@astrale-os/sdk 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/execution/identity/exchange.js

@@ -0,0 +1,111 @@
+import * as protocolErrors from '@astrale-os/kernel-protocol/errors';
+import * as issuerExchange from '@astrale-os/kernel-protocol/issuer/exchange';
+import { errors as joseErrors, SignJWT } from 'jose';
+import { AuthValueError, delegation } from '../../platform/auth/index.js';
+import { protocolError } from '../invocation/result/index.js';
+import { acceptResolvedDelegation } from './authentication.js';
+import { CredentialRejected, IssuerUnavailable } from './errors.js';
+import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
+const DEFAULT_MAXIMUM_TTL_SECONDS = 300;
+export function maximumExchangeTtl(input) {
+    if (input === undefined)
+        return DEFAULT_MAXIMUM_TTL_SECONDS;
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).some((key) => key !== 'maximumTtlSeconds')) {
+        throw new TypeError('Execution identity tokenExchange options are invalid.');
+    }
+    const value = input.maximumTtlSeconds ?? DEFAULT_MAXIMUM_TTL_SECONDS;
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new TypeError('tokenExchange.maximumTtlSeconds must be a positive safe integer.');
+    }
+    return value;
+}
+export function tokenExchange(issuer, subject, signing, fetch, policy, maximumTtlSeconds) {
+    return Object.freeze({
+        async exchange(request, context) {
+            try {
+                const outer = await verifyCredential(request.token, issuer, fetch, context.signal, policy);
+                requireProfile(outer.verified, 'outer');
+                const carried = delegation.accept(outer.verified.claims.delegation);
+                if (typeof carried.credential !== 'string')
+                    invalid();
+                const inner = await verifyCredentialAgainst(carried.credential, outer.verified.iss, outer.basis);
+                requireProfile(inner.verified, 'inner');
+                requireCoherence(outer.verified, inner.verified);
+                acceptResolvedDelegation(inner.verified.claims.delegation);
+                const now = Math.floor(Date.now() / 1_000);
+                const expiresAt = Math.min(outer.verified.exp, inner.verified.exp, now + maximumTtlSeconds);
+                if (expiresAt <= now)
+                    expired();
+                const token = await new SignJWT({
+                    grant: {
+                        v: 1,
+                        expr: { kind: 'identity', credential: carried.credential },
+                    },
+                })
+                    .setProtectedHeader({
+                    alg: signing.algorithm,
+                    ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+                })
+                    .setIssuer(issuer)
+                    .setSubject(subject)
+                    .setAudience(outer.verified.iss)
+                    .setIssuedAt(now)
+                    .setExpirationTime(expiresAt)
+                    .sign(await signing.privateKey);
+                return issuerExchange.response(token, expiresAt);
+            }
+            catch (cause) {
+                if (cause instanceof protocolErrors.ProtocolError)
+                    throw cause;
+                if (context.signal.aborted) {
+                    throw protocolError('CANCELLED', 'Token exchange was cancelled.');
+                }
+                if (cause instanceof joseErrors.JWTExpired)
+                    expired();
+                if (cause instanceof IssuerUnavailable)
+                    unavailable();
+                if (cause instanceof CredentialRejected ||
+                    cause instanceof joseErrors.JOSEError ||
+                    cause instanceof AuthValueError) {
+                    invalid();
+                }
+                throw cause;
+            }
+        },
+    });
+}
+function requireProfile(input, profile) {
+    const expected = ['aud', 'delegation', 'exp', 'iat', 'iss', 'sub'];
+    const actual = Object.keys(input.claims).sort();
+    if (actual.length !== expected.length ||
+        actual.some((field, index) => field !== expected[index]) ||
+        typeof input.iat !== 'number' ||
+        !Number.isSafeInteger(input.iat) ||
+        input.iat < 1 ||
+        typeof input.exp !== 'number' ||
+        !Number.isSafeInteger(input.exp) ||
+        input.exp < 1 ||
+        typeof input.aud !== 'string') {
+        invalid();
+    }
+    if (profile === 'outer')
+        delegation.accept(input.claims.delegation);
+    else
+        acceptResolvedDelegation(input.claims.delegation);
+}
+function requireCoherence(outer, inner) {
+    if (inner.iss !== outer.iss || inner.sub !== outer.sub || inner.aud !== outer.iss)
+        invalid();
+}
+function invalid() {
+    throw protocolError('AUTH_INVALID', 'Token is invalid.');
+}
+function expired() {
+    throw protocolError('AUTH_EXPIRED', 'Token is expired.');
+}
+function unavailable() {
+    throw protocolError('BACKEND_UNAVAILABLE', 'Token exchange is unavailable.');
+}

package/dist/execution/identity/identity.d.ts

@@ -0,0 +1,24 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type * as publicationProtocol from '@astrale-os/kernel-protocol/publication';
+import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
+import type { InvocationAuthority } from '../invocation/index.js';
+import type { ExchangeOptions } from './exchange.js';
+import type { IdentityNetworkPolicy } from './jwks.js';
+/** One execution identity owns issuer discovery, admission, authentication, and optional exchange. */
+export interface Identity extends Issuer, InvocationAuthority {
+    readonly subject: string;
+    readonly tokenExchange?: exchange.Provider;
+    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+}
+export interface IdentityInput extends IdentityNetworkPolicy {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    readonly privateKey: JsonWebKey;
+    readonly fetch?: Fetch;
+    readonly tokenExchange?: ExchangeOptions | false;
+    readonly loadIssuerPublicKeys?: Issuer['loadIssuerPublicKeys'];
+}
+/** Create one stateless execution identity backed by an asymmetric private JWK. */
+export declare function createIdentity(input: IdentityInput): Identity;
+export declare function identity(input: Identity): Identity;

package/dist/execution/identity/identity.js

@@ -0,0 +1,96 @@
+import { admit, authenticate } from './authentication.js';
+import { publicationDelivery } from './delivery.js';
+import { httpIssuer } from './errors.js';
+import { maximumExchangeTtl, tokenExchange } from './exchange.js';
+import { signing } from './signing.js';
+/** Create one stateless execution identity backed by an asymmetric private JWK. */
+export function createIdentity(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const issuer = httpIssuer(input.issuer, input.allowInsecureHttp === true);
+    if (typeof input.subject !== 'string' || input.subject.length === 0) {
+        throw new TypeError('Execution identity subject must not be empty.');
+    }
+    if (input.allowEndpoint !== undefined && typeof input.allowEndpoint !== 'function')
+        invalid();
+    if (input.loadIssuerPublicKeys !== undefined &&
+        typeof input.loadIssuerPublicKeys !== 'function') {
+        invalid();
+    }
+    const fetch = input.fetch ?? globalThis.fetch.bind(globalThis);
+    if (typeof fetch !== 'function')
+        throw new TypeError('Execution identity requires Fetch.');
+    const material = signing(input.privateKey);
+    const policy = Object.freeze({
+        ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
+        ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+    });
+    const configuration = Object.freeze({
+        issuer,
+        subject: input.subject,
+        signing: material,
+        fetch,
+        policy,
+    });
+    const exchangeProvider = input.tokenExchange === false
+        ? undefined
+        : tokenExchange(issuer, input.subject, material, fetch, policy, maximumExchangeTtl(input.tokenExchange));
+    return identity({
+        issuer,
+        subject: input.subject,
+        signingAlgorithm: material.algorithm,
+        async loadPublicKeys() {
+            return [material.publicKey];
+        },
+        ...(input.loadIssuerPublicKeys === undefined
+            ? {}
+            : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
+        ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
+        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        admit: (request) => admit(request, configuration),
+        authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),
+    });
+}
+export function identity(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const allowed = new Set([
+        'issuer',
+        'subject',
+        'signingAlgorithm',
+        'loadPublicKeys',
+        'loadIssuerPublicKeys',
+        'tokenExchange',
+        'delivery',
+        'admit',
+        'authenticate',
+    ]);
+    if (Reflect.ownKeys(input).some((key) => !allowed.has(key)) ||
+        typeof input.subject !== 'string' ||
+        input.subject.length === 0 ||
+        typeof input.loadPublicKeys !== 'function' ||
+        typeof input.delivery !== 'function' ||
+        typeof input.admit !== 'function' ||
+        typeof input.authenticate !== 'function') {
+        invalid();
+    }
+    const receiver = Object.freeze({ ...input });
+    return Object.freeze({
+        issuer: receiver.issuer,
+        subject: receiver.subject,
+        ...(receiver.signingAlgorithm === undefined
+            ? {}
+            : { signingAlgorithm: receiver.signingAlgorithm }),
+        loadPublicKeys: receiver.loadPublicKeys.bind(receiver),
+        ...(receiver.loadIssuerPublicKeys === undefined
+            ? {}
+            : { loadIssuerPublicKeys: receiver.loadIssuerPublicKeys.bind(receiver) }),
+        ...(receiver.tokenExchange === undefined ? {} : { tokenExchange: receiver.tokenExchange }),
+        delivery: receiver.delivery.bind(receiver),
+        admit: receiver.admit.bind(receiver),
+        authenticate: receiver.authenticate.bind(receiver),
+    });
+}
+function invalid() {
+    throw new TypeError('Execution Identity is invalid.');
+}

package/dist/execution/identity/index.d.ts

@@ -0,0 +1,2 @@
+export { createIdentity, identity, type Identity, type IdentityInput } from './identity.js';
+export { maximumExchangeTtl, tokenExchange, type ExchangeOptions } from './exchange.js';

package/dist/execution/identity/index.js

@@ -0,0 +1,2 @@
+export { createIdentity, identity } from './identity.js';
+export { maximumExchangeTtl, tokenExchange } from './exchange.js';

package/dist/execution/identity/jwks.d.ts

@@ -0,0 +1,21 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { CredentialInput, IssuerId, JsonWebKey, VerifiedCredential } from '../../platform/auth/index.js';
+import { credential } from '../../platform/auth/index.js';
+export interface IdentityNetworkPolicy {
+    readonly allowEndpoint?: (url: string) => boolean;
+    readonly allowInsecureHttp?: boolean;
+}
+export interface VerificationBasis {
+    readonly issuer: IssuerId;
+    readonly algorithms: readonly [string, ...string[]];
+    readonly keys: readonly JsonWebKey[];
+}
+export declare function verifyCredential(input: CredentialInput, audience: IssuerId, fetch: Fetch, signal: AbortSignal, policy: IdentityNetworkPolicy): Promise<{
+    readonly raw: CredentialInput;
+    readonly verified: VerifiedCredential;
+    readonly basis: VerificationBasis;
+}>;
+export declare function verifyCredentialAgainst(input: CredentialInput, audience: IssuerId, basis: VerificationBasis, preinspected?: ReturnType<typeof credential.inspect>): Promise<{
+    readonly raw: CredentialInput;
+    readonly verified: VerifiedCredential;
+}>;

package/dist/execution/identity/jwks.js

@@ -0,0 +1,128 @@
+import { acceptConfiguration } from '@astrale-os/kernel-protocol/issuer/configuration';
+import { acceptKeySet } from '@astrale-os/kernel-protocol/issuer/key-set';
+import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { errors as joseErrors, importJWK, jwtVerify } from 'jose';
+import { credential } from '../../platform/auth/index.js';
+import { CredentialRejected, IssuerUnavailable, admitEndpoint, httpIssuer } from './errors.js';
+const MAXIMUM_DISCOVERY_BYTES = 256 * 1024;
+export async function verifyCredential(input, audience, fetch, signal, policy) {
+    let inspected;
+    try {
+        inspected = credential.inspect(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential is malformed.', cause);
+    }
+    if (inspected.iss === undefined)
+        throw new CredentialRejected('Credential issuer is missing.');
+    let admittedIssuer;
+    try {
+        admittedIssuer = httpIssuer(inspected.iss, policy.allowInsecureHttp === true);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential issuer is invalid.', cause);
+    }
+    const basis = await discover(admittedIssuer, fetch, signal, policy);
+    const verified = await verifyCredentialAgainst(input, audience, basis, inspected);
+    admitEndpoint(`${admittedIssuer.replace(/\/+$/u, '')}/invoke`, policy);
+    return Object.freeze({ raw: input, verified: verified.verified, basis });
+}
+export async function verifyCredentialAgainst(input, audience, basis, preinspected) {
+    let inspected;
+    try {
+        inspected = preinspected ?? credential.inspect(input);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential is malformed.', cause);
+    }
+    if (inspected.iss !== basis.issuer) {
+        throw new CredentialRejected('Credential issuer differs from its verification basis.');
+    }
+    const compact = typeof input === 'string' ? input : new TextDecoder().decode(input);
+    const candidates = basis.keys.filter((candidate) => inspected.kid === undefined || candidate.kid === inspected.kid);
+    const matches = [];
+    let expired;
+    for (const candidate of candidates) {
+        try {
+            matches.push(await jwtVerify(compact, await importJWK(candidate, candidate.alg ?? basis.algorithms[0]), {
+                issuer: basis.issuer,
+                audience,
+                algorithms: [...basis.algorithms],
+            }));
+        }
+        catch (cause) {
+            if (cause instanceof joseErrors.JWTExpired)
+                expired = cause;
+            if (cause instanceof joseErrors.JOSEError)
+                continue;
+            throw cause;
+        }
+    }
+    if (matches.length === 0 && expired !== undefined)
+        throw expired;
+    if (matches.length !== 1)
+        throw new CredentialRejected('Credential is not uniquely verified.');
+    const match = matches[0];
+    let verified;
+    try {
+        verified = credential.acceptVerified({
+            method: 'jwt',
+            iss: match.payload.iss,
+            sub: match.payload.sub,
+            aud: match.payload.aud,
+            kid: match.protectedHeader.kid,
+            iat: match.payload.iat,
+            nbf: match.payload.nbf,
+            exp: match.payload.exp,
+            claims: match.payload,
+        });
+        credential.verifyAudience(verified, audience);
+    }
+    catch (cause) {
+        throw new CredentialRejected('Credential claims are invalid.', cause);
+    }
+    return Object.freeze({ raw: input, verified });
+}
+async function discover(issuer, fetch, signal, policy) {
+    const configurationUrl = new URL(issuerPaths(issuer).configuration, issuer).href;
+    admitEndpoint(configurationUrl, policy);
+    const configuration = acceptConfiguration(await json(await request(fetch, configurationUrl, signal), signal), issuer);
+    admitEndpoint(configuration.jwks_uri, policy);
+    const keys = acceptKeySet(await json(await request(fetch, configuration.jwks_uri, signal), signal), configuration.id_token_signing_alg_values_supported).keys;
+    return Object.freeze({
+        issuer,
+        algorithms: configuration.id_token_signing_alg_values_supported,
+        keys,
+    });
+}
+async function request(fetch, url, signal) {
+    try {
+        const response = await fetch(url, { method: 'GET', redirect: 'error', signal });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
+        }
+        return response;
+    }
+    catch (cause) {
+        if (signal.aborted)
+            throw signal.reason;
+        if (cause instanceof IssuerUnavailable)
+            throw cause;
+        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
+    }
+}
+async function json(response, signal) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (signal.aborted)
+        throw signal.reason;
+    if (bytes.byteLength > MAXIMUM_DISCOVERY_BYTES) {
+        throw new CredentialRejected('Issuer discovery document exceeds its byte limit.');
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch (cause) {
+        throw new CredentialRejected('Issuer discovery document is invalid.', cause);
+    }
+}

package/dist/execution/identity/signing.d.ts

@@ -0,0 +1,9 @@
+import { importJWK } from 'jose';
+import type { JsonWebKey } from '../../platform/auth/index.js';
+export interface SigningMaterial {
+    readonly algorithm: string;
+    readonly keyId?: string;
+    readonly privateKey: ReturnType<typeof importJWK>;
+    readonly publicKey: JsonWebKey;
+}
+export declare function signing(input: JsonWebKey): SigningMaterial;

package/dist/execution/identity/signing.js

@@ -0,0 +1,28 @@
+import { importJWK } from 'jose';
+import { jwk } from '../../platform/auth/index.js';
+export function signing(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const algorithm = input.alg;
+    if (typeof algorithm !== 'string' || algorithm.length === 0)
+        invalid();
+    const keyId = input.kid;
+    if (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0))
+        invalid();
+    const value = input;
+    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, k: _k, key_ops: _keyOperations, ...publicValue } = value;
+    const publicKey = jwk.acceptPublic({
+        ...publicValue,
+        alg: algorithm,
+        ...(keyId === undefined ? {} : { kid: keyId }),
+    });
+    return Object.freeze({
+        algorithm,
+        ...(keyId === undefined ? {} : { keyId }),
+        privateKey: importJWK(input, algorithm),
+        publicKey,
+    });
+}
+function invalid() {
+    throw new TypeError('Execution identity private JWK is invalid.');
+}

package/dist/execution/index.d.ts

@@ -0,0 +1,5 @@
+export { serve } from './serve.js';
+export type { ExecutionContext, ServedApplication, ServeInput } from './serve.js';
+export { createIdentity, type Identity, type IdentityInput } from './identity/index.js';
+export { InvocationError } from './invocation/index.js';
+export type { InvocationErrorCode } from './invocation/index.js';

package/dist/execution/index.js

@@ -0,0 +1,3 @@
+export { serve } from './serve.js';
+export { createIdentity } from './identity/index.js';
+export { InvocationError } from './invocation/index.js';

package/dist/execution/invocation/admission/authentication.d.ts

@@ -0,0 +1,12 @@
+import type { HandlerRequest } from '@astrale-os/kernel-server';
+import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
+import type { Release } from '../../../deployment/release/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
+export interface AnonymousInvocation {
+    readonly caller: AnonymousCaller;
+    readonly client: null;
+    close(): void;
+}
+export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -0,0 +1,122 @@
+import { grant, issuer } from '../../../platform/auth/index.js';
+import { bindSession } from '../../../platform/client/session/index.js';
+import { NodeId } from '../../../platform/graph/node/index.js';
+import { protocolError } from '../result/index.js';
+import { requireVia } from './authority.js';
+const ANONYMOUS = Object.freeze({
+    caller: Object.freeze({ kind: 'anonymous' }),
+    client: null,
+    close() { },
+});
+export async function authentication(callable, request, release, domain, authority) {
+    const credential = request.credential;
+    if (callable.auth === 'anonymous' && credential === undefined)
+        return ANONYMOUS;
+    if (credential === undefined) {
+        throw protocolError('AUTH_MISSING', 'Authentication is required.');
+    }
+    if (typeof credential !== 'string')
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    const authenticated = await authority.authenticate({
+        credential,
+        via: requireVia(request),
+        publication: release.publication,
+        domain,
+        context: request.context,
+    });
+    let close;
+    try {
+        close = captureClose(authenticated);
+        if (authenticated === null ||
+            typeof authenticated !== 'object' ||
+            Array.isArray(authenticated) ||
+            Reflect.ownKeys(authenticated).some((key) => key !== 'caller' && key !== 'client' && key !== 'close') ||
+            close === undefined) {
+            invalid();
+        }
+        const caller = admitCaller(authenticated.caller);
+        const client = bindSession(authenticated.client);
+        return Object.freeze({ caller, client, close });
+    }
+    catch (cause) {
+        if (close === undefined)
+            invalid(cause);
+        try {
+            close();
+        }
+        catch (cleanup) {
+            throw new AggregateError([cause, cleanup], 'Invocation authority returned invalid authenticated capabilities and cleanup failed.');
+        }
+        invalid(cause);
+    }
+}
+function captureClose(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    const operation = Reflect.get(input, 'close');
+    return typeof operation === 'function' ? operation.bind(input) : undefined;
+}
+function admitCaller(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (!Object.hasOwn(input, 'kind') ||
+        !Object.hasOwn(input, 'principal') ||
+        !Object.hasOwn(input, 'authority') ||
+        !Object.hasOwn(input, 'authentication') ||
+        Reflect.ownKeys(input).some((key) => key !== 'kind' && key !== 'principal' && key !== 'authority' && key !== 'authentication') ||
+        Reflect.get(input, 'kind') !== 'authenticated') {
+        invalid();
+    }
+    const principal = NodeId(Reflect.get(input, 'principal'));
+    const authority = grant.accept(Reflect.get(input, 'authority'));
+    const authentication = admitEvidence(Reflect.get(input, 'authentication'));
+    return Object.freeze({ kind: 'authenticated', principal, authority, authentication });
+}
+function admitEvidence(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const required = ['method', 'issuer', 'subject'];
+    const optional = ['audience', 'keyId', 'issuedAt', 'notBefore', 'expiresAt'];
+    const allowed = new Set([...required, ...optional]);
+    if (required.some((key) => !Object.hasOwn(input, key)) ||
+        Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !allowed.has(key))) {
+        invalid();
+    }
+    const method = Reflect.get(input, 'method');
+    const evidenceIssuer = Reflect.get(input, 'issuer');
+    const subject = Reflect.get(input, 'subject');
+    const audience = Reflect.get(input, 'audience');
+    const keyId = Reflect.get(input, 'keyId');
+    const issuedAt = Reflect.get(input, 'issuedAt');
+    const notBefore = Reflect.get(input, 'notBefore');
+    const expiresAt = Reflect.get(input, 'expiresAt');
+    if (method !== 'jwt' ||
+        !issuer.is(evidenceIssuer) ||
+        typeof subject !== 'string' ||
+        subject.length === 0 ||
+        (audience !== undefined &&
+            (!Array.isArray(audience) || audience.some((value) => typeof value !== 'string'))) ||
+        (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0)) ||
+        !optionalTime(issuedAt) ||
+        !optionalTime(notBefore) ||
+        !optionalTime(expiresAt)) {
+        invalid();
+    }
+    return Object.freeze({
+        method,
+        issuer: evidenceIssuer,
+        subject,
+        ...(audience === undefined ? {} : { audience: Object.freeze([...audience]) }),
+        ...(keyId === undefined ? {} : { keyId }),
+        ...(issuedAt === undefined ? {} : { issuedAt }),
+        ...(notBefore === undefined ? {} : { notBefore }),
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+    });
+}
+function optionalTime(input) {
+    return input === undefined || (typeof input === 'number' && Number.isFinite(input));
+}
+function invalid(cause) {
+    const message = 'Invocation authority returned invalid authenticated capabilities.';
+    throw cause === undefined ? new TypeError(message) : new TypeError(message, { cause });
+}

package/dist/execution/invocation/admission/authority.d.ts

@@ -0,0 +1,33 @@
+import type * as invocation from '@astrale-os/kernel-protocol/invocation';
+import type * as publication from '@astrale-os/kernel-protocol/publication';
+import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
+import type { AuthenticatedCaller } from '../../../application/action/index.js';
+import type { BoundClientSession } from '../../../platform/client/session/index.js';
+import type { Domain } from '../../../platform/schema/index.js';
+export interface InvocationAdmissionInput {
+    readonly call: invocation.Call;
+    readonly credential?: string;
+    readonly via: invocation.Via;
+    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface InvocationAuthenticationInput {
+    readonly credential: string;
+    readonly via: invocation.Via;
+    readonly publication: publication.Publication;
+    readonly domain: Domain;
+    readonly context: InvocationContext;
+}
+export interface AuthenticatedInvocation {
+    readonly caller: AuthenticatedCaller;
+    readonly client: BoundClientSession;
+    close(): void;
+}
+export interface InvocationAuthority {
+    admit(input: InvocationAdmissionInput): Promise<unknown>;
+    authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
+}
+/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+export declare function authority(input: InvocationAuthority): InvocationAuthority;
+export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -0,0 +1,23 @@
+import { protocolError } from '../result/index.js';
+/** Capture the execution Identity capability and receiver-bind both privileged operations. */
+export function authority(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (typeof input.admit !== 'function' || typeof input.authenticate !== 'function') {
+        invalid();
+    }
+    const receiver = Object.freeze({ ...input });
+    return Object.freeze({
+        admit: receiver.admit.bind(receiver),
+        authenticate: receiver.authenticate.bind(receiver),
+    });
+}
+export function requireVia(request) {
+    if (request.via === undefined) {
+        throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');
+    }
+    return request.via;
+}
+function invalid() {
+    throw new TypeError('Invocation authority is invalid.');
+}

package/dist/execution/invocation/admission/index.d.ts

@@ -0,0 +1,5 @@
+export { authority, requireVia } from './authority.js';
+export type { AuthenticatedInvocation, InvocationAdmissionInput, InvocationAuthenticationInput, InvocationAuthority, } from './authority.js';
+export { authentication, type InvocationAuthentication } from './authentication.js';
+export { input } from './input.js';
+export { target, type InvocationTarget } from './target.js';

package/dist/execution/invocation/admission/index.js

@@ -0,0 +1,4 @@
+export { authority, requireVia } from './authority.js';
+export { authentication } from './authentication.js';
+export { input } from './input.js';
+export { target } from './target.js';

package/dist/execution/invocation/admission/input.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedCallable } from '../../../application/action/index.js';
+export declare function input(callable: ResolvedCallable, value: unknown): void;

package/dist/execution/invocation/admission/input.js

@@ -0,0 +1,4 @@
+import { validateInput } from '../result/index.js';
+export function input(callable, value) {
+    validateInput(callable, value);
+}