@astrale-os/sdk 0.4.19 → 0.5.0-beta.1

package/dist/service/index.d.ts

@@ -1,3 +0,0 @@
-export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
-export type { ServiceFunctionDiscoveryRequest, ServiceFunctionDiscoveryResponse, ServiceFunctionManifest, ServiceFunctionManifestEntry, } from './functions.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/service/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,+BAA+B,EAC/B,gCAAgC,EAChC,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAA"}

package/dist/service/index.js

@@ -1,2 +0,0 @@
-export { SERVICE_FUNCTIONS_PATH, SERVICE_FUNCTIONS_PURPOSE, ServiceFunctionDiscoveryRequestSchema, ServiceFunctionDiscoveryResponseSchema, ServiceFunctionManifestEntrySchema, ServiceFunctionManifestSchema, hashServiceFunctionManifest, signServiceFunctionManifest, toServiceFunctionManifestEntries, verifyServiceFunctionManifest, } from './functions.js';
-//# sourceMappingURL=index.js.map

package/dist/service/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qCAAqC,EACrC,sCAAsC,EACtC,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA"}

package/dist/step/index.d.ts

@@ -1,5 +0,0 @@
-export { createInlineStep } from './inline.js';
-export type { InlineStepOptions, StepExecutor } from './inline.js';
-export { buildStepRun } from './step.js';
-export type { FunctionStepScope, MethodStepScope, Step, StepRun, StepScope } from './step.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/step/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA"}

package/dist/step/index.js

@@ -1,3 +0,0 @@
-export { createInlineStep } from './inline.js';
-export { buildStepRun } from './step.js';
-//# sourceMappingURL=index.js.map

package/dist/step/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/step/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA"}

package/dist/step/inline.d.ts

@@ -1,8 +0,0 @@
-import type { Step, StepRun, StepScope } from './step.js';
-export type StepExecutor = <T>(run: StepRun, handler: () => T | Promise<T>) => Promise<T>;
-export type InlineStepOptions = {
-    scope?: StepScope;
-    execute?: StepExecutor;
-};
-export declare function createInlineStep(options?: InlineStepOptions): Step;
-//# sourceMappingURL=inline.d.ts.map

package/dist/step/inline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"inline.d.ts","sourceRoot":"","sources":["../../src/step/inline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAIzD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAEzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,IAAI,CAUtE"}

package/dist/step/inline.js

@@ -1,22 +0,0 @@
-import { buildStepRun, roundTripStepResult } from './step.js';
-export function createInlineStep(options = {}) {
-    const occurrences = new Map();
-    const execute = options.execute ?? inlineExecute;
-    return {
-        async run(id, handler) {
-            const run = buildStepRun(id, options.scope, nextOccurrence(id, options.scope, occurrences));
-            return execute(run, handler);
-        },
-    };
-}
-async function inlineExecute(run, handler) {
-    const result = await handler();
-    return roundTripStepResult(run.key, result);
-}
-function nextOccurrence(id, scope, occurrences) {
-    const run = buildStepRun(id, scope, 0);
-    const occurrence = occurrences.get(run.key) ?? 0;
-    occurrences.set(run.key, occurrence + 1);
-    return occurrence;
-}
-//# sourceMappingURL=inline.js.map

package/dist/step/inline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inline.js","sourceRoot":"","sources":["../../src/step/inline.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAS7D,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsB,EAAE;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAA;IAEhD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO;YACnB,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;YAC3F,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC9B,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAI,GAAY,EAAE,OAA6B;IACzE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;IAC9B,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CACrB,EAAU,EACV,KAA4B,EAC5B,WAAgC;IAEhC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;IACxC,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/step/step.d.ts

@@ -1,28 +0,0 @@
-export type Step = {
-    run<T>(id: string, handler: () => T | Promise<T>): Promise<T>;
-};
-export type MethodStepScope = {
-    kind: 'method';
-    ref: string;
-    owner: string;
-    method: string;
-};
-export type FunctionStepScope = {
-    kind: 'function';
-    ref: string;
-    slug: string;
-};
-export type StepScope = MethodStepScope | FunctionStepScope;
-export type StepRun = {
-    /** The author-provided id, normalized to the local id inside this scope. */
-    id: string;
-    /** Backend-facing durable key, qualified by the method/function scope. */
-    key: string;
-    /** Zero-based occurrence for repeated ids in one execution. */
-    occurrence: number;
-    scope?: StepScope;
-};
-export declare function requireStepId(id: string): string;
-export declare function buildStepRun(id: string, scope: StepScope | undefined, occurrence: number): StepRun;
-export declare function roundTripStepResult<T>(id: string, value: T): T;
-//# sourceMappingURL=step.d.ts.map

package/dist/step/step.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step.d.ts","sourceRoot":"","sources":["../../src/step/step.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG;IACjB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CAC9D,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,UAAU,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAA;AAE3D,MAAM,MAAM,OAAO,GAAG;IACpB,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GACjB,OAAO,CAST;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAmB9D"}

package/dist/step/step.js

@@ -1,53 +0,0 @@
-export function requireStepId(id) {
-    if (typeof id !== 'string' || id.trim() === '') {
-        throw new TypeError('step.run: id must be a non-empty string');
-    }
-    return id;
-}
-export function buildStepRun(id, scope, occurrence) {
-    const stepId = requireStepId(localStepId(id, scope));
-    const key = scope ? `${canonicalScope(scope)}.${stepId}` : stepId;
-    return {
-        id: stepId,
-        key,
-        occurrence,
-        ...(scope ? { scope } : {}),
-    };
-}
-export function roundTripStepResult(id, value) {
-    if (value === undefined)
-        return value;
-    let serialized;
-    try {
-        serialized = JSON.stringify(value);
-    }
-    catch (err) {
-        throw new TypeError(`step.run("${id}"): result must be JSON-serializable: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (serialized === undefined) {
-        throw new TypeError(`step.run("${id}"): result must be JSON-serializable`);
-    }
-    return JSON.parse(serialized);
-}
-function localStepId(id, scope) {
-    if (!scope)
-        return id;
-    for (const prefix of scopePrefixes(scope)) {
-        const scoped = `${prefix}.`;
-        if (id.startsWith(scoped) && id.length > scoped.length)
-            return id.slice(scoped.length);
-    }
-    return id;
-}
-function scopePrefixes(scope) {
-    switch (scope.kind) {
-        case 'method':
-            return [scope.ref, `${scope.owner}.${scope.method}`];
-        case 'function':
-            return [scope.ref, `function.${scope.slug}`];
-    }
-}
-function canonicalScope(scope) {
-    return scope.ref;
-}
-//# sourceMappingURL=step.js.map

package/dist/step/step.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"step.js","sourceRoot":"","sources":["../../src/step/step.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAAU,EACV,KAA4B,EAC5B,UAAkB;IAElB,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,OAAO;QACL,EAAE,EAAE,MAAM;QACV,GAAG;QACH,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,EAAU,EAAE,KAAQ;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,UAA8B,CAAA;IAClC,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,aAAa,EAAE,yCACb,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAA;IAC5E,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAM,CAAA;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAA4B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IAErB,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAA;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxF,CAAC;IAED,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QACtD,KAAK,UAAU;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,OAAO,KAAK,CAAC,GAAG,CAAA;AAClB,CAAC"}

package/src/auth/authenticate.ts

@@ -1,51 +0,0 @@
-/**
- * Authentication orchestrator.
- *
- * Verifies an inbound credential, extracts the delegation it carries,
- * and binds a `BoundClientSessionView` for outbound kernel calls. Delegates
- * the real work to `verify`, `compose` + `sign` (inside `kernel-client`),
- * and returns a generic `Authenticated` result plus the bound view.
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { Authenticated, CredentialInput } from '@astrale-os/kernel-core'
-
-import { IdentityId, selfGrant } from '@astrale-os/kernel-core'
-
-import type { RemoteIdentityConfig } from './identity.js'
-
-import { bindKernel } from './kernel-client.js'
-import { verifyInboundCredential } from './verify.js'
-
-export type AuthenticateResult = {
-  authenticated: Authenticated
-  kernel: BoundClientSessionView<FnMap> | null
-}
-
-/**
- * Verifies an inbound credential and binds a call-back kernel view. The `sub`
- * claim on the outbound credential is the function's own identity, taken from
- * `config.subject` (the function node's path), so the kernel matches an
- * existing function identity instead of provisioning a generic one.
- */
-export async function authenticateRequest(
-  credential: CredentialInput,
-  config: RemoteIdentityConfig,
-): Promise<AuthenticateResult> {
-  const { verified, issuer, attestation, delegation } = await verifyInboundCredential(
-    credential,
-    config,
-  )
-
-  const authenticated: Authenticated = {
-    credential: { raw: credential, verified },
-    grant: selfGrant(IdentityId(verified.sub)),
-    attestation,
-    delegation,
-  }
-
-  const kernel = await bindKernel(delegation, issuer, config)
-
-  return { authenticated, kernel }
-}

package/src/auth/check.ts

@@ -1,69 +0,0 @@
-/**
- * Permission-check helpers for `RemoteHandler.authorize` hooks.
- *
- * The kernel already enforces `has_perm` independently — these helpers just
- * give worker authors a one-line ergonomic way to fail-fast in `authorize`
- * (so the dispatch never even calls `execute`) instead of letting the
- * downstream `kernel.call` raise a less specific error mid-flight.
- *
- * Pattern:
- *
- * ```ts
- * remoteMethod(WorkerSchema, 'Project', 'addMember', {
- *   remoteUrl: BASE_URL,
- *   authorize: async ({ self, auth, kernel }) => {
- *     await assertPerm(kernel, self.path.raw, auth.principal, EDIT)
- *   },
- *   execute: async (ctx) => { ... },
- * })
- * ```
- *
- * Helpers throw `AuthorizationDeniedError` so the dispatch wrapper can
- * surface them to the client as `PERMISSION_DENIED` cleanly.
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { IdentityId } from '@astrale-os/kernel-core'
-
-import { SHARE } from '@astrale-os/kernel-core'
-
-import { AuthorizationDeniedError } from '../dispatch/errors.js'
-
-export { ALL, EDIT, READ, SHARE, USE } from '@astrale-os/kernel-core'
-
-/**
- * Throws `AuthorizationDeniedError` if `principal` lacks `requiredBits` on
- * `target`. `requiredBits` is a bitmask — pass `READ | EDIT` to require both.
- *
- * Implementation: delegates to the bound session's AuthApi. Cheap; adds
- * one round-trip to the dispatch path.
- */
-export async function assertPerm(
-  kernel: BoundClientSessionView<FnMap> | null,
-  target: string,
-  principal: IdentityId | null | undefined,
-  requiredBits: number,
-): Promise<void> {
-  if (!kernel) {
-    throw new AuthorizationDeniedError('No kernel client — cannot verify permissions')
-  }
-  if (!principal) {
-    throw new AuthorizationDeniedError('No authenticated principal')
-  }
-  const ok = await kernel.auth.check({ who: principal, on: target, perms: requiredBits })
-  if (!ok) {
-    throw new AuthorizationDeniedError(
-      `Permission denied on "${target}" — required bits=${requiredBits} for principal "${principal}"`,
-    )
-  }
-}
-
-/** Shortcut for "caller has SHARE bit on target" (the closest thing to "owns it"). */
-export async function requireOwnership(
-  kernel: BoundClientSessionView<FnMap> | null,
-  target: string,
-  principal: IdentityId | null | undefined,
-): Promise<void> {
-  await assertPerm(kernel, target, principal, SHARE)
-}

package/src/auth/compose.ts

@@ -1,56 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-
-import type { Delegation } from '@astrale-os/kernel-core'
-
-import {
-  createUnresolvedGrant,
-  unresolvedCredential,
-  unresolvedSelf,
-  unresolvedUnion,
-} from '@astrale-os/kernel-core'
-
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export function buildComposedExpr(delegation: Delegation) {
-  return unresolvedUnion(unresolvedCredential(delegation.credential), unresolvedSelf())
-}
-
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export function buildComposedGrant(delegation: Delegation) {
-  return { grant: createUnresolvedGrant(buildComposedExpr(delegation)) }
-}
-
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export function buildSelfExpr() {
-  return unresolvedSelf()
-}
-
-/** Self-only grant for function-owned credentials. */
-export function buildSelfGrant() {
-  return { grant: createUnresolvedGrant(buildSelfExpr()) }
-}

package/src/auth/errors.ts

@@ -1,32 +0,0 @@
-/**
- * Errors thrown by the auth bridge.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api'
-
-import { KERNEL_ERROR_CODES } from '@astrale-os/kernel-api'
-
-export class AuthMissingError extends Error implements KernelErrorClassifiable {
-  constructor() {
-    super('Missing credentials')
-    this.name = 'AuthMissingError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return { code: KERNEL_ERROR_CODES.AUTH_MISSING, message: this.message }
-  }
-}
-
-export class AuthInvalidError extends Error implements KernelErrorClassifiable {
-  constructor(message: string, cause?: unknown) {
-    super(message, { cause })
-    this.name = 'AuthInvalidError'
-  }
-
-  toKernelErrorPayload(): KernelErrorPayload {
-    return { code: KERNEL_ERROR_CODES.AUTH_INVALID, message: this.message }
-  }
-}

package/src/auth/function-context.ts

@@ -1,108 +0,0 @@
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core'
-
-import { createUnresolvedGrant } from '@astrale-os/kernel-core'
-
-import type { RemoteIdentityConfig } from './identity.js'
-
-import { buildSelfExpr, buildSelfGrant } from './compose.js'
-import { bindCredentialSession } from './kernel-client.js'
-import { signCredential } from './sign.js'
-
-export type FunctionCredentialOptions = {
-  /** Credential audience. Defaults to the current/default kernel URL when known. */
-  audience?: string
-  /** Grant carried by the top-level kernel bearer. Defaults to self. */
-  grant?: UnresolvedIdentityExpr
-  /** JWT lifetime, jose-style. Default is the SDK per-request kernel TTL. */
-  ttl?: string
-}
-
-export type FunctionKernelOptions = FunctionCredentialOptions & {
-  /** Kernel URL to dial. Defaults to `audience`, then the current/default kernel URL. */
-  url?: string
-  /** Next-hop delegation for remote redirects. Defaults to the credential grant. */
-  delegation?: UnresolvedIdentityExpr
-}
-
-export type FunctionContextApi = {
-  readonly ref: string
-  credential(opts?: FunctionCredentialOptions): Promise<string>
-  kernel(opts?: FunctionKernelOptions): Promise<BoundClientSessionView<FnMap>>
-}
-
-export function makeFunctionContext(
-  identity: RemoteIdentityConfig,
-  deps: unknown,
-  opts: { ref: string; defaultKernelUrl?: string },
-): FunctionContextApi {
-  return {
-    ref: opts.ref,
-    credential: (params) =>
-      signFunctionCredential(
-        identity,
-        resolveAudience(params?.audience, opts.defaultKernelUrl, deps),
-        {
-          grant: params?.grant,
-          ttl: params?.ttl,
-        },
-      ),
-    kernel: async (params) => {
-      const kernelUrl = resolveKernelUrl(params?.url, params?.audience, opts.defaultKernelUrl, deps)
-      const grant = params?.grant ?? buildSelfExpr()
-      const credential = await signFunctionCredential(identity, params?.audience ?? kernelUrl, {
-        grant,
-        ttl: params?.ttl,
-      })
-      return bindCredentialSession(kernelUrl, credential, {
-        delegation: params?.delegation ?? grant,
-      })
-    },
-  }
-}
-
-async function signFunctionCredential(
-  identity: RemoteIdentityConfig,
-  audience: string,
-  opts: { grant?: UnresolvedIdentityExpr; ttl?: string },
-): Promise<string> {
-  const grant =
-    opts.grant === undefined ? buildSelfGrant().grant : createUnresolvedGrant(opts.grant)
-  return signCredential(
-    { grant },
-    {
-      issuer: identity.issuer,
-      subject: identity.subject,
-      audience,
-      privateKey: identity.privateKey,
-      ttl: opts.ttl ?? '30m',
-    },
-  )
-}
-
-function resolveAudience(
-  audience: string | undefined,
-  defaultKernelUrl: string | undefined,
-  deps: unknown,
-): string {
-  return resolveKernelUrl(undefined, audience, defaultKernelUrl, deps)
-}
-
-function resolveKernelUrl(
-  url: string | undefined,
-  audience: string | undefined,
-  defaultKernelUrl: string | undefined,
-  deps: unknown,
-): string {
-  const env = deps as { INSTANCE_KERNEL_URL?: unknown; KERNEL_URL?: unknown } | null | undefined
-  const resolved =
-    url ?? audience ?? defaultKernelUrl ?? env?.INSTANCE_KERNEL_URL ?? env?.KERNEL_URL
-  if (typeof resolved !== 'string' || resolved.length === 0) {
-    throw new Error(
-      'fn.kernel: no kernel URL — pass one explicitly or set INSTANCE_KERNEL_URL in the ' +
-        'worker env (managed deploys set it automatically).',
-    )
-  }
-  return resolved
-}

package/src/auth/identity.ts

@@ -1,17 +0,0 @@
-/**
- * Identity configuration for a remote domain server.
- *
- * The issuer must be reachable via JWKS at `<issuer>/.well-known/jwks.json`
- * (or registered in the kernel's trust store). The private key is used to
- * sign outbound composed credentials.
- */
-export type RemoteIdentityConfig = {
-  /** This service's issuer (URL where its JWKS is served, or a registered ID) */
-  issuer: string
-  /** Optional inbound audience when transport addressing differs from issuer. */
-  audience?: string
-  /** This service's subject identifier (e.g. "task-service") */
-  subject: string
-  /** Private key for signing outbound credentials */
-  privateKey: JsonWebKey
-}

package/src/auth/index.ts

@@ -1,19 +0,0 @@
-export type { RemoteIdentityConfig } from './identity.js'
-export type { VerifiedInbound } from './verify.js'
-export type { AuthenticateResult } from './authenticate.js'
-export { authenticateRequest } from './authenticate.js'
-export { resolveInboundAuth, buildAuthContext, type ResolvedAuth } from './resolve.js'
-export { verifyInboundCredential } from './verify.js'
-export { buildComposedGrant } from './compose.js'
-export { signCredential } from './sign.js'
-export { makeDomainAuthority } from './issuer-mint.js'
-export type { DomainAuthority, MintIssuedParams } from './issuer-mint.js'
-export { makeFunctionContext } from './function-context.js'
-export type {
-  FunctionContextApi,
-  FunctionCredentialOptions,
-  FunctionKernelOptions,
-} from './function-context.js'
-export { bindKernel } from './kernel-client.js'
-export { AuthMissingError, AuthInvalidError } from './errors.js'
-export { assertPerm, requireOwnership, READ, EDIT, USE, SHARE, ALL } from './check.js'

package/src/auth/issuer-mint.ts

@@ -1,76 +0,0 @@
-/**
- * Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
- *
- * A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
- * credential signed with the worker's key back to the graph node carrying that
- * identity. That makes the worker the natural authority for the principals it
- * materializes — an App identity a workspace installs, a per-domain role
- * umbrella, a managed user. `mint` signs such a credential (optionally carrying
- * a `grant` claim with an unresolved identity expression); `sessionFor` opens a
- * kernel session presenting it, so the worker can ACT AS an identity it issues
- * (e.g. call `@<role>::mintDelegationCredential` as the role to obtain a
- * kernel-issued delegation inner).
- *
- * Scope guard: this signs under the WORKER'S OWN issuer only — it cannot forge
- * another issuer's identities. The kernel still enforces everything downstream
- * (trust of the issuer, `frozen`, grant resolution, nested-credential rules).
- */
-
-import type { FnMap } from '@astrale-os/kernel-client'
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core'
-
-import { createUnresolvedGrant } from '@astrale-os/kernel-core'
-
-import type { RemoteIdentityConfig } from './identity.js'
-
-import { bindCredentialSession } from './kernel-client.js'
-import { signCredential } from './sign.js'
-
-export type DomainAuthorityRef = {
-  /** The issuer ID (used as the `iss` claim in credentials and on Identity nodes). */
-  readonly iss: string
-}
-
-export type MintIssuedParams = {
-  /** The issued identity's `sub` — must match the graph node's stored subject. */
-  subject: string
-  /** The credential's audience — the kernel (or worker) it will be presented to. */
-  audience: string
-  /**
-   * Optional `grant` claim: the identity expression the credential's holder may
-   * act as (wrapped `{v:1, expr}`). Omit for a plain self-authenticating
-   * credential — the kernel falls back to a self-grant for externally-issued
-   * credentials. Nested `credential` leaves MUST be kernel-issued delegation
-   * inners (the kernel refuses non-kernel nested credentials).
-   */
-  grant?: UnresolvedIdentityExpr
-  /** JWT lifetime, jose-style (`'60s'`, `'5m'`, `'1h'`). Default `'1h'`. */
-  ttl?: string
-}
-
-export type DomainAuthority = DomainAuthorityRef & {
-  /** Sign a credential AS an identity this domain issues. */
-  mint(params: MintIssuedParams): Promise<string>
-  /**
-   * A kernel session presenting a pre-signed credential (typically from
-   * {@link DomainAuthority.mint} with `audience = kernelUrl`).
-   */
-  sessionFor(kernelUrl: string, credential: string): BoundClientSessionView<FnMap>
-}
-
-/** Build the domain authority for one worker identity config. */
-export function makeDomainAuthority(identity: RemoteIdentityConfig): DomainAuthority {
-  return {
-    iss: identity.issuer,
-    mint: ({ subject, audience, grant, ttl }) =>
-      signCredential(grant !== undefined ? { grant: createUnresolvedGrant(grant) } : {}, {
-        issuer: identity.issuer,
-        subject,
-        audience,
-        privateKey: identity.privateKey,
-        ttl: ttl ?? '1h',
-      }),
-    sessionFor: (kernelUrl, credential) => bindCredentialSession(kernelUrl, credential),
-  }
-}