@astrale-os/sdk 0.3.0 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/compose.d.ts +2 -2
- package/dist/auth/compose.d.ts.map +1 -1
- package/dist/auth/compose.js +2 -2
- package/dist/auth/compose.js.map +1 -1
- package/dist/auth/function-context.d.ts +28 -0
- package/dist/auth/function-context.d.ts.map +1 -0
- package/dist/auth/function-context.js +47 -0
- package/dist/auth/function-context.js.map +1 -0
- package/dist/auth/index.d.ts +5 -3
- package/dist/auth/index.d.ts.map +1 -1
- package/dist/auth/index.js +3 -2
- package/dist/auth/index.js.map +1 -1
- package/dist/auth/issuer-mint.d.ts +9 -9
- package/dist/auth/issuer-mint.d.ts.map +1 -1
- package/dist/auth/issuer-mint.js +3 -3
- package/dist/auth/issuer-mint.js.map +1 -1
- package/dist/auth/kernel-client.d.ts +5 -17
- package/dist/auth/kernel-client.d.ts.map +1 -1
- package/dist/auth/kernel-client.js +12 -34
- package/dist/auth/kernel-client.js.map +1 -1
- package/dist/cli/publish.js +1 -1
- package/dist/cli/publish.js.map +1 -1
- package/dist/config/define-domain.d.ts +1 -1
- package/dist/define/index.d.ts +1 -1
- package/dist/define/index.d.ts.map +1 -1
- package/dist/define/remote-function.d.ts +22 -30
- package/dist/define/remote-function.d.ts.map +1 -1
- package/dist/define/remote-function.js.map +1 -1
- package/dist/define/view.d.ts +6 -10
- package/dist/define/view.d.ts.map +1 -1
- package/dist/define/view.js.map +1 -1
- package/dist/dispatch/dispatcher.d.ts +1 -1
- package/dist/dispatch/dispatcher.d.ts.map +1 -1
- package/dist/dispatch/dispatcher.js +31 -7
- package/dist/dispatch/dispatcher.js.map +1 -1
- package/dist/dispatch/execute.d.ts +10 -6
- package/dist/dispatch/execute.d.ts.map +1 -1
- package/dist/dispatch/execute.js +5 -3
- package/dist/dispatch/execute.js.map +1 -1
- package/dist/dispatch/index.d.ts +0 -1
- package/dist/dispatch/index.d.ts.map +1 -1
- package/dist/dispatch/index.js +0 -1
- package/dist/dispatch/index.js.map +1 -1
- package/dist/index.d.ts +6 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/method/context.d.ts +34 -28
- package/dist/method/context.d.ts.map +1 -1
- package/dist/method/context.js +2 -1
- package/dist/method/context.js.map +1 -1
- package/dist/method/index.d.ts +1 -1
- package/dist/method/index.d.ts.map +1 -1
- package/dist/method/index.js.map +1 -1
- package/dist/method/single.d.ts +2 -2
- package/dist/method/single.d.ts.map +1 -1
- package/dist/server/auxiliary-routes.d.ts.map +1 -1
- package/dist/server/auxiliary-routes.js +40 -21
- package/dist/server/auxiliary-routes.js.map +1 -1
- package/dist/server/create.js +1 -1
- package/dist/server/create.js.map +1 -1
- package/dist/step/index.d.ts +5 -0
- package/dist/step/index.d.ts.map +1 -0
- package/dist/step/index.js +3 -0
- package/dist/step/index.js.map +1 -0
- package/dist/step/inline.d.ts +8 -0
- package/dist/step/inline.d.ts.map +1 -0
- package/dist/step/inline.js +22 -0
- package/dist/step/inline.js.map +1 -0
- package/dist/step/step.d.ts +28 -0
- package/dist/step/step.d.ts.map +1 -0
- package/dist/step/step.js +53 -0
- package/dist/step/step.js.map +1 -0
- package/package.json +5 -1
- package/src/auth/compose.ts +2 -2
- package/src/auth/function-context.ts +108 -0
- package/src/auth/index.ts +9 -3
- package/src/auth/issuer-mint.ts +10 -9
- package/src/auth/kernel-client.ts +19 -44
- package/src/cli/publish.ts +1 -1
- package/src/config/define-domain.ts +1 -1
- package/src/define/index.ts +1 -0
- package/src/define/remote-function.ts +34 -30
- package/src/define/view.ts +6 -10
- package/src/dispatch/dispatcher.ts +34 -8
- package/src/dispatch/execute.ts +15 -9
- package/src/dispatch/index.ts +0 -1
- package/src/index.ts +20 -5
- package/src/method/context.ts +50 -28
- package/src/method/index.ts +8 -1
- package/src/method/single.ts +2 -2
- package/src/server/auxiliary-routes.ts +41 -23
- package/src/server/create.ts +1 -1
- package/src/step/index.ts +4 -0
- package/src/step/inline.ts +38 -0
- package/src/step/step.ts +95 -0
- package/dist/deploy/hash-spec.d.ts +0 -9
- package/dist/deploy/hash-spec.d.ts.map +0 -1
- package/dist/deploy/hash-spec.js +0 -29
- package/dist/deploy/hash-spec.js.map +0 -1
- package/dist/dispatch/call-remote.d.ts +0 -39
- package/dist/dispatch/call-remote.d.ts.map +0 -1
- package/dist/dispatch/call-remote.js +0 -37
- package/dist/dispatch/call-remote.js.map +0 -1
- package/dist/domain/extend-core.d.ts +0 -49
- package/dist/domain/extend-core.d.ts.map +0 -1
- package/dist/domain/extend-core.js +0 -190
- package/dist/domain/extend-core.js.map +0 -1
- package/dist/server/worker-meta.d.ts +0 -6
- package/dist/server/worker-meta.d.ts.map +0 -1
- package/dist/server/worker-meta.js +0 -10
- package/dist/server/worker-meta.js.map +0 -1
- package/src/dispatch/call-remote.ts +0 -53
package/dist/auth/compose.d.ts
CHANGED
|
@@ -30,11 +30,11 @@ export declare function buildComposedGrant(delegation: Delegation): {
|
|
|
30
30
|
};
|
|
31
31
|
/**
|
|
32
32
|
* The SELF-ONLY expression: the function's own identity, nothing delegated.
|
|
33
|
-
* Used by `
|
|
33
|
+
* Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
|
|
34
34
|
* authority) — both as the credential grant and as the next-hop delegation.
|
|
35
35
|
*/
|
|
36
36
|
export declare function buildSelfExpr(): import("@astrale-os/kernel-core").UnresolvedIdentityExpr;
|
|
37
|
-
/** Self-only grant for
|
|
37
|
+
/** Self-only grant for function-owned credentials. */
|
|
38
38
|
export declare function buildSelfGrant(): {
|
|
39
39
|
grant: import("@astrale-os/kernel-core").UnresolvedGrant;
|
|
40
40
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AASzD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,4DAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU;IAC9C,KAAK;EACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,6DAE5B;AAED,
|
|
1
|
+
{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AASzD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,4DAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU;IAC9C,KAAK;EACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,6DAE5B;AAED,sDAAsD;AACtD,wBAAgB,cAAc;IACnB,KAAK;EACf"}
|
package/dist/auth/compose.js
CHANGED
|
@@ -32,13 +32,13 @@ export function buildComposedGrant(delegation) {
|
|
|
32
32
|
}
|
|
33
33
|
/**
|
|
34
34
|
* The SELF-ONLY expression: the function's own identity, nothing delegated.
|
|
35
|
-
* Used by `
|
|
35
|
+
* Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
|
|
36
36
|
* authority) — both as the credential grant and as the next-hop delegation.
|
|
37
37
|
*/
|
|
38
38
|
export function buildSelfExpr() {
|
|
39
39
|
return unresolvedSelf();
|
|
40
40
|
}
|
|
41
|
-
/** Self-only grant for
|
|
41
|
+
/** Self-only grant for function-owned credentials. */
|
|
42
42
|
export function buildSelfGrant() {
|
|
43
43
|
return { grant: createUnresolvedGrant(buildSelfExpr()) };
|
|
44
44
|
}
|
package/dist/auth/compose.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,OAAO,eAAe,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAsB;IACvD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,cAAc,EAAE,CAAA;AACzB,CAAC;AAED,
|
|
1
|
+
{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,OAAO,eAAe,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAsB;IACvD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,cAAc,EAAE,CAAA;AACzB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC"}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
import type { FnMap } from '@astrale-os/kernel-client';
|
|
2
|
+
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
|
|
3
|
+
import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
|
|
4
|
+
import type { RemoteIdentityConfig } from './identity';
|
|
5
|
+
export type FunctionCredentialOptions = {
|
|
6
|
+
/** Credential audience. Defaults to the current/default kernel URL when known. */
|
|
7
|
+
audience?: string;
|
|
8
|
+
/** Grant carried by the top-level kernel bearer. Defaults to self. */
|
|
9
|
+
grant?: UnresolvedIdentityExpr;
|
|
10
|
+
/** JWT lifetime, jose-style. Default is the SDK per-request kernel TTL. */
|
|
11
|
+
ttl?: string;
|
|
12
|
+
};
|
|
13
|
+
export type FunctionKernelOptions = FunctionCredentialOptions & {
|
|
14
|
+
/** Kernel URL to dial. Defaults to `audience`, then the current/default kernel URL. */
|
|
15
|
+
url?: string;
|
|
16
|
+
/** Next-hop delegation for remote redirects. Defaults to the credential grant. */
|
|
17
|
+
delegation?: UnresolvedIdentityExpr;
|
|
18
|
+
};
|
|
19
|
+
export type FunctionContextApi = {
|
|
20
|
+
readonly ref: string;
|
|
21
|
+
credential(opts?: FunctionCredentialOptions): Promise<string>;
|
|
22
|
+
kernel(opts?: FunctionKernelOptions): Promise<BoundClientSessionView<FnMap>>;
|
|
23
|
+
};
|
|
24
|
+
export declare function makeFunctionContext(identity: RemoteIdentityConfig, deps: unknown, opts: {
|
|
25
|
+
ref: string;
|
|
26
|
+
defaultKernelUrl?: string;
|
|
27
|
+
}): FunctionContextApi;
|
|
28
|
+
//# sourceMappingURL=function-context.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"function-context.d.ts","sourceRoot":"","sources":["../../src/auth/function-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAIrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAMtD,MAAM,MAAM,yBAAyB,GAAG;IACtC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;IAC9B,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,yBAAyB,GAAG;IAC9D,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,UAAU,CAAC,EAAE,sBAAsB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,IAAI,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC7E,CAAA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,kBAAkB,CAwBpB"}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
import { createUnresolvedGrant } from '@astrale-os/kernel-core';
|
|
2
|
+
import { buildSelfExpr, buildSelfGrant } from './compose';
|
|
3
|
+
import { bindCredentialSession } from './kernel-client';
|
|
4
|
+
import { signCredential } from './sign';
|
|
5
|
+
export function makeFunctionContext(identity, deps, opts) {
|
|
6
|
+
return {
|
|
7
|
+
ref: opts.ref,
|
|
8
|
+
credential: (params) => signFunctionCredential(identity, resolveAudience(params?.audience, opts.defaultKernelUrl, deps), {
|
|
9
|
+
grant: params?.grant,
|
|
10
|
+
ttl: params?.ttl,
|
|
11
|
+
}),
|
|
12
|
+
kernel: async (params) => {
|
|
13
|
+
const kernelUrl = resolveKernelUrl(params?.url, params?.audience, opts.defaultKernelUrl, deps);
|
|
14
|
+
const grant = params?.grant ?? buildSelfExpr();
|
|
15
|
+
const credential = await signFunctionCredential(identity, params?.audience ?? kernelUrl, {
|
|
16
|
+
grant,
|
|
17
|
+
ttl: params?.ttl,
|
|
18
|
+
});
|
|
19
|
+
return bindCredentialSession(kernelUrl, credential, {
|
|
20
|
+
delegation: params?.delegation ?? grant,
|
|
21
|
+
});
|
|
22
|
+
},
|
|
23
|
+
};
|
|
24
|
+
}
|
|
25
|
+
async function signFunctionCredential(identity, audience, opts) {
|
|
26
|
+
const grant = opts.grant === undefined ? buildSelfGrant().grant : createUnresolvedGrant(opts.grant);
|
|
27
|
+
return signCredential({ grant }, {
|
|
28
|
+
issuer: identity.issuer,
|
|
29
|
+
subject: identity.subject,
|
|
30
|
+
audience,
|
|
31
|
+
privateKey: identity.privateKey,
|
|
32
|
+
ttl: opts.ttl ?? '30m',
|
|
33
|
+
});
|
|
34
|
+
}
|
|
35
|
+
function resolveAudience(audience, defaultKernelUrl, deps) {
|
|
36
|
+
return resolveKernelUrl(undefined, audience, defaultKernelUrl, deps);
|
|
37
|
+
}
|
|
38
|
+
function resolveKernelUrl(url, audience, defaultKernelUrl, deps) {
|
|
39
|
+
const env = deps;
|
|
40
|
+
const resolved = url ?? audience ?? defaultKernelUrl ?? env?.INSTANCE_KERNEL_URL ?? env?.KERNEL_URL;
|
|
41
|
+
if (typeof resolved !== 'string' || resolved.length === 0) {
|
|
42
|
+
throw new Error('fn.kernel: no kernel URL — pass one explicitly or set INSTANCE_KERNEL_URL in the ' +
|
|
43
|
+
'worker env (managed deploys set it automatically).');
|
|
44
|
+
}
|
|
45
|
+
return resolved;
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=function-context.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"function-context.js","sourceRoot":"","sources":["../../src/auth/function-context.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAwBvC,MAAM,UAAU,mBAAmB,CACjC,QAA8B,EAC9B,IAAa,EACb,IAAgD;IAEhD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CACrB,sBAAsB,CACpB,QAAQ,EACR,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAC9D;YACE,KAAK,EAAE,MAAM,EAAE,KAAK;YACpB,GAAG,EAAE,MAAM,EAAE,GAAG;SACjB,CACF;QACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;YAC9F,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,aAAa,EAAE,CAAA;YAC9C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,SAAS,EAAE;gBACvF,KAAK;gBACL,GAAG,EAAE,MAAM,EAAE,GAAG;aACjB,CAAC,CAAA;YACF,OAAO,qBAAqB,CAAC,SAAS,EAAE,UAAU,EAAE;gBAClD,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK;aACxC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAA8B,EAC9B,QAAgB,EAChB,IAAsD;IAEtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvF,OAAO,cAAc,CACnB,EAAE,KAAK,EAAE,EACT;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,KAAK;KACvB,CACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,QAA4B,EAC5B,gBAAoC,EACpC,IAAa;IAEb,OAAO,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAuB,EACvB,QAA4B,EAC5B,gBAAoC,EACpC,IAAa;IAEb,MAAM,GAAG,GAAG,IAAkF,CAAA;IAC9F,MAAM,QAAQ,GACZ,GAAG,IAAI,QAAQ,IAAI,gBAAgB,IAAI,GAAG,EAAE,mBAAmB,IAAI,GAAG,EAAE,UAAU,CAAA;IACpF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,oDAAoD,CACvD,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
|
package/dist/auth/index.d.ts
CHANGED
|
@@ -6,9 +6,11 @@ export { resolveInboundAuth, buildAuthContext, type ResolvedAuth } from './resol
|
|
|
6
6
|
export { verifyInboundCredential } from './verify';
|
|
7
7
|
export { buildComposedGrant } from './compose';
|
|
8
8
|
export { signCredential } from './sign';
|
|
9
|
-
export {
|
|
10
|
-
export type {
|
|
11
|
-
export {
|
|
9
|
+
export { makeDomainAuthority } from './issuer-mint';
|
|
10
|
+
export type { DomainAuthority, MintIssuedParams } from './issuer-mint';
|
|
11
|
+
export { makeFunctionContext } from './function-context';
|
|
12
|
+
export type { FunctionContextApi, FunctionCredentialOptions, FunctionKernelOptions, } from './function-context';
|
|
13
|
+
export { bindKernel } from './kernel-client';
|
|
12
14
|
export { AuthMissingError, AuthInvalidError } from './errors';
|
|
13
15
|
export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './check';
|
|
14
16
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/auth/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC/C,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA"}
|
package/dist/auth/index.js
CHANGED
|
@@ -3,8 +3,9 @@ export { resolveInboundAuth, buildAuthContext } from './resolve';
|
|
|
3
3
|
export { verifyInboundCredential } from './verify';
|
|
4
4
|
export { buildComposedGrant } from './compose';
|
|
5
5
|
export { signCredential } from './sign';
|
|
6
|
-
export {
|
|
7
|
-
export {
|
|
6
|
+
export { makeDomainAuthority } from './issuer-mint';
|
|
7
|
+
export { makeFunctionContext } from './function-context';
|
|
8
|
+
export { bindKernel } from './kernel-client';
|
|
8
9
|
export { AuthMissingError, AuthInvalidError } from './errors';
|
|
9
10
|
export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './check';
|
|
10
11
|
//# sourceMappingURL=index.js.map
|
package/dist/auth/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAqB,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAqB,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAMxD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
|
|
3
3
|
*
|
|
4
4
|
* A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
|
|
5
5
|
* credential signed with the worker's key back to the graph node carrying that
|
|
@@ -19,6 +19,10 @@ import type { FnMap } from '@astrale-os/kernel-client';
|
|
|
19
19
|
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
|
|
20
20
|
import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
|
|
21
21
|
import type { RemoteIdentityConfig } from './identity';
|
|
22
|
+
export type DomainAuthorityRef = {
|
|
23
|
+
/** The issuer ID (used as the `iss` claim in credentials and on Identity nodes). */
|
|
24
|
+
readonly iss: string;
|
|
25
|
+
};
|
|
22
26
|
export type MintIssuedParams = {
|
|
23
27
|
/** The issued identity's `sub` — must match the graph node's stored subject. */
|
|
24
28
|
subject: string;
|
|
@@ -35,19 +39,15 @@ export type MintIssuedParams = {
|
|
|
35
39
|
/** JWT lifetime, jose-style (`'60s'`, `'5m'`, `'1h'`). Default `'1h'`. */
|
|
36
40
|
ttl?: string;
|
|
37
41
|
};
|
|
38
|
-
export type
|
|
39
|
-
/** The issuer (`iss`) this worker signs under — what issued identities store. */
|
|
40
|
-
readonly iss: string;
|
|
42
|
+
export type DomainAuthority = DomainAuthorityRef & {
|
|
41
43
|
/** Sign a credential AS an identity this domain issues. */
|
|
42
44
|
mint(params: MintIssuedParams): Promise<string>;
|
|
43
45
|
/**
|
|
44
46
|
* A kernel session presenting a pre-signed credential (typically from
|
|
45
|
-
* {@link
|
|
46
|
-
* no delegation mint is wired, so redirect-following to other workers is not
|
|
47
|
-
* available on this session.
|
|
47
|
+
* {@link DomainAuthority.mint} with `audience = kernelUrl`).
|
|
48
48
|
*/
|
|
49
49
|
sessionFor(kernelUrl: string, credential: string): BoundClientSessionView<FnMap>;
|
|
50
50
|
};
|
|
51
|
-
/** Build the
|
|
52
|
-
export declare function
|
|
51
|
+
/** Build the domain authority for one worker identity config. */
|
|
52
|
+
export declare function makeDomainAuthority(identity: RemoteIdentityConfig): DomainAuthority;
|
|
53
53
|
//# sourceMappingURL=issuer-mint.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"issuer-mint.d.ts","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAIrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAA;IAC9B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,
|
|
1
|
+
{"version":3,"file":"issuer-mint.d.ts","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAIrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAKtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAA;IAC9B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG;IACjD,2DAA2D;IAC3D,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;CACjF,CAAA;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,eAAe,CAanF"}
|
package/dist/auth/issuer-mint.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
|
|
3
3
|
*
|
|
4
4
|
* A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
|
|
5
5
|
* credential signed with the worker's key back to the graph node carrying that
|
|
@@ -18,8 +18,8 @@
|
|
|
18
18
|
import { createUnresolvedGrant } from '@astrale-os/kernel-core';
|
|
19
19
|
import { bindCredentialSession } from './kernel-client';
|
|
20
20
|
import { signCredential } from './sign';
|
|
21
|
-
/** Build the
|
|
22
|
-
export function
|
|
21
|
+
/** Build the domain authority for one worker identity config. */
|
|
22
|
+
export function makeDomainAuthority(identity) {
|
|
23
23
|
return {
|
|
24
24
|
iss: identity.issuer,
|
|
25
25
|
mint: ({ subject, audience, grant, ttl }) => signCredential(grant !== undefined ? { grant: createUnresolvedGrant(grant) } : {}, {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"issuer-mint.js","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;
|
|
1
|
+
{"version":3,"file":"issuer-mint.js","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAkCvC,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,QAA8B;IAChE,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1C,cAAc,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,QAAQ;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,GAAG,IAAI,IAAI;SACjB,CAAC;QACJ,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC;KACpF,CAAA;AACH,CAAC"}
|
|
@@ -15,6 +15,7 @@
|
|
|
15
15
|
* the old proactive `lookupRemoteBinding` resolve-then-dial.
|
|
16
16
|
*/
|
|
17
17
|
import type { Delegation } from '@astrale-os/kernel-core';
|
|
18
|
+
import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
|
|
18
19
|
import { type FnMap } from '@astrale-os/kernel-client';
|
|
19
20
|
import { type BoundClientSessionView } from '@astrale-os/kernel-client/session';
|
|
20
21
|
import type { RemoteIdentityConfig } from './identity';
|
|
@@ -24,26 +25,13 @@ import type { RemoteIdentityConfig } from './identity';
|
|
|
24
25
|
* identity). Remote-bound redirects mint worker-scoped delegations via AuthApi.
|
|
25
26
|
*/
|
|
26
27
|
export declare function bindKernel(delegation: Delegation, kernelUrl: string, config: RemoteIdentityConfig): Promise<BoundClientSessionView<FnMap>>;
|
|
27
|
-
/**
|
|
28
|
-
* Build a `BoundClientSessionView` authenticated as the FUNCTION'S OWN
|
|
29
|
-
* identity — no inbound delegation, authority = the function's own grants
|
|
30
|
-
* only. The seam behind `selfKernel` for public/webhook handlers: an HMAC- or
|
|
31
|
-
* signature-verified webhook can act on the graph as itself after verifying
|
|
32
|
-
* the upstream. Next-hop mints delegate self only.
|
|
33
|
-
*/
|
|
34
|
-
export declare function bindSelfKernel(kernelUrl: string, config: RemoteIdentityConfig): Promise<BoundClientSessionView<FnMap>>;
|
|
35
28
|
/**
|
|
36
29
|
* Bind a session to a PRE-SIGNED credential — no delegation mint, no composed
|
|
37
30
|
* grant; the credential IS the authority. The seam behind
|
|
38
|
-
* `
|
|
31
|
+
* `DomainAuthority.sessionFor` (a worker acting as an identity it issues). Pool +
|
|
39
32
|
* schema registry are the same per-URL caches the composed sessions use.
|
|
40
33
|
*/
|
|
41
|
-
export declare function bindCredentialSession(kernelUrl: string, credential: string
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
* Resolves the kernel URL from the explicit argument or `deps.KERNEL_URL`
|
|
45
|
-
* (a public request carries no credential, so the parent kernel cannot be
|
|
46
|
-
* inferred — it must be configured).
|
|
47
|
-
*/
|
|
48
|
-
export declare function makeSelfKernel(identity: RemoteIdentityConfig, deps: unknown): (kernelUrl?: string) => Promise<BoundClientSessionView<FnMap>>;
|
|
34
|
+
export declare function bindCredentialSession(kernelUrl: string, credential: string, opts?: {
|
|
35
|
+
delegation?: UnresolvedIdentityExpr;
|
|
36
|
+
}): BoundClientSessionView<FnMap>;
|
|
49
37
|
//# sourceMappingURL=kernel-client.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kernel-client.d.ts","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;
|
|
1
|
+
{"version":3,"file":"kernel-client.d.ts","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAErE,OAAO,EAAgC,KAAK,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAEpF,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAA;AAE1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAiCtD;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAIxC;AAiDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,sBAAsB,CAAA;CAAO,GACjD,sBAAsB,CAAC,KAAK,CAAC,CAkB/B"}
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
import { KernelClient, SchemaRegistry } from '@astrale-os/kernel-client';
|
|
18
18
|
import { ClientPool } from '@astrale-os/kernel-client/pool';
|
|
19
19
|
import { ClientSession, allowAllDelegations, delegationMintVia, } from '@astrale-os/kernel-client/session';
|
|
20
|
-
import { buildComposedExpr, buildComposedGrant, buildSelfExpr
|
|
20
|
+
import { buildComposedExpr, buildComposedGrant, buildSelfExpr } from './compose';
|
|
21
21
|
import { signCredential } from './sign';
|
|
22
22
|
const DELEGATION_TTL_SECONDS = 3600;
|
|
23
23
|
// Shared per kernel URL — the expensive, identity-agnostic state. Sessions are
|
|
@@ -52,16 +52,6 @@ function getPool(url) {
|
|
|
52
52
|
export async function bindKernel(delegation, kernelUrl, config) {
|
|
53
53
|
return bindSession(kernelUrl, config, buildComposedGrant(delegation).grant, () => buildComposedExpr(delegation));
|
|
54
54
|
}
|
|
55
|
-
/**
|
|
56
|
-
* Build a `BoundClientSessionView` authenticated as the FUNCTION'S OWN
|
|
57
|
-
* identity — no inbound delegation, authority = the function's own grants
|
|
58
|
-
* only. The seam behind `selfKernel` for public/webhook handlers: an HMAC- or
|
|
59
|
-
* signature-verified webhook can act on the graph as itself after verifying
|
|
60
|
-
* the upstream. Next-hop mints delegate self only.
|
|
61
|
-
*/
|
|
62
|
-
export async function bindSelfKernel(kernelUrl, config) {
|
|
63
|
-
return bindSession(kernelUrl, config, buildSelfGrant().grant, () => buildSelfExpr());
|
|
64
|
-
}
|
|
65
55
|
/**
|
|
66
56
|
* Shared session construction: sign a credential as this function's identity
|
|
67
57
|
* carrying `grant`, bind the session to it, and wire the lazy NEXT-HOP mint.
|
|
@@ -86,7 +76,7 @@ async function bindSession(kernelUrl, config, grant, nextHopDelegation) {
|
|
|
86
76
|
schema: getRegistry(kernelUrl),
|
|
87
77
|
pool: getPool(kernelUrl),
|
|
88
78
|
delegation: {
|
|
89
|
-
mint: delegationMintVia(() => session, credential),
|
|
79
|
+
mint: delegationMintVia(() => session, () => credential),
|
|
90
80
|
ttl: DELEGATION_TTL_SECONDS,
|
|
91
81
|
},
|
|
92
82
|
delegationPolicy: {
|
|
@@ -99,35 +89,23 @@ async function bindSession(kernelUrl, config, grant, nextHopDelegation) {
|
|
|
99
89
|
/**
|
|
100
90
|
* Bind a session to a PRE-SIGNED credential — no delegation mint, no composed
|
|
101
91
|
* grant; the credential IS the authority. The seam behind
|
|
102
|
-
* `
|
|
92
|
+
* `DomainAuthority.sessionFor` (a worker acting as an identity it issues). Pool +
|
|
103
93
|
* schema registry are the same per-URL caches the composed sessions use.
|
|
104
94
|
*/
|
|
105
|
-
export function bindCredentialSession(kernelUrl, credential) {
|
|
95
|
+
export function bindCredentialSession(kernelUrl, credential, opts = {}) {
|
|
106
96
|
const session = new ClientSession({
|
|
107
97
|
default: kernelUrl,
|
|
108
98
|
schema: getRegistry(kernelUrl),
|
|
109
99
|
pool: getPool(kernelUrl),
|
|
100
|
+
delegation: {
|
|
101
|
+
mint: delegationMintVia(() => session, () => credential),
|
|
102
|
+
ttl: DELEGATION_TTL_SECONDS,
|
|
103
|
+
},
|
|
104
|
+
delegationPolicy: {
|
|
105
|
+
...allowAllDelegations({ default: kernelUrl }),
|
|
106
|
+
delegationFor: () => opts.delegation ?? buildSelfExpr(),
|
|
107
|
+
},
|
|
110
108
|
});
|
|
111
109
|
return session.as(credential);
|
|
112
110
|
}
|
|
113
|
-
/**
|
|
114
|
-
* Build the `selfKernel` accessor handed to remote-function handlers.
|
|
115
|
-
* Resolves the kernel URL from the explicit argument or `deps.KERNEL_URL`
|
|
116
|
-
* (a public request carries no credential, so the parent kernel cannot be
|
|
117
|
-
* inferred — it must be configured).
|
|
118
|
-
*/
|
|
119
|
-
export function makeSelfKernel(identity, deps) {
|
|
120
|
-
return async (kernelUrl) => {
|
|
121
|
-
const env = deps;
|
|
122
|
-
// Prefer the INSTANCE kernel (the graph this domain is installed on);
|
|
123
|
-
// KERNEL_URL on managed services is the HOST kernel (the box) — wrong
|
|
124
|
-
// graph for domain writes, kept only as a last-resort fallback.
|
|
125
|
-
const url = kernelUrl ?? env?.INSTANCE_KERNEL_URL ?? env?.KERNEL_URL;
|
|
126
|
-
if (typeof url !== 'string' || url.length === 0) {
|
|
127
|
-
throw new Error('selfKernel: no kernel URL — pass one explicitly or set INSTANCE_KERNEL_URL in the ' +
|
|
128
|
-
'worker env (managed deploys set it automatically).');
|
|
129
|
-
}
|
|
130
|
-
return bindSelfKernel(url, identity);
|
|
131
|
-
};
|
|
132
|
-
}
|
|
133
111
|
//# sourceMappingURL=kernel-client.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kernel-client.js","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAc,MAAM,2BAA2B,CAAA;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mCAAmC,CAAA;AAI1C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,
|
|
1
|
+
{"version":3,"file":"kernel-client.js","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAc,MAAM,2BAA2B,CAAA;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mCAAmC,CAAA;AAI1C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AAEvC,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAEnC,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAA;AAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;AAEpD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAA;QAC/B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAQ;QACjC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,YAAY,CAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KAC5E,CAAC,CAAA;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAsB,EACtB,SAAiB,EACjB,MAA4B;IAE5B,OAAO,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAC/E,iBAAiB,CAAC,UAAU,CAAC,CAC9B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,MAA4B,EAC5B,KAAc,EACd,iBAA+C;IAE/C,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,EAAE,KAAK,EAAE,EACT;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,8BAA8B;QAC9B,GAAG,EAAE,KAAK;KACX,CACF,CAAA;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAyB,IAAI,aAAa,CAAQ;QAC7D,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB,CACrB,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,CAAC,UAAU,CACjB;YACD,GAAG,EAAE,sBAAsB;SAC5B;QACD,gBAAgB,EAAE;YAChB,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9C,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;SACzC;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,UAAkB,EAClB,IAAI,GAA4C,EAAE;IAElD,MAAM,OAAO,GAAyB,IAAI,aAAa,CAAQ;QAC7D,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB,CACrB,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,CAAC,UAAU,CACjB;YACD,GAAG,EAAE,sBAAsB;SAC5B;QACD,gBAAgB,EAAE;YAChB,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9C,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,EAAE;SACxD;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC"}
|
package/dist/cli/publish.js
CHANGED
|
@@ -122,7 +122,7 @@ export async function publishSchema(args) {
|
|
|
122
122
|
if (!dir) {
|
|
123
123
|
error(`No schema package found (no package.json at ./schema or the current dir). A schema\n` +
|
|
124
124
|
` package declares peerDependencies (@astrale-os/kernel-core + kernel-dsl + zod) and a\n` +
|
|
125
|
-
` publishConfig that repoints main/exports to ./dist — see domains/
|
|
125
|
+
` publishConfig that repoints main/exports to ./dist — see domains/shell/schema.`);
|
|
126
126
|
return 1;
|
|
127
127
|
}
|
|
128
128
|
const pkgPath = join(dir, 'package.json');
|
package/dist/cli/publish.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/cli/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAalE,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAShC;IACC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC1E,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAA;IACtD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,GAAG,yCAAyC,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,MAAM,GAAG,mCAAmC,CAAC,CAAA;IAC5E,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAQ3C;IACC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChG,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IACvC,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;AACvE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,0BAA0B,CACvC,UAAkB,EAClB,IAA4D;IAE5D,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,qDAAqD,CAAC,CAAA;QAC3D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,UAAU;QACV,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC;QACZ,KAAK,CACH,wFAAwF;YACtF,wFAAwF,CAC3F,CAAA;IACH,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,IAAmE,EACnE,GAAW;IAEX,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAA;IAClE,uFAAuF;IACvF,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,SAAS;QACT,UAAU;QACV,IAAI,CAAC,MAAM;QACX,QAAQ;QACR,IAAI;QACJ,cAAc;QACd,GAAG;KACJ,CAAA;IACD,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;IAC3D,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAE/D,IAAI,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtE,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAClD,KAAK,CACH,0EAA0E,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAA;;gBACE,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACtE,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGvE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAOnC;IACC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,KAAK,CACH,sFAAsF;YACpF,0FAA0F;YAC1F,
|
|
1
|
+
{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/cli/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAalE,gFAAgF;AAEhF,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAShC;IACC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC1E,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAEvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAA;IACtD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,GAAG,yCAAyC,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,MAAM,GAAG,mCAAmC,CAAC,CAAA;IAC5E,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAQ3C;IACC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAChG,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IACvC,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;AACvE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,0BAA0B,CACvC,UAAkB,EAClB,IAA4D;IAE5D,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,qDAAqD,CAAC,CAAA;QAC3D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,UAAU;QACV,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAA;IACF,IAAI,IAAI,KAAK,CAAC;QACZ,KAAK,CACH,wFAAwF;YACtF,wFAAwF,CAC3F,CAAA;IACH,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,UAAkB,EAClB,IAAmE,EACnE,GAAW;IAEX,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAA;IAClE,uFAAuF;IACvF,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,SAAS;QACT,UAAU;QACV,IAAI,CAAC,MAAM;QACX,QAAQ;QACR,IAAI;QACJ,cAAc;QACd,GAAG;KACJ,CAAA;IACD,IAAI,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;IAC3D,IAAI,IAAI,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAE/D,IAAI,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACtE,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAClD,KAAK,CACH,0EAA0E,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAA;;gBACE,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACtE,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGvE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAOnC;IACC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,KAAK,CACH,sFAAsF;YACpF,0FAA0F;YAC1F,kFAAkF,CACrF,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACzC,IAAI,GAAc,CAAA;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAc,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,kBAAkB,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC7D,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,2CAA2C,OAAO,IAAI,CAAC,CAAA;QAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAc,CAAA;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiB,CAAA;IAErC,wEAAwE;IACxE,qFAAqF;IACrF,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,CACF,GAAG,IAAI,GAAG,IAAI,IAAI,OAAO,GAAG,KAAK,0BAA0B;YACzD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAClF,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,IAAI,GAAG,IAAI,IAAI,OAAO,GAAG,KAAK,SAAS,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACnF,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACvD,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC;aAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAA;YAC/C,OAAO,CAAC,CAAA;QACV,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,MAAM,IAAI,QAAQ,CAAA;QACpD,MAAM,WAAW,GAAG;YAClB,SAAS;YACT,OAAO;YACP,UAAU;YACV,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC,CAAA;QACD,IAAI,CACF,IAAI,CAAC,MAAM;YACT,CAAC,CAAC,YAAY,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE;YACvD,CAAC,CAAC,cAAc,GAAG,8CAA8C,KAAK,EAAE,CAC3E,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,KAAK,CACH,sBAAsB,IAAI,wDAAwD;gBAChF,oCAAoC,CACvC,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,2CAA2C,CAAC,CAAA;;YAC7D,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,UAAkB,EAAE,QAAiB;IAC7D,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAA;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,GAAc;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAC3D,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;SAC5D,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,OAAO,0CAA0C,CAAC,CAAA;IACrF,IAAI,GAAG,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACzE,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC;QACzE,QAAQ,CAAC,IAAI,CACX,qFAAqF,CACtF,CAAA;IACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC5E,IAAI,CAAC,GAAG,CAAC,aAAa;QACpB,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAA;IACjG,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,CAAU,EAAE,CAAC;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxC,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,GAAG,UAAU,IAAI,iDAAiD,CAChF,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACvD,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,GAAG,GAAG,EAAE,CAAA;QACZ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE;YACpE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,6DAA6D;QACrG,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAA0B,EAAE,GAAY;IAC7E,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,OAAmB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,GAAI,GAA6B,CAAC,IAAI,CAAA;YAC7C,KAAK,CACH,CAAC,KAAK,QAAQ;gBACZ,CAAC,CAAC,KAAK,GAAG,uBAAuB;gBACjC,CAAC,CAAC,mBAAmB,GAAG,OAAO,GAAG,CAAC,OAAO,EAAE,CAC/C,CAAA;YACD,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,KAAK,IAAI,KAAK,cAAc,IAAI,GAAG,IAAI,IAAI,OAAO,GAAG,KAAK,IAAI;QACjE,KAAK,GAAG,cAAc,KAAK,IAAI,IAAI,gCAAgC,IAAI,IAAI,KAAK,EAAE;QAClF,GAAG,GAAG,gDAAgD,KAAK,IAAI;QAC/D,KAAK,GAAG,WAAW,IAAI,8BAA8B,KAAK,GAAG,GAAG,mBAAmB;QACnF,6BAA6B,KAAK,MAAM,CAC3C,CAAA;AACH,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,EAAU;IACnC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACtE,CAAC"}
|
|
@@ -135,7 +135,7 @@ export interface DefineDomainConfig<S extends Schema, TDeps, TEnv = unknown> {
|
|
|
135
135
|
* `has_parent` position: the domain's `installed_in` edge and EVERY typed
|
|
136
136
|
* address (`/:<origin>`, `/:<origin>:Class`, …) stay ROOT-mounted, so
|
|
137
137
|
* addressing is unchanged. A platform domain that must stay top-level sets its
|
|
138
|
-
* own origin path (e.g. `'/
|
|
138
|
+
* own origin path (e.g. `'/shell.astrale.ai'`).
|
|
139
139
|
*/
|
|
140
140
|
path?: string;
|
|
141
141
|
/**
|
package/dist/define/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export { defineView } from './view';
|
|
2
2
|
export type { ViewDef, ViewRenderContext } from './view';
|
|
3
3
|
export { defineRemoteFunction } from './remote-function';
|
|
4
|
-
export type { AnyRemoteFunctionDef, RemoteFunctionContext, RemoteFunctionDef, } from './remote-function';
|
|
4
|
+
export type { AnyRemoteFunctionDef, RemoteFunctionAuthorizeContext, RemoteFunctionContext, RemoteFunctionDef, } from './remote-function';
|
|
5
5
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/define/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/define/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,YAAY,EACV,oBAAoB,EACpB,8BAA8B,EAC9B,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAA"}
|
|
@@ -21,10 +21,11 @@ import type { FnMap } from '@astrale-os/kernel-client';
|
|
|
21
21
|
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
|
|
22
22
|
import type { Context } from 'hono';
|
|
23
23
|
import type { z } from 'zod';
|
|
24
|
-
import type {
|
|
25
|
-
import type {
|
|
26
|
-
import type { AuthForPolicy, KernelForAuth } from '../method/context';
|
|
27
|
-
|
|
24
|
+
import type { FunctionContextApi } from '../auth/function-context';
|
|
25
|
+
import type { DomainAuthority } from '../auth/issuer-mint';
|
|
26
|
+
import type { AuthForPolicy, CallerContext, KernelForAuth, RemoteEnv } from '../method/context';
|
|
27
|
+
import type { Step } from '../step';
|
|
28
|
+
type RemoteFunctionBaseContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null, TAuth extends AuthPolicy = AuthPolicy> = {
|
|
28
29
|
/** Validated params (Zod-checked against `inputSchema`). */
|
|
29
30
|
params: TParams;
|
|
30
31
|
/** Hono request context — escape hatch for headers, raw body, etc. */
|
|
@@ -37,6 +38,8 @@ export type RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClien
|
|
|
37
38
|
auth: AuthForPolicy<TAuth>;
|
|
38
39
|
/** Typed dependency container injected at server startup. */
|
|
39
40
|
deps: TDeps;
|
|
41
|
+
/** Local serving metadata. */
|
|
42
|
+
env: RemoteEnv;
|
|
40
43
|
/**
|
|
41
44
|
* `BoundClientSessionView` to the parent kernel, bound to the composed
|
|
42
45
|
* credential `union(delegation, self)` — same shape as `RemoteContext.kernel`
|
|
@@ -45,33 +48,22 @@ export type RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClien
|
|
|
45
48
|
* `kernel.createNode` / `kernel.mutate(patch)`, …) over the `function.get` /
|
|
46
49
|
* `function.mutate` syscalls. Nullability follows {@link KernelForAuth} of the
|
|
47
50
|
* function's `auth`: non-null for the default `'required'`, `… | null` for
|
|
48
|
-
* `'optional'`, `null` for `'public'` (use
|
|
49
|
-
*
|
|
51
|
+
* `'optional'`, `null` for `'public'` (use `ctx.fn.kernel()` there, after
|
|
52
|
+
* verifying the upstream).
|
|
50
53
|
*/
|
|
51
54
|
kernel: TKernel;
|
|
52
|
-
/**
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
* Call another worker's remote method, re-minting the credential for the
|
|
59
|
-
* target's audience. Same contract as {@link RemoteContext.callRemote}: throws
|
|
60
|
-
* on a public/unauthenticated request; needs `USE` on
|
|
61
|
-
* `Identity.mintDelegationCredential` + the target method's grants.
|
|
62
|
-
*/
|
|
63
|
-
callRemote: CallRemoteFn;
|
|
64
|
-
/**
|
|
65
|
-
* Acquire a kernel session authenticated as THIS FUNCTION'S OWN identity —
|
|
66
|
-
* authority = the function's own grants only, no caller delegation. The
|
|
67
|
-
* webhook seam: when an `auth: 'public'` upstream can't carry an Astrale
|
|
68
|
-
* token (HMAC-signature webhooks, Stripe-style), VERIFY THE UPSTREAM'S
|
|
69
|
-
* SIGNATURE FIRST, then act on the graph as yourself. `kernelUrl` defaults
|
|
70
|
-
* to `deps.KERNEL_URL` (set automatically on managed deploys); pass it
|
|
71
|
-
* explicitly for other targets.
|
|
72
|
-
*/
|
|
73
|
-
selfKernel: (kernelUrl?: string) => Promise<BoundClientSessionView<FnMap>>;
|
|
55
|
+
/** Inbound kernel/peer context. Present only for authenticated invocations. */
|
|
56
|
+
caller?: CallerContext;
|
|
57
|
+
/** Mint seam for identities THIS DOMAIN issues. */
|
|
58
|
+
domain: DomainAuthority;
|
|
59
|
+
/** Current function identity tools. */
|
|
60
|
+
fn: FunctionContextApi;
|
|
74
61
|
};
|
|
62
|
+
export type RemoteFunctionAuthorizeContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null, TAuth extends AuthPolicy = AuthPolicy> = RemoteFunctionBaseContext<TParams, TDeps, TKernel, TAuth>;
|
|
63
|
+
export interface RemoteFunctionContext<TParams, TDeps = unknown, TKernel = BoundClientSessionView<FnMap> | null, TAuth extends AuthPolicy = AuthPolicy> extends RemoteFunctionBaseContext<TParams, TDeps, TKernel, TAuth> {
|
|
64
|
+
/** Durable-shaped step builder. Inline today, replayable by future backends. */
|
|
65
|
+
step: Step;
|
|
66
|
+
}
|
|
75
67
|
export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unknown, TAuth extends AuthPolicy = 'required'> = {
|
|
76
68
|
/** Zod schema for the call's parameters. */
|
|
77
69
|
inputSchema: z.ZodType<TParams>;
|
|
@@ -93,11 +85,11 @@ export type RemoteFunctionDef<TParams = unknown, TResult = unknown, TDeps = unkn
|
|
|
93
85
|
* so it drives `ctx.auth` and {@link KernelForAuth} on the
|
|
94
86
|
* `execute`/`authorize` context: omit it (or `'required'`) makes both
|
|
95
87
|
* non-null; `'optional'` widens them to `... | null`; `'public'` makes them
|
|
96
|
-
* `null` (webhooks reach the graph via `ctx.
|
|
88
|
+
* `null` (webhooks reach the graph via `ctx.fn.kernel()`).
|
|
97
89
|
*/
|
|
98
90
|
auth?: TAuth;
|
|
99
91
|
/** Optional pre-execute authorization. Throw to deny. */
|
|
100
|
-
authorize?: (ctx:
|
|
92
|
+
authorize?: (ctx: RemoteFunctionAuthorizeContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>) => void | Promise<void>;
|
|
101
93
|
/** The function body. May be async. */
|
|
102
94
|
execute: (ctx: RemoteFunctionContext<TParams, TDeps, KernelForAuth<TAuth>, TAuth>) => TResult | Promise<TResult>;
|
|
103
95
|
/** Optional human-readable description. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"remote-function.d.ts","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,KAAK,EAAE,
|
|
1
|
+
{"version":3,"file":"remote-function.d.ts","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAE5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC/F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAEnC,KAAK,yBAAyB,CAC5B,OAAO,EACP,KAAK,GAAG,OAAO,EACf,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC9C,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,4DAA4D;IAC5D,MAAM,EAAE,OAAO,CAAA;IACf,sEAAsE;IACtE,CAAC,EAAE,OAAO,CAAA;IACV;;;;OAIG;IACH,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,CAAA;IAC1B,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAA;IACX,8BAA8B;IAC9B,GAAG,EAAE,SAAS,CAAA;IACd;;;;;;;;;;OAUG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,+EAA+E;IAC/E,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,mDAAmD;IACnD,MAAM,EAAE,eAAe,CAAA;IACvB,uCAAuC;IACvC,EAAE,EAAE,kBAAkB,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,8BAA8B,CACxC,OAAO,EACP,KAAK,GAAG,OAAO,EACf,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC9C,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC,yBAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AAE7D,MAAM,WAAW,qBAAqB,CACpC,OAAO,EACP,KAAK,GAAG,OAAO,EACf,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,IAAI,EAC9C,KAAK,SAAS,UAAU,GAAG,UAAU,CACrC,SAAQ,yBAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;IACjE,gFAAgF;IAChF,IAAI,EAAE,IAAI,CAAA;CACX;AAED,MAAM,MAAM,iBAAiB,CAC3B,OAAO,GAAG,OAAO,EACjB,OAAO,GAAG,OAAO,EACjB,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,IACnC;IACF,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,wCAAwC;IACxC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAChC;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ,yDAAyD;IACzD,SAAS,CAAC,EAAE,CACV,GAAG,EAAE,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAC7E,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,uCAAuC;IACvC,OAAO,EAAE,CACP,GAAG,EAAE,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KACpE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAcD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,EAC5C,WAAW,GAAG,SAAS,CACxB,GAAG;IACF,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,CAAA;CAC3B,CAAA;AAOD,KAAK,WAAW,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;AACpC,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,oBAAoB,GAAG,IAAI,GAAG,KAAK,CAAA;AAKlE,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/E,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACjF,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;CAClF,CAAA;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EACP,OAAO,EACP,KAAK,GAAG,OAAO,EACf,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GACrD,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAEnD"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"remote-function.js","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;
|
|
1
|
+
{"version":3,"file":"remote-function.js","sourceRoot":"","sources":["../../src/define/remote-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAoJH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAMlC,GAAsD;IAEtD,OAAO,GAAG,CAAA;AACZ,CAAC"}
|