope,
-                cacheTtlSeconds,
-                fetch,
-                signal,
-              )),
-              user: user.id,
-              sourceIssuer: sourceIdentity.issuer,
-              sourceSubject: sourceIdentity.subject,
-            }
-          } finally {
-            client.close()
-          }
-        },
-      )
-    },
-  })
-}
-
-function sourceCacheIdentity(sourceToken: string): { issuer: string; subject: string } {
-  const inspected = credential.inspect(sourceToken)
-  if (
-    typeof inspected.iss !== 'string' ||
-    inspected.iss.length === 0 ||
-    typeof inspected.sub !== 'string' ||
-    inspected.sub.length === 0
-  ) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_SOURCE_INVALID',
-      'The source identity credential has no stable issuer and subject.',
-    )
-  }
-  return Object.freeze({ issuer: inspected.iss, subject: inspected.sub })
-}
-
-function unknownFunctionOutcome(cause: unknown): boolean {
-  if (cause === null || typeof cause !== 'object') return false
-  const error = cause as { readonly code?: unknown; readonly reason?: unknown }
-  if (error.code === 5002) return true
-  if (error.reason === null || typeof error.reason !== 'object') return false
-  return (error.reason as { readonly code?: unknown }).code === 'FUNCTION_OUTCOME_UNKNOWN'
-}
-
-function delegationLifetime(sourceToken: string, requiredTtlSeconds: number): number {
-  const expiresAt = credential.inspect(sourceToken).claims.exp
-  if (typeof expiresAt !== 'number' || !Number.isSafeInteger(expiresAt)) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_SOURCE_INVALID',
-      'The source identity credential has no valid expiration.',
-    )
-  }
-  const remaining = remainingCredentialLifetimeSeconds(expiresAt)
-  if (!Number.isSafeInteger(remaining) || remaining < 1) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_SOURCE_EXPIRED',
-      'The source identity credential has no lifetime available for token exchange.',
-    )
-  }
-  if (remaining < requiredTtlSeconds) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_SOURCE_LIFETIME_INSUFFICIENT',
-      'The source credential cannot cover the requested command timeout.',
-      `Refresh the identity session or use a shorter --timeout; ${remaining} seconds remain but ${requiredTtlSeconds} are required.`,
-    )
-  }
-  return requiredTtlSeconds
-}
-
-async function exchange(
-  domainIssuer: IssuerId,
-  kernelIssuer: IssuerId,
-  envelope: string,
-  requiredTtlSeconds: number,
-  fetch: Fetch,
-  signal: AbortSignal,
-): Promise<{ readonly credential: string; readonly expiresAt: number }> {
-  const configurationUrl = new URL(
-    exchangeProtocol.paths(domainIssuer).configuration,
-    domainIssuer,
-  ).toString()
-  const configurationResponse = await fetchExchange(
-    fetch,
-    configurationUrl,
-    {
-      method: 'GET',
-      redirect: 'error',
-      credentials: 'omit',
-      cache: 'no-store',
-      referrerPolicy: 'no-referrer',
-      headers: { accept: 'application/json' },
-      signal,
-    },
-    'Domain issuer discovery could not be reached.',
-  )
-  if (!configurationResponse.ok) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_DISCOVERY_FAILED',
-      `Domain issuer discovery failed with HTTP ${configurationResponse.status}.`,
-    )
-  }
-  const configuration = exchangeProtocol.acceptConfiguration(
-    await boundedJson(configurationResponse, signal),
-    domainIssuer,
-  )
-  const endpoint = configuration.token_exchange_endpoint
-  if (endpoint === undefined) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_UNSUPPORTED',
-      `Domain issuer ${domainIssuer} does not advertise token exchange.`,
-      'This command has no legacy token fallback.',
-    )
-  }
-
-  const response = await fetchExchange(
-    fetch,
-    endpoint,
-    {
-      method: 'POST',
-      redirect: 'error',
-      credentials: 'omit',
-      cache: 'no-store',
-      referrerPolicy: 'no-referrer',
-      headers: {
-        authorization: `Bearer ${envelope}`,
-        accept: exchangeProtocol.MEDIA_TYPE,
-      },
-      signal,
-    },
-    'Domain token exchange could not be reached.',
-  )
-  const body = await boundedJson(response, signal)
-  if (!response.ok) {
-    let admitted: exchangeProtocol.ErrorResponse
-    try {
-      admitted = exchangeProtocol.acceptErrorResponse(body)
-    } catch (cause) {
-      if (!(cause instanceof TypeError)) throw cause
-      throw new AstraleError(
-        'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-        `Token exchange failed with HTTP ${response.status} and an invalid error response.`,
-        cause instanceof Error ? cause.message : undefined,
-      )
-    }
-    throw new AstraleError(String(admitted.error.code), admitted.error.message)
-  }
-  requireExchangeResponseHeaders(response)
-  let exchanged: exchangeProtocol.Response
-  let inspected: ReturnType<typeof credential.inspect>
-  try {
-    exchanged = exchangeProtocol.acceptResponse(body)
-    inspected = credential.inspect(exchanged.token)
-  } catch (cause) {
-    if (!(cause instanceof TypeError)) throw cause
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Token exchange returned an invalid success response.',
-      cause.message,
-    )
-  }
-  if (
-    inspected.iss !== domainIssuer ||
-    inspected.aud !== kernelIssuer ||
-    inspected.claims.exp !== exchanged.expiresAt
-  ) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Token exchange returned a credential inconsistent with the requested Domain and Kernel.',
-    )
-  }
-  const remaining = effectiveExchangeLifetime(inspected, exchanged.expiresAt)
-  if (remaining < requiredTtlSeconds) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_LIFETIME_INSUFFICIENT',
-      'The Domain exchange credential cannot cover the requested command timeout.',
-      `The Domain issuer returned ${Math.max(0, remaining)} seconds but ${requiredTtlSeconds} are required. Use a shorter --timeout or update the Domain execution service.`,
-    )
-  }
-  return Object.freeze({ credential: exchanged.token, expiresAt: exchanged.expiresAt })
-}
-
-/** The outer Domain bearer and its carried Kernel proof must both survive the operation. */
-function effectiveExchangeLifetime(
-  inspected: ReturnType<typeof credential.inspect>,
-  outerExpiresAt: number,
-): number {
-  let proofExpiresAt: number
-  try {
-    const carried = grant.acceptUnresolved(inspected.claims.grant).expr
-    if (
-      carried.kind !== 'identity' ||
-      !('credential' in carried) ||
-      typeof carried.credential !== 'string'
-    ) {
-      throw new TypeError('Domain credential does not carry an identity proof.')
-    }
-    const value = credential.inspect(carried.credential).claims.exp
-    if (typeof value !== 'number' || !Number.isSafeInteger(value)) {
-      throw new TypeError('Domain credential carries an identity proof without an expiration.')
-    }
-    proofExpiresAt = value
-  } catch (cause) {
-    if (!(cause instanceof TypeError)) throw cause
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Token exchange returned an invalid carried identity proof.',
-      cause.message,
-    )
-  }
-  return remainingCredentialLifetimeSeconds(Math.min(outerExpiresAt, proofExpiresAt))
-}
-
-async function fetchExchange(
-  fetch: Fetch,
-  input: string,
-  init: RequestInit,
-  message: string,
-): Promise<Response> {
-  try {
-    return await fetch(input, init)
-  } catch (cause) {
-    if (init.signal?.aborted) throw cause
-    throw new AstraleError('TOKEN_EXCHANGE_UNAVAILABLE', message, undefined, { cause })
-  }
-}
-
-function requireExchangeTransport(
-  target: ConnectionTarget & { readonly domainIssuer: IssuerId },
-): void {
-  const kernel = new URL(target.kernelIssuer)
-  const domain = new URL(target.domainIssuer)
-  if (domain.protocol === 'https:') return
-  if (domain.protocol === 'http:' && kernel.protocol === 'http:') return
-  throw new AstraleError(
-    'TOKEN_EXCHANGE_INSECURE',
-    'An HTTP Domain issuer is allowed only with an explicitly configured HTTP Kernel target.',
-  )
-}
-
-function requireExchangeResponseHeaders(response: Response): void {
-  const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase()
-  if (contentType !== exchangeProtocol.MEDIA_TYPE) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Token exchange returned an unsupported Content-Type.',
-    )
-  }
-  if (
-    !response.headers
-      .get('cache-control')
-      ?.toLowerCase()
-      .split(',')
-      .some((v) => v.trim() === 'no-store')
-  ) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Token exchange response is missing Cache-Control: no-store.',
-    )
-  }
-}
-
-async function boundedJson(response: Response, signal: AbortSignal): Promise<unknown> {
-  const declared = response.headers.get('content-length')
-  if (
-    declared !== null &&
-    (!/^\d+$/u.test(declared) || Number(declared) > MAXIMUM_RESPONSE_BYTES)
-  ) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Issuer response exceeds the size limit.',
-    )
-  }
-  if (response.body === null) {
-    throw new AstraleError('TOKEN_EXCHANGE_PROTOCOL_ERROR', 'Issuer response body is missing.')
-  }
-  const reader = response.body.getReader()
-  const chunks: Uint8Array[] = []
-  let size = 0
-  try {
-    for (;;) {
-      requireLive(signal)
-      const next = await reader.read()
-      if (next.done) break
-      size += next.value.byteLength
-      if (size > MAXIMUM_RESPONSE_BYTES) {
-        throw new AstraleError(
-          'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-          'Issuer response exceeds the size limit.',
-        )
-      }
-      chunks.push(next.value)
-    }
-  } finally {
-    reader.releaseLock()
-  }
-  const bytes = new Uint8Array(size)
-  let offset = 0
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset)
-    offset += chunk.byteLength
-  }
-  try {
-    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)) as unknown
-  } catch (cause) {
-    throw new AstraleError(
-      'TOKEN_EXCHANGE_PROTOCOL_ERROR',
-      'Issuer response is not valid UTF-8 JSON.',
-      cause instanceof Error ? cause.message : undefined,
-    )
-  }
-}
-
-function requireLive(signal: AbortSignal): void {
-  if (!signal.aborted) return
-  throw signal.reason instanceof Error
-    ? signal.reason
-    : new DOMException('The operation was aborted.', 'AbortError')
-}

package/src/connection/failure/classify.ts

@@ -1,110 +0,0 @@
-import { AuthValueError } from '@astrale-os/sdk/auth'
-import { ClientError, ProtocolError, ResponseError, TransportError } from '@astrale-os/sdk/client'
-import { NodeUnavailableError } from '@astrale-os/sdk/client'
-import { PathError } from '@astrale-os/sdk/graph/path'
-
-import type { FailureDiagnostic, TransportDiagnosticContext } from './model'
-
-import { AstraleError } from '../../errors'
-
-export function classifyFailure(error: unknown): FailureDiagnostic {
-  if (error instanceof AstraleError) return simple(error.code, error.message, error.hint)
-  if (error instanceof TransportError) {
-    const context = transportContext(error)
-    if (context === undefined) return simple('TRANSPORT_ERROR', error.message)
-    return {
-      kind: 'transport',
-      code: lifecycleCode(error.phase),
-      message: error.message,
-      phase: error.phase,
-      context,
-    }
-  }
-  if (error instanceof ResponseError) {
-    return {
-      kind: 'response',
-      code: error.code,
-      message: error.message,
-      ...(error.reason === undefined ? {} : { reason: error.reason }),
-    }
-  }
-  if (error instanceof ClientError) {
-    const failure = sessionFailure(error)
-    if (failure !== undefined) return simple(lifecycleCode(failure), error.message)
-  }
-  if (error instanceof ProtocolError) return simple('PROTOCOL_ERROR', error.message)
-  if (error instanceof NodeUnavailableError)
-    return simple(
-      'NODE_UNAVAILABLE',
-      error.message,
-      'If this is a callable Path, use `astrale call` or `astrale introspect`.',
-    )
-  if (error instanceof PathError) return simple('PATH_INVALID', error.message)
-  if (error instanceof AuthValueError) return simple('AUTH_VALUE_INVALID', error.message)
-  if (error instanceof ClientError) return simple('CLIENT_ERROR', error.message)
-  return simple('UNEXPECTED_ERROR', 'The CLI encountered an unexpected internal failure.')
-}
-
-type TransportCode = Extract<FailureDiagnostic, { kind: 'transport' }>['code']
-type SessionFailure = 'cancelled' | 'closed' | 'timeout'
-
-function lifecycleCode(value: TransportError['phase']): TransportCode
-function lifecycleCode(value: SessionFailure): string
-function lifecycleCode(value: TransportError['phase'] | SessionFailure): string {
-  if (value === 'connect') return 'CONNECTION_ERROR'
-  if (value === 'timeout') return 'TIMEOUT'
-  if (value === 'closed') return 'DISCONNECTED'
-  return value === 'cancelled' ? 'CANCELLED' : 'TRANSPORT_ERROR'
-}
-
-function transportContext(error: TransportError): TransportDiagnosticContext | undefined {
-  const evidence = error as TransportError & {
-    readonly context?: unknown
-    readonly delivery?: unknown
-    readonly invocation?: unknown
-  }
-  if (record(evidence.context)) {
-    if (
-      evidence.context.kind === 'acquisition' &&
-      (evidence.context.resource === 'publication' || evidence.context.resource === 'bundle')
-    ) {
-      return { kind: 'acquisition', resource: evidence.context.resource }
-    }
-    if (
-      evidence.context.kind === 'invocation' &&
-      (evidence.context.delivery === 'not-sent' || evidence.context.delivery === 'unknown')
-    ) {
-      return {
-        kind: 'invocation',
-        delivery: evidence.context.delivery,
-        ...(evidence.context.invocation === undefined
-          ? {}
-          : { invocation: evidence.context.invocation }),
-      }
-    }
-  }
-  if (evidence.delivery !== 'not-sent' && evidence.delivery !== 'unknown') return undefined
-  return {
-    kind: 'invocation',
-    delivery: evidence.delivery,
-    ...(evidence.invocation === undefined ? {} : { invocation: evidence.invocation }),
-  }
-}
-
-function sessionFailure(error: ClientError): SessionFailure | undefined {
-  const failure = (error as ClientError & { readonly failure?: unknown }).failure
-  return failure === 'cancelled' || failure === 'closed' || failure === 'timeout'
-    ? failure
-    : undefined
-}
-
-function record(input: unknown): input is Readonly<Record<string, unknown>> {
-  return input !== null && typeof input === 'object' && !Array.isArray(input)
-}
-
-const simple = (code: string, message: string, hint?: string): FailureDiagnostic => ({
-  kind: 'simple',
-  code,
-  message,
-  ...(hint === undefined ? {} : { hint }),
-})

package/src/connection/failure/index.ts

@@ -1,18 +0,0 @@
-import type { OperationRecovery } from '../command'
-
-import { printFailureDebug } from '../../lib/failure-debug'
-import { classifyFailure } from './classify'
-import { renderFailure } from './render'
-
-export { functionInputIssues, schemaUpgradeHint } from '../reasons'
-
-export async function formatKernelError(
-  error: unknown,
-  machine: boolean,
-  urlArg = '',
-  debug = false,
-  options: { recovery?: OperationRecovery } = {},
-): Promise<void> {
-  renderFailure(classifyFailure(error), machine, urlArg, options.recovery)
-  if (debug) printFailureDebug(error, urlArg)
-}

package/src/connection/failure/model.ts

@@ -1,28 +0,0 @@
-export type TransportDiagnosticContext =
-  | { readonly kind: 'acquisition'; readonly resource: 'publication' | 'bundle' }
-  | {
-      readonly kind: 'invocation'
-      readonly delivery: 'not-sent' | 'unknown'
-      readonly invocation?: unknown
-    }
-
-export type FailureDiagnostic =
-  | {
-      readonly kind: 'simple'
-      readonly code: string
-      readonly message: string
-      readonly hint?: string
-    }
-  | {
-      readonly kind: 'response'
-      readonly code: number
-      readonly message: string
-      readonly reason?: unknown
-    }
-  | {
-      readonly kind: 'transport'
-      readonly code: 'CONNECTION_ERROR' | 'DISCONNECTED' | 'TIMEOUT' | 'TRANSPORT_ERROR'
-      readonly message: string
-      readonly phase: string
-      readonly context: TransportDiagnosticContext
-    }