@astrale-os/sdk 0.5.0-beta.13 → 0.5.0-beta.131

package/dist/deployment/verify/readiness/identity.js

@@ -0,0 +1,29 @@
+import { issuer } from '@astrale-os/kernel-protocol';
+const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
+/** Verify issuer discovery and at least one admitted signing key at the serving identity. */
+export async function verifyIdentity(addressing, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
+    if (keys.keys.length === 0)
+        throw new Error('Serving issuer publishes no signing keys.');
+}
+async function json(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > MAXIMUM_IDENTITY_BYTES) {
+        throw new Error(`GET ${url} exceeded ${MAXIMUM_IDENTITY_BYTES} bytes.`);
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid JSON.`, { cause });
+    }
+}

package/dist/deployment/verify/readiness/index.d.ts

@@ -0,0 +1,10 @@
+import type { Release } from '../../release/index.js';
+import type { ReadinessFetch } from './publication.js';
+export { verifyDeployment } from './deployment.js';
+export { verifyIdentity } from './identity.js';
+export { verifyPublication, type ReadinessFetch } from './publication.js';
+/** Read-only verification of one exact live Release and serving identity. */
+export declare function readiness(release: Release, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -0,0 +1,10 @@
+import { verifyIdentity } from './identity.js';
+import { verifyPublication } from './publication.js';
+export { verifyDeployment } from './deployment.js';
+export { verifyIdentity } from './identity.js';
+export { verifyPublication } from './publication.js';
+/** Read-only verification of one exact live Release and serving identity. */
+export async function readiness(release, options = {}) {
+    await verifyPublication(release, options);
+    await verifyIdentity(release.addressing, options);
+}

package/dist/deployment/verify/readiness/publication.d.ts

@@ -0,0 +1,11 @@
+import { publication } from '@astrale-os/kernel-protocol';
+import type { Release } from '../../release/index.js';
+export type ReadinessFetch = (input: string, init: {
+    readonly redirect: 'error';
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+/** Fetch and verify the exact live Publication and Bundle for one Release. */
+export declare function verifyPublication(release: Release, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/publication.js

@@ -0,0 +1,41 @@
+import { publication } from '@astrale-os/kernel-protocol';
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024;
+const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
+/** Fetch and verify the exact live Publication and Bundle for one Release. */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.issuer);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_PUBLICATION_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}
+async function fetchRequired(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    return response;
+}
+async function bounded(response, url, maximum) {
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > maximum)
+        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
+    return bytes;
+}
+async function text(response, url, maximum) {
+    const bytes = await bounded(response, url, maximum);
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
+    }
+}

package/dist/execution/identity/authentication.d.ts

@@ -0,0 +1,21 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
+import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { InvocationAdmissionInput } from '../invocation/index.js';
+import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
+import type { SigningMaterial } from './signing.js';
+export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
+export interface AuthenticationConfiguration {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    readonly signing: SigningMaterial;
+    readonly fetch: Fetch;
+    readonly policy: IdentityNetworkPolicy;
+    readonly verification: VerificationBasisResolver;
+}
+export declare function authenticate(credentialInput: CredentialInput, expectedKernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
+export declare function acceptResolvedDelegation(input: unknown): Grant;
+export type { VerificationBasis };

package/dist/execution/identity/authentication.js

@@ -0,0 +1,161 @@
+import { function as functionSyscalls } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import * as protocolErrors from '@astrale-os/kernel-protocol/errors';
+import { errors as joseErrors } from 'jose';
+import { AuthValueError, credential, delegation, grant } from '../../platform/auth/index.js';
+import { Client, call } from '../../platform/client/index.js';
+import { bindSession, ClientSession } from '../../platform/client/session/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+import { Path } from '../../platform/graph/path/index.js';
+import { projectError, protocolError } from '../invocation/result/index.js';
+import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, signDomainCallback, } from './callback.js';
+import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
+import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
+const DEFAULT_ROUTE_AGE_MS = 60_000;
+export async function admit(request, configuration) {
+    const execution = request.context.execution;
+    requireLive(execution);
+    if (request.via.issuer === configuration.issuer) {
+        throw protocolError('VALIDATION_ERROR', 'Remote invocation Via must identify its source Kernel.');
+    }
+    const url = invocationUrl(request.via.issuer);
+    admitEndpoint(url, configuration.policy);
+    const callback = await signDomainCallback(configuration.signing, configuration.issuer, request.domain.origin, request.via.issuer, execution);
+    const owner = Path.project(functionSyscalls.admit.owner);
+    const client = new Client({
+        url,
+        fetch: boundedFetch(configuration.fetch, execution.signal),
+    });
+    try {
+        const result = await client.as(callback).call(call(Path.staticMethod(owner, functionSyscalls.admit.name), {
+            call: request.call,
+            ...(request.credential === undefined ? {} : { credential: request.credential }),
+        }), {
+            signal: execution.signal,
+            timeoutMs: Math.max(1, execution.deadline - Date.now()),
+            delegate: {
+                ttlSeconds: callbackTtl(execution.deadline),
+                attenuation: { kind: 'identity', self: true },
+            },
+        });
+        return result.value;
+    }
+    catch (cause) {
+        requireLive(execution);
+        throw projectError(cause);
+    }
+    finally {
+        client.close();
+    }
+}
+export async function authenticate(credentialInput, expectedKernel, execution, configuration) {
+    const established = await establishCaller(credentialInput, configuration.issuer, configuration.verification, execution, configuration.policy);
+    if (established.verified.iss !== expectedKernel) {
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    }
+    const expressions = callbackIdentities(established.delegation.credential);
+    const sessions = Object.freeze({
+        caller: callbackSession(expressions.caller),
+        self: callbackSession(expressions.self),
+        union: callbackSession(expressions.union),
+    });
+    const graph = Object.freeze({
+        caller: bindSession(sessions.caller, execution),
+        self: bindSession(sessions.self, execution),
+        union: bindSession(sessions.union, execution),
+    });
+    let closed = false;
+    return Object.freeze({
+        caller: established.caller,
+        graph,
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            sessions.caller.close();
+            sessions.self.close();
+            sessions.union.close();
+        },
+    });
+    function callbackSession(expression) {
+        const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, expression, established.verified, execution);
+        return new ClientSession({
+            kernel: expectedKernel,
+            fetch: boundedFetch(configuration.fetch, execution.signal),
+            auth: {
+                ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
+                async resolve(_call, signal) {
+                    const callback = await resolveCallback(signal);
+                    signal.throwIfAborted();
+                    return {
+                        credential: callback.credential,
+                        delegate: { ttlSeconds: callback.delegateTtlSeconds },
+                    };
+                },
+            },
+            policy: {
+                maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
+                ...(configuration.policy.allowEndpoint === undefined
+                    ? {}
+                    : { allowEndpoint: configuration.policy.allowEndpoint }),
+                ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+            },
+            timeoutMs: Math.max(1, execution.deadline - Date.now()),
+        });
+    }
+}
+async function establishCaller(input, audience, verification, execution, policy) {
+    requireLive(execution);
+    try {
+        const context = await verifyCredential(input, audience, verification, execution.signal, policy);
+        const carried = delegation.accept(context.verified.claims.delegation);
+        if (typeof carried.credential !== 'string') {
+            throw new CredentialRejected('Destination carrier has no Kernel authority proof.');
+        }
+        const proof = await verifyCredentialAgainst(carried.credential, context.verified.iss, context.basis);
+        if (proof.verified.sub !== context.verified.sub) {
+            throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
+        }
+        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
+        let principal;
+        try {
+            principal = NodeId(context.verified.sub);
+        }
+        catch {
+            throw new CredentialRejected('Credential subject is not a Kernel IdentityId.');
+        }
+        return Object.freeze({
+            verified: context.verified,
+            delegation: carried,
+            caller: Object.freeze({
+                kind: 'authenticated',
+                principal,
+                authority,
+                authentication: credential.evidence(context),
+            }),
+        });
+    }
+    catch (cause) {
+        requireLive(execution);
+        if (cause instanceof IssuerUnavailable) {
+            throw protocolError('BACKEND_UNAVAILABLE', 'Credential issuer is unavailable.');
+        }
+        if (cause instanceof CredentialRejected ||
+            cause instanceof joseErrors.JOSEError ||
+            cause instanceof protocolErrors.ProtocolError) {
+            throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+        }
+        throw cause;
+    }
+}
+export function acceptResolvedDelegation(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== 2 ||
+        !Object.hasOwn(input, 'v') ||
+        !Object.hasOwn(input, 'expr') ||
+        Reflect.get(input, 'v') !== 1) {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected resolved delegation.');
+    }
+    return grant.accept({ expr: Reflect.get(input, 'expr') });
+}

package/dist/execution/identity/callback.d.ts

@@ -0,0 +1,44 @@
+import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { SigningMaterial } from './signing.js';
+export declare const maximumCallbackTtlSeconds = 120;
+export declare const maximumCallbackDelegationTtlSeconds = 60;
+export interface SignedCallback {
+    readonly credential: string;
+    readonly expiresAt: number;
+    readonly delegateTtlSeconds: number;
+}
+export type CallbackGrantMode = 'caller' | 'self' | 'union';
+/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+export declare function callbackIdentities(nested: string | Uint8Array): Readonly<{
+    caller: Readonly<{
+        kind: 'identity';
+        credential: string | Uint8Array<ArrayBufferLike>;
+    }>;
+    self: Readonly<{
+        kind: 'identity';
+        self: true;
+    }>;
+    union: Readonly<{
+        kind: 'union';
+        operands: readonly (Readonly<{
+            kind: 'identity';
+            credential: string | Uint8Array<ArrayBufferLike>;
+        }> | Readonly<{
+            kind: 'identity';
+            self: true;
+        }>)[];
+    }>;
+}>;
+export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): Promise<string>;
+export declare function signCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): Promise<string>;
+/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -0,0 +1,105 @@
+import { SignJWT } from 'jose';
+import { protocolError } from '../invocation/result/index.js';
+import { requireLive } from './errors.js';
+export const maximumCallbackTtlSeconds = 120;
+export const maximumCallbackDelegationTtlSeconds = 60;
+const CALLBACK_DELEGATION_SKEW_SECONDS = 5;
+/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+export function callbackIdentities(nested) {
+    const caller = Object.freeze({ kind: 'identity', credential: nested });
+    const self = Object.freeze({ kind: 'identity', self: true });
+    return Object.freeze({
+        caller,
+        self,
+        union: Object.freeze({
+            kind: 'union',
+            operands: Object.freeze([self, caller]),
+        }),
+    });
+}
+export async function signDomainCallback(signing, issuer, subject, audience, execution) {
+    return (await sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution)).credential;
+}
+export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
+    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+    return (await sign(signing, issuer, subject, audience, expression, execution, maximum)).credential;
+}
+/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution) {
+    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+    let cached;
+    let pending;
+    return async (signal) => {
+        signal.throwIfAborted();
+        requireLive(execution);
+        const now = Math.floor(Date.now() / 1_000);
+        if (cached !== undefined &&
+            now <= cached.expiresAt - CALLBACK_DELEGATION_SKEW_SECONDS - cached.delegateTtlSeconds) {
+            return cached;
+        }
+        if (pending === undefined) {
+            const current = sign(signing, issuer, subject, audience, expression, execution, maximum).then((signed) => {
+                const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
+                if (delegateTtlSeconds < 1) {
+                    throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+                }
+                return (cached = Object.freeze({
+                    credential: signed.credential,
+                    expiresAt: signed.expiresAt,
+                    delegateTtlSeconds,
+                }));
+            });
+            pending = current;
+            void current.then(() => {
+                if (pending === current)
+                    pending = undefined;
+            }, () => {
+                if (pending === current)
+                    pending = undefined;
+            });
+        }
+        return withSignal(pending, signal);
+    };
+}
+async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+    requireLive(execution);
+    const privateKey = await withSignal(signing.privateKey, execution.signal);
+    requireLive(execution);
+    const now = Math.floor(Date.now() / 1_000);
+    const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + maximumCallbackTtlSeconds);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    }
+    const credential = await withSignal(new SignJWT({ grant: { v: 1, expr: expression } })
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(audience)
+        .setIssuedAt(now)
+        .setExpirationTime(expiresAt)
+        .sign(privateKey), execution.signal);
+    requireLive(execution);
+    return Object.freeze({ credential, issuedAt: now, expiresAt });
+}
+function withSignal(operation, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal.removeEventListener('abort', abort);
+        const abort = () => {
+            cleanup();
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        operation.then((value) => {
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            cleanup();
+            reject(error);
+        });
+    });
+}

package/dist/execution/identity/delivery.d.ts

@@ -0,0 +1,6 @@
+import type { publication as serverPublication } from '@astrale-os/kernel-server';
+import * as publication from '@astrale-os/kernel-protocol/publication';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { SigningMaterial } from './signing.js';
+/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
+export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;

package/dist/execution/identity/delivery.js

@@ -0,0 +1,34 @@
+import * as publication from '@astrale-os/kernel-protocol/publication';
+import { SignJWT } from 'jose';
+const ATTESTATION_TTL_SECONDS = 60;
+/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
+export function publicationDelivery(signing, issuer, subject, deployed) {
+    return Object.freeze({
+        async create(request, context) {
+            context.signal.throwIfAborted();
+            const now = Math.floor(Date.now() / 1_000);
+            const attestation = await new SignJWT({
+                purpose: publication.delivery.PURPOSE,
+                nonce: request.nonce,
+                etag: deployed.etag,
+                schemaRevision: deployed.schema.revision,
+            })
+                .setProtectedHeader({
+                alg: signing.algorithm,
+                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+            })
+                .setIssuer(issuer)
+                .setSubject(subject)
+                .setAudience(request.kernel)
+                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+                .sign(await signing.privateKey);
+            context.signal.throwIfAborted();
+            return publication.delivery.accept({
+                format: 'astrale.domain.delivery',
+                version: 1,
+                publication: deployed,
+                attestation,
+            });
+        },
+    });
+}

package/dist/execution/identity/errors.d.ts

@@ -0,0 +1,22 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { IssuerId } from '../../platform/auth/index.js';
+export declare class CredentialRejected extends Error {
+    readonly name = "CredentialRejected";
+    constructor(message: string, cause?: unknown);
+}
+export declare class IssuerUnavailable extends Error {
+    readonly name = "IssuerUnavailable";
+    constructor(message: string, cause?: unknown);
+}
+export declare function requireLive(execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): void;
+export declare function httpIssuer(input: string, allowInsecureHttp: boolean): IssuerId;
+export declare function admitEndpoint(input: string, policy: {
+    readonly allowEndpoint?: (url: string) => boolean;
+    readonly allowInsecureHttp?: boolean;
+}): void;
+export declare function invocationUrl(input: IssuerId): string;
+export declare function boundedFetch(fetch: Fetch, lifecycle: AbortSignal): Fetch;
+export declare function callbackTtl(deadline: number): number;

package/dist/execution/identity/errors.js

@@ -0,0 +1,61 @@
+import { issuer } from '../../platform/auth/index.js';
+import { protocolError } from '../invocation/result/index.js';
+export class CredentialRejected extends Error {
+    name = 'CredentialRejected';
+    constructor(message, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+    }
+}
+export class IssuerUnavailable extends Error {
+    name = 'IssuerUnavailable';
+    constructor(message, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+    }
+}
+export function requireLive(execution) {
+    if (execution.signal.aborted)
+        throw protocolError('CANCELLED', 'Invocation was cancelled.');
+    if (Date.now() >= execution.deadline) {
+        throw protocolError('DEADLINE_EXCEEDED', 'Invocation deadline was exceeded.');
+    }
+}
+export function httpIssuer(input, allowInsecureHttp) {
+    const admitted = issuer.accept(input);
+    let url;
+    try {
+        url = new URL(admitted);
+    }
+    catch (cause) {
+        throw new TypeError('Execution issuer must be an absolute HTTP(S) URL.', { cause });
+    }
+    if (url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        (url.protocol !== 'https:' && !(allowInsecureHttp && url.protocol === 'http:'))) {
+        throw new TypeError('Execution issuer must be an admitted HTTP(S) URL.');
+    }
+    return admitted;
+}
+export function admitEndpoint(input, policy) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:' &&
+        !(policy.allowInsecureHttp === true && url.protocol === 'http:')) {
+        throw new CredentialRejected('Endpoint transport is not allowed.');
+    }
+    if (policy.allowEndpoint !== undefined && !policy.allowEndpoint(url.href)) {
+        throw new CredentialRejected('Endpoint is not allowed.');
+    }
+}
+export function invocationUrl(input) {
+    return `${input.replace(/\/+$/u, '')}/invoke`;
+}
+export function boundedFetch(fetch, lifecycle) {
+    return (input, init = {}) => {
+        lifecycle.throwIfAborted();
+        return fetch(input, init.signal === undefined ? { ...init, signal: lifecycle } : init);
+    };
+}
+export function callbackTtl(deadline) {
+    return Math.max(1, Math.ceil((deadline - Date.now()) / 1_000));
+}

package/dist/execution/identity/exchange.d.ts

@@ -0,0 +1,10 @@
+import type { exchange } from '@astrale-os/kernel-server';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { IdentityNetworkPolicy, VerificationBasisResolver } from './jwks.js';
+import type { SigningMaterial } from './signing.js';
+export interface ExchangeOptions {
+    /** Caller-only exchange ceiling in seconds. Defaults to 30 minutes. */
+    readonly maximumTtlSeconds?: number;
+}
+export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;
+export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, policy: IdentityNetworkPolicy, verification: VerificationBasisResolver, maximumTtlSeconds: number): exchange.Provider;