@astrale-os/sdk 0.6.0-beta.3 → 0.6.0-beta.31

package/dist/deployment/worker/response.d.ts

@@ -0,0 +1,101 @@
+import type { WorkerRecord, WorkerRecordWireV1 } from './record.js';
+/** Where a Worker host addresses Services and deployments. */
+export interface WorkerHostingV1 {
+    /**
+     * The DNS name every URL ends with: `https://<service>.<routingDomain>` serves a Service's
+     * current deployment, `https://<label>.<routingDomain>` one deployment.
+     */
+    readonly routingDomain: string;
+}
+/** What a host lists: the deployments of the caller's Services, optionally of one project or environment. */
+export interface WorkerDeploymentListRequestV1 {
+    readonly project?: string;
+    readonly environment?: string;
+}
+/** The lifecycle of one deployment at its host. */
+export type WorkerDeploymentState = 'deploying' | 'active' | 'retiring' | 'retired' | 'failed';
+/**
+ * What a host knows of one deployment. It names a deployment by its label and URL, never by a
+ * provider version. A host keeps every deployment until it is retired: it has no preview, expiry or
+ * last call.
+ */
+export interface WorkerDeploymentSummaryV1 {
+    /** The host's id of the deployment (a node id on Admin's Services). */
+    readonly id: string;
+    readonly url: string;
+    readonly label: string;
+    /** The host's id of the Service this deployment is a version of. */
+    readonly serviceId: string;
+    /** The name of that Service: the first part of the label. */
+    readonly service: string;
+    readonly project: string;
+    readonly environment: string;
+    /** Who owns the Service (an Identity node path on Admin's Services). */
+    readonly owner: string;
+    readonly state: WorkerDeploymentState;
+    /** Whether the Service's stable URL serves this deployment. */
+    readonly current: boolean;
+    readonly createdAt: string;
+    /** When its retirement began; present once it is `retiring`. */
+    readonly retiredAt?: string;
+    readonly buildDigest: string;
+    /** The digest of its `WorkerConfigurationV1`. */
+    readonly configuration: string;
+    /** The RFC 7638 thumbprint of its key, when its configuration asked for a signing identity. */
+    readonly signingKeyId?: string;
+    /** The record it serves, when its configuration asked for one. */
+    readonly record?: WorkerRecordWireV1;
+}
+/** One summary with its record decoded. */
+export type WorkerDeploymentSummary = Omit<WorkerDeploymentSummaryV1, 'record'> & {
+    readonly record?: WorkerRecord;
+};
+/** Why a host refused to host one Worker release. A refusal changed nothing (see each reason). */
+export type WorkerDeploymentRejectionReason = 'invalid-deployment' | 'address-mismatch' | 'build-mismatch' | 'service-owned-elsewhere' | 'deployment-conflict' | 'deployment-retired' | 'hosting-unavailable' | 'service-unavailable';
+export declare const WORKER_DEPLOYMENT_REJECTIONS: readonly WorkerDeploymentRejectionReason[];
+/**
+ * `WorkerDeploymentResponseV1`: a deployment `created` with the request's secrets `bound` to it,
+ * or `reused` with its declared secrets rewritten in place (`updated`) or left `unchanged`, or a
+ * refusal. A refusal changed nothing, except that a `service-unavailable` may follow effects (a
+ * creation that lost its lease after uploading, an in-place rewrite that wrote part of the
+ * values): rerunning the same deploy converges.
+ */
+export type WorkerDeploymentResponseV1 = {
+    readonly kind: 'deployed';
+    readonly state: 'created' | 'reused';
+    readonly secrets: {
+        readonly state: 'bound' | 'updated' | 'unchanged';
+    };
+    readonly deployment: WorkerDeploymentSummaryV1;
+} | WorkerDeploymentRejection;
+export interface WorkerDeploymentRejection {
+    readonly kind: 'rejected';
+    readonly reason: WorkerDeploymentRejectionReason;
+    readonly message: string;
+    /** When a retry may succeed, for a refusal that only waits on another operation. */
+    readonly retryAfter?: string;
+}
+/** One decoded answer of a deploy. */
+export type WorkerDeploymentResult = {
+    readonly kind: 'deployed';
+    readonly state: 'created' | 'reused';
+    readonly secrets: {
+        readonly state: 'bound' | 'updated' | 'unchanged';
+    };
+    readonly deployment: WorkerDeploymentSummary;
+} | WorkerDeploymentRejection;
+/** Admit the answer of a host's `hosting`: exactly its routing domain. */
+export declare function decodeWorkerHosting(input: unknown): WorkerHostingV1;
+/**
+ * Admit the answer of a deploy exactly: a deployment whose state reports the secret state it
+ * pairs with, or a refusal a host can give.
+ */
+export declare function decodeWorkerDeploymentResponse(input: unknown): WorkerDeploymentResult;
+/** Admit the answer of a host's `list`: the summaries of the caller's deployments, in its order. */
+export declare function decodeWorkerDeploymentList(input: unknown): readonly WorkerDeploymentSummary[];
+/**
+ * Admit one summary exactly: node ids and names a person can read, a label whose first part is
+ * the Service's name, the URL of that label, a known state, instants, digests, and a record that
+ * decodes.
+ */
+export declare function decodeWorkerDeploymentSummary(input: unknown): WorkerDeploymentSummary;

package/dist/deployment/worker/response.js

@@ -0,0 +1,207 @@
+import { parseDeploymentLabel } from '../address/label.js';
+import { serviceName } from './address.js';
+import { decodeWorkerRecord } from './record.js';
+export const WORKER_DEPLOYMENT_REJECTIONS = Object.freeze([
+    'invalid-deployment',
+    'address-mismatch',
+    'build-mismatch',
+    'service-owned-elsewhere',
+    'deployment-conflict',
+    'deployment-retired',
+    'hosting-unavailable',
+    'service-unavailable',
+]);
+const STATES = Object.freeze([
+    'deploying',
+    'active',
+    'retiring',
+    'retired',
+    'failed',
+]);
+/** Which secret states each deployment state reports. */
+const SECRETS_BY_STATE = Object.freeze({
+    created: Object.freeze(['bound']),
+    reused: Object.freeze(['updated', 'unchanged']),
+});
+/** Admit the answer of a host's `hosting`: exactly its routing domain. */
+export function decodeWorkerHosting(input) {
+    const value = exact(input, ['routingDomain'], [], 'hosting');
+    if (typeof value.routingDomain !== 'string' || !isDnsName(value.routingDomain)) {
+        invalid('hosting', 'routingDomain');
+    }
+    return Object.freeze({ routingDomain: value.routingDomain });
+}
+/**
+ * Admit the answer of a deploy exactly: a deployment whose state reports the secret state it
+ * pairs with, or a refusal a host can give.
+ */
+export function decodeWorkerDeploymentResponse(input) {
+    const value = exact(input, ['kind'], ['state', 'secrets', 'deployment', 'reason', 'message', 'retryAfter'], 'deploy');
+    if (value.kind === 'rejected') {
+        exact(value, ['kind', 'reason', 'message'], ['retryAfter'], 'refusal');
+        if (!WORKER_DEPLOYMENT_REJECTIONS.includes(value.reason)) {
+            invalid('refusal', 'reason');
+        }
+        if (typeof value.message !== 'string' ||
+            value.message.length < 1 ||
+            value.message.length > 500) {
+            invalid('refusal', 'message');
+        }
+        if (value.retryAfter !== undefined && !isInstant(value.retryAfter)) {
+            invalid('refusal', 'retryAfter');
+        }
+        return Object.freeze({
+            kind: 'rejected',
+            reason: value.reason,
+            message: value.message,
+            ...(value.retryAfter === undefined ? {} : { retryAfter: value.retryAfter }),
+        });
+    }
+    exact(value, ['kind', 'state', 'secrets', 'deployment'], [], 'deploy');
+    if (value.kind !== 'deployed')
+        invalid('deploy', 'kind');
+    if (value.state !== 'created' && value.state !== 'reused')
+        invalid('deploy', 'state');
+    const secrets = exact(value.secrets, ['state'], [], 'secrets');
+    const allowed = SECRETS_BY_STATE[value.state];
+    if (typeof secrets.state !== 'string' || !allowed.includes(secrets.state)) {
+        invalid('deploy', 'secrets.state');
+    }
+    return Object.freeze({
+        kind: 'deployed',
+        state: value.state,
+        secrets: Object.freeze({ state: secrets.state }),
+        deployment: decodeWorkerDeploymentSummary(value.deployment),
+    });
+}
+/** Admit the answer of a host's `list`: the summaries of the caller's deployments, in its order. */
+export function decodeWorkerDeploymentList(input) {
+    const value = exact(input, ['deployments'], [], 'list');
+    if (!Array.isArray(value.deployments))
+        invalid('list', 'deployments');
+    return Object.freeze(value.deployments.map((deployment) => decodeWorkerDeploymentSummary(deployment)));
+}
+/**
+ * Admit one summary exactly: node ids and names a person can read, a label whose first part is
+ * the Service's name, the URL of that label, a known state, instants, digests, and a record that
+ * decodes.
+ */
+export function decodeWorkerDeploymentSummary(input) {
+    const value = exact(input, [
+        'id',
+        'url',
+        'label',
+        'serviceId',
+        'service',
+        'project',
+        'environment',
+        'owner',
+        'state',
+        'current',
+        'createdAt',
+        'buildDigest',
+        'configuration',
+    ], ['retiredAt', 'signingKeyId', 'record'], 'deployment');
+    for (const key of [
+        'id',
+        'url',
+        'label',
+        'serviceId',
+        'service',
+        'project',
+        'environment',
+        'owner',
+    ]) {
+        if (typeof value[key] !== 'string' || !isPrintable(value[key]))
+            invalid('deployment', key);
+    }
+    if (value.signingKeyId !== undefined) {
+        if (typeof value.signingKeyId !== 'string' || !isPrintable(value.signingKeyId)) {
+            invalid('deployment', 'signingKeyId');
+        }
+    }
+    let line;
+    try {
+        line = parseDeploymentLabel(value.label).line;
+    }
+    catch {
+        invalid('deployment', 'label');
+    }
+    if (value.service !== line)
+        invalid('deployment', 'service');
+    let named;
+    try {
+        named = serviceName(value.project, value.environment);
+    }
+    catch {
+        invalid('deployment', 'project');
+    }
+    if (named !== line)
+        invalid('deployment', 'service');
+    if (!isDeploymentUrl(value.url, value.label))
+        invalid('deployment', 'url');
+    if (!STATES.includes(value.state))
+        invalid('deployment', 'state');
+    if (typeof value.current !== 'boolean')
+        invalid('deployment', 'current');
+    if (!isInstant(value.createdAt))
+        invalid('deployment', 'createdAt');
+    if (value.retiredAt !== undefined && !isInstant(value.retiredAt))
+        invalid('deployment', 'retiredAt');
+    for (const key of ['buildDigest', 'configuration']) {
+        if (typeof value[key] !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(value[key])) {
+            invalid('deployment', key);
+        }
+    }
+    let record;
+    if (value.record !== undefined) {
+        try {
+            record = decodeWorkerRecord(value.record);
+        }
+        catch {
+            invalid('deployment', 'record');
+        }
+    }
+    const summary = { ...value };
+    delete summary.record;
+    return Object.freeze({
+        ...summary,
+        ...(record === undefined ? {} : { record }),
+    });
+}
+/** `https://<label>.<routing domain>`, nothing more. */
+function isDeploymentUrl(url, label) {
+    const prefix = `https://${label}.`;
+    return url.startsWith(prefix) && isDnsName(url.slice(prefix.length));
+}
+/** Text a person can read in a listing: at most 512 characters, none of them a control character. */
+function isPrintable(value) {
+    return value.length > 0 && value.length <= 512 && !/[\p{Cc}]/u.test(value);
+}
+function isInstant(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= 64 &&
+        !Number.isNaN(Date.parse(value)));
+}
+function isDnsName(value) {
+    return (value.length <= 253 &&
+        value.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)));
+}
+function exact(input, required, optional, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(label);
+    const value = input;
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== 'string' || (!required.includes(key) && !optional.includes(key))) {
+            invalid(label, String(key));
+        }
+    }
+    for (const key of required)
+        if (!Object.hasOwn(value, key))
+            invalid(label, key);
+    return value;
+}
+function invalid(label, member) {
+    throw new TypeError(`The Worker host returned an invalid ${label} answer${member === undefined ? '' : ` (${member})`}.`);
+}

package/dist/execution/identity/authentication.d.ts

@@ -1,9 +1,18 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type { CredentialInput, Grant, IssuerId } from '../../platform/auth/index.js';
-import type { AuthenticatedInvocation } from '../invocation/index.js';
+import type { CredentialInput, IdentityId, IssuerId } from '../../platform/auth/index.js';
+import type { AuthenticatedInvocation, SelfInvocation } from '../invocation/index.js';
 import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
+import { ClientSession } from '../../platform/client/session/index.js';
+import { NodeId } from '../../platform/graph/node/index.js';
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export declare const DEFAULT_ROUTE_AGE_MS = 60000;
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
     readonly issuer: IssuerId;
@@ -17,5 +26,26 @@ export declare function authenticate(credentialInput: CredentialInput, expectedK
     readonly deadline: number;
     readonly signal: AbortSignal;
 }, configuration: AuthenticationConfiguration): Promise<AuthenticatedInvocation>;
-export declare function acceptResolvedDelegation(input: unknown): Grant;
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export declare function selfInvocation(kernel: IssuerId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): SelfInvocation;
+/**
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
+ */
+export declare function executorSession(kernel: IssuerId, executionId: NodeId, execution: {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}, configuration: AuthenticationConfiguration): ClientSession;
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
+export declare function acceptResolvedDelegation(input: unknown): IdentityId;
 export type { VerificationBasis };

package/dist/execution/identity/authentication.js

@@ -7,10 +7,16 @@ import { bindSession, ClientSession } from '../../platform/client/session/index.
 import { NodeId } from '../../platform/graph/node/index.js';
 import { Path } from '../../platform/graph/path/index.js';
 import { projectError, protocolError } from '../invocation/result/index.js';
-import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, signDomainCallback, } from './callback.js';
-import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
+import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, selfIdentity, signDomainCallback, } from './callback.js';
+import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, httpIssuer, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export const DEFAULT_ROUTE_AGE_MS = 60_000;
 export async function admit(request, configuration) {
     const execution = request.context.execution;
     requireLive(execution);
@@ -32,10 +38,7 @@ export async function admit(request, configuration) {
         }), {
             signal: execution.signal,
             timeoutMs: Math.max(1, execution.deadline - Date.now()),
-            delegate: {
-                ttlSeconds: callbackTtl(execution.deadline),
-                attenuation: { kind: 'identity', self: true },
-            },
+            delegate: { ttlSeconds: callbackTtl(execution.deadline) },
         });
         return result.value;
     }
@@ -53,15 +56,14 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
     const expressions = callbackIdentities(established.delegation.credential);
+    const session = (expression) => callbackSession(expectedKernel, expression, established.verified, execution, configuration);
     const sessions = Object.freeze({
-        caller: callbackSession(expressions.caller),
-        self: callbackSession(expressions.self),
-        union: callbackSession(expressions.union),
+        caller: session(expressions.caller),
+        self: session(expressions.self),
     });
     const graph = Object.freeze({
         caller: bindSession(sessions.caller, execution),
         self: bindSession(sessions.self, execution),
-        union: bindSession(sessions.union, execution),
     });
     let closed = false;
     return Object.freeze({
@@ -73,35 +75,67 @@ export async function authenticate(credentialInput, expectedKernel, execution, c
             closed = true;
             sessions.caller.close();
             sessions.self.close();
-            sessions.union.close();
         },
     });
-    function callbackSession(expression) {
-        const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, expectedKernel, expression, established.verified, execution);
-        return new ClientSession({
-            kernel: expectedKernel,
-            fetch: boundedFetch(configuration.fetch, execution.signal),
-            auth: {
-                ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
-                async resolve(_call, signal) {
-                    const callback = await resolveCallback(signal);
-                    signal.throwIfAborted();
-                    return {
-                        credential: callback.credential,
-                        delegate: { ttlSeconds: callback.delegateTtlSeconds },
-                    };
-                },
-            },
-            policy: {
-                maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
-                ...(configuration.policy.allowEndpoint === undefined
-                    ? {}
-                    : { allowEndpoint: configuration.policy.allowEndpoint }),
-                ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+}
+/**
+ * The Domain's own authority toward the source Kernel of an admitted call that carries no
+ * credential. No caller credential bounds it: its callbacks live as long as the execution, exactly
+ * as the `self` half of an authenticated call does within its carrier.
+ */
+export function selfInvocation(kernel, execution, configuration) {
+    requireLive(execution);
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    const session = callbackSession(admitted, selfIdentity, undefined, execution, configuration);
+    let closed = false;
+    return Object.freeze({
+        graph: Object.freeze({ self: bindSession(session, execution) }),
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            session.close();
+        },
+    });
+}
+/**
+ * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`,
+ * which no caller credential carries: the run acts as its executor, never as its initiator. Every
+ * credential names `executionId` in `EXECUTION_CLAIM`, so the Kernel can accept a replaced issuer
+ * for the steps of a run in flight at a consented issuer change. The caller owns the returned
+ * Session.
+ */
+export function executorSession(kernel, executionId, execution, configuration) {
+    const admitted = httpIssuer(kernel, configuration.policy.allowInsecureHttp === true);
+    admitEndpoint(invocationUrl(admitted), configuration.policy);
+    return callbackSession(admitted, selfIdentity, undefined, execution, configuration, executionId);
+}
+function callbackSession(kernel, expression, carrier, execution, configuration, executionId) {
+    const resolveCallback = createCallbackCredentialResolver(configuration.signing, configuration.issuer, configuration.subject, kernel, expression, carrier, execution, executionId);
+    return new ClientSession({
+        kernel,
+        fetch: boundedFetch(configuration.fetch, execution.signal),
+        auth: {
+            ttlSeconds: Math.min(callbackTtl(execution.deadline), maximumCallbackDelegationTtlSeconds),
+            async resolve(_call, signal) {
+                const callback = await resolveCallback(signal);
+                signal.throwIfAborted();
+                return {
+                    credential: callback.credential,
+                    delegate: { ttlSeconds: callback.delegateTtlSeconds },
+                };
             },
-            timeoutMs: Math.max(1, execution.deadline - Date.now()),
-        });
-    }
+        },
+        policy: {
+            maximumRouteAgeMs: DEFAULT_ROUTE_AGE_MS,
+            ...(configuration.policy.allowEndpoint === undefined
+                ? {}
+                : { allowEndpoint: configuration.policy.allowEndpoint }),
+            ...(configuration.policy.allowInsecureHttp === true ? { allowInsecureHttp: true } : {}),
+        },
+        timeoutMs: Math.max(1, execution.deadline - Date.now()),
+    });
 }
 async function establishCaller(input, audience, verification, execution, policy) {
     requireLive(execution);
@@ -115,7 +149,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         if (proof.verified.sub !== context.verified.sub) {
             throw new CredentialRejected('Destination carrier and authority proof subjects differ.');
         }
-        const authority = acceptResolvedDelegation(proof.verified.claims.delegation);
+        const identity = acceptResolvedDelegation(proof.verified.claims.delegation);
         let principal;
         try {
             principal = NodeId(context.verified.sub);
@@ -129,7 +163,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             caller: Object.freeze({
                 kind: 'authenticated',
                 principal,
-                authority,
+                identity,
                 authentication: credential.evidence(context),
             }),
         });
@@ -140,6 +174,7 @@ async function establishCaller(input, audience, verification, execution, policy)
             throw protocolError('BACKEND_UNAVAILABLE', 'Credential issuer is unavailable.');
         }
         if (cause instanceof CredentialRejected ||
+            cause instanceof AuthValueError ||
             cause instanceof joseErrors.JOSEError ||
             cause instanceof protocolErrors.ProtocolError) {
             throw protocolError('AUTH_INVALID', 'Credential is invalid.');
@@ -147,6 +182,7 @@ async function establishCaller(input, audience, verification, execution, policy)
         throw cause;
     }
 }
+/** Accept a Kernel delegation proof claim naming exactly one resolved caller Identity. */
 export function acceptResolvedDelegation(input) {
     if (input === null ||
         typeof input !== 'object' ||
@@ -157,5 +193,14 @@ export function acceptResolvedDelegation(input) {
         Reflect.get(input, 'v') !== 1) {
         throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected resolved delegation.');
     }
-    return grant.accept({ expr: Reflect.get(input, 'expr') });
+    const raw = Reflect.get(input, 'expr');
+    // grant.accept collapses duplicate operands (union(X, X) becomes X), so the leaf is checked as sent.
+    if (raw === null || typeof raw !== 'object' || Reflect.get(raw, 'kind') !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    const { expr } = grant.accept({ expr: raw });
+    if (expr.kind !== 'identity') {
+        throw new AuthValueError('AUTH_GRANT_INVALID', 'Expected one resolved caller Identity.');
+    }
+    return expr.id;
 }

package/dist/execution/identity/callback.d.ts

@@ -1,4 +1,5 @@
 import type { IssuerId, UnresolvedIdentityExpr, VerifiedCredential } from '../../platform/auth/index.js';
+import type { NodeId } from '../../platform/graph/node/index.js';
 import type { SigningMaterial } from './signing.js';
 export declare const maximumCallbackTtlSeconds = 120;
 export declare const maximumCallbackDelegationTtlSeconds = 60;
@@ -7,8 +8,13 @@ export interface SignedCallback {
     readonly expiresAt: number;
     readonly delegateTtlSeconds: number;
 }
-export type CallbackGrantMode = 'caller' | 'self' | 'union';
-/** Exact callback Grant expressions corresponding to the Kernel Domain graph modes. */
+export type CallbackMode = 'caller' | 'self';
+/** The Domain's own authority, independent of any caller. */
+export declare const selfIdentity: Readonly<{
+    kind: 'identity';
+    self: true;
+}>;
+/** Exact single-identity callback authority for each Kernel Domain graph mode. */
 export declare function callbackIdentities(nested: string | Uint8Array): Readonly<{
     caller: Readonly<{
         kind: 'identity';
@@ -18,16 +24,6 @@ export declare function callbackIdentities(nested: string | Uint8Array): Readonl
         kind: 'identity';
         self: true;
     }>;
-    union: Readonly<{
-        kind: 'union';
-        operands: readonly (Readonly<{
-            kind: 'identity';
-            credential: string | Uint8Array<ArrayBufferLike>;
-        }> | Readonly<{
-            kind: 'identity';
-            self: true;
-        }>)[];
-    }>;
 }>;
 export declare function signDomainCallback(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, execution: {
     readonly deadline: number;
@@ -37,8 +33,13 @@ export declare function signCallback(signing: SigningMaterial, issuer: IssuerId,
     readonly deadline: number;
     readonly signal: AbortSignal;
 }): Promise<string>;
-/** Reuse one exact callback authority partition, refreshing only near its bounded expiry. */
-export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential, execution: {
+/**
+ * Reuse one exact callback authority partition, refreshing only near its bounded expiry. Without a
+ * carrier the callback is the Domain's own authority, bounded by the execution alone. An
+ * `executionId` is the durable Execution a step's executor credential names in `EXECUTION_CLAIM`;
+ * no caller-bound callback names one.
+ */
+export declare function createCallbackCredentialResolver(signing: SigningMaterial, issuer: IssuerId, subject: string, audience: IssuerId, expression: UnresolvedIdentityExpr, carrier: VerifiedCredential | undefined, execution: {
     readonly deadline: number;
     readonly signal: AbortSignal;
-}): (signal: AbortSignal) => Promise<SignedCallback>;
+}, executionId?: NodeId): (signal: AbortSignal) => Promise<SignedCallback>;