@astrale-os/sdk 0.4.18 → 0.5.0-beta.1

package/dist/service/functions.d.ts

@@ -1,148 +0,0 @@
-import type { FunctionBinding } from '@astrale-os/kernel-api/routed';
-import type { FunctionSchema } from '@astrale-os/kernel-core/domain';
-import { z } from 'zod';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-export declare const SERVICE_FUNCTIONS_PATH = "/_astrale/functions";
-export declare const SERVICE_FUNCTIONS_PURPOSE = "astrale.service-functions.v1";
-export declare const ServiceFunctionManifestEntrySchema: z.ZodObject<{
-    slug: z.ZodString;
-    ref: z.ZodString;
-    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    output: z.ZodDefault<z.ZodEnum<{
-        binary: "binary";
-        stream: "stream";
-        value: "value";
-    }>>;
-    binding: z.ZodObject<{
-        remoteUrl: z.ZodOptional<z.ZodString>;
-        route: z.ZodOptional<z.ZodObject<{
-            method: z.ZodEnum<{
-                "*": "*";
-                DELETE: "DELETE";
-                GET: "GET";
-                PATCH: "PATCH";
-                POST: "POST";
-                PUT: "PUT";
-            }>;
-            path: z.ZodString;
-            self: z.ZodOptional<z.ZodString>;
-            query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-            body: z.ZodOptional<z.ZodUnknown>;
-            credential: z.ZodOptional<z.ZodUnknown>;
-        }, z.core.$strip>>;
-        auth: z.ZodOptional<z.ZodEnum<{
-            optional: "optional";
-            public: "public";
-            required: "required";
-        }>>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const ServiceFunctionManifestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    service: z.ZodObject<{
-        issuer: z.ZodString;
-        subject: z.ZodString;
-    }, z.core.$strip>;
-    functions: z.ZodArray<z.ZodObject<{
-        slug: z.ZodString;
-        ref: z.ZodString;
-        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        output: z.ZodDefault<z.ZodEnum<{
-            binary: "binary";
-            stream: "stream";
-            value: "value";
-        }>>;
-        binding: z.ZodObject<{
-            remoteUrl: z.ZodOptional<z.ZodString>;
-            route: z.ZodOptional<z.ZodObject<{
-                method: z.ZodEnum<{
-                    "*": "*";
-                    DELETE: "DELETE";
-                    GET: "GET";
-                    PATCH: "PATCH";
-                    POST: "POST";
-                    PUT: "PUT";
-                }>;
-                path: z.ZodString;
-                self: z.ZodOptional<z.ZodString>;
-                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                body: z.ZodOptional<z.ZodUnknown>;
-                credential: z.ZodOptional<z.ZodUnknown>;
-            }, z.core.$strip>>;
-            auth: z.ZodOptional<z.ZodEnum<{
-                optional: "optional";
-                public: "public";
-                required: "required";
-            }>>;
-        }, z.core.$strip>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const ServiceFunctionDiscoveryRequestSchema: z.ZodObject<{
-    kernelIssuer: z.ZodString;
-    nonce: z.ZodString;
-}, z.core.$strip>;
-export declare const ServiceFunctionDiscoveryResponseSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    service: z.ZodObject<{
-        issuer: z.ZodString;
-        subject: z.ZodString;
-    }, z.core.$strip>;
-    functions: z.ZodArray<z.ZodObject<{
-        slug: z.ZodString;
-        ref: z.ZodString;
-        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        output: z.ZodDefault<z.ZodEnum<{
-            binary: "binary";
-            stream: "stream";
-            value: "value";
-        }>>;
-        binding: z.ZodObject<{
-            remoteUrl: z.ZodOptional<z.ZodString>;
-            route: z.ZodOptional<z.ZodObject<{
-                method: z.ZodEnum<{
-                    "*": "*";
-                    DELETE: "DELETE";
-                    GET: "GET";
-                    PATCH: "PATCH";
-                    POST: "POST";
-                    PUT: "PUT";
-                }>;
-                path: z.ZodString;
-                self: z.ZodOptional<z.ZodString>;
-                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                body: z.ZodOptional<z.ZodUnknown>;
-                credential: z.ZodOptional<z.ZodUnknown>;
-            }, z.core.$strip>>;
-            auth: z.ZodOptional<z.ZodEnum<{
-                optional: "optional";
-                public: "public";
-                required: "required";
-            }>>;
-        }, z.core.$strip>;
-    }, z.core.$strip>>;
-    identity: z.ZodObject<{
-        credential: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export type ServiceFunctionManifestEntry = z.infer<typeof ServiceFunctionManifestEntrySchema>;
-export type ServiceFunctionManifest = z.infer<typeof ServiceFunctionManifestSchema>;
-export type ServiceFunctionDiscoveryRequest = z.infer<typeof ServiceFunctionDiscoveryRequestSchema>;
-export type ServiceFunctionDiscoveryResponse = z.infer<typeof ServiceFunctionDiscoveryResponseSchema>;
-export declare function toServiceFunctionManifestEntries(schemas: readonly FunctionSchema[]): ServiceFunctionManifestEntry[];
-export declare function signServiceFunctionManifest(manifest: ServiceFunctionManifest, request: ServiceFunctionDiscoveryRequest, identity: RemoteIdentityConfig): Promise<ServiceFunctionDiscoveryResponse>;
-export declare function verifyServiceFunctionManifest(input: unknown, expected: {
-    kernelIssuer: string;
-    nonce: string;
-    serviceIssuer: string;
-    serviceSubject: string;
-    publicKey: JsonWebKey;
-}): Promise<ServiceFunctionDiscoveryResponse>;
-export declare function hashServiceFunctionManifest(manifest: ServiceFunctionManifest): Promise<string>;
-export declare function functionBindingForManifest(binding: FunctionBinding, auth: 'required' | 'optional' | 'public' | undefined): FunctionBinding;
-//# sourceMappingURL=functions.d.ts.map

package/dist/service/functions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAKpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAI/D,eAAO,MAAM,sBAAsB,wBAAwB,CAAA;AAC3D,eAAO,MAAM,yBAAyB,iCAAiC,CAAA;AAIvE,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO7C,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIxC,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;iBAGhD,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEjD,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAC7F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AACnF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAA;AACnG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,4BAA4B,EAAE,CAchC;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAc3C;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,UAAU,CAAA;CACtB,GACA,OAAO,CAAC,gCAAgC,CAAC,CAkC3C;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GACnD,eAAe,CAEjB"}

package/dist/service/functions.js

@@ -1,115 +0,0 @@
-import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
-import { functionBindingSchema, functionOutputSchema } from '@astrale-os/kernel-core/domain';
-import { importJWK, jwtVerify } from 'jose';
-import { z } from 'zod';
-import { signCredential } from '../auth/sign.js';
-export const SERVICE_FUNCTIONS_PATH = '/_astrale/functions';
-export const SERVICE_FUNCTIONS_PURPOSE = 'astrale.service-functions.v1';
-const JsonSchema = z.record(z.string(), z.unknown());
-export const ServiceFunctionManifestEntrySchema = z.object({
-    slug: z.string().regex(/^[a-z][a-z0-9-]*$/),
-    ref: z.string().regex(/^function\.[a-z][a-z0-9-]*$/),
-    inputSchema: JsonSchema,
-    outputSchema: JsonSchema,
-    output: functionOutputSchema.default('value'),
-    binding: functionBindingSchema.unwrap(),
-});
-export const ServiceFunctionManifestSchema = z.object({
-    version: z.literal(1),
-    service: z.object({ issuer: z.string().min(1), subject: z.string().min(1) }),
-    functions: z.array(ServiceFunctionManifestEntrySchema).max(500),
-});
-export const ServiceFunctionDiscoveryRequestSchema = z.object({
-    kernelIssuer: z.string().url(),
-    nonce: z.string().min(16).max(256),
-});
-export const ServiceFunctionDiscoveryResponseSchema = ServiceFunctionManifestSchema.extend({
-    identity: z.object({ credential: z.string().min(1) }),
-});
-export function toServiceFunctionManifestEntries(schemas) {
-    return schemas
-        .map((schema) => {
-        const slug = schema.ref.slice('function.'.length);
-        return ServiceFunctionManifestEntrySchema.parse({
-            slug,
-            ref: schema.ref,
-            inputSchema: schema.inputSchema,
-            outputSchema: schema.outputSchema,
-            output: schema.output ?? 'value',
-            binding: schema.binding,
-        });
-    })
-        .sort((a, b) => a.slug.localeCompare(b.slug));
-}
-export async function signServiceFunctionManifest(manifest, request, identity) {
-    const parsedManifest = ServiceFunctionManifestSchema.parse(manifest);
-    const manifestHash = await hashServiceFunctionManifest(parsedManifest);
-    const credential = await signCredential({ purpose: SERVICE_FUNCTIONS_PURPOSE, nonce: request.nonce, manifestHash }, {
-        issuer: identity.issuer,
-        subject: identity.subject,
-        audience: request.kernelIssuer,
-        privateKey: identity.privateKey,
-        ttl: '2m',
-    });
-    return { ...parsedManifest, identity: { credential } };
-}
-export async function verifyServiceFunctionManifest(input, expected) {
-    const response = ServiceFunctionDiscoveryResponseSchema.parse(input);
-    if (response.service.issuer !== expected.serviceIssuer ||
-        response.service.subject !== expected.serviceSubject) {
-        throw new Error('service function manifest identity does not match the deployed Service');
-    }
-    const algorithms = deriveAllowedAlgorithms(expected.publicKey);
-    const algorithm = algorithms[0];
-    if (!algorithm)
-        throw new Error('service function manifest public key has no supported algorithm');
-    const key = await importJWK(expected.publicKey, algorithm);
-    const verified = await jwtVerify(response.identity.credential, key, {
-        algorithms,
-        issuer: expected.serviceIssuer,
-        subject: expected.serviceSubject,
-        audience: expected.kernelIssuer,
-    });
-    const expectedHash = await hashServiceFunctionManifest({
-        version: response.version,
-        service: response.service,
-        functions: response.functions,
-    });
-    if (verified.payload.purpose !== SERVICE_FUNCTIONS_PURPOSE) {
-        throw new Error('service function manifest credential has the wrong purpose');
-    }
-    if (verified.payload.nonce !== expected.nonce) {
-        throw new Error('service function manifest credential has the wrong nonce');
-    }
-    if (verified.payload.manifestHash !== expectedHash) {
-        throw new Error('service function manifest credential does not cover the returned manifest');
-    }
-    return response;
-}
-export async function hashServiceFunctionManifest(manifest) {
-    const bytes = new TextEncoder().encode(canonicalJson(ServiceFunctionManifestSchema.parse(manifest)));
-    const digest = await crypto.subtle.digest('SHA-256', bytes);
-    return `sha256:${hex(new Uint8Array(digest))}`;
-}
-export function functionBindingForManifest(binding, auth) {
-    return { ...binding, auth: auth ?? 'required' };
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object')
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    const entries = Object.entries(value)
-        .filter(([, item]) => item !== undefined)
-        .sort(([a], [b]) => a.localeCompare(b));
-    return `{${entries
-        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
-        .join(',')}}`;
-}
-function hex(bytes) {
-    let value = '';
-    for (const byte of bytes)
-        value += byte.toString(16).padStart(2, '0');
-    return value;
-}
-//# sourceMappingURL=functions.js.map

package/dist/service/functions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"functions.js","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAA;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAA;AAEvE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAEpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IACpD,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU;IACxB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7C,OAAO,EAAE,qBAAqB,CAAC,MAAM,EAAE;CACxC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,6BAA6B,CAAC,MAAM,CAAC;IACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACtD,CAAC,CAAA;AASF,MAAM,UAAU,gCAAgC,CAC9C,OAAkC;IAElC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,kCAAkC,CAAC,KAAK,CAAC;YAC9C,IAAI;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO;YAChC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAA;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC,EACjC,OAAwC,EACxC,QAA8B;IAE9B,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,cAAc,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,EAC1E;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,EAAE,IAAI;KACV,CACF,CAAA;IACD,OAAO,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAc,EACd,QAMC;IAED,MAAM,QAAQ,GAAG,sCAAsC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACpE,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa;QAClD,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,cAAc,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAClG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QAClE,UAAU;QACV,MAAM,EAAE,QAAQ,CAAC,aAAa;QAC9B,OAAO,EAAE,QAAQ,CAAC,cAAc;QAChC,QAAQ,EAAE,QAAQ,CAAC,YAAY;KAChC,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,aAAa,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC7D,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,UAAU,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAwB,EACxB,IAAoD;IAEpD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,UAAU,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,IAAI,OAAO;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;SACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/service/index.d.ts

@@ -1,3 +0,0 @@
-export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
-export type { ServiceFunctionDiscoveryRequest, ServiceFunctionDiscoveryResponse, ServiceFunctionManifest, ServiceFunctionManifestEntry, } from './functions.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/service/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,+BAA+B,EAC/B,gCAAgC,EAChC,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAA"}

package/dist/service/index.js

@@ -1,2 +0,0 @@
-export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
-//# sourceMappingURL=index.js.map

package/dist/service/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA"}

package/dist/step/index.d.ts

@@ -1,5 +0,0 @@
-export { createInlineStep } from './inline.js';
-export type { InlineStepOptions, StepExecutor } from './inline.js';
-export { buildStepRun } from './step.js';
-export type { FunctionStepScope, MethodStepScope, Step, StepRun, StepScope } from './step.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/step/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}

package/dist/step/index.js

@@ -1,3 +0,0 @@
-export { createInlineStep } from './inline.js';
-export { buildStepRun } from './step.js';
-//# sourceMappingURL=index.js.map

package/dist/step/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA"}

package/dist/step/inline.d.ts

@@ -1,8 +0,0 @@
-import type { Step, StepRun, StepScope } from './step.js';
-export type StepExecutor = <T>(run: StepRun, handler: () => T | Promise<T>) => Promise<T>;
-export type InlineStepOptions = {
-    scope?: StepScope;
-    execute?: StepExecutor;
-};
-export declare function createInlineStep(options?: InlineStepOptions): Step;
-//# sourceMappingURL=inline.d.ts.map

package/dist/step/inline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inline.d.ts","sourceRoot":"","sources":["../../src/step/inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAIzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAEzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,IAAI,CAUtE"}

package/dist/step/inline.js

@@ -1,22 +0,0 @@
-import { buildStepRun, roundTripStepResult } from './step.js';
-export function createInlineStep(options = {}) {
-    const occurrences = new Map();
-    const execute = options.execute ?? inlineExecute;
-    return {
-        async run(id, handler) {
-            const run = buildStepRun(id, options.scope, nextOccurrence(id, options.scope, occurrences));
-            return execute(run, handler);
-        },
-    };
-}
-async function inlineExecute(run, handler) {
-    const result = await handler();
-    return roundTripStepResult(run.key, result);
-}
-function nextOccurrence(id, scope, occurrences) {
-    const run = buildStepRun(id, scope, 0);
-    const occurrence = occurrences.get(run.key) ?? 0;
-    occurrences.set(run.key, occurrence + 1);
-    return occurrence;
-}
-//# sourceMappingURL=inline.js.map

package/dist/step/inline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inline.js","sourceRoot":"","sources":["../../src/step/inline.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAS7D,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsB,EAAE;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAA;IAEhD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO;YACnB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;YAC3F,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC9B,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAI,GAAY,EAAE,OAA6B;IACzE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;IAC9B,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,EAAU,EACV,KAA4B,EAC5B,WAAgC;IAEhC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IACxC,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/step/step.d.ts

@@ -1,28 +0,0 @@
-export type Step = {
-    run<T>(id: string, handler: () => T | Promise<T>): Promise<T>;
-};
-export type MethodStepScope = {
-    kind: 'method';
-    ref: string;
-    owner: string;
-    method: string;
-};
-export type FunctionStepScope = {
-    kind: 'function';
-    ref: string;
-    slug: string;
-};
-export type StepScope = MethodStepScope | FunctionStepScope;
-export type StepRun = {
-    /** The author-provided id, normalized to the local id inside this scope. */
-    id: string;
-    /** Backend-facing durable key, qualified by the method/function scope. */
-    key: string;
-    /** Zero-based occurrence for repeated ids in one execution. */
-    occurrence: number;
-    scope?: StepScope;
-};
-export declare function requireStepId(id: string): string;
-export declare function buildStepRun(id: string, scope: StepScope | undefined, occurrence: number): StepRun;
-export declare function roundTripStepResult<T>(id: string, value: T): T;
-//# sourceMappingURL=step.d.ts.map

package/dist/step/step.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../src/step/step.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG;IACjB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC9D,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,UAAU,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAA;AAE3D,MAAM,MAAM,OAAO,GAAG;IACpB,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GACjB,OAAO,CAST;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAmB9D"}

package/dist/step/step.js

@@ -1,53 +0,0 @@
-export function requireStepId(id) {
-    if (typeof id !== 'string' || id.trim() === '') {
-        throw new TypeError('step.run: id must be a non-empty string');
-    }
-    return id;
-}
-export function buildStepRun(id, scope, occurrence) {
-    const stepId = requireStepId(localStepId(id, scope));
-    const key = scope ? `${canonicalScope(scope)}.${stepId}` : stepId;
-    return {
-        id: stepId,
-        key,
-        occurrence,
-        ...(scope ? { scope } : {}),
-    };
-}
-export function roundTripStepResult(id, value) {
-    if (value === undefined)
-        return value;
-    let serialized;
-    try {
-        serialized = JSON.stringify(value);
-    }
-    catch (err) {
-        throw new TypeError(`step.run("${id}"): result must be JSON-serializable: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (serialized === undefined) {
-        throw new TypeError(`step.run("${id}"): result must be JSON-serializable`);
-    }
-    return JSON.parse(serialized);
-}
-function localStepId(id, scope) {
-    if (!scope)
-        return id;
-    for (const prefix of scopePrefixes(scope)) {
-        const scoped = `${prefix}.`;
-        if (id.startsWith(scoped) && id.length > scoped.length)
-            return id.slice(scoped.length);
-    }
-    return id;
-}
-function scopePrefixes(scope) {
-    switch (scope.kind) {
-        case 'method':
-            return [scope.ref, `${scope.owner}.${scope.method}`];
-        case 'function':
-            return [scope.ref, `function.${scope.slug}`];
-    }
-}
-function canonicalScope(scope) {
-    return scope.ref;
-}
-//# sourceMappingURL=step.js.map

package/dist/step/step.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"step.js","sourceRoot":"","sources":["../../src/step/step.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAU,EACV,KAA4B,EAC5B,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,OAAO;QACL,EAAE,EAAE,MAAM;QACV,GAAG;QACH,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,EAAU,EAAE,KAAQ;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,aAAa,EAAE,yCACb,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAM,CAAA;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAA4B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IAErB,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAA;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxF,CAAC;IAED,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QACtD,KAAK,UAAU;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,OAAO,KAAK,CAAC,GAAG,CAAA;AAClB,CAAC"}

package/src/auth/authenticate.ts

@@ -1,51 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core'
-
-import { IdentityId, selfGrant } from '@astrale-os/kernel-core'
-
-import type { RemoteIdentityConfig } from './identity.js'
-
-import { bindKernel } from './kernel-client.js'
-import { verifyInboundCredential } from './verify.js'
-
-export type AuthenticateResult = {
-  authenticated: Authenticated
-  kernel: BoundClientSessionView<FnMap> | null
-}
-
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export async function authenticateRequest(
-  credential: CredentialInput,
-  config: RemoteIdentityConfig,
-): Promise<AuthenticateResult> {
-  const { verified, issuer, attestation, delegation } = await verifyInboundCredential(
-    credential,
-    config,
-  )
-
-  const authenticated: Authenticated = {
-    credential: { raw: credential, verified },
-    grant: selfGrant(IdentityId(verified.sub)),
-    attestation,
-    delegation,
-  }
-
-  const kernel = await bindKernel(delegation, issuer, config)
-
-  return { authenticated, kernel }
-}

package/src/auth/check.ts

@@ -1,69 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { IdentityId } from '@astrale-os/kernel-core'
-
-import { SHARE } from '@astrale-os/kernel-core'
-
-import { AuthorizationDeniedError } from '../dispatch/errors.js'
-
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core'
-
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export async function assertPerm(
-  kernel: BoundClientSessionView<FnMap> | null,
-  target: string,
-  principal: IdentityId | null | undefined,
-  requiredBits: number,
-): Promise<void> {
-  if (!kernel) {
-    throw new AuthorizationDeniedError('No kernel client — cannot verify permissions')
-  }
-  if (!principal) {
-    throw new AuthorizationDeniedError('No authenticated principal')
-  }
-  const ok = await kernel.auth.check({ who: principal, on: target, perms: requiredBits })
-  if (!ok) {
-    throw new AuthorizationDeniedError(
-      `Permission denied on "${target}" — required bits=${requiredBits} for principal "${principal}"`,
-    )
-  }
-}
-
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export async function requireOwnership(
-  kernel: BoundClientSessionView<FnMap> | null,
-  target: string,
-  principal: IdentityId | null | undefined,
-): Promise<void> {
-  await assertPerm(kernel, target, principal, SHARE)
-}

package/src/auth/compose.ts

@@ -1,56 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-
-import type { Delegation } from '@astrale-os/kernel-core'
-
-import {
-  createUnresolvedGrant,
-  unresolvedCredential,
-  unresolvedSelf,
-  unresolvedUnion,
-} from '@astrale-os/kernel-core'
-
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export function buildComposedExpr(delegation: Delegation) {
-  return unresolvedUnion(unresolvedCredential(delegation.credential), unresolvedSelf())
-}
-
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export function buildComposedGrant(delegation: Delegation) {
-  return { grant: createUnresolvedGrant(buildComposedExpr(delegation)) }
-}
-
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export function buildSelfExpr() {
-  return unresolvedSelf()
-}
-
-/** Self-only grant for function-owned credentials. */
-export function buildSelfGrant() {
-  return { grant: createUnresolvedGrant(buildSelfExpr()) }
-}