@astrale-os/sdk 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/deployment/verify/readiness/deployment.js

@@ -0,0 +1,143 @@
+import { isRelease } from '../../release/index.js';
+import { isPreparedArtifact } from '../preflight/artifact.js';
+/** Admit adapter-reported progress without changing its mutation knowledge. */
+export function verifyDeployment(artifact, input) {
+    if (!isPreparedArtifact(artifact))
+        throw new TypeError('PreparedArtifact is not admitted.');
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const release = input.release === undefined ? undefined : verifyRelease(artifact, input.release);
+    const progress = verifyProgress(artifact, input.progress, release);
+    if (input.status === 'ready') {
+        exact(input, ['status', 'phase', 'progress', 'release']);
+        if (input.phase !== 'complete' ||
+            release === undefined ||
+            progress.provider.kind !== 'applied' ||
+            progress.provider.evidence.issuer === undefined ||
+            !terminal(progress.prerequisite) ||
+            !terminal(progress.configuration) ||
+            !terminal(progress.installation)) {
+            invalid();
+        }
+        return Object.freeze({ status: 'ready', phase: 'complete', progress, release });
+    }
+    if (input.status === 'failed') {
+        exact(input, ['status', 'phase', 'progress', 'error'], ['release']);
+        if (![
+            'prerequisite',
+            'provider',
+            'addressing',
+            'release',
+            'configuration',
+            'installation',
+            'readiness',
+        ].includes(input.phase) ||
+            !(input.error instanceof Error)) {
+            invalid();
+        }
+        return Object.freeze({
+            status: 'failed',
+            phase: input.phase,
+            progress,
+            error: input.error,
+            ...(release === undefined ? {} : { release }),
+        });
+    }
+    return invalid();
+}
+function verifyRelease(artifact, release) {
+    if (!isRelease(release) || release.build !== artifact.build) {
+        throw new TypeError('DeployResult Release differs from the PreparedArtifact Build.');
+    }
+    if (artifact.addressing.kind === 'configured' &&
+        release.addressing.issuer !== artifact.addressing.addressing.issuer) {
+        throw new TypeError('DeployResult Release differs from configured Addressing.');
+    }
+    return release;
+}
+function verifyProgress(artifact, input, release) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    exact(input, ['prerequisite', 'provider', 'configuration', 'installation']);
+    return Object.freeze({
+        prerequisite: knowledge(input.prerequisite),
+        provider: providerKnowledge(artifact, input.provider, release),
+        configuration: knowledge(input.configuration),
+        installation: knowledge(input.installation),
+    });
+}
+function providerKnowledge(artifact, input, release) {
+    if (input?.kind === 'partial') {
+        exact(input, ['kind'], ['evidence']);
+        if (input.evidence === undefined)
+            return Object.freeze({ kind: 'partial' });
+        const evidence = providerEvidence(input.evidence);
+        if (evidence.artifact !== artifact.digest) {
+            throw new TypeError('Provider deployment evidence differs from the PreparedArtifact digest.');
+        }
+        if (release !== undefined && evidence.issuer !== release.addressing.issuer) {
+            throw new TypeError('Provider deployment evidence differs from the Release issuer.');
+        }
+        return Object.freeze({ kind: 'partial', evidence });
+    }
+    if (input?.kind !== 'applied')
+        return knowledge(input);
+    exact(input, ['kind', 'evidence']);
+    const evidence = providerEvidence(input.evidence);
+    if (evidence.artifact !== artifact.digest) {
+        throw new TypeError('Provider deployment evidence differs from the PreparedArtifact digest.');
+    }
+    if (release !== undefined && evidence.issuer !== release.addressing.issuer) {
+        throw new TypeError('Provider deployment evidence differs from the Release issuer.');
+    }
+    return Object.freeze({ kind: 'applied', evidence });
+}
+function terminal(input) {
+    return input.kind === 'none' || input.kind === 'applied';
+}
+function providerEvidence(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    exact(input, ['provider', 'deployment', 'artifact'], ['issuer']);
+    if (typeof input.provider !== 'string' ||
+        input.provider.length === 0 ||
+        input.provider.trim() !== input.provider ||
+        typeof input.deployment !== 'string' ||
+        input.deployment.length === 0 ||
+        input.deployment.trim() !== input.deployment ||
+        typeof input.artifact !== 'string' ||
+        (input.issuer !== undefined && typeof input.issuer !== 'string')) {
+        invalid();
+    }
+    return Object.freeze({ ...input });
+}
+function knowledge(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    if (input.kind === 'applied') {
+        exact(input, ['kind', 'evidence']);
+        return Object.freeze({ kind: 'applied', evidence: input.evidence });
+    }
+    if (input.kind === 'partial') {
+        exact(input, ['kind'], ['evidence']);
+        return Object.freeze({
+            kind: 'partial',
+            ...(input.evidence === undefined ? {} : { evidence: input.evidence }),
+        });
+    }
+    if (input.kind === 'none' || input.kind === 'unknown') {
+        exact(input, ['kind']);
+        return Object.freeze({ kind: input.kind });
+    }
+    return invalid();
+}
+function exact(input, required, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    if (required.some((key) => !Object.hasOwn(input, key)) ||
+        Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !allowed.has(key))) {
+        invalid();
+    }
+}
+function invalid() {
+    throw new TypeError('DeployResult is invalid.');
+}

package/dist/deployment/verify/readiness/identity.d.ts

@@ -0,0 +1,7 @@
+import type { Addressing } from '../../release/index.js';
+import type { ReadinessFetch } from './publication.js';
+/** Verify issuer discovery and at least one admitted signing key at the serving identity. */
+export declare function verifyIdentity(addressing: Addressing, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<void>;

package/dist/deployment/verify/readiness/identity.js

@@ -0,0 +1,29 @@
+import { issuer } from '@astrale-os/kernel-protocol';
+const MAXIMUM_IDENTITY_BYTES = 256 * 1024;
+/** Verify issuer discovery and at least one admitted signing key at the serving identity. */
+export async function verifyIdentity(addressing, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const configurationUrl = new URL(issuer.paths(addressing.issuer).configuration, addressing.issuer);
+    const configuration = issuer.acceptConfiguration(await json(fetcher, configurationUrl.href, options.signal), addressing.issuer);
+    const keys = issuer.acceptKeySet(await json(fetcher, configuration.jwks_uri, options.signal), configuration.id_token_signing_alg_values_supported);
+    if (keys.keys.length === 0)
+        throw new Error('Serving issuer publishes no signing keys.');
+}
+async function json(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > MAXIMUM_IDENTITY_BYTES) {
+        throw new Error(`GET ${url} exceeded ${MAXIMUM_IDENTITY_BYTES} bytes.`);
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid JSON.`, { cause });
+    }
+}

package/dist/deployment/verify/readiness/index.d.ts

@@ -0,0 +1,10 @@
+import type { Release } from '../../release/index.js';
+import type { ReadinessFetch } from './publication.js';
+export { verifyDeployment } from './deployment.js';
+export { verifyIdentity } from './identity.js';
+export { verifyPublication, type ReadinessFetch } from './publication.js';
+/** Read-only verification of one exact live Release and serving identity. */
+export declare function readiness(release: Release, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<void>;

package/dist/deployment/verify/readiness/index.js

@@ -0,0 +1,10 @@
+import { verifyIdentity } from './identity.js';
+import { verifyPublication } from './publication.js';
+export { verifyDeployment } from './deployment.js';
+export { verifyIdentity } from './identity.js';
+export { verifyPublication } from './publication.js';
+/** Read-only verification of one exact live Release and serving identity. */
+export async function readiness(release, options = {}) {
+    await verifyPublication(release, options);
+    await verifyIdentity(release.addressing, options);
+}

package/dist/deployment/verify/readiness/publication.d.ts

@@ -0,0 +1,11 @@
+import { publication } from '@astrale-os/kernel-protocol';
+import type { Release } from '../../release/index.js';
+export type ReadinessFetch = (input: string, init: {
+    readonly redirect: 'error';
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+/** Fetch and verify the exact live Publication and Bundle for one Release. */
+export declare function verifyPublication(release: Release, options?: {
+    readonly fetch?: ReadinessFetch;
+    readonly signal?: AbortSignal;
+}): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/publication.js

@@ -0,0 +1,41 @@
+import { publication } from '@astrale-os/kernel-protocol';
+const MAXIMUM_PUBLICATION_BYTES = 1024 * 1024;
+const MAXIMUM_BUNDLE_BYTES = 16 * 1024 * 1024;
+/** Fetch and verify the exact live Publication and Bundle for one Release. */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.issuer);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_PUBLICATION_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}
+async function fetchRequired(fetcher, url, signal) {
+    const response = await fetcher(url, {
+        redirect: 'error',
+        ...(signal === undefined ? {} : { signal }),
+    });
+    if (!response.ok)
+        throw new Error(`GET ${url} returned ${response.status}.`);
+    return response;
+}
+async function bounded(response, url, maximum) {
+    const bytes = await response.arrayBuffer();
+    if (bytes.byteLength > maximum)
+        throw new Error(`GET ${url} exceeded ${maximum} bytes.`);
+    return bytes;
+}
+async function text(response, url, maximum) {
+    const bytes = await bounded(response, url, maximum);
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch (cause) {
+        throw new Error(`GET ${url} returned invalid UTF-8.`, { cause });
+    }
+}

package/dist/execution/identity/authentication.d.ts

@@ -0,0 +1,20 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
+import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { InvocationAdmissionInput } from '../invocation/index.js';
+import type { IdentityNetworkPolicy, VerificationBasis } from './jwks.js';
+import type { SigningMaterial } from './signing.js';
+export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
+export interface AuthenticationConfiguration {
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    readonly signing: SigningMaterial;
+    readonly fetch: Fetch;
+    readonly policy: IdentityNetworkPolicy;
+}
+export declare function authenticate(credentialInput: CredentialInput, expectedKernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
+export declare function acceptResolvedDelegation(input: unknown): Grant;
+export type { VerificationBasis };

package/dist/execution/identity/authentication.js

@@ -0,0 +1,140 @@
+import { function as functionSyscalls } from '@astrale-os/kernel-core/schema/kernel/syscalls/references';
+import * as protocolErrors from '@astrale-os/kernel-protocol/errors';
+import { errors as joseErrors } from 'jose';
+import { AuthValueError, credential, delegation, grant } from '../../platform/auth/index.js';
+import { Client, call } from '../../platform/client/index.js';
+import { bindSession, ClientSession } from '../../platform/client/session/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+import { Path } from '../../platform/graph/path/index.js';
+import { projectError, protocolError } from '../invocation/result/index.js';
+import { composedIdentity, signCallback, signDomainCallback } from './callback.js';
+import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
+import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
+const DEFAULT_ROUTE_AGE_MS = 60_000;
+export async function admit(request, configuration) {
+    const execution = request.context.execution;
+    requireLive(execution);
+    if (request.via.issuer === configuration.issuer) {
+        throw protocolError('VALIDATION_ERROR', 'Remote invocation Via must identify its source Kernel.');
+    }
+    const url = invocationUrl(request.via.issuer);
+    admitEndpoint(url, configuration.policy);
+    const callback = await signDomainCallback(configuration.signing, configuration.issuer, request.domain.origin, request.via.issuer, execution);
+    const owner = Path.project(functionSyscalls.admit.owner);
+    const client = new Client({
+        url,
+        fetch: boundedFetch(configuration.fetch, execution.signal),
+    });
+    try {
+        const result = await client.as(callback).call(call(Path.staticMethod(owner, functionSyscalls.admit.name), {
+            call: request.call,
+            ...(request.credential === undefined ? {} : { credential: request.credential }),
+        }), {
+            signal: execution.signal,
+            timeoutMs: Math.max(1, execution.deadline - Date.now()),
+            delegate: {
+                ttlSeconds: callbackTtl(execution.deadline),
+                attenuation: { kind: 'identity', self: true },
+            },
+        });
+        return result.value;
+    }
+    catch (cause) {
+        requireLive(execution);
+        throw projectError(cause);
+    }
+    finally {
+        client.close();
+    }
+}
+export async function authenticate(credentialInput, expectedKernel, execution, configuration) {
+    const established = await establishCaller(credentialInput, configuration.issuer, configuration.fetch, execution, configuration.policy);
+    if (established.verified.iss !== expectedKernel) {
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    }
+    const callbackCredential = await signCallback(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, composedIdentity(established.delegation.credential), established.verified, execution);
+    const session = new ClientSession({
+        kernel: expectedKernel,
+        fetch: boundedFetch(configuration.fetch, execution.signal),
+        auth: {
+            ttlSeconds: callbackTtl(execution.deadline),
+            resolve: () => ({ credential: callbackCredential }),
+        },
+        policy: {
+            maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
+            ...(configuration.policy.allowEndpoint === undefined
+                ? {}
+                : { allowEndpoint: configuration.policy.allowEndpoint }),
+            ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+        },
+        timeoutMs: Math.max(1, execution.deadline - Date.now()),
+    });
+    const client = bindSession(session, execution);
+    let closed = false;
+    return Object.freeze({
+        caller: established.caller,
+        client,
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            session.close();
+        },
+    });
+}
+async function establishCaller(input, audience, fetch, execution, policy) {
+    requireLive(execution);
+    try {
+        const context = await verifyCredential(input, audience, fetch, execution.signal, policy);
+        const carried = delegation.accept(context.verified.claims.delegation);
+        if (typeof carried.credential !== 'string') {
+            throw new CredentialRejected('Destination carrier has no Kernel authority proof.');
+        }
+        const proof = await verifyCredentialAgainst(carried.credential, context.verified.iss, context.basis);
+        if (proof.verified.sub !== context.verified.sub) {
+            throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
+        }
+        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
+        let principal;
+        try {
+            principal = NodeId(context.verified.sub);
+        }
+        catch {
+            throw new CredentialRejected('Credential subject is not a Kernel IdentityId.');
+        }
+        return Object.freeze({
+            verified: context.verified,
+            delegation: carried,
+            caller: Object.freeze({
+                kind: 'authenticated',
+                principal,
+                authority,
+                authentication: credential.evidence(context),
+            }),
+        });
+    }
+    catch (cause) {
+        requireLive(execution);
+        if (cause instanceof IssuerUnavailable) {
+            throw protocolError('BACKEND_UNAVAILABLE', 'Credential issuer is unavailable.');
+        }
+        if (cause instanceof CredentialRejected ||
+            cause instanceof joseErrors.JOSEError ||
+            cause instanceof protocolErrors.ProtocolError) {
+            throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+        }
+        throw cause;
+    }
+}
+export function acceptResolvedDelegation(input) {
+    if (input === null ||
+        typeof input !== 'object' ||
+        Array.isArray(input) ||
+        Reflect.ownKeys(input).length !== 2 ||
+        !Object.hasOwn(input, 'v') ||
+        !Object.hasOwn(input, 'expr') ||
+        Reflect.get(input, 'v') !== 1) {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected resolved delegation.');
+    }
+    return grant.accept({ expr: Reflect.get(input, 'expr') });
+}

package/dist/execution/identity/callback.d.ts

@@ -0,0 +1,11 @@
+import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { SigningMaterial } from './signing.js';
+export declare function composedIdentity(nested: string | Uint8Array): UnresolvedIdentityExpr;
+export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): Promise<string>;
+export declare function signCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): Promise<string>;

package/dist/execution/identity/callback.js

@@ -0,0 +1,39 @@
+import { SignJWT } from 'jose';
+import { protocolError } from '../invocation/result/index.js';
+import { requireLive } from './errors.js';
+const CALLBACK_TTL_SECONDS = 120;
+export function composedIdentity(nested) {
+    return Object.freeze({
+        kind: 'union',
+        operands: Object.freeze([
+            Object.freeze({ kind: 'identity', self: true }),
+            Object.freeze({ kind: 'identity', credential: nested }),
+        ]),
+    });
+}
+export async function signDomainCallback(signing, issuer, subject, audience, execution) {
+    return sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution);
+}
+export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
+    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+    return sign(signing, issuer, subject, audience, expression, execution, maximum);
+}
+async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+    requireLive(execution);
+    const now = Math.floor(Date.now() / 1_000);
+    const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
+    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
+        throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+    }
+    return new SignJWT({ grant: { v: 1, expr: expression } })
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(audience)
+        .setIssuedAt(now)
+        .setExpirationTime(expiresAt)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/delivery.d.ts

@@ -0,0 +1,6 @@
+import type { publication as serverPublication } from '@astrale-os/kernel-server';
+import * as publication from '@astrale-os/kernel-protocol/publication';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { SigningMaterial } from './signing.js';
+/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
+export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;

package/dist/execution/identity/delivery.js

@@ -0,0 +1,34 @@
+import * as publication from '@astrale-os/kernel-protocol/publication';
+import { SignJWT } from 'jose';
+const ATTESTATION_TTL_SECONDS = 60;
+/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
+export function publicationDelivery(signing, issuer, subject, deployed) {
+    return Object.freeze({
+        async create(request, context) {
+            context.signal.throwIfAborted();
+            const now = Math.floor(Date.now() / 1_000);
+            const attestation = await new SignJWT({
+                purpose: publication.delivery.PURPOSE,
+                nonce: request.nonce,
+                etag: deployed.etag,
+                schemaRevision: deployed.schema.revision,
+            })
+                .setProtectedHeader({
+                alg: signing.algorithm,
+                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+            })
+                .setIssuer(issuer)
+                .setSubject(subject)
+                .setAudience(request.kernel)
+                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+                .sign(await signing.privateKey);
+            context.signal.throwIfAborted();
+            return publication.delivery.accept({
+                format: 'astrale.domain.delivery',
+                version: 1,
+                publication: deployed,
+                attestation,
+            });
+        },
+    });
+}

package/dist/execution/identity/errors.d.ts

@@ -0,0 +1,22 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { IssuerId } from '../../platform/auth/index.js';
+export declare class CredentialRejected extends Error {
+    readonly name = "CredentialRejected";
+    constructor(message: string, cause?: unknown);
+}
+export declare class IssuerUnavailable extends Error {
+    readonly name = "IssuerUnavailable";
+    constructor(message: string, cause?: unknown);
+}
+export declare function requireLive(execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): void;
+export declare function httpIssuer(input: string, allowInsecureHttp: boolean): IssuerId;
+export declare function admitEndpoint(input: string, policy: {
+    readonly allowEndpoint?: (url: string) => boolean;
+    readonly allowInsecureHttp?: boolean;
+}): void;
+export declare function invocationUrl(input: IssuerId): string;
+export declare function boundedFetch(fetch: Fetch, lifecycle: AbortSignal): Fetch;
+export declare function callbackTtl(deadline: number): number;

package/dist/execution/identity/errors.js

@@ -0,0 +1,61 @@
+import { issuer } from '../../platform/auth/index.js';
+import { protocolError } from '../invocation/result/index.js';
+export class CredentialRejected extends Error {
+    name = 'CredentialRejected';
+    constructor(message, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+    }
+}
+export class IssuerUnavailable extends Error {
+    name = 'IssuerUnavailable';
+    constructor(message, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+    }
+}
+export function requireLive(execution) {
+    if (execution.signal.aborted)
+        throw protocolError('CANCELLED', 'Invocation was cancelled.');
+    if (Date.now() >= execution.deadline) {
+        throw protocolError('DEADLINE_EXCEEDED', 'Invocation deadline was exceeded.');
+    }
+}
+export function httpIssuer(input, allowInsecureHttp) {
+    const admitted = issuer.accept(input);
+    let url;
+    try {
+        url = new URL(admitted);
+    }
+    catch (cause) {
+        throw new TypeError('Execution issuer must be an absolute HTTP(S) URL.', { cause });
+    }
+    if (url.username !== '' ||
+        url.password !== '' ||
+        url.search !== '' ||
+        url.hash !== '' ||
+        (url.protocol !== 'https:' && !(allowInsecureHttp && url.protocol === 'http:'))) {
+        throw new TypeError('Execution issuer must be an admitted HTTP(S) URL.');
+    }
+    return admitted;
+}
+export function admitEndpoint(input, policy) {
+    const url = new URL(input);
+    if (url.protocol !== 'https:' &&
+        !(policy.allowInsecureHttp === true && url.protocol === 'http:')) {
+        throw new CredentialRejected('Endpoint transport is not allowed.');
+    }
+    if (policy.allowEndpoint !== undefined && !policy.allowEndpoint(url.href)) {
+        throw new CredentialRejected('Endpoint is not allowed.');
+    }
+}
+export function invocationUrl(input) {
+    return `${input.replace(/\/+$/u, '')}/invoke`;
+}
+export function boundedFetch(fetch, lifecycle) {
+    return (input, init = {}) => {
+        lifecycle.throwIfAborted();
+        return fetch(input, init.signal === undefined ? { ...init, signal: lifecycle } : init);
+    };
+}
+export function callbackTtl(deadline) {
+    return Math.max(1, Math.ceil((deadline - Date.now()) / 1_000));
+}

package/dist/execution/identity/exchange.d.ts

@@ -0,0 +1,10 @@
+import type { Fetch } from '@astrale-os/kernel-client';
+import type { exchange } from '@astrale-os/kernel-server';
+import type { IssuerId } from '../../platform/auth/index.js';
+import type { IdentityNetworkPolicy } from './jwks.js';
+import type { SigningMaterial } from './signing.js';
+export interface ExchangeOptions {
+    readonly maximumTtlSeconds?: number;
+}
+export declare function maximumExchangeTtl(input: ExchangeOptions | undefined): number;
+export declare function tokenExchange(issuer: IssuerId, subject: string, signing: SigningMaterial, fetch: Fetch, policy: IdentityNetworkPolicy, maximumTtlSeconds: number): exchange.Provider;