@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/dist/server/remote.js

@@ -0,0 +1,631 @@
+import { call, Client } from '@astrale-os/kernel-client';
+import { createAuth } from '@astrale-os/kernel-client/auth';
+import { createGraph } from '@astrale-os/kernel-client/graph';
+import { ClientSession } from '@astrale-os/kernel-client/session';
+import { credential, delegation, issuer, jwk } from '@astrale-os/kernel-core/auth';
+import { Domain } from '@astrale-os/kernel-core/domain';
+import { NodeId } from '@astrale-os/kernel-core/graph/node';
+import { Path } from '@astrale-os/kernel-core/path';
+import { syscalls } from '@astrale-os/kernel-core/schema';
+import { AuthenticationError } from '@astrale-os/kernel-ports/authentication';
+import { FunctionError } from '@astrale-os/kernel-ports/functions';
+import { errors as protocolErrors, installation, issuer as issuerProtocol, } from '@astrale-os/kernel-protocol';
+import { errors as joseErrors, importJWK, jwtVerify, SignJWT } from 'jose';
+import { bindCallables, createDeployment } from '../deployment/index.js';
+import { createApplication } from './application.js';
+const CALLBACK_TTL_SECONDS = 120;
+const MAXIMUM_DISCOVERY_DOCUMENT_BYTES = 256 * 1024;
+const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * Compose the portable V2 Deployment/Application pair for one remotely hosted Domain.
+ * The helper owns only generic remote identity, installation attestation, and callback authority;
+ * provider routing and lifecycle remain adapter capabilities.
+ */
+export function createRemoteApplication(input) {
+    const issuerId = httpIssuer(input.identity.issuer, input.identity.allowInsecureHttp === true);
+    if (input.identity.subject !== input.definition.schema.origin) {
+        throw new TypeError('Remote identity subject must equal the Domain origin.');
+    }
+    const delivery = input.deployment;
+    const deploymentInput = {
+        definition: input.definition,
+        issuer: issuerId,
+        bundleHref: delivery.bundleHref,
+        bindings: {
+            callables: bindCallables(input.definition, delivery.endpoint),
+        },
+        ...(delivery.frontendBaseHref === undefined
+            ? {}
+            : { frontendBaseHref: delivery.frontendBaseHref }),
+        ...(delivery.frontendCacheKey === undefined
+            ? {}
+            : { frontendCacheKey: delivery.frontendCacheKey }),
+        ...(delivery.protocolViewBindings === undefined
+            ? {}
+            : { protocolViewBindings: delivery.protocolViewBindings }),
+        ...(delivery.routes === undefined ? {} : { routes: delivery.routes }),
+        ...(delivery.manifest === undefined ? {} : { manifest: delivery.manifest }),
+        ...(delivery.installation === undefined ? {} : { installation: delivery.installation }),
+        servingEndpoint: delivery.endpoint,
+    };
+    const deployed = createDeployment(deploymentInput);
+    const signing = signingMaterial(input.identity.privateKey);
+    let current = deployed;
+    const applicationInput = {
+        deployment: deployed,
+        environment: input.environment,
+        identity: remoteIdentity({ ...input.identity, issuer: issuerId }, signing),
+        server: input.server,
+        ...(input.workflowRunner === undefined ? {} : { workflowRunner: input.workflowRunner }),
+        ...(delivery.installation === undefined
+            ? {}
+            : { installation: publicInstallationProvider(() => current, signing) }),
+        ...(input.app === undefined ? {} : { app: input.app }),
+    };
+    const application = createApplication(applicationInput);
+    return Object.freeze({
+        app: application.app,
+        get publication() {
+            return application.publication;
+        },
+        replace(candidate) {
+            const replaced = application.replace(candidate);
+            current = candidate;
+            return replaced;
+        },
+        drain: application.drain,
+        close: application.close,
+    });
+}
+/** Build one immutable Application identity backed by an asymmetric private JWK. */
+export function createRemoteIdentity(input) {
+    return remoteIdentity(input, signingMaterial(input.privateKey));
+}
+function remoteIdentity(input, signing) {
+    const selfIssuer = httpIssuer(input.issuer, input.allowInsecureHttp === true);
+    const fetchImpl = input.fetch ?? globalThis.fetch.bind(globalThis);
+    if (typeof fetchImpl !== 'function')
+        throw new TypeError('Remote identity requires Fetch.');
+    if (typeof input.subject !== 'string' || input.subject.length === 0) {
+        throw new TypeError('Remote identity subject must not be empty.');
+    }
+    if (input.allowEndpoint !== undefined && typeof input.allowEndpoint !== 'function') {
+        throw new TypeError('Remote identity endpoint policy is invalid.');
+    }
+    return Object.freeze({
+        issuer: selfIssuer,
+        signingAlgorithm: signing.algorithm,
+        loadPublicKeys: async () => [signing.publicKey],
+        admit: (request) => admitAttempt(request, signing, selfIssuer, fetchImpl, input),
+        authenticate: async (request) => {
+            const established = await establishCaller(request.credential, selfIssuer, fetchImpl, request.context.execution.signal, input);
+            if (established.verified.iss !== request.via.issuer) {
+                throw new AuthenticationError('INVALID_CREDENTIAL', 'Destination carrier issuer differs from the admitted Via Kernel.');
+            }
+            const context = request.context.execution;
+            const callbackAudience = established.verified.iss;
+            const composed = composedIdentity(established.delegation.credential);
+            const composedCredential = await signCallback(signing, selfIssuer, input.subject, callbackAudience, composed, established.verified, context);
+            const fetch = boundedFetch(fetchImpl, context.signal);
+            const session = new ClientSession({
+                url: invocationUrl(callbackAudience),
+                sourceIssuer: callbackAudience,
+                fetch,
+                auth: {
+                    ttlSeconds: callbackTtl(context.deadline),
+                    resolve: () => ({ credential: composedCredential }),
+                },
+                policy: {
+                    maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
+                    ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
+                    ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+                },
+                timeoutMs: Math.max(1, context.deadline - Date.now()),
+            });
+            const dispatch = (call, options) => session.dispatch(call, boundedSessionOptions(context, options));
+            const kernel = kernelCapability(session, dispatch, context);
+            const app = domainHandle(request.domain, dispatch);
+            return Object.freeze({
+                caller: established.caller,
+                app,
+                kernel,
+            });
+        },
+    });
+}
+function signingMaterial(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError('Remote identity private key must be a JWK object.');
+    }
+    const algorithm = input.alg;
+    if (typeof algorithm !== 'string' || algorithm.length === 0) {
+        throw new TypeError('Remote identity private JWK requires alg.');
+    }
+    const keyId = input.kid;
+    if (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0)) {
+        throw new TypeError('Remote identity private JWK kid is invalid.');
+    }
+    const value = input;
+    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, k: _k, ...publicValue } = value;
+    const publicKey = jwk.acceptPublic({
+        ...publicValue,
+        alg: algorithm,
+        ...(keyId ? { kid: keyId } : {}),
+    });
+    return Object.freeze({
+        algorithm,
+        ...(keyId === undefined ? {} : { keyId }),
+        privateKey: importJWK(input, algorithm),
+        publicKey,
+    });
+}
+async function establishCaller(input, audience, fetch, signal, policy) {
+    try {
+        const context = await verifyCredential(input, audience, fetch, signal, policy);
+        const carried = delegation.accept(context.verified.claims.delegation);
+        let principal;
+        try {
+            principal = NodeId(context.verified.sub);
+        }
+        catch {
+            throw new CredentialRejected('Credential subject is not a Kernel IdentityId.');
+        }
+        return Object.freeze({
+            verified: context.verified,
+            delegation: carried,
+            caller: Object.freeze({
+                kind: 'authenticated',
+                principal,
+                authentication: credential.evidence(context),
+            }),
+        });
+    }
+    catch (cause) {
+        if (cause instanceof AuthenticationError)
+            throw cause;
+        if (cause instanceof IssuerUnavailable) {
+            throw new AuthenticationError('AUTHENTICATION_BACKEND_FAILED', cause.message, {
+                cause: cause.cause,
+            });
+        }
+        if (cause instanceof CredentialRejected ||
+            cause instanceof joseErrors.JOSEError ||
+            cause instanceof protocolErrors.ProtocolError) {
+            throw new AuthenticationError('INVALID_CREDENTIAL', 'Credential is invalid.');
+        }
+        throw cause;
+    }
+}
+async function verifyCredential(input, audience, fetch, signal, policy) {
+    let inspected;
+    try {
+        inspected = credential.inspect(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential is malformed.', cause);
+    }
+    if (inspected.iss === undefined)
+        throw new CredentialRejected('Credential issuer is missing.');
+    let admittedIssuer;
+    try {
+        admittedIssuer = httpIssuer(inspected.iss, policy.allowInsecureHttp === true);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential issuer is invalid.', cause);
+    }
+    const paths = issuerProtocol.paths(admittedIssuer);
+    const configurationUrl = new URL(paths.configuration, admittedIssuer).toString();
+    admitEndpoint(configurationUrl, policy);
+    const configurationResponse = await fetchDiscovery(fetch, configurationUrl, signal);
+    const configuration = issuerProtocol.acceptConfiguration(await boundedJson(configurationResponse, signal), admittedIssuer);
+    admitEndpoint(configuration.jwks_uri, policy);
+    const keysResponse = await fetchDiscovery(fetch, configuration.jwks_uri, signal);
+    const keys = issuerProtocol.acceptKeySet(await boundedJson(keysResponse, signal), configuration.id_token_signing_alg_values_supported).keys;
+    const compact = typeof input === 'string' ? input : new TextDecoder().decode(input);
+    const candidates = keys.filter((candidate) => inspected.kid === undefined || candidate.kid === inspected.kid);
+    const matches = [];
+    for (const candidate of candidates) {
+        try {
+            const imported = await importJWK(candidate, candidate.alg ?? configuration.id_token_signing_alg_values_supported[0]);
+            matches.push(await jwtVerify(compact, imported, {
+                issuer: admittedIssuer,
+                audience,
+                algorithms: [...configuration.id_token_signing_alg_values_supported],
+            }));
+        }
+        catch (cause) {
+            if (cause instanceof joseErrors.JOSEError)
+                continue;
+            throw cause;
+        }
+    }
+    if (matches.length !== 1) {
+        throw new CredentialRejected('Credential signature is not uniquely verified.');
+    }
+    const match = matches[0];
+    let verified;
+    try {
+        verified = credential.acceptVerified({
+            method: 'jwt',
+            iss: match.payload.iss,
+            sub: match.payload.sub,
+            aud: match.payload.aud,
+            kid: match.protectedHeader.kid,
+            iat: match.payload.iat,
+            nbf: match.payload.nbf,
+            exp: match.payload.exp,
+            claims: match.payload,
+        });
+        credential.verifyAudience(verified, audience);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential claims are invalid.', cause);
+    }
+    admitEndpoint(invocationUrl(admittedIssuer), policy);
+    return Object.freeze({ raw: input, verified });
+}
+async function fetchDiscovery(fetch, url, signal) {
+    let response;
+    try {
+        response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+    }
+    catch (cause) {
+        if (signal.aborted)
+            throw signal.reason;
+        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+    }
+    return response;
+}
+async function boundedJson(response, signal) {
+    const declared = response.headers.get('content-length');
+    if (declared !== null && Number(declared) > MAXIMUM_DISCOVERY_DOCUMENT_BYTES) {
+        await response.body?.cancel();
+        throw new CredentialRejected('Issuer discovery document exceeds the byte limit.');
+    }
+    if (response.body === null)
+        throw new CredentialRejected('Issuer discovery response is empty.');
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const read = await reader.read();
+            if (read.done)
+                break;
+            size += read.value.byteLength;
+            if (size > MAXIMUM_DISCOVERY_DOCUMENT_BYTES) {
+                await reader.cancel();
+                throw new CredentialRejected('Issuer discovery document exceeds the byte limit.');
+            }
+            chunks.push(read.value);
+        }
+    }
+    catch (cause) {
+        if (signal.aborted)
+            throw signal.reason;
+        throw cause;
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (signal.aborted)
+        throw signal.reason;
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch (cause) {
+        throw new CredentialRejected('Issuer discovery document is not JSON.', cause);
+    }
+}
+function identityLeaf(nested) {
+    return Object.freeze({ kind: 'identity', credential: nested });
+}
+function composedIdentity(nested) {
+    return Object.freeze({
+        kind: 'union',
+        operands: Object.freeze([
+            Object.freeze({ kind: 'identity', self: true }),
+            identityLeaf(nested),
+        ]),
+    });
+}
+async function signApplicationCallback(signing, callbackIssuer, subject, audience, execution) {
+    requireLive(execution);
+    const now = Math.floor(Date.now() / 1_000);
+    const expiresAt = Math.min(Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
+    if (expiresAt <= now) {
+        throw new AuthenticationError('INVALID_CREDENTIAL', 'Callback credential would be expired.');
+    }
+    return new SignJWT({
+        grant: { v: 1, expr: { kind: 'identity', self: true } },
+    })
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(callbackIssuer)
+        .setSubject(subject)
+        .setAudience(audience)
+        .setIssuedAt(now)
+        .setExpirationTime(expiresAt)
+        .sign(await signing.privateKey);
+}
+async function signCallback(signing, callbackIssuer, subject, audience, expression, carrier, execution) {
+    requireLive(execution);
+    const now = Math.floor(Date.now() / 1_000);
+    const expiresAt = Math.min(carrier.exp ?? Number.POSITIVE_INFINITY, Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
+        throw new AuthenticationError('INVALID_CREDENTIAL', 'Credential proof has expired.');
+    }
+    return new SignJWT({ grant: { v: 1, expr: expression } })
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(callbackIssuer)
+        .setSubject(subject)
+        .setAudience(audience)
+        .setIssuedAt(now)
+        .setExpirationTime(expiresAt)
+        .sign(await signing.privateKey);
+}
+function kernelCapability(session, dispatch, execution) {
+    const value = (call, options) => session.call(call, boundedSessionOptions(execution, options));
+    const graph = createGraph(value);
+    const auth = createAuth((target, input, options) => value(call(target, input), boundedRequestOptions(execution, options)));
+    return Object.freeze({
+        ...graph,
+        auth,
+        dispatch: (call, options) => dispatch(call, options),
+        call: (call, options) => session.call(call, boundedSessionOptions(execution, options)),
+        stream: (call, options) => session.stream(call, boundedSessionOptions(execution, options)),
+        binary: (call, options) => session.binary(call, boundedSessionOptions(execution, options)),
+        snapshot: (options) => session.snapshot(boundedSessionOptions(execution, options)),
+        viewsFor: (target, options) => session.viewsFor(target, boundedSessionOptions(execution, options)),
+        domain: async (domainSchema) => domainHandle(Domain.fromSchema(domainSchema), dispatch),
+    });
+}
+function domainHandle(domain, dispatch) {
+    const callables = concreteCallables(domain);
+    const invokeCallable = async (callable, receiver, input, options) => {
+        if (!callables.has(callable)) {
+            throw new FunctionError('FUNCTION_BINDING_INVALID', 'Callable is not a concrete member of the Domain.');
+        }
+        const target = 'on' in callable ? Path.instanceMethod(Path.from(receiver), callable.name) : callable.path;
+        if (target === undefined) {
+            throw new FunctionError('FUNCTION_BINDING_INVALID', 'Callable has no canonical Path.');
+        }
+        const result = await dispatch(call(target, input), options);
+        return callableOutput(callable, result);
+    };
+    const methodBinder = (method, receiver) => (input) => invokeCallable(method, Path.id(receiver.id), input);
+    const invoke = ((callable, receiverOrInput, inputOrOptions, options) => 'on' in callable
+        ? invokeCallable(callable, receiverOrInput, inputOrOptions, options)
+        : invokeCallable(callable, undefined, receiverOrInput, inputOrOptions));
+    const bind = ((definitionOrValue, value) => value === undefined
+        ? domain.$.wrap(definitionOrValue, methodBinder)
+        : domain.$.wrap(definitionOrValue, value, methodBinder));
+    return Object.freeze({
+        ...domain,
+        $: Object.freeze({ ...domain.$, invoke, bind }),
+    });
+}
+function concreteCallables(domain) {
+    const result = new Set();
+    for (const definition of domain.$.definitions.values()) {
+        if (definition.kind === 'function') {
+            result.add(definition);
+            continue;
+        }
+        if ((definition.kind !== 'class' && definition.kind !== 'interface') ||
+            definition.family !== 'node') {
+            continue;
+        }
+        for (const method of definition.methods.values()) {
+            if (method.definition.inheritance !== 'abstract') {
+                result.add(method);
+            }
+        }
+    }
+    return result;
+}
+function callableOutput(callable, result) {
+    switch (callable.definition.output.mode) {
+        case 'value':
+            if (result.kind === 'value')
+                return result.value;
+            break;
+        case 'stream':
+            if (result.kind === 'stream')
+                return result.stream;
+            break;
+        case 'binary':
+            if (result.kind === 'binary')
+                return result.value;
+            break;
+    }
+    if (result.kind === 'stream')
+        void result.stream.cancel('Remote callable output kind changed.');
+    throw new FunctionError('FUNCTION_OUTPUT_INVALID', `Remote callable returned ${result.kind} for ${callable.definition.output.mode} output.`);
+}
+async function admitAttempt(request, signing, applicationIssuer, fetch, policy) {
+    const execution = request.context.execution;
+    const kernel = request.via.issuer;
+    const url = invocationUrl(kernel);
+    admitEndpoint(url, policy);
+    const callback = await signApplicationCallback(signing, applicationIssuer, request.domain.$.origin, kernel, execution);
+    const owner = Path.project(syscalls.function.admit.ref.owner);
+    const target = Path.staticMethod(owner, syscalls.function.admit.ref.name);
+    const client = new Client({ url, fetch: boundedFetch(fetch, execution.signal) });
+    try {
+        const portableRequest = {
+            call: request.call,
+            ...(request.credential === undefined ? {} : { credential: request.credential }),
+        };
+        const value = await client.as(callback).call(call(target, portableRequest), {
+            ...boundedRequestOptions(execution),
+            delegate: {
+                ttlSeconds: callbackTtl(execution.deadline),
+                delegation: { kind: 'identity', self: true },
+            },
+        });
+        if (!isTarget(value)) {
+            throw new FunctionError('FUNCTION_EXECUTION_FAILED', 'Kernel returned an invalid Function admission Target.');
+        }
+        return Object.freeze({
+            callable: value.callable,
+            ...(value.receiver === undefined ? {} : { receiver: value.receiver }),
+        });
+    }
+    finally {
+        client.close();
+    }
+}
+function isTarget(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        return false;
+    const fields = Reflect.ownKeys(input);
+    return (fields.every((field) => field === 'callable' || field === 'receiver') &&
+        fields.includes('callable') &&
+        typeof Reflect.get(input, 'callable') === 'string' &&
+        (Reflect.get(input, 'receiver') === undefined ||
+            typeof Reflect.get(input, 'receiver') === 'string'));
+}
+function publicInstallationProvider(current, signing) {
+    if (current().publication.installation?.authentication.kind !== 'public') {
+        throw new TypeError('Remote application helper currently requires a public install endpoint.');
+    }
+    return Object.freeze({
+        async create(request) {
+            const deployed = current();
+            if (deployed.publication.installation?.authentication.kind !== 'public') {
+                throw new FunctionError('FUNCTION_CONFLICT', 'Installation endpoint changed.');
+            }
+            if (request.etag !== deployed.publication.etag) {
+                throw new FunctionError('FUNCTION_CONFLICT', 'Installation Publication changed.');
+            }
+            const now = Math.floor(Date.now() / 1_000);
+            const attestation = await new SignJWT({
+                purpose: installation.PURPOSE,
+                nonce: request.nonce,
+                etag: deployed.publication.etag,
+                schemaRevision: deployed.publication.schema.revision,
+            })
+                .setProtectedHeader({
+                alg: signing.algorithm,
+                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+            })
+                .setIssuer(deployed.publication.identity.issuer)
+                .setSubject(deployed.publication.origin)
+                .setAudience(request.kernelIssuer)
+                .setExpirationTime(now + CALLBACK_TTL_SECONDS)
+                .sign(await signing.privateKey);
+            return installation.accept({
+                format: 'astrale.domain.installation',
+                version: 1,
+                publication: deployed.publication,
+                attestation,
+            });
+        },
+    });
+}
+function boundedFetch(fetch, lifecycle) {
+    return (input, init = {}) => fetch(input, {
+        ...init,
+        signal: init.signal === undefined || init.signal === null
+            ? lifecycle
+            : AbortSignal.any([lifecycle, init.signal]),
+    });
+}
+function boundedRequestOptions(execution, options = {}) {
+    return boundedOptions(execution, options);
+}
+function boundedSessionOptions(execution, options) {
+    return boundedOptions(execution, options ?? {});
+}
+function boundedOptions(execution, options) {
+    requireLive(execution);
+    const remaining = Math.max(1, execution.deadline - Date.now());
+    return {
+        ...options,
+        signal: options.signal === undefined
+            ? execution.signal
+            : AbortSignal.any([execution.signal, options.signal]),
+        timeoutMs: Math.min(options.timeoutMs ?? remaining, remaining),
+    };
+}
+function requireLive(execution) {
+    if (execution.signal.aborted) {
+        throw new FunctionError('FUNCTION_CANCELLED', 'Remote invocation was cancelled.');
+    }
+    if (execution.deadline <= Date.now()) {
+        throw new FunctionError('FUNCTION_DEADLINE_EXCEEDED', 'Remote invocation deadline was exceeded.');
+    }
+}
+function callbackTtl(deadline) {
+    return Math.max(1, Math.min(CALLBACK_TTL_SECONDS, Math.floor((deadline - Date.now()) / 1_000)));
+}
+function httpIssuer(input, allowInsecureHttp) {
+    const admitted = issuer.accept(input);
+    let url;
+    try {
+        url = new URL(admitted);
+    }
+    catch (cause) {
+        throw new TypeError('Remote identity issuer must be an absolute HTTP(S) URL.', { cause });
+    }
+    if (url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        (url.protocol !== 'https:' && !(allowInsecureHttp && url.protocol === 'http:'))) {
+        throw new TypeError(allowInsecureHttp
+            ? 'Remote identity issuer must be an absolute HTTP(S) URL without credentials, query, or fragment.'
+            : 'Remote identity issuer must be an absolute HTTPS URL without credentials, query, or fragment.');
+    }
+    return admitted;
+}
+function admitEndpoint(input, policy) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential issuer endpoint is invalid.', cause);
+    }
+    if (url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '' ||
+        (url.protocol !== 'https:' && !(policy.allowInsecureHttp === true && url.protocol === 'http:'))) {
+        throw new CredentialRejected('Credential issuer endpoint is not allowed.');
+    }
+    if (policy.allowEndpoint?.(url.toString()) === false) {
+        throw new CredentialRejected('Credential issuer endpoint is denied by policy.');
+    }
+}
+function invocationUrl(input) {
+    return `${input.replace(/\/+$/u, '')}/invoke`;
+}
+class CredentialRejected extends Error {
+    constructor(message, cause) {
+        super(message, { cause });
+        this.name = 'CredentialRejected';
+    }
+}
+class IssuerUnavailable extends Error {
+    constructor(message, cause) {
+        super(message, { cause });
+        this.name = 'IssuerUnavailable';
+    }
+}
+//# sourceMappingURL=remote.js.map