@astrale-os/sdk 0.5.0-beta.53 → 0.5.0-beta.55

package/dist/execution/identity/authentication.js

@@ -7,7 +7,7 @@ import { bindSession, ClientSession } from '../../platform/client/session/index.
 import { NodeId } from '../../platform/graph/node/index.js';
 import { Path } from '../../platform/graph/path/index.js';
 import { projectError, protocolError } from '../invocation/result/index.js';
-import { composedIdentity, signCallback, signDomainCallback } from './callback.js';
+import { composedIdentity, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, signDomainCallback, } from './callback.js';
 import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
 const DEFAULT_ROUTE_AGE_MS = 60_000;
@@ -52,13 +52,21 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
     if (established.verified.iss !== expectedKernel) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const callbackCredential = await signCallback(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, composedIdentity(established.delegation.credential), established.verified, execution);
+    const callbackIdentity = composedIdentity(established.delegation.credential);
+    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, callbackIdentity, established.verified, execution);
     const session = new ClientSession({
         kernel: expectedKernel,
         fetch: boundedFetch(configuration.fetch, execution.signal),
         auth: {
-            ttlSeconds: callbackTtl(execution.deadline),
-            resolve: () => ({ credential: callbackCredential }),
+            ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
+            async resolve(_call, signal) {
+                const callback = await resolveCallback(signal);
+                signal.throwIfAborted();
+                return {
+                    credential: callback.credential,
+                    delegate: { ttlSeconds: callback.delegateTtlSeconds },
+                };
+            },
         },
         policy: {
             maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,

package/dist/execution/identity/callback.d.ts

@@ -1,5 +1,12 @@
 import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
+export declare const maximumCallbackTtlSeconds = 120;
+export declare const maximumCallbackDelegationTtlSeconds = 60;
+export interface SignedCallback {
+    readonly credential: string;
+    readonly expiresAt: number;
+    readonly delegateTtlSeconds: number;
+}
 export declare function composedIdentity(nested: string | Uint8Array): UnresolvedIdentityExpr;
 export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
     readonly deadline: number;
@@ -9,3 +16,8 @@ export declare function signCallback(signing: SigningMaterial, issuer: IssuerId,
     readonly deadline: number;
     readonly signal: AbortSignal;
 }): Promise<string>;
+/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}): (signal: AbortSignal) => Promise<SignedCallback>;

package/dist/execution/identity/callback.js

@@ -1,7 +1,9 @@
 import { SignJWT } from 'jose';
 import { protocolError } from '../invocation/result/index.js';
 import { requireLive } from './errors.js';
-const CALLBACK_TTL_SECONDS = 120;
+export const maximumCallbackTtlSeconds = 120;
+export const maximumCallbackDelegationTtlSeconds = 60;
+const CALLBACK_DELEGATION_SKEW_SECONDS = 5;
 export function composedIdentity(nested) {
     return Object.freeze({
         kind: 'union',
@@ -12,20 +14,59 @@ export function composedIdentity(nested) {
     });
 }
 export async function signDomainCallback(signing, issuer, subject, audience, execution) {
-    return sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution);
+    return (await sign(signing, issuer, subject, audience, { kind: 'identity', self: true }, execution)).credential;
 }
 export async function signCallback(signing, issuer, subject, audience, expression, carrier, execution) {
     const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
-    return sign(signing, issuer, subject, audience, expression, execution, maximum);
+    return (await sign(signing, issuer, subject, audience, expression, execution, maximum)).credential;
+}
+/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
+export function createCallbackCredentialResolver(signing, issuer, subject, audience, expression, carrier, execution) {
+    const maximum = carrier.exp ?? Number.POSITIVE_INFINITY;
+    let cached;
+    let pending;
+    return async (signal) => {
+        signal.throwIfAborted();
+        requireLive(execution);
+        const now = Math.floor(Date.now() / 1_000);
+        if (cached !== undefined &&
+            now <= cached.expiresAt - CALLBACK_DELEGATION_SKEW_SECONDS - cached.delegateTtlSeconds) {
+            return cached;
+        }
+        if (pending === undefined) {
+            const current = sign(signing, issuer, subject, audience, expression, execution, maximum).then((signed) => {
+                const delegateTtlSeconds = Math.min(maximumCallbackDelegationTtlSeconds, signed.expiresAt - signed.issuedAt - CALLBACK_DELEGATION_SKEW_SECONDS);
+                if (delegateTtlSeconds < 1) {
+                    throw protocolError('AUTH_INVALID', 'Credential is invalid.');
+                }
+                return (cached = Object.freeze({
+                    credential: signed.credential,
+                    expiresAt: signed.expiresAt,
+                    delegateTtlSeconds,
+                }));
+            });
+            pending = current;
+            void current.then(() => {
+                if (pending === current)
+                    pending = undefined;
+            }, () => {
+                if (pending === current)
+                    pending = undefined;
+            });
+        }
+        return withSignal(pending, signal);
+    };
 }
 async function sign(signing, issuer, subject, audience, expression, execution, maximum = Number.POSITIVE_INFINITY) {
+    requireLive(execution);
+    const privateKey = await withSignal(signing.privateKey, execution.signal);
     requireLive(execution);
     const now = Math.floor(Date.now() / 1_000);
-    const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + CALLBACK_TTL_SECONDS);
+    const expiresAt = Math.min(maximum, Math.floor(execution.deadline / 1_000), now + maximumCallbackTtlSeconds);
     if (!Number.isFinite(expiresAt) || expiresAt <= now) {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    return new SignJWT({ grant: { v: 1, expr: expression } })
+    const credential = await withSignal(new SignJWT({ grant: { v: 1, expr: expression } })
         .setProtectedHeader({
         alg: signing.algorithm,
         ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
@@ -35,5 +76,26 @@ async function sign(signing, issuer, subject, audience, expression, execution, m
         .setAudience(audience)
         .setIssuedAt(now)
         .setExpirationTime(expiresAt)
-        .sign(await signing.privateKey);
+        .sign(privateKey), execution.signal);
+    requireLive(execution);
+    return Object.freeze({ credential, issuedAt: now, expiresAt });
+}
+function withSignal(operation, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal.removeEventListener('abort', abort);
+        const abort = () => {
+            cleanup();
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        operation.then((value) => {
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            cleanup();
+            reject(error);
+        });
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.5.0-beta.53",
+  "version": "0.5.0-beta.55",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -213,11 +213,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.20",
-    "@astrale-os/kernel-core": "0.9.0-beta.16",
-    "@astrale-os/kernel-dsl": "0.2.0-beta.13",
-    "@astrale-os/kernel-protocol": "0.5.0-beta.16",
-    "@astrale-os/kernel-server": "0.5.0-beta.17",
+    "@astrale-os/kernel-client": "0.6.0-beta.22",
+    "@astrale-os/kernel-core": "0.9.0-beta.17",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.14",
+    "@astrale-os/kernel-protocol": "0.5.0-beta.17",
+    "@astrale-os/kernel-server": "0.5.0-beta.18",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "hono": "^4.13.2",
     "jose": "^6.2.9",