@astrale-os/sdk 0.4.19 → 0.5.0-beta.2

package/dist/server/worker-entry.d.ts

@@ -1,157 +0,0 @@
-/**
- * `createWorkerEntry` — the shared worker `fetch` plumbing every Astrale domain
- * worker (and the cloudflare adapter's codegen) needs, so it lives in ONE place
- * instead of being copy-pasted per worker:
- *
- *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
- *     what `createRemoteServer` signs with and the kernel pins), and cache the
- *     built app per distinct URL;
- *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
- *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
- *     certain outbound fetches through a caller-supplied binding — `selfBinding`
- *     for same-host fetches (a Worker can't fetch its own hostname), and the
- *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
- *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
- *     backend or topology; the caller owns the predicate + the fetcher;
- *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
- *
- * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
- * route by `createRemoteServer`; the verifier resolves a self-issued credential
- * from the in-memory key (see `auth/verify.ts`), so no self-fetch shim is needed.
- *
- * The worker file is then just schema + methods + a `build(url, env)` callback.
- */
-import type { ExecutionContext } from 'hono';
-import type { RemoteServerConfig } from './config.js';
-export type Fetcher = {
-    fetch(request: Request): Response | Promise<Response>;
-};
-export type WorkerApp = {
-    fetch(request: Request, env?: unknown, executionCtx?: ExecutionContext): Response | Promise<Response>;
-};
-/** A built app cached by its serving URL: `origin` for same-origin matching,
- * `app` for in-process self-dispatch. */
-type CachedApp = {
-    origin: string;
-    app: WorkerApp;
-};
-/**
- * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
- * real `fetch` handle it. Order matters and same-origin wins FIRST: a call to
- * this worker's OWN serving origin is a self-dispatch, not an edge fetch — and
- * the caller's `routeSubrequest` policy may itself match our own host (e.g. an
- * `isInstanceHost` predicate matches every `*.svc.astrale.ai`, ours included),
- * so it must never get first look at a same-origin call.
- *
- *   • same-origin + SELF binding present → the SELF fetcher: a fresh same-script
- *     invocation. The normal Cloudflare path — a Worker can't fetch its own
- *     hostname over the edge, so it re-enters itself through the binding.
- *   • same-origin + NO SELF binding → the cached app, dispatched IN-PROCESS. A
- *     Workers-for-Platforms dispatch-namespace tenant can't service-bind to
- *     itself (its script name is platform-renamed), so it has no SELF binding; an
- *     in-process dispatch reaches the same script with no edge hop and no binding.
- *     `App` and the SELF `Fetcher` share the `{ fetch(request) }` shape, so the
- *     caller drives both identically.
- *   • else, the caller's `routeSubrequest` policy matched → its fetcher.
- *   • else → `null`: passthrough to the real network fetch.
- *
- * Pure (no closure over instance state) so the routing decision is unit-testable
- * without standing up a real app.
- */
-export declare function selectSubrequestTarget<TDeps>(u: URL, ctx: {
-    self: Fetcher | null;
-    apps: Iterable<CachedApp>;
-    routeEnv: TDeps | null;
-    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
-}): {
-    fetch(request: Request): Response | Promise<Response>;
-} | null;
-export interface WorkerEntryConfig<TDeps> {
-    /**
-     * Build the `createRemoteServer` config for the resolved serving `url`. Called
-     * once per distinct URL (the resulting app is cached), with the same `env` the
-     * request carries — so it can read additional bindings (e.g. a base domain).
-     */
-    build: (url: string, env: TDeps) => RemoteServerConfig<TDeps>;
-    /**
-     * Resolve the raw serving URL from `env` (+ the per-request origin, for workers
-     * that fall back to the request host). Defaults to the `WORKER_URL` env var.
-     * The result is always canonicalized before use.
-     *
-     * The `requestOrigin` honors an `X-Forwarded-Proto: https` upgrade (see
-     * `clientOrigin`), so a dev worker behind a TLS-terminating proxy (cloudflared
-     * tunnel, reverse proxy) resolves its public `https://` origin, not the raw
-     * `http://` one workerd sees.
-     */
-    resolveUrl?: (env: TDeps, requestOrigin: string) => string;
-    /** Optional: the `SELF` service binding used to route same-host subrequests. */
-    selfBinding?: (env: TDeps) => Fetcher | null | undefined;
-    /**
-     * Optional, vendor-neutral: route an OUTBOUND subrequest through a
-     * caller-supplied fetcher instead of the network — for hosts a Worker can't
-     * reach directly over the edge (e.g. a platform router on the SAME zone:
-     * Cloudflare 522s a same-zone Worker→Worker public `fetch`). Return a `Fetcher`
-     * to route the request through, or null/undefined to fall through to the normal
-     * fetch. The SDK names no backend or topology — the CALLER owns BOTH the
-     * predicate (which hosts) and the fetcher (the binding). This generalizes
-     * `selfBinding` (same-origin → SELF) to any caller policy; both are honored.
-     */
-    routeSubrequest?: (url: URL, env: TDeps) => Fetcher | null | undefined;
-    /**
-     * Optional: handle a request before it reaches the kernel app — e.g. serve a
-     * SPA under `/ui/*` or a same-origin `/api/*` endpoint the view calls. Return
-     * a `Response` to short-circuit, or `undefined` to fall through to the domain
-     * dispatch.
-     */
-    before?: (env: TDeps, url: URL, request: Request) => Response | undefined | Promise<Response | undefined>;
-    /**
-     * Optional: transform the request on the fall-through path, just before it
-     * reaches the kernel app (e.g. rewrite the hostname for wildcard-subdomain
-     * routing). Not applied when `before` short-circuits.
-     */
-    rewriteRequest?: (env: TDeps, request: Request) => Request;
-}
-export interface AppWorkerEntryConfig<TDeps> extends Omit<WorkerEntryConfig<TDeps>, 'build'> {
-    buildApp: (url: string, env: TDeps) => WorkerApp;
-}
-export interface WorkerEntry<TDeps> {
-    fetch(request: Request, env: TDeps, executionCtx?: ExecutionContext): Response | Promise<Response>;
-}
-/**
- * The request origin as the CLIENT reached it — i.e. the origin a fallback
- * serving URL (and therefore the `iss`) may be derived from. Behind a
- * TLS-terminating proxy (a cloudflared tunnel in front of `wrangler dev`, any
- * reverse proxy) the worker sees plain HTTP, so `request.url` says `http://…`
- * while the public URL is `https://…`; the proxy advertises the original
- * scheme via `X-Forwarded-Proto`. Honoring it is restricted to the http→https
- * UPGRADE of the SAME host (never a downgrade, never a host change), so a
- * spoofed header can at worst derive an `iss` the kernel's JWKS check then
- * fails — it can never make this worker speak for another origin.
- */
-export declare function clientOrigin(url: URL, request: Request): string;
-/**
- * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
- * Assets binding) mounted under `base` (default `/ui`) — the runtime half of an
- * adapter env's client-asset config. Returns `undefined` for non-matching paths
- * (and when no binding is present) so the request falls through to domain dispatch.
- *
- * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
- * this hook strips that prefix before delegating to the binding, so
- * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
- * (local dev), requests are proxied there instead — the seam for a bundler's
- * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
- * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
- * here.
- *
- * Lives here, type-checked and testable, instead of being emitted as a string
- * by every adapter's worker codegen.
- */
-export declare function assets<TDeps>(opts: {
-    base?: string;
-    binding: (env: TDeps) => Fetcher | null | undefined;
-    devProxy?: (env: TDeps) => string | null | undefined;
-}): (env: TDeps, url: URL, request: Request) => Response | Promise<Response> | undefined;
-export declare function createWorkerEntry<TDeps>(config: WorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
-export declare function createAppWorkerEntry<TDeps>(config: AppWorkerEntryConfig<TDeps>): WorkerEntry<TDeps>;
-export {};
-//# sourceMappingURL=worker-entry.d.ts.map

package/dist/server/worker-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"worker-entry.d.ts","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,MAAM,CAAA;AAE5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAMrD,MAAM,MAAM,OAAO,GAAG;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAA;AAC/E,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CACH,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,OAAO,EACb,YAAY,CAAC,EAAE,gBAAgB,GAC9B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAChC,CAAA;AAED;yCACyC;AACzC,KAAK,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,CAAC,EAAE,GAAG,EACN,GAAG,EAAE;IACH,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;IACzB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;CACvE,GACA;IAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAAE,GAAG,IAAI,CAWlE;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK;IACtC;;;;OAIG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC7D;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1D,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACxD;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACtE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,GAAG,EAAE,KAAK,EACV,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAA;CAC3D;AAED,MAAM,WAAW,oBAAoB,CAAC,KAAK,CAAE,SAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAC1F,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,KAAK,SAAS,CAAA;CACjD;AAED,MAAM,WAAW,WAAW,CAAC,KAAK;IAChC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAM/D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE;IAClC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrD,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAiBvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAK7F;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EACxC,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAClC,WAAW,CAAC,KAAK,CAAC,CAsEpB"}

package/dist/server/worker-entry.js

@@ -1,201 +0,0 @@
-/**
- * `createWorkerEntry` — the shared worker `fetch` plumbing every Astrale domain
- * worker (and the cloudflare adapter's codegen) needs, so it lives in ONE place
- * instead of being copy-pasted per worker:
- *
- *   • resolve the serving URL (== `iss`), canonicalize it (so the value matches
- *     what `createRemoteServer` signs with and the kernel pins), and cache the
- *     built app per distinct URL;
- *   • optional subrequest routing: a `globalThis.fetch` override (installed ONLY
- *     when `selfBinding` and/or `routeSubrequest` is configured) redirects
- *     certain outbound fetches through a caller-supplied binding — `selfBinding`
- *     for same-host fetches (a Worker can't fetch its own hostname), and the
- *     vendor-neutral `routeSubrequest` for any caller policy (e.g. instance
- *     hostnames a same-zone Worker→Worker fetch would 522 on). The SDK names no
- *     backend or topology; the caller owns the predicate + the fetcher;
- *   • optional SPA hook (e.g. `/ui/*` served from an `ASSETS` binding).
- *
- * The worker's OWN JWKS (`<url>/.well-known/jwks.json`) is served as a normal
- * route by `createRemoteServer`; the verifier resolves a self-issued credential
- * from the in-memory key (see `auth/verify.ts`), so no self-fetch shim is needed.
- *
- * The worker file is then just schema + methods + a `build(url, env)` callback.
- */
-import { createRemoteServer } from './create.js';
-import { requireEnv } from './require-env.js';
-import { canonicalizeServingUrl } from './serving-url.js';
-/**
- * Choose where an OUTBOUND subrequest to `u` is routed — or `null` to let the
- * real `fetch` handle it. Order matters and same-origin wins FIRST: a call to
- * this worker's OWN serving origin is a self-dispatch, not an edge fetch — and
- * the caller's `routeSubrequest` policy may itself match our own host (e.g. an
- * `isInstanceHost` predicate matches every `*.svc.astrale.ai`, ours included),
- * so it must never get first look at a same-origin call.
- *
- *   • same-origin + SELF binding present → the SELF fetcher: a fresh same-script
- *     invocation. The normal Cloudflare path — a Worker can't fetch its own
- *     hostname over the edge, so it re-enters itself through the binding.
- *   • same-origin + NO SELF binding → the cached app, dispatched IN-PROCESS. A
- *     Workers-for-Platforms dispatch-namespace tenant can't service-bind to
- *     itself (its script name is platform-renamed), so it has no SELF binding; an
- *     in-process dispatch reaches the same script with no edge hop and no binding.
- *     `App` and the SELF `Fetcher` share the `{ fetch(request) }` shape, so the
- *     caller drives both identically.
- *   • else, the caller's `routeSubrequest` policy matched → its fetcher.
- *   • else → `null`: passthrough to the real network fetch.
- *
- * Pure (no closure over instance state) so the routing decision is unit-testable
- * without standing up a real app.
- */
-export function selectSubrequestTarget(u, ctx) {
-    // Same-origin self-subrequest → the same script (SELF binding, else in-process).
-    for (const cached of ctx.apps) {
-        if (cached.origin === u.origin)
-            return ctx.self ?? cached.app;
-    }
-    // Caller policy (e.g. a platform router on the same zone) → its fetcher.
-    if (ctx.routeSubrequest && ctx.routeEnv) {
-        const via = ctx.routeSubrequest(u, ctx.routeEnv);
-        if (via)
-            return via;
-    }
-    return null;
-}
-/**
- * The request origin as the CLIENT reached it — i.e. the origin a fallback
- * serving URL (and therefore the `iss`) may be derived from. Behind a
- * TLS-terminating proxy (a cloudflared tunnel in front of `wrangler dev`, any
- * reverse proxy) the worker sees plain HTTP, so `request.url` says `http://…`
- * while the public URL is `https://…`; the proxy advertises the original
- * scheme via `X-Forwarded-Proto`. Honoring it is restricted to the http→https
- * UPGRADE of the SAME host (never a downgrade, never a host change), so a
- * spoofed header can at worst derive an `iss` the kernel's JWKS check then
- * fails — it can never make this worker speak for another origin.
- */
-export function clientOrigin(url, request) {
-    if (url.protocol !== 'http:')
-        return url.origin;
-    const forwarded = request.headers.get('x-forwarded-proto');
-    // Multiple proxies append: "https, http" — the first hop is the client-facing one.
-    const scheme = forwarded?.split(',')[0]?.trim().toLowerCase();
-    return scheme === 'https' ? `https://${url.host}` : url.origin;
-}
-/**
- * Build a `before` hook that serves a static-asset `binding` (e.g. a Workers
- * Assets binding) mounted under `base` (default `/ui`) — the runtime half of an
- * adapter env's client-asset config. Returns `undefined` for non-matching paths
- * (and when no binding is present) so the request falls through to domain dispatch.
- *
- * Asset URLs are rooted at `base` (a client bundler sets `base: '<base>/'`);
- * this hook strips that prefix before delegating to the binding, so
- * `<base>/x.js` resolves from the binding's root. When `devProxy` yields a URL
- * (local dev), requests are proxied there instead — the seam for a bundler's
- * HMR dev server. Whether unknown sub-paths fall back to `index.html` is the
- * binding's own concern (e.g. wrangler's `not_found_handling`), not baked in
- * here.
- *
- * Lives here, type-checked and testable, instead of being emitted as a string
- * by every adapter's worker codegen.
- */
-export function assets(opts) {
-    const base = (opts.base ?? '/ui').replace(/\/+$/, '');
-    const prefix = `${base}/`;
-    return (env, url, request) => {
-        const binding = opts.binding(env);
-        if (!binding)
-            return undefined;
-        if (url.pathname !== base && !url.pathname.startsWith(prefix))
-            return undefined;
-        const devUrl = opts.devProxy?.(env);
-        if (devUrl) {
-            const devBase = devUrl.replace(/\/+$/, '');
-            return fetch(new Request(`${devBase}${url.pathname}${url.search}`, request));
-        }
-        // `<base>` → `/`, `<base>/x` → `/x`: serve from the binding's root.
-        const stripped = url.pathname.slice(base.length) || '/';
-        const rewritten = new URL(stripped + url.search, url.origin);
-        return binding.fetch(new Request(rewritten, request));
-    };
-}
-export function createWorkerEntry(config) {
-    return createAppWorkerEntry({
-        ...config,
-        buildApp: (url, env) => createRemoteServer(config.build(url, env)).app,
-    });
-}
-export function createAppWorkerEntry(config) {
-    // Cache the built app per distinct resolved URL — plural and bounded. On the
-    // request-origin fallback the URL legitimately alternates for one worker
-    // (direct http hits vs https-upgraded tunnel hits, workers.dev + custom
-    // domain), and a single slot would tear down and rebuild the whole app on
-    // every alternation. The bound caps abuse via attacker-minted Host /
-    // X-Forwarded-Proto values on that same fallback path.
-    const MAX_CACHED_APPS = 4;
-    const apps = new Map();
-    let self = null;
-    let routeEnv = null;
-    function getApp(url, env) {
-        const cached = apps.get(url);
-        if (cached)
-            return cached.app;
-        const app = config.buildApp(url, env);
-        if (apps.size >= MAX_CACHED_APPS) {
-            const oldest = apps.keys().next().value;
-            if (oldest !== undefined)
-                apps.delete(oldest);
-        }
-        apps.set(url, { origin: new URL(url).origin, app });
-        return app;
-    }
-    // A Worker can't fetch its own hostname over the edge, nor — on Cloudflare — a
-    // same-zone hostname routed to another Worker (the `routeSubrequest` case).
-    // When either is configured, override `globalThis.fetch` to redirect those
-    // subrequests through the right target (see `selectSubrequestTarget`). Workers
-    // with neither selfBinding nor routeSubrequest get no global mutation. (A
-    // self-issued credential's JWKS is resolved in-memory by the verifier, not
-    // fetched — see `auth/verify.ts` — so no self-JWKS shim is needed.)
-    if (config.selfBinding || config.routeSubrequest) {
-        const originalFetch = globalThis.fetch;
-        globalThis.fetch = (async (input, init) => {
-            const href = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
-            try {
-                const target = selectSubrequestTarget(new URL(href), {
-                    self,
-                    apps: apps.values(),
-                    routeEnv,
-                    routeSubrequest: config.routeSubrequest,
-                });
-                if (target)
-                    return target.fetch(new Request(input, init));
-            }
-            catch {
-                // non-absolute URL — fall through to the original fetch
-            }
-            return originalFetch(input, init);
-        });
-    }
-    return {
-        async fetch(request, env, executionCtx) {
-            if (config.selfBinding)
-                self ??= config.selfBinding(env) ?? null;
-            if (config.routeSubrequest)
-                routeEnv = env;
-            // Only parse the request URL when a hook actually needs it.
-            const requestUrl = config.before || config.resolveUrl ? new URL(request.url) : null;
-            if (config.before && requestUrl) {
-                // Await so an async `before` that resolves to `undefined` falls through
-                // (a returned Promise<undefined> would otherwise be sent as the response).
-                const handled = await config.before(env, requestUrl, request);
-                if (handled !== undefined)
-                    return handled;
-            }
-            const raw = config.resolveUrl
-                ? config.resolveUrl(env, clientOrigin(requestUrl, request))
-                : requireEnv(env, 'WORKER_URL', "the worker's public serving URL (its iss identity)");
-            const url = canonicalizeServingUrl(raw);
-            const dispatched = config.rewriteRequest ? config.rewriteRequest(env, request) : request;
-            return getApp(url, env).fetch(dispatched, env, executionCtx);
-        },
-    };
-}
-//# sourceMappingURL=worker-entry.js.map

package/dist/server/worker-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/server/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAezD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CACpC,CAAM,EACN,GAKC;IAED,iFAAiF;IACjF,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAA;IAC/D,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AA4DD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAQ,EAAE,OAAgB;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC1D,mFAAmF;IACnF,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7D,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAQ,IAI7B;IACC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAQ,MAAgC;IACvE,OAAO,oBAAoB,CAAC;QAC1B,GAAG,MAAM;QACT,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAQ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG;KAC9E,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAmC;IAEnC,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,eAAe,GAAG,CAAC,CAAA;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAA;IACzC,IAAI,IAAI,GAAmB,IAAI,CAAA;IAC/B,IAAI,QAAQ,GAAiB,IAAI,CAAA;IAEjC,SAAS,MAAM,CAAC,GAAW,EAAE,GAAU;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YACvC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAA;QACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA;YAC9F,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE;oBACnD,IAAI;oBACJ,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;oBACnB,QAAQ;oBACR,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC,CAAA;gBACF,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC,CAAiB,CAAA;IACpB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAU,EAAE,YAA+B;YACvE,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CAAA;YAChE,IAAI,MAAM,CAAC,eAAe;gBAAE,QAAQ,GAAG,GAAG,CAAA;YAC1C,4DAA4D;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACnF,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,wEAAwE;gBACxE,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;gBAC7D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAA;YAC3C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU;gBAC3B,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,UAAW,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oDAAoD,CAAC,CAAA;YACvF,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACxF,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QAC9D,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/service/functions.d.ts

@@ -1,148 +0,0 @@
-import type { FunctionBinding } from '@astrale-os/kernel-api/routed';
-import type { FunctionSchema } from '@astrale-os/kernel-core/domain';
-import { z } from 'zod';
-import type { RemoteIdentityConfig } from '../auth/identity.js';
-export declare const SERVICE_FUNCTIONS_PATH = "/_astrale/functions";
-export declare const SERVICE_FUNCTIONS_PURPOSE = "astrale.service-functions.v1";
-export declare const ServiceFunctionManifestEntrySchema: z.ZodObject<{
-    slug: z.ZodString;
-    ref: z.ZodString;
-    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    output: z.ZodDefault<z.ZodEnum<{
-        binary: "binary";
-        stream: "stream";
-        value: "value";
-    }>>;
-    binding: z.ZodObject<{
-        remoteUrl: z.ZodOptional<z.ZodString>;
-        route: z.ZodOptional<z.ZodObject<{
-            method: z.ZodEnum<{
-                "*": "*";
-                DELETE: "DELETE";
-                GET: "GET";
-                PATCH: "PATCH";
-                POST: "POST";
-                PUT: "PUT";
-            }>;
-            path: z.ZodString;
-            self: z.ZodOptional<z.ZodString>;
-            query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-            body: z.ZodOptional<z.ZodUnknown>;
-            credential: z.ZodOptional<z.ZodUnknown>;
-        }, z.core.$strip>>;
-        auth: z.ZodOptional<z.ZodEnum<{
-            optional: "optional";
-            public: "public";
-            required: "required";
-        }>>;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export declare const ServiceFunctionManifestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    service: z.ZodObject<{
-        issuer: z.ZodString;
-        subject: z.ZodString;
-    }, z.core.$strip>;
-    functions: z.ZodArray<z.ZodObject<{
-        slug: z.ZodString;
-        ref: z.ZodString;
-        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        output: z.ZodDefault<z.ZodEnum<{
-            binary: "binary";
-            stream: "stream";
-            value: "value";
-        }>>;
-        binding: z.ZodObject<{
-            remoteUrl: z.ZodOptional<z.ZodString>;
-            route: z.ZodOptional<z.ZodObject<{
-                method: z.ZodEnum<{
-                    "*": "*";
-                    DELETE: "DELETE";
-                    GET: "GET";
-                    PATCH: "PATCH";
-                    POST: "POST";
-                    PUT: "PUT";
-                }>;
-                path: z.ZodString;
-                self: z.ZodOptional<z.ZodString>;
-                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                body: z.ZodOptional<z.ZodUnknown>;
-                credential: z.ZodOptional<z.ZodUnknown>;
-            }, z.core.$strip>>;
-            auth: z.ZodOptional<z.ZodEnum<{
-                optional: "optional";
-                public: "public";
-                required: "required";
-            }>>;
-        }, z.core.$strip>;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export declare const ServiceFunctionDiscoveryRequestSchema: z.ZodObject<{
-    kernelIssuer: z.ZodString;
-    nonce: z.ZodString;
-}, z.core.$strip>;
-export declare const ServiceFunctionDiscoveryResponseSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    service: z.ZodObject<{
-        issuer: z.ZodString;
-        subject: z.ZodString;
-    }, z.core.$strip>;
-    functions: z.ZodArray<z.ZodObject<{
-        slug: z.ZodString;
-        ref: z.ZodString;
-        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        outputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        output: z.ZodDefault<z.ZodEnum<{
-            binary: "binary";
-            stream: "stream";
-            value: "value";
-        }>>;
-        binding: z.ZodObject<{
-            remoteUrl: z.ZodOptional<z.ZodString>;
-            route: z.ZodOptional<z.ZodObject<{
-                method: z.ZodEnum<{
-                    "*": "*";
-                    DELETE: "DELETE";
-                    GET: "GET";
-                    PATCH: "PATCH";
-                    POST: "POST";
-                    PUT: "PUT";
-                }>;
-                path: z.ZodString;
-                self: z.ZodOptional<z.ZodString>;
-                query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                body: z.ZodOptional<z.ZodUnknown>;
-                credential: z.ZodOptional<z.ZodUnknown>;
-            }, z.core.$strip>>;
-            auth: z.ZodOptional<z.ZodEnum<{
-                optional: "optional";
-                public: "public";
-                required: "required";
-            }>>;
-        }, z.core.$strip>;
-    }, z.core.$strip>>;
-    identity: z.ZodObject<{
-        credential: z.ZodString;
-    }, z.core.$strip>;
-}, z.core.$strip>;
-export type ServiceFunctionManifestEntry = z.infer<typeof ServiceFunctionManifestEntrySchema>;
-export type ServiceFunctionManifest = z.infer<typeof ServiceFunctionManifestSchema>;
-export type ServiceFunctionDiscoveryRequest = z.infer<typeof ServiceFunctionDiscoveryRequestSchema>;
-export type ServiceFunctionDiscoveryResponse = z.infer<typeof ServiceFunctionDiscoveryResponseSchema>;
-export declare function toServiceFunctionManifestEntries(schemas: readonly FunctionSchema[]): ServiceFunctionManifestEntry[];
-export declare function signServiceFunctionManifest(manifest: ServiceFunctionManifest, request: ServiceFunctionDiscoveryRequest, identity: RemoteIdentityConfig): Promise<ServiceFunctionDiscoveryResponse>;
-export declare function verifyServiceFunctionManifest(input: unknown, expected: {
-    kernelIssuer: string;
-    nonce: string;
-    serviceIssuer: string;
-    serviceSubject: string;
-    publicKey: JsonWebKey;
-}): Promise<ServiceFunctionDiscoveryResponse>;
-export declare function hashServiceFunctionManifest(manifest: ServiceFunctionManifest): Promise<string>;
-export declare function functionBindingForManifest(binding: FunctionBinding, auth: 'required' | 'optional' | 'public' | undefined): FunctionBinding;
-//# sourceMappingURL=functions.d.ts.map

package/dist/service/functions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAKpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAI/D,eAAO,MAAM,sBAAsB,wBAAwB,CAAA;AAC3D,eAAO,MAAM,yBAAyB,iCAAiC,CAAA;AAIvE,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAO7C,CAAA;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIxC,CAAA;AAEF,eAAO,MAAM,qCAAqC;;;iBAGhD,CAAA;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEjD,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAC7F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AACnF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAA;AACnG,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAA;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,SAAS,cAAc,EAAE,GACjC,4BAA4B,EAAE,CAchC;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,+BAA+B,EACxC,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,gCAAgC,CAAC,CAc3C;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE;IACR,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,UAAU,CAAA;CACtB,GACA,OAAO,CAAC,gCAAgC,CAAC,CAkC3C;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GACnD,eAAe,CAEjB"}

package/dist/service/functions.js

@@ -1,115 +0,0 @@
-import { deriveAllowedAlgorithms } from '@astrale-os/kernel-core';
-import { functionBindingSchema, functionOutputSchema } from '@astrale-os/kernel-core/domain';
-import { importJWK, jwtVerify } from 'jose';
-import { z } from 'zod';
-import { signCredential } from '../auth/sign.js';
-export const SERVICE_FUNCTIONS_PATH = '/_astrale/functions';
-export const SERVICE_FUNCTIONS_PURPOSE = 'astrale.service-functions.v1';
-const JsonSchema = z.record(z.string(), z.unknown());
-export const ServiceFunctionManifestEntrySchema = z.object({
-    slug: z.string().regex(/^[a-z][a-z0-9-]*$/),
-    ref: z.string().regex(/^function\.[a-z][a-z0-9-]*$/),
-    inputSchema: JsonSchema,
-    outputSchema: JsonSchema,
-    output: functionOutputSchema.default('value'),
-    binding: functionBindingSchema.unwrap(),
-});
-export const ServiceFunctionManifestSchema = z.object({
-    version: z.literal(1),
-    service: z.object({ issuer: z.string().min(1), subject: z.string().min(1) }),
-    functions: z.array(ServiceFunctionManifestEntrySchema).max(500),
-});
-export const ServiceFunctionDiscoveryRequestSchema = z.object({
-    kernelIssuer: z.string().url(),
-    nonce: z.string().min(16).max(256),
-});
-export const ServiceFunctionDiscoveryResponseSchema = ServiceFunctionManifestSchema.extend({
-    identity: z.object({ credential: z.string().min(1) }),
-});
-export function toServiceFunctionManifestEntries(schemas) {
-    return schemas
-        .map((schema) => {
-        const slug = schema.ref.slice('function.'.length);
-        return ServiceFunctionManifestEntrySchema.parse({
-            slug,
-            ref: schema.ref,
-            inputSchema: schema.inputSchema,
-            outputSchema: schema.outputSchema,
-            output: schema.output ?? 'value',
-            binding: schema.binding,
-        });
-    })
-        .sort((a, b) => a.slug.localeCompare(b.slug));
-}
-export async function signServiceFunctionManifest(manifest, request, identity) {
-    const parsedManifest = ServiceFunctionManifestSchema.parse(manifest);
-    const manifestHash = await hashServiceFunctionManifest(parsedManifest);
-    const credential = await signCredential({ purpose: SERVICE_FUNCTIONS_PURPOSE, nonce: request.nonce, manifestHash }, {
-        issuer: identity.issuer,
-        subject: identity.subject,
-        audience: request.kernelIssuer,
-        privateKey: identity.privateKey,
-        ttl: '2m',
-    });
-    return { ...parsedManifest, identity: { credential } };
-}
-export async function verifyServiceFunctionManifest(input, expected) {
-    const response = ServiceFunctionDiscoveryResponseSchema.parse(input);
-    if (response.service.issuer !== expected.serviceIssuer ||
-        response.service.subject !== expected.serviceSubject) {
-        throw new Error('service function manifest identity does not match the deployed Service');
-    }
-    const algorithms = deriveAllowedAlgorithms(expected.publicKey);
-    const algorithm = algorithms[0];
-    if (!algorithm)
-        throw new Error('service function manifest public key has no supported algorithm');
-    const key = await importJWK(expected.publicKey, algorithm);
-    const verified = await jwtVerify(response.identity.credential, key, {
-        algorithms,
-        issuer: expected.serviceIssuer,
-        subject: expected.serviceSubject,
-        audience: expected.kernelIssuer,
-    });
-    const expectedHash = await hashServiceFunctionManifest({
-        version: response.version,
-        service: response.service,
-        functions: response.functions,
-    });
-    if (verified.payload.purpose !== SERVICE_FUNCTIONS_PURPOSE) {
-        throw new Error('service function manifest credential has the wrong purpose');
-    }
-    if (verified.payload.nonce !== expected.nonce) {
-        throw new Error('service function manifest credential has the wrong nonce');
-    }
-    if (verified.payload.manifestHash !== expectedHash) {
-        throw new Error('service function manifest credential does not cover the returned manifest');
-    }
-    return response;
-}
-export async function hashServiceFunctionManifest(manifest) {
-    const bytes = new TextEncoder().encode(canonicalJson(ServiceFunctionManifestSchema.parse(manifest)));
-    const digest = await crypto.subtle.digest('SHA-256', bytes);
-    return `sha256:${hex(new Uint8Array(digest))}`;
-}
-export function functionBindingForManifest(binding, auth) {
-    return { ...binding, auth: auth ?? 'required' };
-}
-function canonicalJson(value) {
-    if (value === null || typeof value !== 'object')
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    const entries = Object.entries(value)
-        .filter(([, item]) => item !== undefined)
-        .sort(([a], [b]) => a.localeCompare(b));
-    return `{${entries
-        .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
-        .join(',')}}`;
-}
-function hex(bytes) {
-    let value = '';
-    for (const byte of bytes)
-        value += byte.toString(16).padStart(2, '0');
-    return value;
-}
-//# sourceMappingURL=functions.js.map

package/dist/service/functions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"functions.js","sourceRoot":"","sources":["../../src/service/functions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAA;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAA;AAEvE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAEpD,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC;IACpD,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU;IACxB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7C,OAAO,EAAE,qBAAqB,CAAC,MAAM,EAAE;CACxC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,6BAA6B,CAAC,MAAM,CAAC;IACzF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACtD,CAAC,CAAA;AASF,MAAM,UAAU,gCAAgC,CAC9C,OAAkC;IAElC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,kCAAkC,CAAC,KAAK,CAAC;YAC9C,IAAI;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO;YAChC,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAA;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC,EACjC,OAAwC,EACxC,QAA8B;IAE9B,MAAM,cAAc,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,cAAc,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,MAAM,cAAc,CACrC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,EAC1E;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,GAAG,EAAE,IAAI;KACV,CACF,CAAA;IACD,OAAO,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,CAAA;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAc,EACd,QAMC;IAED,MAAM,QAAQ,GAAG,sCAAsC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACpE,IACE,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa;QAClD,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,cAAc,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAClG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;QAClE,UAAU;QACV,MAAM,EAAE,QAAQ,CAAC,aAAa;QAC9B,OAAO,EAAE,QAAQ,CAAC,cAAc;QAChC,QAAQ,EAAE,QAAQ,CAAC,YAAY;KAChC,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC;QACrD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,yBAAyB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,aAAa,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAC7D,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC3D,OAAO,UAAU,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAwB,EACxB,IAAoD;IAEpD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,UAAU,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,IAAI,OAAO;SACf,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;SACrE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC"}