@astrale-os/sdk 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/server/remote.js

@@ -1,798 +0,0 @@
-import { call, Client } from '@astrale-os/kernel-client';
-import { createAuth } from '@astrale-os/kernel-client/auth';
-import { createGraph } from '@astrale-os/kernel-client/graph';
-import { ClientSession } from '@astrale-os/kernel-client/session';
-import { AuthValueError, credential, delegation, grant, issuer, jwk, } from '@astrale-os/kernel-core/auth';
-import { Domain } from '@astrale-os/kernel-core/domain';
-import { NodeId } from '@astrale-os/kernel-core/graph/node';
-import { Path } from '@astrale-os/kernel-core/path';
-import { syscalls } from '@astrale-os/kernel-core/schema';
-import { AuthenticationError } from '@astrale-os/kernel-ports/authentication';
-import { FunctionError } from '@astrale-os/kernel-ports/functions';
-import { errors as protocolErrors, issuer as issuerProtocol, publication as publicationProtocol, } from '@astrale-os/kernel-protocol';
-import { errors as joseErrors, importJWK, jwtVerify, SignJWT } from 'jose';
-import { bindCallables, createDeployment } from '../deployment/index.js';
-import { createApplication } from './application.js';
-const CALLBACK_TTL_SECONDS = 120;
-const MAXIMUM_DISCOVERY_DOCUMENT_BYTES = 256 * 1024;
-const DEFAULT_ROUTE_AGE_MS = 60_000;
-const DEFAULT_TOKEN_EXCHANGE_TTL_SECONDS = 300;
-/**
- * Compose the portable V2 Deployment/Application pair for one remotely hosted Domain.
- * The helper owns only generic remote identity, installation attestation, and callback authority;
- * provider routing and lifecycle remain adapter capabilities.
- */
-export function createRemoteApplication(input) {
-    const issuerId = httpIssuer(input.identity.issuer, input.identity.allowInsecureHttp === true);
-    if (input.identity.subject !== input.definition.schema.origin) {
-        throw new TypeError('Remote identity subject must equal the Domain origin.');
-    }
-    const delivery = input.deployment;
-    const deploymentInput = {
-        definition: input.definition,
-        issuer: issuerId,
-        bundleHref: delivery.bundleHref,
-        bindings: {
-            callables: bindCallables(input.definition, delivery.endpoint),
-        },
-        ...(delivery.frontendBaseHref === undefined
-            ? {}
-            : { frontendBaseHref: delivery.frontendBaseHref }),
-        ...(delivery.frontendCacheKey === undefined
-            ? {}
-            : { frontendCacheKey: delivery.frontendCacheKey }),
-        ...(delivery.protocolViewBindings === undefined
-            ? {}
-            : { protocolViewBindings: delivery.protocolViewBindings }),
-        ...(delivery.routes === undefined ? {} : { routes: delivery.routes }),
-        ...(delivery.manifest === undefined ? {} : { manifest: delivery.manifest }),
-        ...(delivery.delivery === undefined ? {} : { delivery: delivery.delivery }),
-        servingEndpoint: delivery.endpoint,
-    };
-    const deployed = createDeployment(deploymentInput);
-    const signing = signingMaterial(input.identity.privateKey);
-    let current = deployed;
-    const applicationInput = {
-        deployment: deployed,
-        environment: input.environment,
-        identity: remoteIdentity({ ...input.identity, issuer: issuerId }, signing),
-        server: input.server,
-        ...(input.workflowRunner === undefined ? {} : { workflowRunner: input.workflowRunner }),
-        ...(delivery.delivery === undefined
-            ? {}
-            : { delivery: publicDeliveryProvider(() => current, signing) }),
-        ...(input.app === undefined ? {} : { app: input.app }),
-    };
-    const application = createApplication(applicationInput);
-    return Object.freeze({
-        app: application.app,
-        get publication() {
-            return application.publication;
-        },
-        replace(candidate) {
-            const replaced = application.replace(candidate);
-            current = candidate;
-            return replaced;
-        },
-        drain: application.drain,
-        close: application.close,
-    });
-}
-/** Build one immutable Application identity backed by an asymmetric private JWK. */
-export function createRemoteIdentity(input) {
-    return remoteIdentity(input, signingMaterial(input.privateKey));
-}
-function remoteIdentity(input, signing) {
-    const selfIssuer = httpIssuer(input.issuer, input.allowInsecureHttp === true);
-    const fetchImpl = input.fetch ?? globalThis.fetch.bind(globalThis);
-    if (typeof fetchImpl !== 'function')
-        throw new TypeError('Remote identity requires Fetch.');
-    if (typeof input.subject !== 'string' || input.subject.length === 0) {
-        throw new TypeError('Remote identity subject must not be empty.');
-    }
-    if (input.allowEndpoint !== undefined && typeof input.allowEndpoint !== 'function') {
-        throw new TypeError('Remote identity endpoint policy is invalid.');
-    }
-    const maximumExchangeTtlSeconds = admitExchangeOptions(input.tokenExchange);
-    return Object.freeze({
-        issuer: selfIssuer,
-        signingAlgorithm: signing.algorithm,
-        loadPublicKeys: async () => [signing.publicKey],
-        tokenExchange: exchangeProvider(selfIssuer, input.subject, signing, fetchImpl, input, maximumExchangeTtlSeconds),
-        admit: (request) => admitAttempt(request, signing, selfIssuer, fetchImpl, input),
-        authenticate: async (request) => {
-            const established = await establishCaller(request.credential, selfIssuer, fetchImpl, request.context.execution.signal, input);
-            if (established.verified.iss !== request.via.issuer) {
-                throw new AuthenticationError('INVALID_CREDENTIAL', 'Destination carrier issuer differs from the admitted Via Kernel.');
-            }
-            const context = request.context.execution;
-            const callbackAudience = established.verified.iss;
-            const composed = composedIdentity(established.delegation.credential);
-            const composedCredential = await signCallback(signing, selfIssuer, input.subject, callbackAudience, composed, established.verified, context);
-            const fetch = boundedFetch(fetchImpl, context.signal);
-            const session = new ClientSession({
-                kernel: callbackAudience,
-                fetch,
-                auth: {
-                    ttlSeconds: callbackTtl(context.deadline),
-                    resolve: () => ({ credential: composedCredential }),
-                },
-                policy: {
-                    maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
-                    ...(input.allowEndpoint === undefined ? {} : { allowEndpoint: input.allowEndpoint }),
-                    ...(input.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
-                },
-                timeoutMs: Math.max(1, context.deadline - Date.now()),
-            });
-            const dispatch = (call, options) => session.dispatch(call, boundedSessionOptions(context, options));
-            const kernel = kernelCapability(session, dispatch, context);
-            const app = domainHandle(request.domain, dispatch);
-            return Object.freeze({
-                caller: established.caller,
-                app,
-                kernel,
-            });
-        },
-    });
-}
-function admitExchangeOptions(input) {
-    if (input === undefined)
-        return DEFAULT_TOKEN_EXCHANGE_TTL_SECONDS;
-    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-        throw new TypeError('Remote identity tokenExchange options are invalid.');
-    }
-    const fields = Reflect.ownKeys(input);
-    if (fields.some((field) => field !== 'maximumTtlSeconds')) {
-        throw new TypeError('Remote identity tokenExchange options contain an unknown field.');
-    }
-    const maximumTtlSeconds = input.maximumTtlSeconds ?? DEFAULT_TOKEN_EXCHANGE_TTL_SECONDS;
-    if (!Number.isSafeInteger(maximumTtlSeconds) || maximumTtlSeconds < 1) {
-        throw new TypeError('tokenExchange.maximumTtlSeconds must be a positive safe integer.');
-    }
-    return maximumTtlSeconds;
-}
-function signingMaterial(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-        throw new TypeError('Remote identity private key must be a JWK object.');
-    }
-    const algorithm = input.alg;
-    if (typeof algorithm !== 'string' || algorithm.length === 0) {
-        throw new TypeError('Remote identity private JWK requires alg.');
-    }
-    const keyId = input.kid;
-    if (keyId !== undefined && (typeof keyId !== 'string' || keyId.length === 0)) {
-        throw new TypeError('Remote identity private JWK kid is invalid.');
-    }
-    const value = input;
-    const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, k: _k, 
-    // A WebCrypto-exported private JWK can be restricted to signing. That
-    // operation does not apply to the derived public verification key and
-    // makes strict JOSE consumers reject it when retained in JWKS.
-    key_ops: _keyOperations, ...publicValue } = value;
-    const publicKey = jwk.acceptPublic({
-        ...publicValue,
-        alg: algorithm,
-        ...(keyId ? { kid: keyId } : {}),
-    });
-    return Object.freeze({
-        algorithm,
-        ...(keyId === undefined ? {} : { keyId }),
-        privateKey: importJWK(input, algorithm),
-        publicKey,
-    });
-}
-function exchangeProvider(domainIssuer, subject, signing, fetch, policy, maximumTtlSeconds) {
-    return Object.freeze({
-        async exchange(request, context) {
-            try {
-                const outer = await verifyCredential(request.token, domainIssuer, fetch, context.signal, policy);
-                requireExchangeProfile(outer.verified, 'outer');
-                const carried = delegation.accept(outer.verified.claims.delegation);
-                if (typeof carried.credential !== 'string')
-                    exchangeInvalid();
-                const inner = await verifyCredentialAgainst(carried.credential, outer.verified.iss, outer.basis);
-                requireExchangeProfile(inner.verified, 'inner');
-                requireExchangeCoherence(outer.verified, inner.verified);
-                acceptResolvedDelegation(inner.verified.claims.delegation);
-                const now = Math.floor(Date.now() / 1_000);
-                const expiresAt = Math.min(outer.verified.exp, inner.verified.exp, now + maximumTtlSeconds);
-                if (expiresAt <= now)
-                    exchangeExpired();
-                const token = await new SignJWT({
-                    grant: {
-                        v: 1,
-                        expr: { kind: 'identity', credential: carried.credential },
-                    },
-                })
-                    .setProtectedHeader({
-                    alg: signing.algorithm,
-                    ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-                })
-                    .setIssuer(domainIssuer)
-                    .setSubject(subject)
-                    .setAudience(outer.verified.iss)
-                    .setIssuedAt(now)
-                    .setExpirationTime(expiresAt)
-                    .sign(await signing.privateKey);
-                return issuerProtocol.exchange.response(token, expiresAt);
-            }
-            catch (cause) {
-                if (cause instanceof protocolErrors.ProtocolError)
-                    throw cause;
-                if (context.signal.aborted)
-                    throw context.signal.reason;
-                if (cause instanceof joseErrors.JWTExpired)
-                    exchangeExpired();
-                if (cause instanceof IssuerUnavailable)
-                    exchangeUnavailable();
-                if (cause instanceof CredentialRejected ||
-                    cause instanceof joseErrors.JOSEError ||
-                    cause instanceof AuthenticationError ||
-                    cause instanceof AuthValueError) {
-                    exchangeInvalid();
-                }
-                throw cause;
-            }
-        },
-    });
-}
-function requireExchangeProfile(input, profile) {
-    const expected = ['aud', 'delegation', 'exp', 'iat', 'iss', 'sub'];
-    const actual = Object.keys(input.claims).sort();
-    if (actual.length !== expected.length ||
-        actual.some((field, index) => field !== expected[index]) ||
-        typeof input.iat !== 'number' ||
-        !Number.isSafeInteger(input.iat) ||
-        input.iat < 1 ||
-        typeof input.exp !== 'number' ||
-        !Number.isSafeInteger(input.exp) ||
-        input.exp < 1 ||
-        typeof input.aud !== 'string') {
-        exchangeInvalid();
-    }
-    if (profile === 'outer')
-        delegation.accept(input.claims.delegation);
-    else
-        acceptResolvedDelegation(input.claims.delegation);
-}
-function requireExchangeCoherence(outer, inner) {
-    if (inner.iss !== outer.iss || inner.sub !== outer.sub || inner.aud !== outer.iss) {
-        exchangeInvalid();
-    }
-}
-function acceptResolvedDelegation(input) {
-    if (input === null ||
-        typeof input !== 'object' ||
-        Array.isArray(input) ||
-        Reflect.ownKeys(input).length !== 2 ||
-        !Object.hasOwn(input, 'v') ||
-        !Object.hasOwn(input, 'expr') ||
-        Reflect.get(input, 'v') !== 1) {
-        exchangeInvalid();
-    }
-    return grant.accept({ expr: Reflect.get(input, 'expr') });
-}
-function exchangeInvalid() {
-    throw new protocolErrors.ProtocolError({
-        code: protocolErrors.CODES.AUTH_INVALID,
-        message: 'Token is invalid.',
-    });
-}
-function exchangeExpired() {
-    throw new protocolErrors.ProtocolError({
-        code: protocolErrors.CODES.AUTH_EXPIRED,
-        message: 'Token is expired.',
-    });
-}
-function exchangeUnavailable() {
-    throw new protocolErrors.ProtocolError({
-        code: protocolErrors.CODES.BACKEND_UNAVAILABLE,
-        message: 'Token exchange is unavailable.',
-    });
-}
-async function establishCaller(input, audience, fetch, signal, policy) {
-    try {
-        const context = await verifyCredential(input, audience, fetch, signal, policy);
-        const carried = delegation.accept(context.verified.claims.delegation);
-        if (typeof carried.credential !== 'string') {
-            throw new CredentialRejected('Destination carrier has no Kernel authority proof.');
-        }
-        const proof = await verifyCredentialAgainst(carried.credential, context.verified.iss, context.basis);
-        if (proof.verified.sub !== context.verified.sub) {
-            throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
-        }
-        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
-        let principal;
-        try {
-            principal = NodeId(context.verified.sub);
-        }
-        catch {
-            throw new CredentialRejected('Credential subject is not a Kernel IdentityId.');
-        }
-        return Object.freeze({
-            verified: context.verified,
-            delegation: carried,
-            caller: Object.freeze({
-                kind: 'authenticated',
-                principal,
-                authority,
-                authentication: credential.evidence(context),
-            }),
-        });
-    }
-    catch (cause) {
-        if (cause instanceof AuthenticationError)
-            throw cause;
-        if (cause instanceof IssuerUnavailable) {
-            throw new AuthenticationError('AUTHENTICATION_BACKEND_FAILED', cause.message, {
-                cause: cause.cause,
-            });
-        }
-        if (cause instanceof CredentialRejected ||
-            cause instanceof joseErrors.JOSEError ||
-            cause instanceof protocolErrors.ProtocolError) {
-            throw new AuthenticationError('INVALID_CREDENTIAL', 'Credential is invalid.');
-        }
-        throw cause;
-    }
-}
-async function verifyCredential(input, audience, fetch, signal, policy) {
-    let inspected;
-    try {
-        inspected = credential.inspect(input);
-    }
-    catch (cause) {
-        throw new CredentialRejected('Credential is malformed.', cause);
-    }
-    if (inspected.iss === undefined)
-        throw new CredentialRejected('Credential issuer is missing.');
-    let admittedIssuer;
-    try {
-        admittedIssuer = httpIssuer(inspected.iss, policy.allowInsecureHttp === true);
-    }
-    catch (cause) {
-        throw new CredentialRejected('Credential issuer is invalid.', cause);
-    }
-    const basis = await discoverVerificationBasis(admittedIssuer, fetch, signal, policy);
-    const verified = await verifyCredentialAgainst(input, audience, basis, inspected);
-    admitEndpoint(invocationUrl(admittedIssuer), policy);
-    return Object.freeze({ raw: input, verified: verified.verified, basis });
-}
-async function discoverVerificationBasis(admittedIssuer, fetch, signal, policy) {
-    const paths = issuerProtocol.paths(admittedIssuer);
-    const configurationUrl = new URL(paths.configuration, admittedIssuer).toString();
-    admitEndpoint(configurationUrl, policy);
-    const configurationResponse = await fetchDiscovery(fetch, configurationUrl, signal);
-    const configuration = issuerProtocol.acceptConfiguration(await boundedJson(configurationResponse, signal), admittedIssuer);
-    admitEndpoint(configuration.jwks_uri, policy);
-    const keysResponse = await fetchDiscovery(fetch, configuration.jwks_uri, signal);
-    const keys = issuerProtocol.acceptKeySet(await boundedJson(keysResponse, signal), configuration.id_token_signing_alg_values_supported).keys;
-    return Object.freeze({
-        issuer: admittedIssuer,
-        algorithms: configuration.id_token_signing_alg_values_supported,
-        keys,
-    });
-}
-async function verifyCredentialAgainst(input, audience, basis, preinspected) {
-    let inspected;
-    try {
-        inspected = preinspected ?? credential.inspect(input);
-    }
-    catch (cause) {
-        throw new CredentialRejected('Credential is malformed.', cause);
-    }
-    if (inspected.iss !== basis.issuer) {
-        throw new CredentialRejected('Credential issuer differs from the captured verification basis.');
-    }
-    const compact = typeof input === 'string' ? input : new TextDecoder().decode(input);
-    const candidates = basis.keys.filter((candidate) => inspected.kid === undefined || candidate.kid === inspected.kid);
-    const matches = [];
-    let expired;
-    for (const candidate of candidates) {
-        try {
-            const imported = await importJWK(candidate, candidate.alg ?? basis.algorithms[0]);
-            matches.push(await jwtVerify(compact, imported, {
-                issuer: basis.issuer,
-                audience,
-                algorithms: [...basis.algorithms],
-            }));
-        }
-        catch (cause) {
-            if (cause instanceof joseErrors.JWTExpired)
-                expired = cause;
-            if (cause instanceof joseErrors.JOSEError)
-                continue;
-            throw cause;
-        }
-    }
-    if (matches.length === 0 && expired !== undefined)
-        throw expired;
-    if (matches.length !== 1) {
-        throw new CredentialRejected('Credential signature is not uniquely verified.');
-    }
-    const match = matches[0];
-    let verified;
-    try {
-        verified = credential.acceptVerified({
-            method: 'jwt',
-            iss: match.payload.iss,
-            sub: match.payload.sub,
-            aud: match.payload.aud,
-            kid: match.protectedHeader.kid,
-            iat: match.payload.iat,
-            nbf: match.payload.nbf,
-            exp: match.payload.exp,
-            claims: match.payload,
-        });
-        credential.verifyAudience(verified, audience);
-    }
-    catch (cause) {
-        throw new CredentialRejected('Credential claims are invalid.', cause);
-    }
-    return Object.freeze({ raw: input, verified });
-}
-async function fetchDiscovery(fetch, url, signal) {
-    let response;
-    try {
-        response = await fetch(url, { method: 'GET', redirect: 'error', signal });
-    }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        throw new IssuerUnavailable('Issuer discovery request failed.', cause);
-    }
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new IssuerUnavailable(`Issuer discovery returned HTTP ${response.status}.`);
-    }
-    return response;
-}
-async function boundedJson(response, signal) {
-    const declared = response.headers.get('content-length');
-    if (declared !== null && Number(declared) > MAXIMUM_DISCOVERY_DOCUMENT_BYTES) {
-        await response.body?.cancel();
-        throw new CredentialRejected('Issuer discovery document exceeds the byte limit.');
-    }
-    if (response.body === null)
-        throw new CredentialRejected('Issuer discovery response is empty.');
-    const reader = response.body.getReader();
-    const chunks = [];
-    let size = 0;
-    try {
-        for (;;) {
-            const read = await reader.read();
-            if (read.done)
-                break;
-            size += read.value.byteLength;
-            if (size > MAXIMUM_DISCOVERY_DOCUMENT_BYTES) {
-                await reader.cancel();
-                throw new CredentialRejected('Issuer discovery document exceeds the byte limit.');
-            }
-            chunks.push(read.value);
-        }
-    }
-    catch (cause) {
-        if (signal.aborted)
-            throw signal.reason;
-        throw cause;
-    }
-    finally {
-        reader.releaseLock();
-    }
-    if (signal.aborted)
-        throw signal.reason;
-    const bytes = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    try {
-        return JSON.parse(new TextDecoder().decode(bytes));
-    }
-    catch (cause) {
-        throw new CredentialRejected('Issuer discovery document is not JSON.', cause);
-    }
-}
-function identityLeaf(nested) {
-    return Object.freeze({ kind: 'identity', credential: nested });
-}
-function composedIdentity(nested) {
-    return Object.freeze({
-        kind: 'union',
-        operands: Object.freeze([
-            Object.freeze({ kind: 'identity', self: true }),
-            identityLeaf(nested),
-        ]),
-    });
-}
-async function signDomainCallback(signing, callbackIssuer, subject, audience, execution) {
-    requireLive(execution);
-    const now = Math.floor(Date.now() / 1_000);
-    const expiresAt = Math.min(Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
-    if (expiresAt <= now) {
-        throw new AuthenticationError('INVALID_CREDENTIAL', 'Callback credential would be expired.');
-    }
-    return new SignJWT({
-        grant: { v: 1, expr: { kind: 'identity', self: true } },
-    })
-        .setProtectedHeader({
-        alg: signing.algorithm,
-        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-    })
-        .setIssuer(callbackIssuer)
-        .setSubject(subject)
-        .setAudience(audience)
-        .setIssuedAt(now)
-        .setExpirationTime(expiresAt)
-        .sign(await signing.privateKey);
-}
-async function signCallback(signing, callbackIssuer, subject, audience, expression, carrier, execution) {
-    requireLive(execution);
-    const now = Math.floor(Date.now() / 1_000);
-    const expiresAt = Math.min(carrier.exp ?? Number.POSITIVE_INFINITY, Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
-    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
-        throw new AuthenticationError('INVALID_CREDENTIAL', 'Credential proof has expired.');
-    }
-    return new SignJWT({ grant: { v: 1, expr: expression } })
-        .setProtectedHeader({
-        alg: signing.algorithm,
-        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-    })
-        .setIssuer(callbackIssuer)
-        .setSubject(subject)
-        .setAudience(audience)
-        .setIssuedAt(now)
-        .setExpirationTime(expiresAt)
-        .sign(await signing.privateKey);
-}
-function kernelCapability(session, dispatch, execution) {
-    const value = (call, options) => session.call(call, boundedSessionOptions(execution, options));
-    const graph = createGraph(value);
-    const auth = createAuth((target, input, options) => value(call(target, input), boundedRequestOptions(execution, options)));
-    return Object.freeze({
-        ...graph,
-        auth,
-        dispatch: (call, options) => dispatch(call, options),
-        call: (call, options) => session.call(call, boundedSessionOptions(execution, options)),
-        stream: (call, options) => session.stream(call, boundedSessionOptions(execution, options)),
-        binary: (call, options) => session.binary(call, boundedSessionOptions(execution, options)),
-        snapshot: (options) => session.snapshot(boundedSessionOptions(execution, options)),
-        viewsFor: (target, options) => session.viewsFor(target, boundedSessionOptions(execution, options)),
-        domain: async (domainSchema) => domainHandle(Domain.fromSchema(domainSchema), dispatch),
-    });
-}
-function domainHandle(domain, dispatch) {
-    const callables = concreteCallables(domain);
-    const invokeCallable = async (callable, receiver, input, options) => {
-        if (!callables.has(callable)) {
-            throw new FunctionError('FUNCTION_BINDING_INVALID', 'Callable is not a concrete member of the Domain.');
-        }
-        const target = 'on' in callable ? Path.instanceMethod(Path.from(receiver), callable.name) : callable.path;
-        if (target === undefined) {
-            throw new FunctionError('FUNCTION_BINDING_INVALID', 'Callable has no canonical Path.');
-        }
-        const result = await dispatch(call(target, input), options);
-        return callableOutput(callable, result);
-    };
-    const methodBinder = (method, receiver) => (input) => invokeCallable(method, Path.id(receiver.id), input);
-    const invoke = ((callable, receiverOrInput, inputOrOptions, options) => 'on' in callable
-        ? invokeCallable(callable, receiverOrInput, inputOrOptions, options)
-        : invokeCallable(callable, undefined, receiverOrInput, inputOrOptions));
-    const bind = ((definitionOrValue, value) => value === undefined
-        ? domain.$.wrap(definitionOrValue, methodBinder)
-        : domain.$.wrap(definitionOrValue, value, methodBinder));
-    return Object.freeze({
-        ...domain,
-        $: Object.freeze({ ...domain.$, invoke, bind }),
-    });
-}
-function concreteCallables(domain) {
-    const result = new Set();
-    for (const definition of domain.$.definitions.values()) {
-        if (definition.kind === 'function') {
-            result.add(definition);
-            continue;
-        }
-        if ((definition.kind !== 'class' && definition.kind !== 'interface') ||
-            definition.family !== 'node') {
-            continue;
-        }
-        for (const method of definition.methods.values()) {
-            if (method.definition.inheritance !== 'abstract') {
-                result.add(method);
-            }
-        }
-    }
-    return result;
-}
-function callableOutput(callable, result) {
-    switch (callable.definition.output.mode) {
-        case 'value':
-            if (result.kind === 'value')
-                return result.value;
-            break;
-        case 'stream':
-            if (result.kind === 'stream')
-                return result.stream;
-            break;
-        case 'binary':
-            if (result.kind === 'binary')
-                return result.value;
-            break;
-    }
-    if (result.kind === 'stream')
-        void result.stream.cancel('Remote callable output kind changed.');
-    throw new FunctionError('FUNCTION_OUTPUT_INVALID', `Remote callable returned ${result.kind} for ${callable.definition.output.mode} output.`);
-}
-async function admitAttempt(request, signing, domainIssuer, fetch, policy) {
-    const execution = request.context.execution;
-    const kernel = request.via.issuer;
-    const url = invocationUrl(kernel);
-    admitEndpoint(url, policy);
-    const callback = await signDomainCallback(signing, domainIssuer, request.domain.$.origin, kernel, execution);
-    const owner = Path.project(syscalls.function.admit.ref.owner);
-    const target = Path.staticMethod(owner, syscalls.function.admit.ref.name);
-    const client = new Client({ url, fetch: boundedFetch(fetch, execution.signal) });
-    try {
-        const portableRequest = {
-            call: request.call,
-            ...(request.credential === undefined ? {} : { credential: request.credential }),
-        };
-        const value = await client.as(callback).call(call(target, portableRequest), {
-            ...boundedRequestOptions(execution),
-            delegate: {
-                ttlSeconds: callbackTtl(execution.deadline),
-                attenuation: { kind: 'identity', self: true },
-            },
-        });
-        if (!isTarget(value)) {
-            throw new FunctionError('FUNCTION_EXECUTION_FAILED', 'Kernel returned an invalid Function admission Target.');
-        }
-        return Object.freeze({
-            callable: value.callable,
-            ...(value.receiver === undefined ? {} : { receiver: value.receiver }),
-        });
-    }
-    finally {
-        client.close();
-    }
-}
-function isTarget(input) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        return false;
-    const fields = Reflect.ownKeys(input);
-    return (fields.every((field) => field === 'callable' || field === 'receiver') &&
-        fields.includes('callable') &&
-        typeof Reflect.get(input, 'callable') === 'string' &&
-        (Reflect.get(input, 'receiver') === undefined ||
-            typeof Reflect.get(input, 'receiver') === 'string'));
-}
-function publicDeliveryProvider(current, signing) {
-    if (current().publication.delivery?.authentication.kind !== 'public') {
-        throw new TypeError('Remote application helper currently requires a public delivery endpoint.');
-    }
-    return Object.freeze({
-        async create(request) {
-            const deployed = current();
-            if (deployed.publication.delivery?.authentication.kind !== 'public') {
-                throw new FunctionError('FUNCTION_CONFLICT', 'Delivery endpoint changed.');
-            }
-            if (request.etag !== deployed.publication.etag) {
-                throw new FunctionError('FUNCTION_CONFLICT', 'Delivery Publication changed.');
-            }
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publicationProtocol.delivery.PURPOSE,
-                nonce: request.nonce,
-                etag: deployed.publication.etag,
-                schemaRevision: deployed.publication.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(deployed.publication.identity.issuer)
-                .setSubject(deployed.publication.origin)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + CALLBACK_TTL_SECONDS)
-                .sign(await signing.privateKey);
-            return publicationProtocol.delivery.accept({
-                format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed.publication,
-                attestation,
-            });
-        },
-    });
-}
-function boundedFetch(fetch, lifecycle) {
-    return (input, init = {}) => fetch(input, {
-        ...init,
-        signal: init.signal === undefined || init.signal === null
-            ? lifecycle
-            : AbortSignal.any([lifecycle, init.signal]),
-    });
-}
-function boundedRequestOptions(execution, options = {}) {
-    return boundedOptions(execution, options);
-}
-function boundedSessionOptions(execution, options) {
-    return boundedOptions(execution, options ?? {});
-}
-function boundedOptions(execution, options) {
-    requireLive(execution);
-    const remaining = Math.max(1, execution.deadline - Date.now());
-    return {
-        ...options,
-        signal: options.signal === undefined
-            ? execution.signal
-            : AbortSignal.any([execution.signal, options.signal]),
-        timeoutMs: Math.min(options.timeoutMs ?? remaining, remaining),
-    };
-}
-function requireLive(execution) {
-    if (execution.signal.aborted) {
-        throw new FunctionError('FUNCTION_CANCELLED', 'Remote invocation was cancelled.');
-    }
-    if (execution.deadline <= Date.now()) {
-        throw new FunctionError('FUNCTION_DEADLINE_EXCEEDED', 'Remote invocation deadline was exceeded.');
-    }
-}
-function callbackTtl(deadline) {
-    return Math.max(1, Math.min(CALLBACK_TTL_SECONDS, Math.floor((deadline - Date.now()) / 1_000)));
-}
-function httpIssuer(input, allowInsecureHttp) {
-    const admitted = issuer.accept(input);
-    let url;
-    try {
-        url = new URL(admitted);
-    }
-    catch (cause) {
-        throw new TypeError('Remote identity issuer must be an absolute HTTP(S) URL.', { cause });
-    }
-    if (url.username !== '' ||
-        url.password !== '' ||
-        url.search !== '' ||
-        url.hash !== '' ||
-        (url.protocol !== 'https:' && !(allowInsecureHttp && url.protocol === 'http:'))) {
-        throw new TypeError(allowInsecureHttp
-            ? 'Remote identity issuer must be an absolute HTTP(S) URL without credentials, query, or fragment.'
-            : 'Remote identity issuer must be an absolute HTTPS URL without credentials, query, or fragment.');
-    }
-    return admitted;
-}
-function admitEndpoint(input, policy) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch (cause) {
-        throw new CredentialRejected('Credential issuer endpoint is invalid.', cause);
-    }
-    if (url.username !== '' ||
-        url.password !== '' ||
-        url.hash !== '' ||
-        (url.protocol !== 'https:' && !(policy.allowInsecureHttp === true && url.protocol === 'http:'))) {
-        throw new CredentialRejected('Credential issuer endpoint is not allowed.');
-    }
-    if (policy.allowEndpoint?.(url.toString()) === false) {
-        throw new CredentialRejected('Credential issuer endpoint is denied by policy.');
-    }
-}
-function invocationUrl(input) {
-    return `${input.replace(/\/+$/u, '')}/invoke`;
-}
-class CredentialRejected extends Error {
-    constructor(message, cause) {
-        super(message, { cause });
-        this.name = 'CredentialRejected';
-    }
-}
-class IssuerUnavailable extends Error {
-    constructor(message, cause) {
-        super(message, { cause });
-        this.name = 'IssuerUnavailable';
-    }
-}
-//# sourceMappingURL=remote.js.map