@astrale-os/sdk 0.5.0-beta.13 → 0.5.0-beta.130

package/dist/execution/identity/exchange.js

@@ -0,0 +1,115 @@
+import * as protocolErrors from '@astrale-os/kernel-protocol/errors';
+import * as issuerExchange from '@astrale-os/kernel-protocol/issuer/exchange';
+import { errors as joseErrors, SignJWT } from 'jose';
+import { AuthValueError, delegation } from '../../platform/auth/index.js';
+import { protocolError } from '../invocation/result/index.js';
+import { acceptResolvedDelegation } from './authentication.js';
+import { CredentialRejected, IssuerUnavailable } from './errors.js';
+import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
+const DEFAULT_MAXIMUM_TTL_SECONDS = 30 * 60;
+export function maximumExchangeTtl(input) {
+    if (input === undefined)
+        return DEFAULT_MAXIMUM_TTL_SECONDS;
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'maximumTtlSeconds')) {
+        throw new TypeError('Execution identity tokenExchange options are invalid.');
+    }
+    const value = input.maximumTtlSeconds ?? DEFAULT_MAXIMUM_TTL_SECONDS;
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new TypeError('tokenExchange.maximumTtlSeconds must be a positive safe integer.');
+    }
+    return value;
+}
+export function tokenExchange(issuer, subject, signing, policy, verification, maximumTtlSeconds) {
+    return Object.freeze({
+        async exchange(request, context) {
+            try {
+                context.signal.throwIfAborted();
+                const outer = await verifyCredential(request.token, issuer, verification, context.signal, policy);
+                requireProfile(outer.verified, 'outer');
+                const carried = delegation.accept(outer.verified.claims.delegation);
+                if (typeof carried.credential !== 'string')
+                    invalid();
+                context.signal.throwIfAborted();
+                const inner = await verifyCredentialAgainst(carried.credential, outer.verified.iss, outer.basis);
+                requireProfile(inner.verified, 'inner');
+                requireCoherence(outer.verified, inner.verified);
+                acceptResolvedDelegation(inner.verified.claims.delegation);
+                context.signal.throwIfAborted();
+                const now = Math.floor(Date.now() / 1_000);
+                const expiresAt = Math.min(outer.verified.exp, inner.verified.exp, now + maximumTtlSeconds);
+                if (expiresAt <= now)
+                    expired();
+                const token = await new SignJWT({
+                    grant: {
+                        v: 1,
+                        expr: { kind: 'identity', credential: carried.credential },
+                    },
+                })
+                    .setProtectedHeader({
+                    alg: signing.algorithm,
+                    ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+                })
+                    .setIssuer(issuer)
+                    .setSubject(subject)
+                    .setAudience(outer.verified.iss)
+                    .setIssuedAt(now)
+                    .setExpirationTime(expiresAt)
+                    .sign(await signing.privateKey);
+                context.signal.throwIfAborted();
+                return issuerExchange.response(token, expiresAt);
+            }
+            catch (cause) {
+                if (cause instanceof protocolErrors.ProtocolError)
+                    throw cause;
+                if (context.signal.aborted) {
+                    throw protocolError('CANCELLED', 'Token exchange was cancelled.');
+                }
+                if (cause instanceof joseErrors.JWTExpired)
+                    expired();
+                if (cause instanceof IssuerUnavailable)
+                    unavailable();
+                if (cause instanceof CredentialRejected ||
+                    cause instanceof joseErrors.JOSEError ||
+                    cause instanceof AuthValueError) {
+                    invalid();
+                }
+                throw cause;
+            }
+        },
+    });
+}
+function requireProfile(input, profile) {
+    const expected = ['aud', 'delegation', 'exp', 'iat', 'iss', 'sub'];
+    const actual = Object.keys(input.claims).sort();
+    if (actual.length !== expected.length ||
+        actual.some((field, index) => field !== expected[index]) ||
+        typeof input.iat !== 'number' ||
+        !Number.isSafeInteger(input.iat) ||
+        input.iat < 1 ||
+        typeof input.exp !== 'number' ||
+        !Number.isSafeInteger(input.exp) ||
+        input.exp < 1 ||
+        typeof input.aud !== 'string') {
+        invalid();
+    }
+    if (profile === 'outer')
+        delegation.accept(input.claims.delegation);
+    else
+        acceptResolvedDelegation(input.claims.delegation);
+}
+function requireCoherence(outer, inner) {
+    if (inner.iss !== outer.iss || inner.sub !== outer.sub || inner.aud !== outer.iss)
+        invalid();
+}
+function invalid() {
+    throw protocolError('AUTH_INVALID', 'Token is invalid.');
+}
+function expired() {
+    throw protocolError('AUTH_EXPIRED', 'Token is expired.');
+}
+function unavailable() {
+    throw protocolError('BACKEND_UNAVAILABLE', 'Token exchange is unavailable.');
+}

package/dist/execution/identity/identity.d.ts

@@ -0,0 +1,24 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type * as publicationProtocol from '@astrale-os/kernel-protocol/publication';
+import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
+import type { InvocationAuthority } from '../invocation/index.js';
+import type { ExchangeOptions } from './exchange.js';
+import type { IdentityNetworkPolicy } from './jwks.js';
+/** One execution identity owns issuer discovery, admission, authentication, and optional exchange. */
+export interface Identity extends Issuer, InvocationAuthority {
+    readonly subject: string;
+    readonly tokenExchange?: exchange.Provider;
+    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+}
+export interface IdentityInput extends IdentityNetworkPolicy {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    readonly privateKey: JsonWebKey;
+    readonly fetch?: Fetch;
+    readonly tokenExchange?: ExchangeOptions | false;
+    readonly loadIssuerPublicKeys?: Issuer['loadIssuerPublicKeys'];
+}
+/** Create one stateless execution identity backed by an asymmetric private JWK. */
+export declare function createIdentity(input: IdentityInput): Identity;
+export declare function identity(input: Identity): Identity;

package/dist/execution/identity/identity.js

@@ -0,0 +1,99 @@
+import { admit, authenticate } from './authentication.js';
+import { publicationDelivery } from './delivery.js';
+import { httpIssuer } from './errors.js';
+import { maximumExchangeTtl, tokenExchange } from './exchange.js';
+import { createVerificationBasisResolver } from './jwks.js';
+import { signing } from './signing.js';
+/** Create one stateless execution identity backed by an asymmetric private JWK. */
+export function createIdentity(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const issuer = httpIssuer(input.issuer, input.allowInsecureHttp === true);
+    if (typeof input.subject !== 'string' || input.subject.length === 0) {
+        throw new TypeError('Execution identity subject must not be empty.');
+    }
+    if (input.allowEndpoint !== undefined && typeof input.allowEndpoint !== 'function')
+        invalid();
+    if (input.loadIssuerPublicKeys !== undefined &&
+        typeof input.loadIssuerPublicKeys !== 'function') {
+        invalid();
+    }
+    const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
+    if (typeof fetch !== 'function')
+        throw new TypeError('Execution identity requires Fetch.');
+    const material = signing(input.privateKey);
+    const policy = Object.freeze({
+        ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
+        ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+    });
+    const verification = createVerificationBasisResolver(fetch, policy);
+    const configuration = Object.freeze({
+        issuer,
+        subject: input.subject,
+        signing: material,
+        fetch,
+        policy,
+        verification,
+    });
+    const exchangeProvider = input.tokenExchange === false
+        ? undefined
+        : tokenExchange(issuer, input.subject, material, policy, verification, maximumExchangeTtl(input.tokenExchange));
+    return identity({
+        issuer,
+        subject: input.subject,
+        signingAlgorithm: material.algorithm,
+        async loadPublicKeys() {
+            return [material.publicKey];
+        },
+        ...(input.loadIssuerPublicKeys === undefined
+            ? {}
+            : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
+        ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
+        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        admit: (request) => admit(request, configuration),
+        authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+    });
+}
+export function identity(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const allowed = new Set([
+        'issuer',
+        'subject',
+        'signingAlgorithm',
+        'loadPublicKeys',
+        'loadIssuerPublicKeys',
+        'tokenExchange',
+        'delivery',
+        'admit',
+        'authenticate',
+    ]);
+    if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
+        typeof input.subject !== 'string' ||
+        input.subject.length === 0 ||
+        typeof input.loadPublicKeys !== 'function' ||
+        typeof input.delivery !== 'function' ||
+        typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function') {
+        invalid();
+    }
+    const receiver = Object.freeze({ ...input });
+    return Object.freeze({
+        issuer: receiver.issuer,
+        subject: receiver.subject,
+        ...(receiver.signingAlgorithm === undefined
+            ? {}
+            : { signingAlgorithm: receiver.signingAlgorithm }),
+        loadPublicKeys: receiver.loadPublicKeys.bind(receiver),
+        ...(receiver.loadIssuerPublicKeys === undefined
+            ? {}
+            : { loadIssuerPublicKeys: receiver.loadIssuerPublicKeys.bind(receiver) }),
+        ...(receiver.tokenExchange === undefined ? {} : { tokenExchange: receiver.tokenExchange }),
+        delivery: receiver.delivery.bind(receiver),
+        admit: receiver.admit.bind(receiver),
+        authenticate: receiver.authenticate.bind(receiver),
+    });
+}
+function invalid() {
+    throw new TypeError('Execution Identity is invalid.');
+}

package/dist/execution/identity/index.d.ts

@@ -0,0 +1,2 @@
+export { createIdentity, identity, type Identity, type IdentityInput } from './identity.js';
+export { maximumExchangeTtl, tokenExchange, type ExchangeOptions } from './exchange.js';

package/dist/execution/identity/index.js

@@ -0,0 +1,2 @@
+export { createIdentity, identity } from './identity.js';
+export { maximumExchangeTtl, tokenExchange } from './exchange.js';

package/dist/execution/identity/jwks.d.ts

@@ -0,0 +1,29 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { CredentialInput, IssuerId, JsonWebKey, VerifiedCredential } from '../../platform/auth/index.js';
+import { credential } from '../../platform/auth/index.js';
+export interface IdentityNetworkPolicy {
+    readonly allowEndpoint?: (url: string) => boolean;
+    readonly allowInsecureHttp?: boolean;
+}
+export interface VerificationBasis {
+    readonly issuer: IssuerId;
+    readonly algorithms: readonly [string, ...string[]];
+    readonly keys: readonly JsonWebKey[];
+}
+export interface VerificationBasisResolver {
+    resolve(issuer: IssuerId, keyId: string | undefined, signal: AbortSignal): Promise<VerificationBasis>;
+}
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export declare function createVerificationBasisResolver(fetch: Fetch, policy: IdentityNetworkPolicy, now?: () => number): VerificationBasisResolver;
+export declare function verifyCredential(input: CredentialInput, audience: IssuerId, bases: VerificationBasisResolver, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
+    readonly raw: CredentialInput;
+    readonly verified: VerifiedCredential;
+    readonly basis: VerificationBasis;
+}>;
+export declare function verifyCredentialAgainst(input: CredentialInput, audience: IssuerId, basis: VerificationBasis, preinspected?: ReturnType<typeof credential.inspect>): Promise<{
+    readonly raw: CredentialInput;
+    readonly verified: VerifiedCredential;
+}>;

package/dist/execution/identity/jwks.js

@@ -0,0 +1,252 @@
+import { acceptConfiguration } from '@astrale-os/kernel-protocol/issuer/configuration';
+import { acceptKeySet } from '@astrale-os/kernel-protocol/issuer/key-set';
+import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { errors as joseErrors, importJWK, jwtVerify } from 'jose';
+import { credential } from '../../platform/auth/index.js';
+import { CredentialRejected, IssuerUnavailable, admitEndpoint, httpIssuer } from './errors.js';
+const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
+const MAXIMUM_VERIFICATION_BASES = 64;
+const VERIFICATION_BASIS_TTL_MS = 60_000;
+const UNKNOWN_KEY_REFRESH_COOLDOWN_MS = 60_000;
+/**
+ * Retain only recently admitted public issuer material for one execution Identity.
+ * An unseen key ID may refresh once per cooldown; failures never replace a usable basis.
+ */
+export function createVerificationBasisResolver(fetch, policy, now = Date.now) {
+    const bases = new Map();
+    const pending = new Map();
+    return Object.freeze({
+        async resolve(issuer, keyId, signal) {
+            signal.throwIfAborted();
+            const cached = bases.get(issuer);
+            const observedAt = now();
+            const age = cached === undefined ? Number.POSITIVE_INFINITY : observedAt - cached.refreshedAt;
+            const fresh = cached !== undefined && age >= 0 && age < VERIFICATION_BASIS_TTL_MS;
+            const knownKey = keyId === undefined ||
+                cached?.basis.keys.some((candidate) => candidate.kid === keyId) === true;
+            const unknownKeyCooldown = cached?.unknownKeyRefreshedAt !== undefined &&
+                observedAt - cached.unknownKeyRefreshedAt >= 0 &&
+                observedAt - cached.unknownKeyRefreshedAt < UNKNOWN_KEY_REFRESH_COOLDOWN_MS;
+            if (fresh && knownKey) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            const unknownKeyRefresh = cached !== undefined && !knownKey;
+            let refresh = pending.get(issuer);
+            if (refresh === undefined && fresh && unknownKeyCooldown) {
+                bases.delete(issuer);
+                bases.set(issuer, cached);
+                return cached.basis;
+            }
+            if (refresh === undefined && unknownKeyRefresh && cached !== undefined) {
+                bases.set(issuer, Object.freeze({ ...cached, unknownKeyRefreshedAt: observedAt }));
+            }
+            if (refresh === undefined) {
+                const controller = new AbortController();
+                refresh = {
+                    controller,
+                    operation: undefined,
+                    subscribers: 0,
+                    settled: false,
+                    unknownKeyRefresh,
+                    requestedKeyIds: new Set(keyId === undefined ? [] : [keyId]),
+                };
+                const owned = refresh;
+                owned.operation = discover(issuer, fetch, controller.signal, policy)
+                    .then((basis) => {
+                    controller.signal.throwIfAborted();
+                    const refreshedAt = now();
+                    if (bases.size >= MAXIMUM_VERIFICATION_BASES && !bases.has(issuer)) {
+                        const oldest = bases.keys().next().value;
+                        if (oldest !== undefined)
+                            bases.delete(oldest);
+                    }
+                    bases.delete(issuer);
+                    bases.set(issuer, Object.freeze({
+                        basis,
+                        refreshedAt,
+                        ...(owned.unknownKeyRefresh ||
+                            [...owned.requestedKeyIds].some((requested) => !basis.keys.some((candidate) => candidate.kid === requested))
+                            ? { unknownKeyRefreshedAt: refreshedAt }
+                            : {}),
+                    }));
+                    return basis;
+                })
+                    .finally(() => {
+                    owned.settled = true;
+                    if (pending.get(issuer) === owned)
+                        pending.delete(issuer);
+                });
+                pending.set(issuer, owned);
+            }
+            else if (unknownKeyRefresh) {
+                refresh.unknownKeyRefresh = true;
+            }
+            if (keyId !== undefined)
+                refresh.requestedKeyIds.add(keyId);
+            const basis = await subscribe(refresh, issuer, pending, signal);
+            signal.throwIfAborted();
+            return basis;
+        },
+    });
+}
+export async function verifyCredential(input, audience, bases, signal, policy) {
+    signal.throwIfAborted();
+    let inspected;
+    try {
+        inspected = credential.inspect(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential is malformed.', cause);
+    }
+    if (inspected.iss === undefined)
+        throw new CredentialRejected('Credential issuer is missing.');
+    let admittedIssuer;
+    try {
+        admittedIssuer = httpIssuer(inspected.iss, policy.allowInsecureHttp === true);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential issuer is invalid.', cause);
+    }
+    const basis = await bases.resolve(admittedIssuer, inspected.kid, signal);
+    signal.throwIfAborted();
+    const verified = await verifyCredentialAgainst(input, audience, basis, inspected);
+    signal.throwIfAborted();
+    admitEndpoint(`${admittedIssuer.replace(/\/+$/u, '')}/invoke`, policy);
+    return Object.freeze({ raw: input, verified: verified.verified, basis });
+}
+function subscribe(refresh, issuer, pending, signal) {
+    signal.throwIfAborted();
+    refresh.subscribers += 1;
+    return new Promise((resolve, reject) => {
+        let complete = false;
+        const finish = () => {
+            if (complete)
+                return false;
+            complete = true;
+            signal.removeEventListener('abort', cancel);
+            refresh.subscribers -= 1;
+            if (!refresh.settled && refresh.subscribers === 0) {
+                if (pending.get(issuer) === refresh)
+                    pending.delete(issuer);
+                refresh.controller.abort(new DOMException('Issuer discovery was cancelled.', 'AbortError'));
+            }
+            return true;
+        };
+        const cancel = () => {
+            if (!finish())
+                return;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', cancel, { once: true });
+        refresh.operation.then((basis) => {
+            if (!finish())
+                return;
+            resolve(basis);
+        }, (cause) => {
+            if (!finish())
+                return;
+            reject(cause);
+        });
+    });
+}
+export async function verifyCredentialAgainst(input, audience, basis, preinspected) {
+    let inspected;
+    try {
+        inspected = preinspected ?? credential.inspect(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential is malformed.', cause);
+    }
+    if (inspected.iss !== basis.issuer) {
+        throw new CredentialRejected('Credential issuer differs from its verification basis.');
+    }
+    const compact = typeof input === 'string' ? input : new TextDecoder().decode(input);
+    const candidates = basis.keys.filter((candidate) => inspected.kid === undefined || candidate.kid === inspected.kid);
+    const matches = [];
+    let expired;
+    for (const candidate of candidates) {
+        try {
+            matches.push(await jwtVerify(compact, await importJWK(candidate, candidate.alg ?? basis.algorithms[0]), {
+                issuer: basis.issuer,
+                audience,
+                algorithms: [...basis.algorithms],
+            }));
+        }
+        catch (cause) {
+            if (cause instanceof joseErrors.JWTExpired)
+                expired = cause;
+            if (cause instanceof joseErrors.JOSEError)
+                continue;
+            throw cause;
+        }
+    }
+    if (matches.length === 0 && expired !== undefined)
+        throw expired;
+    if (matches.length !== 1)
+        throw new CredentialRejected('Credential is not uniquely verified.');
+    const match = matches[0];
+    let verified;
+    try {
+        verified = credential.acceptVerified({
+            method: 'jwt',
+            iss: match.payload.iss,
+            sub: match.payload.sub,
+            aud: match.payload.aud,
+            kid: match.protectedHeader.kid,
+            iat: match.payload.iat,
+            nbf: match.payload.nbf,
+            exp: match.payload.exp,
+            claims: match.payload,
+        });
+        credential.verifyAudience(verified, audience);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential claims are invalid.', cause);
+    }
+    return Object.freeze({ raw: input, verified });
+}
+async function discover(issuer, fetch, signal, policy) {
+    const configurationUrl = new URL(issuerPaths(issuer).configuration, issuer).href;
+    admitEndpoint(configurationUrl, policy);
+    const configuration = acceptConfiguration(await json(await request(fetch, configurationUrl, signal), signal), issuer);
+    admitEndpoint(configuration.jwks_uri, policy);
+    const keys = acceptKeySet(await json(await request(fetch, configuration.jwks_uri, signal), signal), configuration.id_token_signing_alg_values_supported).keys;
+    return Object.freeze({
+        issuer,
+        algorithms: configuration.id_token_signing_alg_values_supported,
+        keys,
+    });
+}
+async function request(fetch, url, signal) {
+    try {
+        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+        }
+        return response;
+    }
+    catch (cause) {
+        if (signal.aborted)
+            throw signal.reason;
+        if (cause instanceof IssuerUnavailable)
+            throw cause;
+        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+    }
+}
+async function json(response, signal) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (signal.aborted)
+        throw signal.reason;
+    if (bytes.byteLength > MAXIMUM_DISCOVERY_BYTES) {
+        throw new CredentialRejected('Issuer discovery document exceeds its byte limit.');
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch (cause) {
+        throw new CredentialRejected('Issuer discovery document is invalid.', cause);
+    }
+}

package/dist/execution/identity/signing.d.ts

@@ -0,0 +1,9 @@
+import { importJWK } from 'jose';
+import type { JsonWebKey } from '../../platform/auth/index.js';
+export interface SigningMaterial {
+    readonly algorithm: string;
+    readonly keyId?: string;
+    readonly privateKey: ReturnType<typeof importJWK>;
+    readonly publicKey: JsonWebKey;
+}
+export declare function signing(input: JsonWebKey): SigningMaterial;

package/dist/execution/identity/signing.js

@@ -0,0 +1,28 @@
+import { importJWK } from 'jose';
+import { jwk } from '../../platform/auth/index.js';
+export function signing(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const algorithm = input.alg;
+    if (typeof algorithm !== 'string' || algorithm.length === 0)
+        invalid();
+    const keyId = input.kid;
+    if (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0))
+        invalid();
+    const value = input;
+    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, k: _k, key_ops: _keyOperations, ...publicValue } = value;
+    const publicKey = jwk.acceptPublic({
+        ...publicValue,
+        alg: algorithm,
+        ...(keyId === undefined ? {} : { kid: keyId }),
+    });
+    return Object.freeze({
+        algorithm,
+        ...(keyId === undefined ? {} : { keyId }),
+        privateKey: importJWK(input, algorithm),
+        publicKey,
+    });
+}
+function invalid() {
+    throw new TypeError('Execution identity private JWK is invalid.');
+}

package/dist/execution/index.d.ts

@@ -0,0 +1,5 @@
+export { serve } from './serve.js';
+export type { ExecutionContext, ServedApplication, ServeInput } from './serve.js';
+export { createIdentity, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
+export { InvocationError } from './invocation/index.js';
+export type { InvocationErrorCode } from './invocation/index.js';

package/dist/execution/index.js

@@ -0,0 +1,3 @@
+export { serve } from './serve.js';
+export { createIdentity, } from './identity/index.js';
+export { InvocationError } from './invocation/index.js';

package/dist/execution/invocation/admission/authentication.d.ts

@@ -0,0 +1,17 @@
+import type { HandlerRequest } from '@astrale-os/kernel-server';
+import type { AnonymousCaller, AuthenticatedCaller, ResolvedCallable } from '../../../application/action/index.js';
+import type { Release } from '../../../deployment/release/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
+export interface AnonymousInvocation {
+    readonly caller: AnonymousCaller;
+    readonly kernel: null;
+    readonly graph: null;
+    close(): void;
+}
+interface AdmittedAuthenticatedInvocation extends Omit<AuthenticatedInvocation, 'caller'> {
+    readonly caller: AuthenticatedCaller;
+}
+export type InvocationAuthentication = AnonymousInvocation | AdmittedAuthenticatedInvocation;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+export {};