@aopslabs/aops-server 0.2.1 → 0.2.3

package/build/server/chunks/{registry-DO8ob5o1.js → registry-DIreA2IZ.js}

@@ -1,12 +1,14 @@
+import fs__default, { existsSync } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
-import { createRequire } from 'node:module';
-import { pathToFileURL, fileURLToPath } from 'node:url';
-import { validateHostConfig, DomainPluginRegistry, normalizeDomainName } from '@aopslabs/host-core';
-import { p as private_env } from './index.js-BQnOaW3H.js';
-import './aops-runtime-config-CHpDUCdE.js';
-import { existsSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createLeaseAdmissionProvider } from '@aopslabs/host-admission';
+import { createTrustedLocalAuthorityProvider } from '@aopslabs/host-auth';
+import { bootstrapHostRuntime, resolveHostConfig } from '@aopslabs/host-shell';
 import { Worker } from 'node:worker_threads';
-import { A as AdmissionDecisionCache, b as buildAdmittedDomainSnapshot, C as CommercialArtifactError } from './admission-snapshot-C2wGfTWE.js';
+import { AdmissionDecisionCache, buildAdmittedDomainSnapshot, CommercialArtifactError } from '@aopslabs/artifact-trust-contracts';
+import './aops-runtime-config-CHpDUCdE.js';
+import { validateHostConfig } from '@aopslabs/host-core';
 
 const COMMUNITY_FREE_DOMAIN_IDS = Object.freeze([
   "agentspace",
@@ -81,7 +83,7 @@ function applyScheduledCommercialIntegrityFailure(error, now) {
 const configuredAdmission = process.env.AOPS_COMMERCIAL_ADMISSION_CONFIG?.trim();
 if (configuredAdmission) {
   try {
-    const { loadCommercialAdmissionSnapshot } = await import('./commercial-admission-loader-V_vXHdVa.js');
+    const { loadCommercialAdmissionSnapshot } = await import('./commercial-admission-loader-ZGZHRPLe.js');
     const loaded = loadCommercialAdmissionSnapshot(
       configuredAdmission,
       COMMUNITY_FREE_DOMAIN_IDS
@@ -99,9 +101,6 @@ if (configuredAdmission) {
 function getHostAdmissionSnapshot() {
   return cache.read();
 }
-function getCommercialRuntimeProjection() {
-  return commercialRuntime;
-}
 function runCommercialIntegrityVerificationWorker(input, now, options = {}) {
   return new Promise((resolve, reject) => {
     const workerData = {
@@ -168,7 +167,7 @@ async function runScheduledIntegrityVerification() {
     dueAt: now.toISOString()
   });
   try {
-    const { resolveCommercialIntegrityWorkerInput } = await import('./commercial-admission-loader-V_vXHdVa.js');
+    const { resolveCommercialIntegrityWorkerInput } = await import('./commercial-admission-loader-ZGZHRPLe.js');
     await runCommercialIntegrityVerificationWorker(
       resolveCommercialIntegrityWorkerInput(configuredAdmission),
       now
@@ -195,7 +194,7 @@ async function planScheduledIntegrityVerification() {
   if (!configuredAdmission || integrityWorkerRunning || integritySchedulerStopped) return;
   const now = /* @__PURE__ */ new Date();
   try {
-    const { readCommercialAdmissionIntegritySchedule } = await import('./commercial-admission-loader-V_vXHdVa.js');
+    const { readCommercialAdmissionIntegritySchedule } = await import('./commercial-admission-loader-ZGZHRPLe.js');
     const schedule = readCommercialAdmissionIntegritySchedule(configuredAdmission, now);
     if (schedule.state === "authority-unavailable" || schedule.state === "quarantined") {
       applyScheduledCommercialIntegrityFailure(
@@ -253,9 +252,6 @@ process.once(
 function checkHostDomainAdmission(domain, operationId, now) {
   return cache.check(domain, operationId, now);
 }
-function getAdmittedDomainIds() {
-  return getHostAdmissionSnapshot().orderedDomains.map((decision) => decision.domain);
-}
 function getHostAdmissionDiagnostics() {
   const snapshot = getHostAdmissionSnapshot();
   return Object.freeze({
@@ -283,6 +279,8 @@ function getHostAdmissionDiagnostics() {
     })))
   });
 }
+const profile = "static";
+const authority = { "mode": "trusted-local" };
 const host = { "name": "aops-community-server", "apiBasePath": "/api" };
 const runtime = { "env": { "AOPS_PG_URL": { "fromEnv": "AOPS_PG_URL", "required": true } } };
 const pluginLoader = { "strictAllowlist": true, "tolerantBootstrap": false, "allowlist": ["@aopslabs/domain-host-plugin-sys", "./runtime/agentspace-host-adapter.mjs", "./runtime/docman-host-adapter.mjs", "./runtime/projectman-host-adapter.mjs", "@aopslabs/domain-host-plugin-chatv3"] };
@@ -290,6 +288,8 @@ const diagnostics = { "exposePluginBootstrap": true };
 const agentGateway = { "enabled": true, "includeLocal": true, "catalog": { "enabled": true, "manifestProviders": [{ "id": "sys-dcm", "domain": "sys", "enabled": true, "module": "@aopslabs/domain-kit-sys", "exportName": "buildSysDomainCapabilityManifest", "options": { "domainVersion": "0.0.1", "includeDocs": true } }, { "id": "agentspace-dcm", "domain": "agentspace", "enabled": true, "module": "./runtime/agentspace-tooling.mjs", "exportName": "buildCommunityAgentspaceDomainCapabilityManifest", "options": { "domainVersion": "0.0.4", "includeDocs": true } }, { "id": "docman-dcm", "domain": "docman", "enabled": true, "module": "./runtime/docman-tooling.mjs", "exportName": "buildAopsDocmanDomainCapabilityManifest", "options": { "domainVersion": "0.1.3", "includeDocs": true } }, { "id": "projectman-dcm", "domain": "projectman", "enabled": true, "module": "@aopslabs/domain-kit-projectman", "exportName": "buildProjectmanDomainCapabilityManifest", "options": { "domainVersion": "0.1.2", "includeDocs": true } }, { "id": "chatv3-dcm", "domain": "chatv3", "enabled": true, "module": "@aopslabs/domain-kit-chatv3", "exportName": "buildChatv3DomainCapabilityManifest", "options": { "domainVersion": "0.1.0", "includeDocs": true } }] }, "sources": [] };
 const plugins = [{ "domain": "sys", "enabled": true, "module": "@aopslabs/domain-host-plugin-sys", "factory": "createSysPlugin" }, { "domain": "agentspace", "enabled": true, "module": "./runtime/agentspace-host-adapter.mjs", "factory": "createCommunityAgentspacePlugin", "options": { "defaultTenantId": "123e4567-e89b-41d4-a000-000000000001" } }, { "domain": "docman", "enabled": true, "module": "./runtime/docman-host-adapter.mjs", "factory": "createDocmanPlugin", "options": { "defaultScopeId": "00000000-0000-4000-8000-000000000000" } }, { "domain": "projectman", "enabled": true, "module": "./runtime/projectman-host-adapter.mjs", "factory": "createProjectmanPlugin", "options": { "defaultProjectId": "123e4567-e89b-41d4-a000-000000000000", "enableAopsWriteback": true, "failOnWritebackError": false } }, { "domain": "chatv3", "enabled": true, "module": "@aopslabs/domain-host-plugin-chatv3", "factory": "createChatv3Plugin" }];
 const configRaw = {
+  profile,
+  authority,
   host,
   runtime,
   pluginLoader,
@@ -297,22 +297,22 @@ const configRaw = {
   agentGateway,
   plugins
 };
-const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const MODULE_DIR$1 = path.dirname(fileURLToPath(import.meta.url));
 const SERVER_PACKAGE_ROOT_CANDIDATE = [
-  path.resolve(MODULE_DIR, "../../.."),
-  path.resolve(MODULE_DIR, "../../../.."),
-  path.resolve(MODULE_DIR, "../..")
+  path.resolve(MODULE_DIR$1, "../../.."),
+  path.resolve(MODULE_DIR$1, "../../../.."),
+  path.resolve(MODULE_DIR$1, "../..")
 ].find(
   (candidate) => existsSync(path.join(candidate, "runtime", "agentspace-host-adapter.mjs"))
 );
 if (!SERVER_PACKAGE_ROOT_CANDIDATE) {
   throw new Error("community_server_package_root_not_found");
 }
-const SERVER_PACKAGE_ROOT = SERVER_PACKAGE_ROOT_CANDIDATE;
+const SERVER_PACKAGE_ROOT$1 = SERVER_PACKAGE_ROOT_CANDIDATE;
 function resolveCommunityPackageModule(moduleName) {
   if (!moduleName) throw new Error("community_host_module_missing");
   if (!moduleName.startsWith("./runtime/")) return moduleName;
-  return path.join(SERVER_PACKAGE_ROOT, moduleName.slice(2));
+  return path.join(SERVER_PACKAGE_ROOT$1, moduleName.slice(2));
 }
 const COMMUNITY_PLUGIN_MODULES = Object.freeze([
   "@aopslabs/domain-host-plugin-sys",
@@ -354,50 +354,22 @@ function validateStaticCommunityConfig(input) {
   if (config.pluginLoader) {
     config.pluginLoader.allowlist = (config.pluginLoader.allowlist ?? []).map(resolveCommunityPackageModule);
   }
-  const commercial = getCommercialRuntimeProjection();
-  if (commercial) {
-    config.plugins = [
-      ...config.plugins ?? [],
-      {
-        domain: commercial.domain,
-        enabled: true,
-        module: commercial.pluginModule,
-        factory: commercial.pluginFactory
-      }
-    ];
-    const catalog = config.agentGateway?.catalog;
-    if (!catalog) throw new Error("community_host_config_catalog_missing");
-    catalog.manifestProviders = [
-      ...catalog.manifestProviders ?? [],
-      {
-        id: `${commercial.domain}-commercial-dcm`,
-        domain: commercial.domain,
-        enabled: true,
-        module: commercial.manifestModule,
-        exportName: commercial.manifestExport
-      }
-    ];
-    const loader = config.pluginLoader;
-    if (!loader) throw new Error("community_host_config_plugin_loader_missing");
-    loader.allowlist = [...loader.allowlist ?? [], commercial.pluginModule];
-  }
   const issues = validateHostConfig(config);
   if (issues.length > 0) {
     const first = issues[0];
     throw new Error(`host_config_invalid:${first.code}:${first.path}`);
   }
   const domains = inventory(config);
-  const admittedDomains = getAdmittedDomainIds();
-  exactSet("plugins", domains.pluginDomains, admittedDomains);
-  exactSet("manifest-providers", domains.manifestProviderDomains, admittedDomains);
+  exactSet("plugins", domains.pluginDomains, COMMUNITY_FREE_DOMAIN_IDS);
+  exactSet("manifest-providers", domains.manifestProviderDomains, COMMUNITY_FREE_DOMAIN_IDS);
   exactSet("remote-sources", domains.sourceDomains, []);
   exactSet(
     "plugin-loader",
     config.pluginLoader?.allowlist ?? [],
-    commercial ? [...COMMUNITY_PLUGIN_MODULES, commercial.pluginModule] : COMMUNITY_PLUGIN_MODULES
+    COMMUNITY_PLUGIN_MODULES
   );
   exactSet("runtime-env", Object.keys(config.runtime?.env ?? {}), COMMUNITY_RUNTIME_ENV_KEYS);
-  if (config.pluginLoader?.strictAllowlist !== true || config.pluginLoader?.tolerantBootstrap !== false || config.agentGateway?.enabled !== true || config.agentGateway?.includeLocal !== true || config.agentGateway?.catalog?.enabled !== true) {
+  if (config.profile !== "static" || config.authority?.mode !== "trusted-local" || config.pluginLoader?.strictAllowlist !== true || config.pluginLoader?.tolerantBootstrap !== false || config.agentGateway?.enabled !== true || config.agentGateway?.includeLocal !== true || config.agentGateway?.catalog?.enabled !== true) {
     throw new Error("community_host_config_policy_mismatch");
   }
   return config;
@@ -423,238 +395,130 @@ function getHostRegistrationDiagnostics() {
     registrations: []
   };
 }
-function applyHostRuntimeEnv(config) {
-  const processEnv = process.env;
-  const bindings = config.runtime?.env ?? {};
-  exactSet("runtime-env-apply", Object.keys(bindings), COMMUNITY_RUNTIME_ENV_KEYS);
-  for (const [targetKey, binding] of Object.entries(bindings)) {
-    const resolved = (typeof binding.value === "string" ? binding.value : void 0) ?? (typeof binding.fromEnv === "string" ? private_env[binding.fromEnv] ?? processEnv[binding.fromEnv] : void 0) ?? (typeof binding.default === "string" ? binding.default : void 0);
-    if ((!resolved || resolved.trim().length === 0) && binding.required === true) {
-      throw new Error(`host_runtime_env_required:${targetKey}`);
-    }
-    if (resolved && resolved.trim().length > 0) processEnv[targetKey] = resolved;
+const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const SERVER_PACKAGE_ROOT = [
+  path.resolve(MODULE_DIR, "../.."),
+  path.resolve(MODULE_DIR, "../../.."),
+  path.resolve(process.cwd(), "apps/aops-server"),
+  path.resolve(process.cwd())
+].find((candidate) => fs__default.existsSync(path.join(candidate, "host.config.json")));
+if (!SERVER_PACKAGE_ROOT) {
+  throw new Error("aops_kernel_server_package_root_not_found");
+}
+let cachedSnapshot = null;
+let cachedSnapshotPromise = null;
+function normalized(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function resolveKernelHostConfigPath() {
+  const explicit = normalized(process.env.AOPS_HOST_CONFIG);
+  return explicit ? path.resolve(explicit) : path.join(SERVER_PACKAGE_ROOT, "host.config.json");
+}
+function kernelBootstrapOptions() {
+  getHostConfig();
+  const configPath = resolveKernelHostConfigPath();
+  const stateRoot = path.resolve(
+    normalized(process.env.AOPS_STATE_ROOT) || path.join(os.homedir(), ".aops")
+  );
+  const common = {
+    brand: "aops",
+    profile: "static",
+    configPath,
+    stateRoot,
+    registrationsDir: path.join(stateRoot, "host-registrations"),
+    moduleSearchRoot: SERVER_PACKAGE_ROOT,
+    processEnv: process.env
+  };
+  const resolved = resolveHostConfig(common);
+  if (resolved.profile !== "static" || resolved.registrations.length !== 0) {
+    throw new Error("aops_kernel_static_profile_required");
+  }
+  if (resolved.authority.mode !== "trusted-local") {
+    throw new Error("aops_kernel_trusted_local_authority_required");
   }
-}
-function guardCommercialPluginExecution(instance, domain, checkAdmission) {
-  const baseExecute = instance.execute;
-  if (typeof baseExecute !== "function") return instance;
   return {
-    ...instance,
-    execute: async (args) => {
-      const operationId = String(args?.match?.route?.operation ?? "").trim();
-      if (!operationId) {
-        throw new Error(`domain_admission_denied:${domain}:operation_not_admitted`);
-      }
-      const admission = checkAdmission(domain, operationId);
-      if (!admission.allowed) {
-        throw new Error(`domain_admission_denied:${domain}:${admission.reason}`);
-      }
-      return baseExecute.call(instance, args);
-    }
+    ...common,
+    authority: createTrustedLocalAuthorityProvider({
+      principalId: "aops-local-operator",
+      tenantId: "123e4567-e89b-41d4-a000-000000000001",
+      roles: ["admin", "operator"],
+      requireLoopback: false
+    }),
+    admission: createLeaseAdmissionProvider({
+      generation: 1,
+      freeDomains: COMMUNITY_FREE_DOMAIN_IDS,
+      licensedDomains: []
+    })
   };
 }
-const runtimeImport = new Function("specifier", "return import(specifier)");
-const nodeRequire = createRequire(import.meta.url);
-let pluginImportVersion = 0;
-const DEFAULT_DIAGNOSTICS = {
-  attempt: 0,
-  state: "idle",
-  loadedDomains: [],
-  plugins: []
-};
-let singletonPromise = null;
-let bootstrapAttempt = 0;
-let registryDiagnostics = { ...DEFAULT_DIAGNOSTICS };
-function extractErrorMessage(error) {
-  if (error instanceof Error) return error.message;
-  return String(error ?? "unknown_error");
-}
-function resolveModuleSpecifier(moduleName) {
-  const trimmed = moduleName.trim();
-  if (!trimmed) return trimmed;
-  if (trimmed.startsWith("file://")) return trimmed;
-  if (path.isAbsolute(trimmed)) return pathToFileURL(trimmed).href;
-  if (!trimmed.startsWith(".")) {
-    const resolvePaths = [process.cwd(), path.resolve(process.cwd(), "apps/aops-server")];
-    try {
-      const resolved = nodeRequire.resolve(trimmed, { paths: resolvePaths });
-      return pathToFileURL(resolved).href;
-    } catch {
-      return trimmed;
-    }
-  }
-  const absolutePath = path.resolve(process.cwd(), trimmed);
-  return pathToFileURL(absolutePath).href;
-}
-function withImportVersion(specifier) {
-  if (!specifier.startsWith("file://")) return specifier;
-  const url = new URL(specifier);
-  url.searchParams.set("v", String(pluginImportVersion));
-  return url.href;
-}
-function isModuleAllowed(moduleName, resolvedSpecifier, policy) {
-  const allowlist = policy.allowlist ?? [];
-  if (allowlist.length === 0) return policy.strictAllowlist === false;
-  return allowlist.includes(moduleName) || allowlist.includes(resolvedSpecifier);
-}
-function assertModuleAllowed(moduleName, resolvedSpecifier, pluginConfig, policy) {
-  if (isModuleAllowed(moduleName, resolvedSpecifier, policy)) return;
-  if ((policy.allowlist ?? []).length === 0 && policy.strictAllowlist) {
-    throw new Error(`plugin_module_allowlist_empty:${pluginConfig.domain}`);
+async function warmupRuntime(runtime2) {
+  for (const domain of runtime2.registry.listDomains()) {
+    await runtime2.registry.ensureSetup(domain);
+    const plugin = runtime2.registry.get(domain);
+    if (plugin?.health) await plugin.health();
   }
-  throw new Error(`plugin_module_not_allowed:${pluginConfig.domain}:${moduleName}`);
 }
-async function createPluginFromConfig(pluginConfig, policy) {
-  const moduleName = pluginConfig.module;
-  if (!moduleName) {
-    throw new Error(`plugin_module_missing:${pluginConfig.domain}`);
+async function buildKernelRuntimeSnapshot(options = {}) {
+  const kernel = await bootstrapHostRuntime(kernelBootstrapOptions());
+  if (options.warmup) await warmupRuntime(kernel);
+  return {
+    loadedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    warmupCompleted: options.warmup === true,
+    kernel,
+    registry: kernel.registry,
+    gateway: kernel.gateway
+  };
+}
+async function getKernelRuntimeSnapshot(options = {}) {
+  if (options.reset) resetKernelRuntimeSnapshot();
+  if (cachedSnapshot && (!options.warmup || cachedSnapshot.warmupCompleted)) {
+    return cachedSnapshot;
   }
-  const resolvedSpecifier = resolveModuleSpecifier(moduleName);
-  assertModuleAllowed(moduleName, resolvedSpecifier, pluginConfig, policy);
-  const exportName = pluginConfig.factory?.trim() || "createPlugin";
-  let mod;
+  cachedSnapshotPromise ??= buildKernelRuntimeSnapshot({ warmup: options.warmup });
   try {
-    mod = await runtimeImport(withImportVersion(resolvedSpecifier));
-  } catch (error) {
-    throw new Error(
-      `plugin_module_import_failed:${pluginConfig.domain}:${moduleName}:${extractErrorMessage(error)}`
-    );
-  }
-  const maybeFactory = mod[exportName] ?? mod.default;
-  if (typeof maybeFactory !== "function") {
-    throw new Error(`plugin_factory_not_found:${pluginConfig.domain}:${moduleName}#${exportName}`);
-  }
-  const instance = await Promise.resolve(
-    maybeFactory(pluginConfig.options)
-  );
-  if (!instance || typeof instance !== "object") {
-    throw new Error(`plugin_factory_invalid_result:${pluginConfig.domain}`);
-  }
-  const configDomain = normalizeDomainName(pluginConfig.domain);
-  const pluginDomain = normalizeDomainName(instance.domain ?? "");
-  if (configDomain && pluginDomain && configDomain !== pluginDomain) {
-    throw new Error(`plugin_config_domain_mismatch:${configDomain}:${pluginDomain}`);
+    cachedSnapshot = await cachedSnapshotPromise;
+    return cachedSnapshot;
+  } finally {
+    cachedSnapshotPromise = null;
   }
-  return guardCommercialPluginExecution(
-    instance,
-    configDomain,
-    checkHostDomainAdmission
-  );
 }
-async function buildRegistry() {
-  const registry = new DomainPluginRegistry();
-  const config = getHostConfig();
-  const policy = config.pluginLoader ?? {
-    allowlist: [],
-    strictAllowlist: false,
-    tolerantBootstrap: false
-  };
-  const tolerantBootstrap = policy.tolerantBootstrap === true;
-  const plugins2 = config.plugins ?? [];
-  const diagnostics2 = {
-    attempt: ++bootstrapAttempt,
-    state: "building",
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    loadedDomains: [],
-    plugins: []
-  };
-  registryDiagnostics = diagnostics2;
-  applyHostRuntimeEnv(config);
-  const failedDomains = [];
-  try {
-    for (const pluginConfig of plugins2) {
-      const pluginStart = Date.now();
-      const domain = normalizeDomainName(pluginConfig.domain ?? "");
-      const moduleName = pluginConfig.module?.trim() || null;
-      const factoryName = pluginConfig.factory?.trim() || "createPlugin";
-      if (pluginConfig.enabled === false) {
-        diagnostics2.plugins.push({
-          domain,
-          module: moduleName,
-          factory: factoryName,
-          status: "skipped",
-          durationMs: Date.now() - pluginStart
-        });
-        continue;
-      }
-      if (!checkHostDomainAdmission(domain).allowed) {
-        diagnostics2.plugins.push({
-          domain,
-          module: moduleName,
-          factory: factoryName,
-          status: "skipped",
-          durationMs: Date.now() - pluginStart,
-          error: "domain_not_admitted"
-        });
-        continue;
-      }
-      try {
-        const plugin = await createPluginFromConfig(pluginConfig, policy);
-        registry.register(plugin);
-        diagnostics2.plugins.push({
-          domain: normalizeDomainName(plugin.domain ?? domain),
-          module: moduleName,
-          factory: factoryName,
-          status: "loaded",
-          durationMs: Date.now() - pluginStart
-        });
-      } catch (error) {
-        const message = extractErrorMessage(error);
-        diagnostics2.plugins.push({
-          domain,
-          module: moduleName,
-          factory: factoryName,
-          status: "failed",
-          durationMs: Date.now() - pluginStart,
-          error: message
-        });
-        if (tolerantBootstrap) {
-          failedDomains.push(domain);
-          continue;
-        }
-        throw new Error(`plugin_bootstrap_failed:${domain}:${message}`);
-      }
-    }
-    diagnostics2.state = "ready";
-    if (failedDomains.length > 0) {
-      diagnostics2.error = `plugin_bootstrap_partial_failure:${failedDomains.join(",")}`;
-    }
-    diagnostics2.loadedDomains = registry.listDomains();
-    diagnostics2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-    registryDiagnostics = diagnostics2;
-    return registry;
-  } catch (error) {
-    diagnostics2.state = "failed";
-    diagnostics2.error = extractErrorMessage(error);
-    diagnostics2.loadedDomains = registry.listDomains();
-    diagnostics2.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
-    registryDiagnostics = diagnostics2;
-    throw error;
+function peekKernelRuntimeSnapshot() {
+  return cachedSnapshot;
+}
+function resetKernelRuntimeSnapshot() {
+  const runtime2 = cachedSnapshot?.kernel;
+  cachedSnapshot = null;
+  cachedSnapshotPromise = null;
+  if (runtime2) {
+    void Promise.all(runtime2.shutdownHooks.map((hook) => hook.run())).catch(() => void 0);
   }
 }
 async function getHostPluginRegistry() {
-  if (singletonPromise) return singletonPromise;
-  singletonPromise = buildRegistry().catch((error) => {
-    singletonPromise = null;
-    throw error;
-  });
-  return singletonPromise;
+  return (await getKernelRuntimeSnapshot()).registry;
 }
 function getHostPluginRegistryDiagnostics() {
+  const snapshot = peekKernelRuntimeSnapshot();
+  if (!snapshot) {
+    return { attempt: 0, state: "idle", loadedDomains: [], plugins: [] };
+  }
   return {
-    ...registryDiagnostics,
-    loadedDomains: [...registryDiagnostics.loadedDomains],
-    plugins: registryDiagnostics.plugins.map((plugin) => ({ ...plugin }))
+    attempt: 1,
+    state: "ready",
+    startedAt: snapshot.loadedAt,
+    finishedAt: snapshot.loadedAt,
+    loadedDomains: snapshot.registry.listDomains(),
+    plugins: snapshot.kernel.pluginDiagnostics.map((plugin) => ({
+      domain: plugin.domain,
+      module: plugin.module,
+      factory: plugin.factory ?? "createPlugin",
+      status: plugin.status === "disabled" ? "skipped" : plugin.status,
+      durationMs: 0,
+      ...plugin.error ? { error: plugin.error } : {}
+    }))
   };
 }
 function resetHostPluginRegistry() {
-  singletonPromise = null;
-  pluginImportVersion += 1;
-  registryDiagnostics = {
-    ...DEFAULT_DIAGNOSTICS,
-    loadedDomains: [],
-    plugins: []
-  };
+  resetKernelRuntimeSnapshot();
 }
 
-export { getHostRegistrationDiagnostics as a, getHostPluginRegistryDiagnostics as b, getHostAdmissionDiagnostics as c, checkHostDomainAdmission as d, getHostPluginRegistry as e, resetHostPluginRegistry as f, getHostConfig as g, resolveCommunityPackageModule as r };
+export { getKernelRuntimeSnapshot as a, getHostRegistrationDiagnostics as b, getHostPluginRegistryDiagnostics as c, getHostAdmissionDiagnostics as d, getHostPluginRegistry as e, checkHostDomainAdmission as f, getHostConfig as g, resetHostPluginRegistry as h, resolveCommunityPackageModule as r };