@humwick/server 0.130.1 → 0.130.3

package/node_modules/@humwick/kernel/http-transport.ts

@@ -1,384 +0,0 @@
-import { RELAY_TOKEN_HEADER, HUMWICK_TOKEN_HEADER } from "@humwick/sdk";
-import { OpenAPIHono } from "@hono/zod-openapi";
-import type { Context } from "hono";
-import type { ContentfulStatusCode } from "hono/utils/http-status";
-import { z } from "zod";
-import {
-  type Grant,
-  type HttpMethod,
-  type ModuleDefinition,
-  type ModuleManifest,
-  type OpDecl,
-  OpError,
-} from "./contract";
-import { httpRouteCollisionKey } from "./manifest-validation";
-import { advertisedScopesOf } from "./mcp-transport";
-import type { InvocationIdentity, ModuleHost } from "./module-host";
-
-/**
- * K6b-1 — the HTTP transport, *derived* from a `defineModule` manifest.
- *
- * There is no hand-written per-op route code here. {@link deriveHttpRoutes} reads each op's
- * manifest `http: { method, path }` declaration (K6-contract §OpDecl) and produces the route
- * list; both the Hono router and the OpenAPI document are built from that single list, so the
- * served surface and the generated spec cannot drift.
- *
- * The transport is deliberately thin. It does NOT re-implement any kernel gate: every request is
- * (a) parsed into the op's raw input, (b) handed to {@link ModuleHost.invoke}, which owns
- * authorization (default-deny), input/output validation, and the atomic entity+event commit, and
- * (c) mapped from the typed result / {@link OpError} back to an HTTP response. No request
- * validation middleware runs at the edge — the invoker is the single validation/authz authority,
- * so there is no path that reaches a handler without passing through it.
- */
-
-/** How the edge resolves the caller identity for one request. The owning scope is kernel-injected
- * by the invoker (always `local` today); the edge supplies only actor + grants, exactly as K6a. */
-export type IdentityResolver = (c: Context) => InvocationIdentity;
-
-/** Default-deny at the edge: absent an explicit resolver, every request carries no grants, so the
- * invoker denies every op with a 403 before any handler or session runs. */
-const DEFAULT_DENY_IDENTITY: InvocationIdentity = Object.freeze({ actor: "anonymous", grants: [] });
-
-export interface HttpTransportOptions {
-  /** Resolve the request Principal. Defaults to a no-grant identity (default-deny end-to-end). */
-  readonly identify?: IdentityResolver;
-  /** Where the generated OpenAPI document is served. Defaults to `/openapi.json`. */
-  readonly docPath?: string;
-  /** Whether to serve the generated OpenAPI document at all. Defaults to `true` (unchanged behavior).
-   *  A future `/api/kernel` mount can set this `false` to withhold the public doc route and gate the
-   *  spec itself behind its own auth — this option only omits the built-in unauthenticated doc route;
-   *  it is NOT wired to any mount here. */
-  readonly serveOpenApiDoc?: boolean;
-  /** OpenAPI `info` block. Title/version default from the manifest. */
-  readonly info?: { readonly title?: string; readonly version?: string };
-}
-
-/** One HTTP endpoint derived from an op's `http` declaration. The router and the OpenAPI doc are
- * both generated from these — the sole source of the served surface. */
-export interface DerivedHttpRoute {
-  readonly opName: string;
-  readonly op: OpDecl;
-  readonly method: HttpMethod;
-  /** OpenAPI-style path with `{param}` placeholders (as declared in the manifest). */
-  readonly openapiPath: string;
-  /** Hono-style path with `:param` placeholders (what the router mounts). */
-  readonly honoPath: string;
-  readonly paramNames: readonly string[];
-  /** True for methods that carry a request body (POST/PUT/PATCH); false for GET/DELETE/HEAD. */
-  readonly hasBody: boolean;
-  /** The success status the router returns and the OpenAPI doc declares (POST → 201, else 200). */
-  readonly successStatus: number;
-  readonly grant: Grant;
-  readonly kind: "query" | "mutation";
-}
-
-/** Faithful `OpError.code` → HTTP status map (matches the codes the invoker mints). Falls back to
- * the error's own status, then 500, so an unmapped code can never masquerade as success. */
-const CODE_TO_STATUS: Readonly<Record<string, number>> = {
-  unknown_op: 404,
-  not_found: 404,
-  unauthorized: 403,
-  invalid_input: 400,
-  conflict: 409,
-  invalid_output: 500,
-};
-
-function statusForOpError(error: OpError): number {
-  return CODE_TO_STATUS[error.code] ?? error.status ?? 500;
-}
-
-const BODY_METHODS: ReadonlySet<HttpMethod> = new Set(["POST", "PUT", "PATCH"]);
-const PARAM_PATTERN = /\{([^}]+)\}/g;
-
-function paramNamesOf(openapiPath: string): string[] {
-  return [...openapiPath.matchAll(PARAM_PATTERN)].map((m) => m[1]!);
-}
-
-function toHonoPath(openapiPath: string): string {
-  return openapiPath.replace(PARAM_PATTERN, ":$1");
-}
-
-/** The declared key set of a Zod object schema, or null when the schema is not a plain object. */
-function objectKeys(schema: unknown): string[] | null {
-  const shape = (schema as { shape?: Record<string, unknown> } | undefined)?.shape;
-  return shape && typeof shape === "object" ? Object.keys(shape) : null;
-}
-
-/** Drop the path-param fields from an object input, leaving the query/body portion. */
-function omitParams(schema: z.ZodType, paramNames: readonly string[]): z.ZodType {
-  if (paramNames.length === 0) return schema;
-  const omittable = schema as unknown as { omit?: (mask: Record<string, true>) => z.ZodType };
-  if (typeof omittable.omit !== "function") return schema;
-  try {
-    return omittable.omit(Object.fromEntries(paramNames.map((n) => [n, true as const])));
-  } catch {
-    return schema;
-  }
-}
-
-/**
- * Derive the HTTP route list from a manifest: one {@link DerivedHttpRoute} per op that declares an
- * `http: { method, path }`. This is the single derivation both the router and the OpenAPI document
- * consume — there is no second, hand-written list to fall out of sync with.
- */
-export function deriveHttpRoutes(module: ModuleDefinition): DerivedHttpRoute[] {
-  const routes: DerivedHttpRoute[] = [];
-  // Defense-in-depth: `assertValidManifest` already rejects a method+path collision at
-  // `defineModule` time. Guard again here so a route collision can never silently reach the router
-  // (first-registered wins) and the OpenAPI doc (last-registered wins) in different directions.
-  const seenBy = new Map<string, string>();
-  const ops = module.ops ?? {};
-  for (const [opName, op] of Object.entries(ops)) {
-    const http = op.http;
-    if (!http) continue;
-    // An explicit `expose.http === false` opts an op out of the HTTP surface even if it carries a
-    // route declaration; anything else with an `http` decl is served.
-    if (op.expose && op.expose.http === false) continue;
-    const openapiPath = http.path;
-    const routeKey = httpRouteCollisionKey(http.method, openapiPath);
-    const collidesWith = seenBy.get(routeKey);
-    if (collidesWith !== undefined) {
-      throw new Error(`duplicate HTTP route '${http.method} ${openapiPath}': declared by both '${collidesWith}' and '${opName}' (path params are matched by position, not name)`);
-    }
-    seenBy.set(routeKey, opName);
-    routes.push({
-      opName,
-      op,
-      method: http.method,
-      openapiPath,
-      honoPath: toHonoPath(openapiPath),
-      paramNames: paramNamesOf(openapiPath),
-      hasBody: BODY_METHODS.has(http.method),
-      successStatus: http.method === "POST" ? 201 : 200,
-      grant: op.grant,
-      kind: op.kind,
-    });
-  }
-  return routes;
-}
-
-/** The shared error-body schema (the invoker's typed failure, incl. the invalid_input field map). */
-const errorSchema = z.object({
-  error: z.object({
-    code: z.string(),
-    message: z.string(),
-    fields: z.record(z.string(), z.array(z.string())).optional(),
-  }),
-});
-
-function componentName(moduleId: string, opName: string, suffix: "Input" | "Output"): string {
-  const pascal = (s: string) => s.replace(/(^|[-_.])(\w)/g, (_, __, c: string) => c.toUpperCase());
-  return `${pascal(moduleId)}_${pascal(opName)}_${suffix}`;
-}
-
-/** The REAL transport auth schemes the Kernel accepts, matching how the rest of humwick
- *  authenticates (`docs/openapi.json` + the Dashboard `dashboard/src/lib/api.ts`): a component token
- *  presented as an HTTP bearer, or in the `X-Agent-Relay-Token` header. There is NO OAuth deployment
- *  behind `/api/kernel` — the previous `oauth2` + `urn:kernel:control` scheme was fake metadata (sol
- *  finding 2). Per OpenAPI §4.8.5 an `http`/`apiKey` scheme's SecurityRequirement scope array MUST be
- *  empty, so the per-op grant requirement is advertised out-of-band in the {@link RELAY_SCOPES_EXTENSION}
- *  operation extension instead — advisory only; the invoker's default-deny is the actual gate. */
-const BEARER_SCHEME = "bearerAuth";
-const TOKEN_HEADER_SCHEME = "tokenHeader";
-const TOKEN_HEADER_NAME = RELAY_TOKEN_HEADER;
-const HUMWICK_TOKEN_SCHEME = "humwickTokenHeader";
-
-/** The vendor extension each operation carries its advisory grant requirement under (O3). It mirrors
- *  the derived MCP tool's `requiredScopes` — the SAME {@link advertisedScopesOf} derivation — so the
- *  HTTP surface names the honest requirement (e.g. `control:admin` for an admin-only read) without
- *  abusing the security scope array, which must stay empty for token schemes. */
-const RELAY_SCOPES_EXTENSION = "x-relay-scopes";
-
-/** The security requirement one op advertises: the caller may authenticate with EITHER real scheme
- *  (bearer OR the token header — an OR list of single-scheme requirements), each with an empty scope
- *  array as the spec requires. The advisory grant requirement rides {@link RELAY_SCOPES_EXTENSION}. */
-function securityFor(): Array<Record<string, string[]>> {
-  return [{ [BEARER_SCHEME]: [] }, { [TOKEN_HEADER_SCHEME]: [] }, { [HUMWICK_TOKEN_SCHEME]: [] }];
-}
-
-/** Register bearer and both component-token header spellings (#3470). Registered
- *  only when at least one route exists (an empty module advertises nothing). */
-function registerSecurityScheme(registry: OpenAPIHono["openAPIRegistry"], routes: readonly DerivedHttpRoute[]): void {
-  if (routes.length === 0) return;
-  registry.registerComponent("securitySchemes", BEARER_SCHEME, {
-    type: "http",
-    scheme: "bearer",
-    bearerFormat: "JWT",
-    description: "Humwick component token (JWT) presented as `Authorization: Bearer <token>`. The Kernel derives the caller's identity and scopes solely from this verified token.",
-  });
-  registry.registerComponent("securitySchemes", HUMWICK_TOKEN_SCHEME, {
-    type: "apiKey", in: "header", name: HUMWICK_TOKEN_HEADER,
-    description: "Humwick component token. Equivalent to bearer authentication.",
-  });
-  registry.registerComponent("securitySchemes", TOKEN_HEADER_SCHEME, {
-    type: "apiKey",
-    in: "header",
-    name: TOKEN_HEADER_NAME,
-    description: `Humwick component token presented in the \`${TOKEN_HEADER_NAME}\` header (the Dashboard path). Equivalent to the bearer scheme.`,
-  });
-}
-
-/**
- * Register every derived route on an {@link OpenAPIHono}: its OpenAPI path + I/O component schemas,
- * and — when a host is supplied — its serving handler. Doc-only registration (no host) and full
- * serving registration walk the identical route list, so `app.getOpenAPIDocument()` always
- * describes exactly what the router serves.
- */
-function registerModule<M extends ModuleManifest>(
-  app: OpenAPIHono,
-  module: ModuleDefinition<M>,
-  host: ModuleHost | undefined,
-  identify: IdentityResolver,
-): void {
-  const registry = app.openAPIRegistry;
-  const errorRef = registry.register("Error", errorSchema);
-  const errorContent = { content: { "application/json": { schema: errorRef } } };
-
-  const routes = deriveHttpRoutes(module);
-  if (routes.length > 0) registerSecurityScheme(registry, routes);
-
-  for (const route of routes) {
-    const { op, opName } = route;
-    const inputRef = registry.register(componentName(module.id, opName, "Input"), op.input as z.ZodType);
-    const outputRef = registry.register(componentName(module.id, opName, "Output"), op.output as z.ZodType);
-
-    // Request shape: path params are always strings on the wire; the remaining input fields are the
-    // JSON body (body methods) or the query string (GET/DELETE/HEAD).
-    const request: Record<string, unknown> = {};
-    if (route.paramNames.length > 0) {
-      request.params = z.object(Object.fromEntries(route.paramNames.map((n) => [n, z.string()])));
-    }
-    const nonParamKeys = objectKeys(op.input);
-    const hasNonParamFields = nonParamKeys === null || nonParamKeys.some((k) => !route.paramNames.includes(k));
-    if (route.hasBody) {
-      request.body = { content: { "application/json": { schema: inputRef } }, required: hasNonParamFields };
-    } else if (hasNonParamFields) {
-      request.query = omitParams(op.input as z.ZodType, route.paramNames);
-    }
-
-    // The success response plus the transport's faithful error surface — 404/403 apply to every op,
-    // 400 to every op (input is always validated), 409 to mutations, 500 always (invalid_output).
-    const responses: Record<string, unknown> = {
-      [route.successStatus]: {
-        description: op.summary,
-        content: { "application/json": { schema: outputRef } },
-      },
-      400: { description: "invalid input", ...errorContent },
-      403: { description: "unauthorized", ...errorContent },
-      404: { description: "not found", ...errorContent },
-      500: { description: "internal error", ...errorContent },
-    };
-    if (route.kind === "mutation") responses[409] = { description: "conflict", ...errorContent };
-
-    registry.registerPath({
-      method: route.method.toLowerCase() as Lowercase<HttpMethod>,
-      path: route.openapiPath,
-      summary: op.summary,
-      operationId: `${module.id}.${opName}`,
-      // The caller authenticates with a real component token (bearer OR X-Agent-Relay-Token). The
-      // security scope arrays stay empty (spec §4.8.5); the op's REAL grant requirement — derived
-      // identically to the MCP side (O3) — is advertised in the `x-relay-scopes` extension so the
-      // published surface never names a scope that always 403s. Advisory only — never the gate.
-      security: securityFor(),
-      [RELAY_SCOPES_EXTENSION]: [...advertisedScopesOf(op)],
-      request,
-      responses,
-    } as unknown as Parameters<typeof registry.registerPath>[0]);
-
-    if (host) mountHandler(app, module, route, host, identify);
-  }
-}
-
-/** Mount one op's serving handler: resolve identity → assemble raw op input → delegate to the
- * invoker → map the result / typed OpError back to HTTP. No gate is duplicated here. */
-function mountHandler<M extends ModuleManifest>(
-  app: OpenAPIHono,
-  module: ModuleDefinition<M>,
-  route: DerivedHttpRoute,
-  host: ModuleHost,
-  identify: IdentityResolver,
-): void {
-  app.on(route.method, route.honoPath, async (c) => {
-    const identity = identify(c);
-    const rawInput = await assembleInput(c, route);
-    try {
-      const result = await host.invoke(module, route.opName, identity, rawInput);
-      return c.json(result as never, route.successStatus as ContentfulStatusCode);
-    } catch (error) {
-      if (error instanceof OpError) {
-        // `invalid_output` means the op handler itself returned data that violates its own
-        // declared schema — a server-side bug, not caller-facing feedback like `invalid_input`.
-        // Report it generically so its Zod field map / schema-shaped message never reaches the
-        // client, mirroring the non-OpError catch below.
-        const body = error.code === "invalid_output"
-          ? { error: { code: error.code, message: "internal error" } }
-          : {
-              error: {
-                code: error.code,
-                message: error.message,
-                ...(error.fields ? { fields: error.fields } : {}),
-              },
-            };
-        return c.json(body, statusForOpError(error) as ContentfulStatusCode);
-      }
-      // A handler that throws a non-OpError has already been rolled back by the invoker; surface a
-      // generic 500 without leaking internal detail.
-      return c.json({ error: { code: "internal_error", message: "internal error" } }, 500);
-    }
-  });
-}
-
-/** Assemble the op's raw input from the request: path params (authoritative) layered over the JSON
- * body (body methods) or the query string (otherwise). All validation/coercion is the op schema's
- * job, applied by the invoker — the transport never inspects or reshapes field types. */
-async function assembleInput(c: Context, route: DerivedHttpRoute): Promise<unknown> {
-  let base: Record<string, unknown> = {};
-  if (route.hasBody) {
-    try {
-      const parsed = await c.req.json();
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) base = parsed as Record<string, unknown>;
-    } catch {
-      // Missing/invalid JSON body → empty object; the invoker's input validation reports the 400.
-    }
-  } else {
-    base = { ...c.req.query() };
-  }
-  return { ...base, ...c.req.param() };
-}
-
-/** Build a standalone OpenAPI document from the manifest (no serving). Uses the identical route
- * registration as {@link createHttpApp}, so it matches the served surface byte-for-byte. */
-export function buildOpenApiDocument<M extends ModuleManifest>(
-  module: ModuleDefinition<M>,
-  options: HttpTransportOptions = {},
-) {
-  const app = new OpenAPIHono();
-  registerModule(app, module, undefined, options.identify ?? (() => DEFAULT_DENY_IDENTITY));
-  return app.getOpenAPIDocument({
-    openapi: "3.0.0",
-    info: { title: options.info?.title ?? module.title, version: options.info?.version ?? "0.0.0" },
-  });
-}
-
-/**
- * Derive a fully served HTTP surface from a manifest: mount every `http`-declared op through the
- * K6a invoker and serve the matching OpenAPI document. Exercise it in-process with
- * `app.request(...)` — no network bind required.
- */
-export function createHttpApp<M extends ModuleManifest>(
-  host: ModuleHost,
-  module: ModuleDefinition<M>,
-  options: HttpTransportOptions = {},
-): OpenAPIHono {
-  const app = new OpenAPIHono();
-  const identify = options.identify ?? (() => DEFAULT_DENY_IDENTITY);
-  registerModule(app, module, host, identify);
-  if (options.serveOpenApiDoc !== false) {
-    app.doc(options.docPath ?? "/openapi.json", {
-      openapi: "3.0.0",
-      info: { title: options.info?.title ?? module.title, version: options.info?.version ?? "0.0.0" },
-    });
-  }
-  app.notFound((c) => c.json({ error: { code: "not_found", message: "no route for this request" } }, 404));
-  return app;
-}

package/node_modules/@humwick/kernel/identity-grammar.ts

@@ -1,20 +0,0 @@
-const MODULE_ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-const RESOURCE_GRANT = /^([a-z][a-z0-9]*(?:-[a-z0-9]+)*):(read|write|admin)$/;
-const COMMAND_GRANT = /^command:([a-z][a-z0-9]*(?:-[a-z0-9]+)*|\*)$/;
-const RESERVED_MODULE_IDS = new Set(["command"]);
-
-export function matchesModuleId(value: unknown): value is string {
-  return typeof value === "string" && MODULE_ID.test(value) && !RESERVED_MODULE_IDS.has(value);
-}
-
-export function matchesGrant(value: unknown): value is string {
-  return typeof value === "string" && (RESOURCE_GRANT.test(value) || COMMAND_GRANT.test(value));
-}
-
-export function matchResourceGrant(value: string): RegExpExecArray | null {
-  return RESOURCE_GRANT.exec(value);
-}
-
-export function matchesCommandGrant(value: string): boolean {
-  return COMMAND_GRANT.test(value);
-}

package/node_modules/@humwick/kernel/identity.ts

@@ -1,248 +0,0 @@
-import type { Grant, Principal, ResolvedIdentity, Scope } from "./contract";
-import { matchResourceGrant, matchesCommandGrant, matchesGrant, matchesModuleId } from "./identity-grammar";
-
-const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
-
-/** Compatibility aliases are intentionally kept out of the module-facing Grant type. */
-export const LEGACY_SCOPE_GRANTS = Object.freeze({
-  "message:send": "message:write",
-  "mcp:use": "mcp:admin",
-} as const satisfies Readonly<Record<string, Grant>>);
-
-export type LegacyScope = keyof typeof LEGACY_SCOPE_GRANTS;
-
-export interface IdentityClaims {
-  readonly actor: string;
-  readonly scope: string;
-  readonly grants: readonly string[];
-  /** Opaque server-resolved creator attributes carried through to the {@link Principal} verbatim
-   *  (P2-7 durable-effect identity freezing). Never validated against the grant grammar. */
-  readonly resolvedIdentity?: ResolvedIdentity;
-}
-
-export interface LegacyIdentityClaims {
-  readonly actor: string;
-  readonly scope: string;
-  readonly scopes: readonly string[];
-}
-
-export interface AuthorizationRequirement {
-  /** The manifest that owns the operation being invoked. */
-  readonly moduleId: string;
-  /** The operation's declared grant. */
-  readonly grant: Grant;
-}
-
-export class IdentityResolutionError extends Error {
-  constructor(
-    readonly field: "actor" | "scope" | "grants" | "scopes",
-    message: string,
-  ) {
-    super(`invalid identity ${field}: ${message}`);
-    this.name = "IdentityResolutionError";
-  }
-}
-
-export class AuthorizationError extends Error {
-  constructor(
-    readonly actor: string,
-    readonly moduleId: string,
-    readonly requiredGrant: Grant,
-  ) {
-    super(`actor '${actor}' is not authorized for '${moduleId}' (requires '${requiredGrant}')`);
-    this.name = "AuthorizationError";
-  }
-}
-
-class ImmutableGrantSet implements ReadonlySet<Grant> {
-  readonly #values: Set<Grant>;
-
-  constructor(values: Iterable<Grant>) {
-    this.#values = new Set(values);
-    Object.freeze(this);
-  }
-
-  get size(): number {
-    return this.#values.size;
-  }
-
-  has(value: Grant): boolean {
-    return this.#values.has(value);
-  }
-
-  entries(): SetIterator<[Grant, Grant]> {
-    return this.#values.entries();
-  }
-
-  keys(): SetIterator<Grant> {
-    return this.#values.keys();
-  }
-
-  values(): SetIterator<Grant> {
-    return this.#values.values();
-  }
-
-  forEach(callbackfn: (value: Grant, value2: Grant, set: ReadonlySet<Grant>) => void, thisArg?: unknown): void {
-    for (const value of this.#values) callbackfn.call(thisArg, value, value, this);
-  }
-
-  union<U>(other: ReadonlySetLike<U>): Set<Grant | U> {
-    const result = new Set<Grant | U>(this.#values);
-    forEachSetLike(other, (value) => result.add(value));
-    return result;
-  }
-
-  intersection<U>(other: ReadonlySetLike<U>): Set<Grant & U> {
-    const result = new Set<Grant & U>();
-    for (const value of this.#values) {
-      if ((other as ReadonlySetLike<unknown>).has(value)) result.add(value as Grant & U);
-    }
-    return result;
-  }
-
-  difference<U>(other: ReadonlySetLike<U>): Set<Grant> {
-    const result = new Set<Grant>();
-    for (const value of this.#values) {
-      if (!(other as ReadonlySetLike<unknown>).has(value)) result.add(value);
-    }
-    return result;
-  }
-
-  symmetricDifference<U>(other: ReadonlySetLike<U>): Set<Grant | U> {
-    const result = this.union(other);
-    for (const value of this.#values) {
-      if ((other as ReadonlySetLike<unknown>).has(value)) result.delete(value);
-    }
-    return result;
-  }
-
-  isSubsetOf(other: ReadonlySetLike<unknown>): boolean {
-    for (const value of this.#values) {
-      if (!other.has(value)) return false;
-    }
-    return true;
-  }
-
-  isSupersetOf(other: ReadonlySetLike<unknown>): boolean {
-    let isSuperset = true;
-    forEachSetLike(other, (value) => {
-      if (!this.#values.has(value as Grant)) isSuperset = false;
-    });
-    return isSuperset;
-  }
-
-  isDisjointFrom(other: ReadonlySetLike<unknown>): boolean {
-    for (const value of this.#values) {
-      if (other.has(value)) return false;
-    }
-    return true;
-  }
-
-  [Symbol.iterator](): SetIterator<Grant> {
-    return this.values();
-  }
-
-  get [Symbol.toStringTag](): string {
-    return "ImmutableGrantSet";
-  }
-}
-
-/** True only for the ratified flat runtime grammar; malformed/multi-colon grants fail closed. */
-export function isGrant(value: unknown): value is Grant {
-  return matchesGrant(value);
-}
-
-/**
- * Convert old token scopes at the transport boundary. Strict grants pass through unchanged;
- * only the two enumerated legacy spellings are translated, and every other malformed scope
- * rejects the identity rather than being ignored or widened.
- */
-export function adaptLegacyScopes(scopes: readonly string[]): readonly Grant[] {
-  const grants = new Set<Grant>();
-  for (const scope of scopes) {
-    const adapted = Object.hasOwn(LEGACY_SCOPE_GRANTS, scope)
-      ? LEGACY_SCOPE_GRANTS[scope as LegacyScope]
-      : scope;
-    if (!isGrant(adapted)) {
-      throw new IdentityResolutionError("scopes", `unsupported or malformed scope '${scope}'`);
-    }
-    grants.add(adapted);
-  }
-  return Object.freeze([...grants]);
-}
-
-/** Mint the module-visible principal from already-resolved, strict identity claims. */
-export function resolveIdentity(claims: IdentityClaims): Principal {
-  validateIdentityLabel(claims.actor, "actor");
-  validateIdentityLabel(claims.scope, "scope");
-
-  const grants = new Set<Grant>();
-  for (const grant of claims.grants) {
-    if (!isGrant(grant)) {
-      throw new IdentityResolutionError("grants", `unsupported or malformed grant '${grant}'`);
-    }
-    grants.add(grant);
-  }
-
-  return Object.freeze({
-    actor: claims.actor,
-    scope: claims.scope as Scope,
-    grants: new ImmutableGrantSet(grants),
-    // Opaque passthrough — the kernel never interprets these; a module freezes them into a durable
-    // effect's create-time identity. Frozen shallow so the principal stays immutable.
-    ...(claims.resolvedIdentity ? { resolvedIdentity: Object.freeze({ ...claims.resolvedIdentity }) } : {}),
-  });
-}
-
-/** Explicit compatibility entry point for legacy token scope arrays. */
-export function resolveLegacyIdentity(claims: LegacyIdentityClaims): Principal {
-  return resolveIdentity({
-    actor: claims.actor,
-    scope: claims.scope,
-    grants: adaptLegacyScopes(claims.scopes),
-  });
-}
-
-/**
- * Default-deny authorization for an operation declaration.
- *
- * Resource grants must name the invoked module exactly. The global `command:` namespace is the
- * deliberate exception, including command names that happen to be `read`, `write`, or `admin`.
- * Grants are independent capabilities: `admin` does not imply `read` or `write`. `command:*` is
- * the sole wildcard and applies only to well-formed `command:<name>` requirements.
- */
-export function isAuthorized(principal: Principal, requirement: AuthorizationRequirement): boolean {
-  if (!matchesModuleId(requirement.moduleId) || !isGrant(requirement.grant)) return false;
-
-  if (matchesCommandGrant(requirement.grant)) {
-    return principal.grants.has(requirement.grant)
-      || (requirement.grant !== "command:*" && principal.grants.has("command:*"));
-  }
-
-  const resource = matchResourceGrant(requirement.grant);
-  if (resource) {
-    const [, grantModule] = resource;
-    if (grantModule !== requirement.moduleId) return false;
-    return principal.grants.has(requirement.grant);
-  }
-
-  return false;
-}
-
-/** Throwing counterpart for kernel wrappers that must stop before invoking a handler. */
-export function assertAuthorized(principal: Principal, requirement: AuthorizationRequirement): void {
-  if (!isAuthorized(principal, requirement)) {
-    throw new AuthorizationError(principal.actor, requirement.moduleId, requirement.grant);
-  }
-}
-
-function validateIdentityLabel(value: string, field: "actor" | "scope"): void {
-  if (typeof value !== "string" || value.length === 0 || value.trim() !== value || CONTROL_CHARACTER.test(value)) {
-    throw new IdentityResolutionError(field, "must be a non-empty, trimmed string without control characters");
-  }
-}
-
-function forEachSetLike<T>(set: ReadonlySetLike<T>, fn: (value: T) => void): void {
-  const iterator = set.keys();
-  for (let next = iterator.next(); !next.done; next = iterator.next()) fn(next.value);
-}

package/node_modules/@humwick/kernel/index.ts

@@ -1,28 +0,0 @@
-// MUST be first: extends zod with `.openapi()` before any module below builds its schemas, so every
-// module's derived HTTP/OpenAPI surface (createHttpApp) works irrespective of export order. See file.
-import "./openapi-init";
-
-export * from "./config";
-export * from "./contract";
-export * from "./control";
-export * from "./control-authz";
-export * from "./effects";
-export * from "./event-log";
-export * from "./http-transport";
-export * from "./identity";
-export * from "./kernel-persistence";
-export * from "./manifest-validation";
-export * from "./message-authority";
-export * from "./mcp-transport";
-export * from "./module-host";
-// Named re-export (NOT `export *`): the test/chaos-only `commitAtomically` in sqlite-module-host takes a
-// raw `Database` and runs a synchronous transaction, so it is deliberately kept OFF the public
-// `@humwick/kernel` root surface (#1910 K3 review). Only `createSqliteModuleHost` (the sanctioned
-// raw-handle test host) is public; kernel unit tests import `commitAtomically` via the relative path.
-export { createSqliteModuleHost, type SqliteModuleHostOptions } from "./sqlite-module-host";
-export * from "./persistence";
-export * from "./registry";
-export * from "./workflow-journal";
-export * from "./workflow-journal-codec";
-export * from "./workflow-runtime";
-export * from "./workflow-step-commit";