@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/auth/compose.js

@@ -1,45 +0,0 @@
-/**
- * Outbound grant expression building.
- *
- * Builds a composed grant expression for kernel calls:
- *   grant = union(credential(delegationJWT), self)
- *
- * The kernel resolves this by verifying the delegation JWT (kernel-signed)
- * to get the caller's scoped identity, and resolving self to the function's
- * identity. Union means either identity's permissions work.
- */
-import { createUnresolvedGrant, unresolvedCredential, unresolvedSelf, unresolvedUnion, } from '@astrale-os/kernel-core';
-/**
- * The composed identity expression: union of the caller's delegated access
- * (a kernel-signed credential leaf) and the function's own identity (self).
- *
- * Used both as the grant on outbound kernel calls AND as the delegation
- * expression when minting a NEXT-HOP credential — the next worker receives
- * principal = this function, authority = union(caller's delegated, own).
- */
-export function buildComposedExpr(delegation) {
-    return unresolvedUnion(unresolvedCredential(delegation.credential), unresolvedSelf());
-}
-/**
- * Build the grant expression that unions the caller's delegated access
- * with the function's own identity.
- *
- * @param delegation - Delegation extracted from the inbound credential
- * @returns The unresolved grant object with version and expression
- */
-export function buildComposedGrant(delegation) {
-    return { grant: createUnresolvedGrant(buildComposedExpr(delegation)) };
-}
-/**
- * The SELF-ONLY expression: the function's own identity, nothing delegated.
- * Used by `ctx.fn.kernel()` sessions (public/webhook handlers acting on their own
- * authority) — both as the credential grant and as the next-hop delegation.
- */
-export function buildSelfExpr() {
-    return unresolvedSelf();
-}
-/** Self-only grant for function-owned credentials. */
-export function buildSelfGrant() {
-    return { grant: createUnresolvedGrant(buildSelfExpr()) };
-}
-//# sourceMappingURL=compose.js.map

package/dist/auth/compose.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../src/auth/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAsB;IACtD,OAAO,eAAe,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAsB;IACvD,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,cAAc,EAAE,CAAA;AACzB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC"}

package/dist/auth/errors.d.ts

@@ -1,16 +0,0 @@
-/**
- * Errors thrown by the auth bridge.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import type { KernelErrorPayload, KernelErrorClassifiable } from '@astrale-os/kernel-api';
-export declare class AuthMissingError extends Error implements KernelErrorClassifiable {
-    constructor();
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-export declare class AuthInvalidError extends Error implements KernelErrorClassifiable {
-    constructor(message: string, cause?: unknown);
-    toKernelErrorPayload(): KernelErrorPayload;
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAIzF,qBAAa,gBAAiB,SAAQ,KAAM,YAAW,uBAAuB;IAC5E,cAGC;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAM,YAAW,uBAAuB;IAC5E,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAG3C;IAED,oBAAoB,IAAI,kBAAkB,CAEzC;CACF"}

package/dist/auth/errors.js

@@ -1,26 +0,0 @@
-/**
- * Errors thrown by the auth bridge.
- *
- * Each implements `KernelErrorClassifiable` so `kernel-api/dispatch` can
- * convert them into typed `KernelErrorPayload` values automatically.
- */
-import { KERNEL_ERROR_CODES } from '@astrale-os/kernel-api';
-export class AuthMissingError extends Error {
-    constructor() {
-        super('Missing credentials');
-        this.name = 'AuthMissingError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.AUTH_MISSING, message: this.message };
-    }
-}
-export class AuthInvalidError extends Error {
-    constructor(message, cause) {
-        super(message, { cause });
-        this.name = 'AuthInvalidError';
-    }
-    toKernelErrorPayload() {
-        return { code: KERNEL_ERROR_CODES.AUTH_INVALID, message: this.message };
-    }
-}
-//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAE3D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CAAC,qBAAqB,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACzE,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;IAED,oBAAoB;QAClB,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACzE,CAAC;CACF"}

package/dist/auth/function-context.d.ts

@@ -1,28 +0,0 @@
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type FunctionCredentialOptions = {
-    /** Credential audience. Defaults to the current/default kernel URL when known. */
-    audience?: string;
-    /** Grant carried by the top-level kernel bearer. Defaults to self. */
-    grant?: UnresolvedIdentityExpr;
-    /** JWT lifetime, jose-style. Default is the SDK per-request kernel TTL. */
-    ttl?: string;
-};
-export type FunctionKernelOptions = FunctionCredentialOptions & {
-    /** Kernel URL to dial. Defaults to `audience`, then the current/default kernel URL. */
-    url?: string;
-    /** Next-hop delegation for remote redirects. Defaults to the credential grant. */
-    delegation?: UnresolvedIdentityExpr;
-};
-export type FunctionContextApi = {
-    readonly ref: string;
-    credential(opts?: FunctionCredentialOptions): Promise<string>;
-    kernel(opts?: FunctionKernelOptions): Promise<BoundClientSessionView<FnMap>>;
-};
-export declare function makeFunctionContext(identity: RemoteIdentityConfig, deps: unknown, opts: {
-    ref: string;
-    defaultKernelUrl?: string;
-}): FunctionContextApi;
-//# sourceMappingURL=function-context.d.ts.map

package/dist/auth/function-context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"function-context.d.ts","sourceRoot":"","sources":["../../src/auth/function-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAIrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAMzD,MAAM,MAAM,yBAAyB,GAAG;IACtC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,KAAK,CAAC,EAAE,sBAAsB,CAAA;IAC9B,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,yBAAyB,GAAG;IAC9D,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,UAAU,CAAC,EAAE,sBAAsB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,IAAI,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;CAC7E,CAAA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,kBAAkB,CAwBpB"}

package/dist/auth/function-context.js

@@ -1,47 +0,0 @@
-import { createUnresolvedGrant } from '@astrale-os/kernel-core';
-import { buildSelfExpr, buildSelfGrant } from './compose.js';
-import { bindCredentialSession } from './kernel-client.js';
-import { signCredential } from './sign.js';
-export function makeFunctionContext(identity, deps, opts) {
-    return {
-        ref: opts.ref,
-        credential: (params) => signFunctionCredential(identity, resolveAudience(params?.audience, opts.defaultKernelUrl, deps), {
-            grant: params?.grant,
-            ttl: params?.ttl,
-        }),
-        kernel: async (params) => {
-            const kernelUrl = resolveKernelUrl(params?.url, params?.audience, opts.defaultKernelUrl, deps);
-            const grant = params?.grant ?? buildSelfExpr();
-            const credential = await signFunctionCredential(identity, params?.audience ?? kernelUrl, {
-                grant,
-                ttl: params?.ttl,
-            });
-            return bindCredentialSession(kernelUrl, credential, {
-                delegation: params?.delegation ?? grant,
-            });
-        },
-    };
-}
-async function signFunctionCredential(identity, audience, opts) {
-    const grant = opts.grant === undefined ? buildSelfGrant().grant : createUnresolvedGrant(opts.grant);
-    return signCredential({ grant }, {
-        issuer: identity.issuer,
-        subject: identity.subject,
-        audience,
-        privateKey: identity.privateKey,
-        ttl: opts.ttl ?? '30m',
-    });
-}
-function resolveAudience(audience, defaultKernelUrl, deps) {
-    return resolveKernelUrl(undefined, audience, defaultKernelUrl, deps);
-}
-function resolveKernelUrl(url, audience, defaultKernelUrl, deps) {
-    const env = deps;
-    const resolved = url ?? audience ?? defaultKernelUrl ?? env?.INSTANCE_KERNEL_URL ?? env?.KERNEL_URL;
-    if (typeof resolved !== 'string' || resolved.length === 0) {
-        throw new Error('fn.kernel: no kernel URL — pass one explicitly or set INSTANCE_KERNEL_URL in the ' +
-            'worker env (managed deploys set it automatically).');
-    }
-    return resolved;
-}
-//# sourceMappingURL=function-context.js.map

package/dist/auth/function-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"function-context.js","sourceRoot":"","sources":["../../src/auth/function-context.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAwB1C,MAAM,UAAU,mBAAmB,CACjC,QAA8B,EAC9B,IAAa,EACb,IAAgD;IAEhD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CACrB,sBAAsB,CACpB,QAAQ,EACR,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAC9D;YACE,KAAK,EAAE,MAAM,EAAE,KAAK;YACpB,GAAG,EAAE,MAAM,EAAE,GAAG;SACjB,CACF;QACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;YAC9F,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,aAAa,EAAE,CAAA;YAC9C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,SAAS,EAAE;gBACvF,KAAK;gBACL,GAAG,EAAE,MAAM,EAAE,GAAG;aACjB,CAAC,CAAA;YACF,OAAO,qBAAqB,CAAC,SAAS,EAAE,UAAU,EAAE;gBAClD,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK;aACxC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAA8B,EAC9B,QAAgB,EAChB,IAAsD;IAEtD,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvF,OAAO,cAAc,CACnB,EAAE,KAAK,EAAE,EACT;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,KAAK;KACvB,CACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,QAA4B,EAC5B,gBAAoC,EACpC,IAAa;IAEb,OAAO,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAuB,EACvB,QAA4B,EAC5B,gBAAoC,EACpC,IAAa;IAEb,MAAM,GAAG,GAAG,IAAkF,CAAA;IAC9F,MAAM,QAAQ,GACZ,GAAG,IAAI,QAAQ,IAAI,gBAAgB,IAAI,GAAG,EAAE,mBAAmB,IAAI,GAAG,EAAE,UAAU,CAAA;IACpF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,oDAAoD,CACvD,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/auth/identity.d.ts

@@ -1,18 +0,0 @@
-/**
- * Identity configuration for a remote domain server.
- *
- * The issuer must be reachable via JWKS at `<issuer>/.well-known/jwks.json`
- * (or registered in the kernel's trust store). The private key is used to
- * sign outbound composed credentials.
- */
-export type RemoteIdentityConfig = {
-    /** This service's issuer (URL where its JWKS is served, or a registered ID) */
-    issuer: string;
-    /** Optional inbound audience when transport addressing differs from issuer. */
-    audience?: string;
-    /** This service's subject identifier (e.g. "task-service") */
-    subject: string;
-    /** Private key for signing outbound credentials */
-    privateKey: JsonWebKey;
-};
-//# sourceMappingURL=identity.d.ts.map

package/dist/auth/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/auth/identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAA;IACf,mDAAmD;IACnD,UAAU,EAAE,UAAU,CAAA;CACvB,CAAA"}

package/dist/auth/identity.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=identity.js.map

package/dist/auth/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/auth/identity.ts"],"names":[],"mappings":""}

package/dist/auth/issuer-mint.d.ts

@@ -1,53 +0,0 @@
-/**
- * Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
- *
- * A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
- * credential signed with the worker's key back to the graph node carrying that
- * identity. That makes the worker the natural authority for the principals it
- * materializes — an App identity a workspace installs, a per-domain role
- * umbrella, a managed user. `mint` signs such a credential (optionally carrying
- * a `grant` claim with an unresolved identity expression); `sessionFor` opens a
- * kernel session presenting it, so the worker can ACT AS an identity it issues
- * (e.g. call `@<role>::mintDelegationCredential` as the role to obtain a
- * kernel-issued delegation inner).
- *
- * Scope guard: this signs under the WORKER'S OWN issuer only — it cannot forge
- * another issuer's identities. The kernel still enforces everything downstream
- * (trust of the issuer, `frozen`, grant resolution, nested-credential rules).
- */
-import type { FnMap } from '@astrale-os/kernel-client';
-import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type DomainAuthorityRef = {
-    /** The issuer ID (used as the `iss` claim in credentials and on Identity nodes). */
-    readonly iss: string;
-};
-export type MintIssuedParams = {
-    /** The issued identity's `sub` — must match the graph node's stored subject. */
-    subject: string;
-    /** The credential's audience — the kernel (or worker) it will be presented to. */
-    audience: string;
-    /**
-     * Optional `grant` claim: the identity expression the credential's holder may
-     * act as (wrapped `{v:1, expr}`). Omit for a plain self-authenticating
-     * credential — the kernel falls back to a self-grant for externally-issued
-     * credentials. Nested `credential` leaves MUST be kernel-issued delegation
-     * inners (the kernel refuses non-kernel nested credentials).
-     */
-    grant?: UnresolvedIdentityExpr;
-    /** JWT lifetime, jose-style (`'60s'`, `'5m'`, `'1h'`). Default `'1h'`. */
-    ttl?: string;
-};
-export type DomainAuthority = DomainAuthorityRef & {
-    /** Sign a credential AS an identity this domain issues. */
-    mint(params: MintIssuedParams): Promise<string>;
-    /**
-     * A kernel session presenting a pre-signed credential (typically from
-     * {@link DomainAuthority.mint} with `audience = kernelUrl`).
-     */
-    sessionFor(kernelUrl: string, credential: string): BoundClientSessionView<FnMap>;
-};
-/** Build the domain authority for one worker identity config. */
-export declare function makeDomainAuthority(identity: RemoteIdentityConfig): DomainAuthority;
-//# sourceMappingURL=issuer-mint.d.ts.map

package/dist/auth/issuer-mint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer-mint.d.ts","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAIrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAA;IAC9B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG;IACjD,2DAA2D;IAC3D,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;CACjF,CAAA;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,eAAe,CAanF"}

package/dist/auth/issuer-mint.js

@@ -1,35 +0,0 @@
-/**
- * Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
- *
- * A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
- * credential signed with the worker's key back to the graph node carrying that
- * identity. That makes the worker the natural authority for the principals it
- * materializes — an App identity a workspace installs, a per-domain role
- * umbrella, a managed user. `mint` signs such a credential (optionally carrying
- * a `grant` claim with an unresolved identity expression); `sessionFor` opens a
- * kernel session presenting it, so the worker can ACT AS an identity it issues
- * (e.g. call `@<role>::mintDelegationCredential` as the role to obtain a
- * kernel-issued delegation inner).
- *
- * Scope guard: this signs under the WORKER'S OWN issuer only — it cannot forge
- * another issuer's identities. The kernel still enforces everything downstream
- * (trust of the issuer, `frozen`, grant resolution, nested-credential rules).
- */
-import { createUnresolvedGrant } from '@astrale-os/kernel-core';
-import { bindCredentialSession } from './kernel-client.js';
-import { signCredential } from './sign.js';
-/** Build the domain authority for one worker identity config. */
-export function makeDomainAuthority(identity) {
-    return {
-        iss: identity.issuer,
-        mint: ({ subject, audience, grant, ttl }) => signCredential(grant !== undefined ? { grant: createUnresolvedGrant(grant) } : {}, {
-            issuer: identity.issuer,
-            subject,
-            audience,
-            privateKey: identity.privateKey,
-            ttl: ttl ?? '1h',
-        }),
-        sessionFor: (kernelUrl, credential) => bindCredentialSession(kernelUrl, credential),
-    };
-}
-//# sourceMappingURL=issuer-mint.js.map

package/dist/auth/issuer-mint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer-mint.js","sourceRoot":"","sources":["../../src/auth/issuer-mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAI/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAkC1C,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,QAA8B;IAChE,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1C,cAAc,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,QAAQ;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,GAAG,EAAE,GAAG,IAAI,IAAI;SACjB,CAAC;QACJ,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC;KACpF,CAAA;AACH,CAAC"}

package/dist/auth/kernel-client.d.ts

@@ -1,37 +0,0 @@
-/**
- * Call-back kernel client.
- *
- * Every authenticated inbound request produces a `BoundClientSessionView` the
- * handler uses to call back into the parent kernel. The view is bound to
- * a composed credential (`union(delegation, self)`) so the kernel
- * enforces both the caller's scoped identity and the function's own.
- *
- * The connection pool and schema registry are cached per kernel URL and reused
- * across requests. The `ClientSession` itself is per-request: it carries a
- * delegation mint bound to the calling function's own subject (`config.subject`)
- * so a remote-bound call (one that redirects to another worker) mints a
- * worker-scoped credential for the audience the kernel puts on the redirect
- * (`CallRedirection.iss`) — the worker→worker dance, done reactively instead of
- * the old proactive `lookupRemoteBinding` resolve-then-dial.
- */
-import type { Delegation } from '@astrale-os/kernel-core';
-import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
-import { type FnMap } from '@astrale-os/kernel-client';
-import { type BoundClientSessionView } from '@astrale-os/kernel-client/session';
-import type { RemoteIdentityConfig } from './identity.js';
-/**
- * Build a `BoundClientSessionView` that signs outbound calls as the composed
- * identity (the caller's delegation unioned with this function's own
- * identity). Remote-bound redirects mint worker-scoped delegations via AuthApi.
- */
-export declare function bindKernel(delegation: Delegation, kernelUrl: string, config: RemoteIdentityConfig): Promise<BoundClientSessionView<FnMap>>;
-/**
- * Bind a session to a PRE-SIGNED credential — no delegation mint, no composed
- * grant; the credential IS the authority. The seam behind
- * `DomainAuthority.sessionFor` (a worker acting as an identity it issues). Pool +
- * schema registry are the same per-URL caches the composed sessions use.
- */
-export declare function bindCredentialSession(kernelUrl: string, credential: string, opts?: {
-    delegation?: UnresolvedIdentityExpr;
-}): BoundClientSessionView<FnMap>;
-//# sourceMappingURL=kernel-client.d.ts.map

package/dist/auth/kernel-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kernel-client.d.ts","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAErE,OAAO,EAAgC,KAAK,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAEpF,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAA;AAE1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAiCzD;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAIxC;AAiDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,sBAAsB,CAAA;CAAO,GACjD,sBAAsB,CAAC,KAAK,CAAC,CAkB/B"}

package/dist/auth/kernel-client.js

@@ -1,111 +0,0 @@
-/**
- * Call-back kernel client.
- *
- * Every authenticated inbound request produces a `BoundClientSessionView` the
- * handler uses to call back into the parent kernel. The view is bound to
- * a composed credential (`union(delegation, self)`) so the kernel
- * enforces both the caller's scoped identity and the function's own.
- *
- * The connection pool and schema registry are cached per kernel URL and reused
- * across requests. The `ClientSession` itself is per-request: it carries a
- * delegation mint bound to the calling function's own subject (`config.subject`)
- * so a remote-bound call (one that redirects to another worker) mints a
- * worker-scoped credential for the audience the kernel puts on the redirect
- * (`CallRedirection.iss`) — the worker→worker dance, done reactively instead of
- * the old proactive `lookupRemoteBinding` resolve-then-dial.
- */
-import { KernelClient, SchemaRegistry } from '@astrale-os/kernel-client';
-import { ClientPool } from '@astrale-os/kernel-client/pool';
-import { ClientSession, allowAllDelegations, delegationMintVia, } from '@astrale-os/kernel-client/session';
-import { buildComposedExpr, buildComposedGrant, buildSelfExpr } from './compose.js';
-import { signCredential } from './sign.js';
-const DELEGATION_TTL_SECONDS = 3600;
-// Shared per kernel URL — the expensive, identity-agnostic state. Sessions are
-// NOT shared (each binds a subject-specific delegation mint), but the pool
-// (connections) and registry (learned schemas) are reused across them.
-const pools = new Map();
-const registries = new Map();
-function getRegistry(url) {
-    let registry = registries.get(url);
-    if (!registry) {
-        registry = new SchemaRegistry();
-        registries.set(url, registry);
-    }
-    return registry;
-}
-function getPool(url) {
-    const cached = pools.get(url);
-    if (cached)
-        return cached;
-    const registry = getRegistry(url);
-    const pool = new ClientPool({
-        clientFactory: (u) => new KernelClient({ url: u, schema: registry }),
-    });
-    pools.set(url, pool);
-    return pool;
-}
-/**
- * Build a `BoundClientSessionView` that signs outbound calls as the composed
- * identity (the caller's delegation unioned with this function's own
- * identity). Remote-bound redirects mint worker-scoped delegations via AuthApi.
- */
-export async function bindKernel(delegation, kernelUrl, config) {
-    return bindSession(kernelUrl, config, buildComposedGrant(delegation).grant, () => buildComposedExpr(delegation));
-}
-/**
- * Shared session construction: sign a credential as this function's identity
- * carrying `grant`, bind the session to it, and wire the lazy NEXT-HOP mint.
- */
-async function bindSession(kernelUrl, config, grant, nextHopDelegation) {
-    const credential = await signCredential({ grant }, {
-        issuer: config.issuer,
-        subject: config.subject,
-        audience: kernelUrl,
-        privateKey: config.privateKey,
-        // Long-running handlers (a managed INSTALL saga easily runs minutes on a
-        // cold box) make kernel callbacks throughout — the default 60s wall left
-        // them unable to even write their own failure records (observed live:
-        // install wedged at 'installing' forever). The session credential is
-        // per-request and aud-bound; delegated AUTHORITY still expires with the
-        // inner delegation's own exp.
-        ttl: '30m',
-    });
-    // The standard mint resolves the function identity through `auth.whoami()`.
-    const session = new ClientSession({
-        default: kernelUrl,
-        schema: getRegistry(kernelUrl),
-        pool: getPool(kernelUrl),
-        delegation: {
-            mint: delegationMintVia(() => session, () => credential),
-            ttl: DELEGATION_TTL_SECONDS,
-        },
-        delegationPolicy: {
-            ...allowAllDelegations({ default: kernelUrl }),
-            delegationFor: () => nextHopDelegation(),
-        },
-    });
-    return session.as(credential);
-}
-/**
- * Bind a session to a PRE-SIGNED credential — no delegation mint, no composed
- * grant; the credential IS the authority. The seam behind
- * `DomainAuthority.sessionFor` (a worker acting as an identity it issues). Pool +
- * schema registry are the same per-URL caches the composed sessions use.
- */
-export function bindCredentialSession(kernelUrl, credential, opts = {}) {
-    const session = new ClientSession({
-        default: kernelUrl,
-        schema: getRegistry(kernelUrl),
-        pool: getPool(kernelUrl),
-        delegation: {
-            mint: delegationMintVia(() => session, () => credential),
-            ttl: DELEGATION_TTL_SECONDS,
-        },
-        delegationPolicy: {
-            ...allowAllDelegations({ default: kernelUrl }),
-            delegationFor: () => opts.delegation ?? buildSelfExpr(),
-        },
-    });
-    return session.as(credential);
-}
-//# sourceMappingURL=kernel-client.js.map

package/dist/auth/kernel-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kernel-client.js","sourceRoot":"","sources":["../../src/auth/kernel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAc,MAAM,2BAA2B,CAAA;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,mCAAmC,CAAA;AAI1C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE1C,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAEnC,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAA;AAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;AAEpD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAA;QAC/B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAQ;QACjC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,YAAY,CAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KAC5E,CAAC,CAAA;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACpB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAsB,EACtB,SAAiB,EACjB,MAA4B;IAE5B,OAAO,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAC/E,iBAAiB,CAAC,UAAU,CAAC,CAC9B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,MAA4B,EAC5B,KAAc,EACd,iBAA+C;IAE/C,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,EAAE,KAAK,EAAE,EACT;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,8BAA8B;QAC9B,GAAG,EAAE,KAAK;KACX,CACF,CAAA;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAyB,IAAI,aAAa,CAAQ;QAC7D,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB,CACrB,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,CAAC,UAAU,CACjB;YACD,GAAG,EAAE,sBAAsB;SAC5B;QACD,gBAAgB,EAAE;YAChB,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9C,aAAa,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE;SACzC;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,UAAkB,EAClB,IAAI,GAA4C,EAAE;IAElD,MAAM,OAAO,GAAyB,IAAI,aAAa,CAAQ;QAC7D,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB,CACrB,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,CAAC,UAAU,CACjB;YACD,GAAG,EAAE,sBAAsB;SAC5B;QACD,gBAAgB,EAAE;YAChB,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9C,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,EAAE;SACxD;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;AAC/B,CAAC"}

package/dist/auth/resolve.d.ts

@@ -1,19 +0,0 @@
-/**
- * Shared inbound-credential resolution.
- *
- * Consumed by both `SdkDispatcher` (kernel envelope) and `mountAuxiliaryRoutes`
- * (View / RemoteFunction routes). Centralises the auth-policy three-way
- * (`'required'` / `'optional'` / `'public'`) and the wrap of underlying
- * verification errors into canonical `AuthMissingError` / `AuthInvalidError`.
- */
-import type { AuthPolicy } from '@astrale-os/kernel-api/routed';
-import type { AuthContext, Authenticated, CredentialInput } from '@astrale-os/kernel-core';
-import type { AuthenticateResult } from './authenticate.js';
-import type { RemoteIdentityConfig } from './identity.js';
-export type ResolvedAuth = {
-    auth: AuthContext | null;
-    kernel: AuthenticateResult['kernel'];
-};
-export declare function resolveInboundAuth(credential: CredentialInput, policy: AuthPolicy | undefined, identity: RemoteIdentityConfig): Promise<ResolvedAuth>;
-export declare function buildAuthContext(authenticated: Authenticated): AuthContext;
-//# sourceMappingURL=resolve.d.ts.map

package/dist/auth/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,eAAe,EAEhB,MAAM,yBAAyB,CAAA;AAIhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAKzD,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAA;CACrC,CAAA;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,eAAe,EAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAkBvB;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,aAAa,GAAG,WAAW,CAQ1E"}

package/dist/auth/resolve.js

@@ -1,43 +0,0 @@
-/**
- * Shared inbound-credential resolution.
- *
- * Consumed by both `SdkDispatcher` (kernel envelope) and `mountAuxiliaryRoutes`
- * (View / RemoteFunction routes). Centralises the auth-policy three-way
- * (`'required'` / `'optional'` / `'public'`) and the wrap of underlying
- * verification errors into canonical `AuthMissingError` / `AuthInvalidError`.
- */
-import { isKernelErrorClassifiable } from '@astrale-os/kernel-api';
-import { authenticateRequest } from './authenticate.js';
-import { AuthInvalidError, AuthMissingError } from './errors.js';
-export async function resolveInboundAuth(credential, policy, identity) {
-    const effective = policy ?? 'required';
-    if (effective === 'public')
-        return { auth: null, kernel: null };
-    if (effective === 'optional' && !credential)
-        return { auth: null, kernel: null };
-    if (effective === 'required' && !credential)
-        throw new AuthMissingError();
-    try {
-        const result = await authenticateRequest(credential, identity);
-        return { auth: buildAuthContext(result.authenticated), kernel: result.kernel };
-    }
-    catch (err) {
-        // kernel-core auth errors (UntrustedIssuerError, TrustPolicyDeniedError, …)
-        // already self-classify with a discriminating `data.type`. Rethrow them
-        // unchanged so that classification survives to the wire; only wrap
-        // genuinely unclassified errors into the generic AuthInvalidError.
-        if (isKernelErrorClassifiable(err))
-            throw err;
-        throw new AuthInvalidError(err instanceof Error ? err.message : 'Authentication failed', err);
-    }
-}
-export function buildAuthContext(authenticated) {
-    return {
-        credential: authenticated.credential,
-        principal: authenticated.credential.verified.sub,
-        grant: authenticated.grant,
-        attestation: authenticated.attestation,
-        delegation: authenticated.delegation,
-    };
-}
-//# sourceMappingURL=resolve.js.map

package/dist/auth/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAKlE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAOhE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA2B,EAC3B,MAA8B,EAC9B,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,IAAI,UAAU,CAAA;IAEtC,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAC/D,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAChF,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAA;IAEzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC9D,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;QACnE,IAAI,yBAAyB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAA;QAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAA4B;IAC3D,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,GAA4B;QACzE,KAAK,EAAE,aAAa,CAAC,KAAM;QAC3B,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,UAAU,EAAE,aAAa,CAAC,UAAU;KACrC,CAAA;AACH,CAAC"}

package/dist/auth/sign.d.ts

@@ -1,15 +0,0 @@
-/**
- * JWT signing utilities for outbound composed credentials.
- */
-/**
- * Sign a credential JWT with the given claims and identity config.
- */
-export declare function signCredential(claims: Record<string, unknown>, config: {
-    issuer: string;
-    subject: string;
-    audience: string;
-    privateKey: JsonWebKey;
-    /** JWT lifetime as a jose-compatible string (e.g. '60s', '5m', '1h'). Default: '60s'. */
-    ttl?: string;
-}): Promise<string>;
-//# sourceMappingURL=sign.d.ts.map

package/dist/auth/sign.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/auth/sign.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE;IACN,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,UAAU,CAAA;IACtB,yFAAyF;IACzF,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GACA,OAAO,CAAC,MAAM,CAAC,CAejB"}

package/dist/auth/sign.js

@@ -1,24 +0,0 @@
-/**
- * JWT signing utilities for outbound composed credentials.
- */
-import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
-import { SignJWT, importJWK } from 'jose';
-/**
- * Sign a credential JWT with the given claims and identity config.
- */
-export async function signCredential(claims, config) {
-    const alg = deriveAllowedAlgorithms(config.privateKey)[0];
-    if (!alg) {
-        throw new Error(`Cannot derive algorithm from JWK: kty=${config.privateKey.kty}`);
-    }
-    const key = await importJWK(config.privateKey, alg);
-    return new SignJWT(claims)
-        .setProtectedHeader({ alg })
-        .setIssuer(config.issuer)
-        .setSubject(config.subject)
-        .setAudience(config.audience)
-        .setIssuedAt()
-        .setExpirationTime(config.ttl ?? '60s')
-        .sign(key);
-}
-//# sourceMappingURL=sign.js.map

package/dist/auth/sign.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/auth/sign.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA+B,EAC/B,MAOC;IAED,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAEnD,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;SAC3B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;SACxB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC5B,WAAW,EAAE;SACb,iBAAiB,CAAC,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC;SACtC,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/auth/verify.d.ts

@@ -1,28 +0,0 @@
-/**
- * Inbound credential verification.
- *
- * Uses kernel-core's credential verification infrastructure
- * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
- * Not tied to JWT — supports any credential method kernel-core provides.
- */
-import type { Attestation, CredentialInput, Delegation, VerifiedCredential } from '@astrale-os/kernel-core';
-import type { RemoteIdentityConfig } from './identity.js';
-export type VerifiedInbound = {
-    /** The full verified credential (iss, sub, aud, claims) */
-    verified: VerifiedCredential;
-    /** Issuer URL (from credential's iss claim) */
-    issuer: string;
-    /** Attestation — proves caller can invoke this function */
-    attestation: Attestation;
-    /** Delegation — scoped caller permissions as kernel-signed credential */
-    delegation: Delegation;
-};
-/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
-export declare function clearJwksCache(): void;
-/**
- * Verify an inbound delegation credential using kernel-core's verification.
- *
- * @throws AuthenticationError subclasses from kernel-core on verification failure
- */
-export declare function verifyInboundCredential(credential: CredentialInput, config: RemoteIdentityConfig): Promise<VerifiedInbound>;
-//# sourceMappingURL=verify.d.ts.map