@astrale-os/kernel-server 0.4.1

package/dist/app/create.d.ts

@@ -0,0 +1,48 @@
+/**
+ * createKernelApp — Hono app builder for the kernel protocol.
+ *
+ * Walks a domain of MountableContract and mounts:
+ *  - kernel HTTP envelope (POST) at each base URL
+ *  - native HTTP routes per route binding
+ *  - kernel WS upgrade at the same base URL when transports includes 'ws'
+ *
+ * Codecs are hardcoded (json + msgpack). Credentials for kernel HTTP are
+ * fixed to the Authorization header; route bindings can override via
+ * `route.credential`.
+ */
+import type { KernelAPI } from '@astrale-os/kernel-api';
+import type { MountableContract } from '@astrale-os/kernel-api/routed';
+import type { Hono } from 'hono';
+import type { CorsConfig } from '../cors';
+import type { JwksKeys } from '../jwks';
+import type { MountPlan, ServerHost } from '../plan';
+import { type WsAdapter } from './ws-upgrade';
+export type { WsAdapter };
+export type KernelAppConfig = {
+    /** The kernel runtime handling dispatch. */
+    kernel: KernelAPI;
+    /** The domain's mountable contracts — produced by defineMethods(schema, methods). */
+    domain: MountableContract[];
+    /** Server host URL. Functions anchor against this (ambient functions mount here). */
+    host: ServerHost;
+    /** Required — OpenID Connect Discovery + JWKS endpoints. */
+    jwks: JwksKeys;
+    /** Allowed transports. 'http' is mandatory. 'ws' is opt-in. */
+    transports?: readonly ('http' | 'ws')[];
+    /** CORS configuration. Defaults to { origin: '*' }. */
+    cors?: CorsConfig;
+    /** Optional health endpoint path (defaults to '/health'; false disables). */
+    health?: string | false;
+    /** Pre-created Hono app (for attaching to an existing app). */
+    app?: Hono;
+    /**
+     * Runtime-specific WS adapter (from `hono/bun`, `@hono/node-ws`, `hono/deno`).
+     * Required when `transports` includes `'ws'`.
+     */
+    ws?: WsAdapter;
+};
+export declare function createKernelApp(config: KernelAppConfig): {
+    app: Hono;
+    plan: MountPlan;
+};
+//# sourceMappingURL=create.d.ts.map

package/dist/app/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../app/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAIhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAMpD,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAE5D,YAAY,EAAE,SAAS,EAAE,CAAA;AAIzB,MAAM,MAAM,eAAe,GAAG;IAC5B,4CAA4C;IAC5C,MAAM,EAAE,SAAS,CAAA;IACjB,qFAAqF;IACrF,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,qFAAqF;IACrF,IAAI,EAAE,UAAU,CAAA;IAChB,4DAA4D;IAC5D,IAAI,EAAE,QAAQ,CAAA;IACd,+DAA+D;IAC/D,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACvC,uDAAuD;IACvD,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACvB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,IAAI,CAAA;IACV;;;OAGG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;CACf,CAAA;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CA2FvF"}

package/dist/app/create.js

@@ -0,0 +1,107 @@
+/**
+ * createKernelApp — Hono app builder for the kernel protocol.
+ *
+ * Walks a domain of MountableContract and mounts:
+ *  - kernel HTTP envelope (POST) at each base URL
+ *  - native HTTP routes per route binding
+ *  - kernel WS upgrade at the same base URL when transports includes 'ws'
+ *
+ * Codecs are hardcoded (json + msgpack). Credentials for kernel HTTP are
+ * fixed to the Authorization header; route bindings can override via
+ * `route.credential`.
+ */
+import { Hono as HonoCtor } from 'hono';
+import { createKernelDispatcher } from '../envelope/http';
+import { mountJwks } from '../jwks/keys';
+import { extractHostParams, walkDomain } from '../plan';
+import { createRouteHandler } from '../routed/handler';
+import { mountKernelWs } from './ws-upgrade';
+const DEFAULT_CORS = { origin: '*' };
+export function createKernelApp(config) {
+    const cors = config.cors ?? DEFAULT_CORS;
+    const app = config.app ?? new HonoCtor();
+    const transports = config.transports ?? ['http'];
+    if (!transports.includes('http')) {
+        throw new Error(`createKernelApp: transports must include 'http'`);
+    }
+    // 1. Walk domain → compute mount plan.
+    const plan = walkDomain(config.domain, config.host);
+    // 2. JWKS (always mounted).
+    mountJwks(app, { ...config.jwks, cors });
+    // 3. Health endpoint.
+    if (config.health !== false) {
+        app.get(config.health ?? '/health', (c) => c.json({ status: 'ok' }));
+    }
+    // 4. Kernel HTTP mounts — POST envelope at each unique base path.
+    //    Because ambient functions all share the server's base path, and
+    //    anchored functions re-use the same host, nearly always there's just
+    //    one base path. For multi-domain servers with different remoteUrl
+    //    base paths, we create one mount per path.
+    const hostParams = plan.hostMatcher
+        ? (req) => extractHostParams(plan.hostMatcher, req)
+        : undefined;
+    const dispatcher = createKernelDispatcher(cors, { hostParams });
+    const basePaths = new Set();
+    for (const basePath of plan.kernelMounts.keys()) {
+        basePaths.add(basePath === '' ? '/' : basePath);
+    }
+    if (basePaths.size === 0)
+        basePaths.add('/');
+    // 4a. WS upgrade (HTTP GET with Upgrade header) at each base path.
+    if (transports.includes('ws')) {
+        if (!config.ws) {
+            throw new Error(`createKernelApp: transports includes 'ws' but no WS adapter was passed. ` +
+                `Pass { ws: { upgradeWebSocket } } from your runtime's Hono adapter ` +
+                `(hono/bun, @hono/node-ws, hono/deno).`);
+        }
+        for (const wsPath of basePaths) {
+            mountKernelWs(app, wsPath, config.ws, config.kernel);
+        }
+    }
+    // 4b. HTTP POST envelope + OPTIONS preflight for each base path.
+    for (const path of basePaths) {
+        app.post(path, (c) => dispatcher(c.req.raw, config.kernel));
+        app.options(path, (c) => dispatcher(c.req.raw, config.kernel));
+    }
+    // 6. Route bindings — one Hono handler per mounted route.
+    for (const mountedRoute of plan.routes) {
+        const { route, fullPath } = mountedRoute;
+        const honoPath = toHonoPath(fullPath);
+        const handler = createRouteHandler({
+            method: mountedRoute.contract.ref,
+            route,
+            kernel: config.kernel,
+            cors,
+            hostParams,
+            auth: mountedRoute.contract.binding?.auth,
+        });
+        const mountHandler = async (c) => {
+            const pathParams = {};
+            for (const m of fullPath.matchAll(/\{(\w+)([+*])?\}/g)) {
+                const name = m[1];
+                const value = c.req.param(name);
+                if (value !== undefined)
+                    pathParams[name] = decodeURIComponent(value);
+            }
+            return handler(c.req.raw, pathParams);
+        };
+        if (route.method === '*') {
+            app.all(honoPath, mountHandler);
+        }
+        else {
+            const verb = route.method.toLowerCase();
+            app[verb](honoPath, mountHandler);
+        }
+        // Always allow CORS preflight on routes.
+        app.options(honoPath, (c) => handler(c.req.raw, {}));
+    }
+    return { app, plan };
+}
+/** Convert spec path syntax `/tasks/{id}`, `/files/{name+}` and `/files/{name*}` to Hono syntax. */
+function toHonoPath(path) {
+    return path
+        .replace(/\{(\w+)\+\}/g, ':$1{.+}')
+        .replace(/\{(\w+)\*\}/g, ':$1{.*}')
+        .replace(/\{(\w+)\}/g, ':$1');
+}
+//# sourceMappingURL=create.js.map

package/dist/app/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../app/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,MAAM,CAAA;AAMvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAA;AAI5D,MAAM,YAAY,GAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AA0BhD,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAA;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,CAAA;IAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IAED,uCAAuC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAEnD,4BAA4B;IAC5B,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAExC,sBAAsB;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACtE,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW;QACjC,CAAC,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAE/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAE5C,mEAAmE;IACnE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,qEAAqE;gBACrE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3D,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAA;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG;YACjC,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI;YACJ,UAAU;YACV,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI;SAC1C,CAAC,CAAA;QACF,MAAM,YAAY,GAAG,KAAK,EAAE,CAE3B,EAAE,EAAE;YACH,MAAM,UAAU,GAA2B,EAAE,CAAA;YAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBACjB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;YACvE,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QACvC,CAAC,CAAA;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAW,CAAA;YAChD,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QACnC,CAAC;QACD,yCAAyC;QACzC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC;SAClC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACjC,CAAC"}

package/dist/app/index.d.ts

@@ -0,0 +1,4 @@
+export { createKernelApp, type KernelAppConfig, type WsAdapter } from './create';
+export { createMultiplexedKernelApp, type MultiplexedKernelAppConfig, type KernelResolver, } from './multiplexed';
+export { mountKernelWs } from './ws-upgrade';
+//# sourceMappingURL=index.d.ts.map

package/dist/app/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../app/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAA;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}

package/dist/app/index.js

@@ -0,0 +1,4 @@
+export { createKernelApp } from './create';
+export { createMultiplexedKernelApp, } from './multiplexed';
+export { mountKernelWs } from './ws-upgrade';
+//# sourceMappingURL=index.js.map

package/dist/app/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../app/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAwC,MAAM,UAAU,CAAA;AAChF,OAAO,EACL,0BAA0B,GAG3B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA"}

package/dist/app/multiplexed.d.ts

@@ -0,0 +1,53 @@
+/**
+ * createMultiplexedKernelApp — Hono app for multi-instance kernel hosting.
+ *
+ * One HTTP server hosts many kernel instances under `/{id}/...` paths. Each
+ * incoming request is resolved to a kernel via the supplied `resolve()`
+ * function. The manager kernel (if any) is mounted at its own static prefix.
+ *
+ * Both the envelope HTTP dispatcher and the WS upgrade handler are built
+ * once at startup. The dispatcher takes `(req, kernel)` per request; the WS
+ * handler resolves its kernel once at upgrade time and pins it to the
+ * connection for its entire lifetime.
+ *
+ * Note: this skips per-instance domain mount-walking (no `domain` argument
+ * per request) — multiplexed servers dispatch all calls to the kernel layer
+ * regardless of binding. Anchored functions still work, since the binding is
+ * carried by the contract registered in the runtime.
+ */
+import type { KernelAPI } from '@astrale-os/kernel-api';
+import type { Hono } from 'hono';
+import type { CorsConfig } from '../cors';
+import type { JwksKeys, MultiplexedJwks } from '../jwks';
+import { type WsAdapter } from './ws-upgrade';
+/**
+ * Resolves a KernelAPI from an incoming request (multi-instance servers).
+ */
+export type KernelResolver = (req: Request) => KernelAPI | null | Promise<KernelAPI | null>;
+export type MultiplexedKernelAppConfig = {
+    /** Per-request kernel resolver (direct access — instance handles its own auth). */
+    resolve: KernelResolver;
+    /** Optional manager kernel hosted at a static prefix. */
+    manager?: {
+        kernel: KernelAPI;
+        prefix: string;
+        jwks: JwksKeys;
+    };
+    /** Path prefix for instance routes. Defaults to `/:id`. */
+    instancePrefix?: string;
+    /** Per-instance JWKS lookup. */
+    jwks: MultiplexedJwks;
+    cors?: CorsConfig;
+    health?: string | false;
+    app?: Hono;
+    /**
+     * Runtime-specific WS adapter (from `hono/bun`, `@hono/node-ws`, `hono/deno`).
+     * When provided, WS endpoints are mounted for the manager (if any) and all
+     * instances at `{instancePrefix}`. Omit to serve HTTP only.
+     */
+    ws?: WsAdapter;
+};
+export declare function createMultiplexedKernelApp(config: MultiplexedKernelAppConfig): {
+    app: Hono;
+};
+//# sourceMappingURL=multiplexed.d.ts.map

package/dist/app/multiplexed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiplexed.d.ts","sourceRoot":"","sources":["../../app/multiplexed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAIhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAIxD,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAI5D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;AAE3F,MAAM,MAAM,0BAA0B,GAAG;IACvC,mFAAmF;IACnF,OAAO,EAAE,cAAc,CAAA;IACvB,yDAAyD;IACzD,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAA;IAC/D,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gCAAgC;IAChC,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IACvB,GAAG,CAAC,EAAE,IAAI,CAAA;IACV;;;;OAIG;IACH,EAAE,CAAC,EAAE,SAAS,CAAA;CACf,CAAA;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,CA+C5F"}

package/dist/app/multiplexed.js

@@ -0,0 +1,63 @@
+/**
+ * createMultiplexedKernelApp — Hono app for multi-instance kernel hosting.
+ *
+ * One HTTP server hosts many kernel instances under `/{id}/...` paths. Each
+ * incoming request is resolved to a kernel via the supplied `resolve()`
+ * function. The manager kernel (if any) is mounted at its own static prefix.
+ *
+ * Both the envelope HTTP dispatcher and the WS upgrade handler are built
+ * once at startup. The dispatcher takes `(req, kernel)` per request; the WS
+ * handler resolves its kernel once at upgrade time and pins it to the
+ * connection for its entire lifetime.
+ *
+ * Note: this skips per-instance domain mount-walking (no `domain` argument
+ * per request) — multiplexed servers dispatch all calls to the kernel layer
+ * regardless of binding. Anchored functions still work, since the binding is
+ * carried by the contract registered in the runtime.
+ */
+import { Hono as HonoCtor } from 'hono';
+import { createKernelDispatcher } from '../envelope/http';
+import { mountInstanceJwks, mountJwks } from '../jwks/keys';
+import { mountKernelWs } from './ws-upgrade';
+const DEFAULT_CORS = { origin: '*' };
+export function createMultiplexedKernelApp(config) {
+    const cors = config.cors ?? DEFAULT_CORS;
+    const app = config.app ?? new HonoCtor();
+    const instancePrefix = config.instancePrefix ?? '/:id';
+    if (config.health !== false) {
+        app.get(typeof config.health === 'string' ? config.health : '/health', (c) => c.json({ status: 'ok' }));
+    }
+    // Single dispatcher, reused across manager + all instance kernels.
+    const dispatcher = createKernelDispatcher(cors);
+    // Manager kernel (if any) — static prefix, fixed kernel.
+    // POST + OPTIONS handle HTTP dispatch; GET is reserved for WS upgrade
+    // (matches createKernelApp's mount layout).
+    if (config.manager) {
+        const managerKernel = config.manager.kernel;
+        const managerPath = `${config.manager.prefix}/`;
+        app.post(managerPath, (c) => dispatcher(c.req.raw, managerKernel));
+        app.options(managerPath, (c) => dispatcher(c.req.raw, managerKernel));
+        mountJwks(app, { ...config.manager.jwks, cors });
+        if (config.ws) {
+            mountKernelWs(app, managerPath, config.ws, managerKernel);
+        }
+    }
+    // Per-instance JWKS
+    mountInstanceJwks(app, instancePrefix, { ...config.jwks, cors });
+    // Per-instance kernel envelope — kernel resolved per request.
+    const instancePath = `${instancePrefix}/`;
+    const httpDispatch = async (c) => {
+        const kernel = await config.resolve(c.req.raw);
+        if (!kernel)
+            return new Response('Instance not found', { status: 404 });
+        return dispatcher(c.req.raw, kernel);
+    };
+    app.post(instancePath, httpDispatch);
+    app.options(instancePath, httpDispatch);
+    // Per-instance WS upgrade — kernel resolved at upgrade time and pinned.
+    if (config.ws) {
+        mountKernelWs(app, instancePath, config.ws, config.resolve);
+    }
+    return { app };
+}
+//# sourceMappingURL=multiplexed.js.map

package/dist/app/multiplexed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiplexed.js","sourceRoot":"","sources":["../../app/multiplexed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,MAAM,CAAA;AAKvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAkB,MAAM,cAAc,CAAA;AAE5D,MAAM,YAAY,GAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AA2BhD,MAAM,UAAU,0BAA0B,CAAC,MAAkC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAA;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAA;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAA;IAEtD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3E,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CACzB,CAAA;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAE/C,yDAAyD;IACzD,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAA;QAC3C,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAA;QAC/C,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;QAClE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;QACrE,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhE,8DAA8D;IAC9D,MAAM,YAAY,GAAG,GAAG,cAAc,GAAG,CAAA;IACzC,MAAM,YAAY,GAAG,KAAK,EAAE,CAA4B,EAAqB,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACvE,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC,CAAA;IACD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACpC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IAEvC,wEAAwE;IACxE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,CAAA;AAChB,CAAC"}

package/dist/app/ws-upgrade.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Hono WS upgrade adapter — wires the kernel envelope WS connection class
+ * into a Hono app via the runtime-specific `upgradeWebSocket` shim.
+ *
+ * The adapter is supplied by the caller (`hono/bun`, `@hono/node-ws`,
+ * `hono/deno`) so that this module remains free of runtime imports.
+ *
+ * The kernel can be either a fixed `KernelAPI` (single-kernel servers) or a
+ * resolver called at upgrade time with the upgrade request (multi-instance
+ * servers). Once resolved, the kernel is pinned to the WS connection for its
+ * entire lifetime.
+ */
+import type { KernelAPI } from '@astrale-os/kernel-api';
+import type { Hono } from 'hono';
+import type { UpgradeWebSocket } from 'hono/ws';
+export type WsAdapter = {
+    upgradeWebSocket: UpgradeWebSocket;
+};
+/**
+ * Kernel source for a WS mount — either a fixed kernel or a per-request
+ * resolver. Resolvers may be async and return `null` to reject the upgrade.
+ */
+export type WsKernelSource = KernelAPI | ((req: Request) => KernelAPI | null | Promise<KernelAPI | null>);
+/**
+ * Mount the kernel WS handler at `path` on the Hono app.
+ *
+ * The handler shares the URL with the kernel HTTP handler — clients use the
+ * same base URL and switch transports via HTTP Upgrade negotiation.
+ *
+ * When `source` is a resolver, it is invoked once at upgrade time. A null
+ * result closes the socket with code 4004 (instance not found) before any
+ * messages are exchanged.
+ */
+export declare function mountKernelWs(app: Hono, path: string, ws: WsAdapter, source: WsKernelSource): void;
+//# sourceMappingURL=ws-upgrade.d.ts.map

package/dist/app/ws-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade.d.ts","sourceRoot":"","sources":["../../app/ws-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,SAAS,CAAA;AAK1D,MAAM,MAAM,SAAS,GAAG;IACtB,gBAAgB,EAAE,gBAAgB,CAAA;CACnC,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAA;AAuBpE;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,EACT,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,cAAc,GACrB,IAAI,CAkDN"}

package/dist/app/ws-upgrade.js

@@ -0,0 +1,93 @@
+/**
+ * Hono WS upgrade adapter — wires the kernel envelope WS connection class
+ * into a Hono app via the runtime-specific `upgradeWebSocket` shim.
+ *
+ * The adapter is supplied by the caller (`hono/bun`, `@hono/node-ws`,
+ * `hono/deno`) so that this module remains free of runtime imports.
+ *
+ * The kernel can be either a fixed `KernelAPI` (single-kernel servers) or a
+ * resolver called at upgrade time with the upgrade request (multi-instance
+ * servers). Once resolved, the kernel is pinned to the WS connection for its
+ * entire lifetime.
+ */
+import { negotiateWsCodec } from '../envelope/codec';
+import { KernelWsConnection } from '../envelope/ws';
+function adaptHonoWs(ws) {
+    const raw = ws.raw;
+    return {
+        send(data) {
+            ws.send(data);
+        },
+        close(code, reason) {
+            ws.close(code, reason);
+        },
+        get readyState() {
+            return raw?.readyState ?? ws.readyState;
+        },
+    };
+}
+function isResolver(source) {
+    return typeof source === 'function';
+}
+/**
+ * Mount the kernel WS handler at `path` on the Hono app.
+ *
+ * The handler shares the URL with the kernel HTTP handler — clients use the
+ * same base URL and switch transports via HTTP Upgrade negotiation.
+ *
+ * When `source` is a resolver, it is invoked once at upgrade time. A null
+ * result closes the socket with code 4004 (instance not found) before any
+ * messages are exchanged.
+ */
+export function mountKernelWs(app, path, ws, source) {
+    const route = ws.upgradeWebSocket((c) => {
+        const upgradeRequest = c.req.raw;
+        const codec = negotiateWsCodec(upgradeRequest);
+        let conn = null;
+        return {
+            async onOpen(_evt, wsCtx) {
+                if (!codec) {
+                    wsCtx.close(4000, 'Unsupported codec');
+                    return;
+                }
+                let kernel;
+                try {
+                    kernel = isResolver(source) ? await source(upgradeRequest) : source;
+                }
+                catch (err) {
+                    // A mount-time failure (e.g. a child kernel boot throwing) must not
+                    // escape: this `onOpen` is async but the host WS adapter wraps it in
+                    // a *synchronous* try/catch that cannot observe an async rejection,
+                    // so an uncaught throw here becomes a process-killing unhandled
+                    // rejection. Reject the upgrade by closing the socket instead — and
+                    // log the error so a programmer bug (e.g. an unrelated TypeError
+                    // bubbling up from the resolver) isn't silently masked as a benign
+                    // mount fail.
+                    // eslint-disable-next-line no-console -- diagnostic from boundary handler
+                    console.error('[ws-upgrade] mount failed (socket closed 4005):', err);
+                    wsCtx.close(4005, 'mount failed');
+                    return;
+                }
+                if (!kernel) {
+                    wsCtx.close(4004, 'Instance not found');
+                    return;
+                }
+                conn = new KernelWsConnection(adaptHonoWs(wsCtx), codec, kernel);
+                conn.start();
+            },
+            onMessage(evt) {
+                conn?.handleMessage(evt.data);
+            },
+            onClose() {
+                conn?.handleClose();
+                conn = null;
+            },
+            onError(evt) {
+                const msg = evt instanceof ErrorEvent ? evt.message : `WebSocket error: ${evt.type}`;
+                conn?.handleError(new Error(msg));
+            },
+        };
+    });
+    app.get(path, route);
+}
+//# sourceMappingURL=ws-upgrade.js.map

package/dist/app/ws-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade.js","sourceRoot":"","sources":["../../app/ws-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAsB,MAAM,gBAAgB,CAAA;AAcvE,SAAS,WAAW,CAAC,EAAa;IAChC,MAAM,GAAG,GAAG,EAAE,CAAC,GAAyC,CAAA;IACxD,OAAO;QACL,IAAI,CAAC,IAAyB;YAC5B,EAAE,CAAC,IAAI,CAAC,IAAsD,CAAC,CAAA;QACjE,CAAC;QACD,KAAK,CAAC,IAAa,EAAE,MAAe;YAClC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,UAAU;YACZ,OAAO,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,UAAU,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CACjB,MAAsB;IAEtB,OAAO,OAAO,MAAM,KAAK,UAAU,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAS,EACT,IAAY,EACZ,EAAa,EACb,MAAsB;IAEtB,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAA;QAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,IAAI,GAA8B,IAAI,CAAA;QAE1C,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,IAAW,EAAE,KAAgB;gBACxC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;oBACtC,OAAM;gBACR,CAAC;gBACD,IAAI,MAAwB,CAAA;gBAC5B,IAAI,CAAC;oBACH,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;gBACrE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,oEAAoE;oBACpE,qEAAqE;oBACrE,oEAAoE;oBACpE,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,mEAAmE;oBACnE,cAAc;oBACd,0EAA0E;oBAC1E,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAA;oBACrE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;oBACjC,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;oBACvC,OAAM;gBACR,CAAC;gBACD,IAAI,GAAG,IAAI,kBAAkB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;gBAChE,IAAI,CAAC,KAAK,EAAE,CAAA;YACd,CAAC;YACD,SAAS,CAAC,GAAiB;gBACzB,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,IAAyC,CAAC,CAAA;YACpE,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,WAAW,EAAE,CAAA;gBACnB,IAAI,GAAG,IAAI,CAAA;YACb,CAAC;YACD,OAAO,CAAC,GAAU;gBAChB,MAAM,GAAG,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,GAAG,CAAC,IAAI,EAAE,CAAA;gBACpF,IAAI,EAAE,WAAW,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACnC,CAAC;SACF,CAAA;IACH,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACtB,CAAC"}

package/dist/cors.d.ts

@@ -0,0 +1,21 @@
+/**
+ * CORS configuration and header builder.
+ *
+ * Cross-cutting helper consumed by every protocol handler. The shape mirrors
+ * the standard `Access-Control-*` headers; multi-origin matching belongs in
+ * framework-level middleware (e.g. Hono's `cors()`), not here.
+ */
+export type CorsConfig = {
+    /**
+     * Allowed origin. Use '*' for any, or a single origin string.
+     *
+     * Note: HTTP `Access-Control-Allow-Origin` does not support multiple
+     * comma-separated origins. For multi-origin, implement per-request
+     * matching at the framework middleware level (e.g., Hono cors()).
+     */
+    origin: string;
+    methods?: string[];
+    headers?: string[];
+};
+export declare function buildCorsHeaders(cors: CorsConfig): Record<string, string>;
+//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../cors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,CAAA;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQzE"}

package/dist/cors.js

@@ -0,0 +1,17 @@
+/**
+ * CORS configuration and header builder.
+ *
+ * Cross-cutting helper consumed by every protocol handler. The shape mirrors
+ * the standard `Access-Control-*` headers; multi-origin matching belongs in
+ * framework-level middleware (e.g. Hono's `cors()`), not here.
+ */
+export function buildCorsHeaders(cors) {
+    const origin = cors.origin;
+    return {
+        'access-control-allow-origin': origin,
+        'access-control-allow-methods': (cors.methods ?? ['POST', 'OPTIONS']).join(', '),
+        'access-control-allow-headers': (cors.headers ?? ['content-type', 'authorization']).join(', '),
+        'access-control-expose-headers': 'x-binary-result',
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../cors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,OAAO;QACL,6BAA6B,EAAE,MAAM;QACrC,8BAA8B,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChF,8BAA8B,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9F,+BAA+B,EAAE,iBAAiB;KACnD,CAAA;AACH,CAAC"}

package/dist/envelope/batch.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Kernel envelope batch processing.
+ *
+ * A batch is an array of kernel envelope requests delivered in a single HTTP
+ * POST. Each is dispatched independently and the encoded responses are
+ * collected into an array. Notifications are dropped from the response;
+ * streams and binary results are rejected (those need their own connection).
+ */
+import type { KernelAPI } from '@astrale-os/kernel-api';
+import { type CodecEntry } from './codec';
+export declare function handleBatch(raw: unknown[], kernel: KernelAPI, codecEntry: CodecEntry, req: Request, corsHeaders: Record<string, string>): Promise<Response>;
+//# sourceMappingURL=batch.d.ts.map

package/dist/envelope/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../envelope/batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,wBAAwB,CAAA;AAa3E,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EAAE,EACd,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}

package/dist/envelope/batch.js

@@ -0,0 +1,90 @@
+/**
+ * Kernel envelope batch processing.
+ *
+ * A batch is an array of kernel envelope requests delivered in a single HTTP
+ * POST. Each is dispatched independently and the encoded responses are
+ * collected into an array. Notifications are dropped from the response;
+ * streams and binary results are rejected (those need their own connection).
+ */
+import { KERNEL_ERROR_CODES, decodeKernelRequest, dispatch, encodeKernelError, encodeKernelRedirect, encodeKernelResponse, isBinaryResult, } from '@astrale-os/kernel-api';
+import { toBody } from '../render';
+import {} from './codec';
+import { extractCredential } from './credential';
+export async function handleBatch(raw, kernel, codecEntry, req, corsHeaders) {
+    if (raw.length === 0) {
+        return errorResponse(codecEntry, { code: KERNEL_ERROR_CODES.INVALID_REQUEST, message: 'Empty batch' }, corsHeaders, 400);
+    }
+    const auth = await extractCredential(req);
+    const results = Array.from({ length: raw.length }, () => null);
+    await Promise.all(raw.map(async (item, i) => {
+        let request;
+        try {
+            request = decodeKernelRequest(item);
+        }
+        catch (e) {
+            results[i] = encodeKernelError(null, {
+                code: KERNEL_ERROR_CODES.INVALID_REQUEST,
+                message: e instanceof Error ? e.message : 'Invalid request',
+            });
+            return;
+        }
+        const isAck = request.id === undefined;
+        let cred;
+        if (request.creds !== undefined) {
+            cred = request.creds;
+        }
+        else if (!auth.ok) {
+            results[i] = encodeKernelError(request.id ?? null, {
+                code: KERNEL_ERROR_CODES.AUTH_INVALID,
+                message: `Unsupported Authorization scheme: ${auth.scheme}`,
+            });
+            return;
+        }
+        else {
+            cred = auth.credential;
+        }
+        const res = await dispatch(request.method, request.params, cred, kernel, isAck ? { ack: true } : { id: request.id, isStream: false });
+        if (res.kind === 'ack')
+            return;
+        if (res.kind === 'stream') {
+            results[i] = encodeKernelError(request.id, {
+                code: KERNEL_ERROR_CODES.INVALID_REQUEST,
+                message: 'Streaming is not supported inside a batch',
+            });
+            return;
+        }
+        if (res.kind === 'redirect') {
+            results[i] = encodeKernelRedirect(res.id, res.redirection);
+            return;
+        }
+        if (res.kind === 'success') {
+            if (isBinaryResult(res.data)) {
+                results[i] = encodeKernelError(res.id, {
+                    code: KERNEL_ERROR_CODES.INVALID_REQUEST,
+                    message: 'Binary result is not supported inside a batch',
+                });
+                return;
+            }
+            results[i] = encodeKernelResponse(res.id, res.data);
+            return;
+        }
+        results[i] = encodeKernelError(res.id, res.error);
+    }));
+    const encoded = results.filter((r) => r !== null);
+    if (encoded.length === 0) {
+        return new Response(null, { status: 204, headers: corsHeaders });
+    }
+    const bytes = codecEntry.codec.encode(encoded);
+    return new Response(toBody(bytes), {
+        status: 200,
+        headers: { ...corsHeaders, 'content-type': codecEntry.kernelType },
+    });
+}
+function errorResponse(codecEntry, error, corsHeaders, httpStatus) {
+    const bytes = codecEntry.codec.encode(encodeKernelError(null, error));
+    return new Response(toBody(bytes), {
+        status: httpStatus,
+        headers: { ...corsHeaders, 'content-type': codecEntry.kernelType },
+    });
+}
+//# sourceMappingURL=batch.js.map

package/dist/envelope/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../envelope/batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,QAAQ,EACR,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAmB,MAAM,SAAS,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAc,EACd,MAAiB,EACjB,UAAsB,EACtB,GAAY,EACZ,WAAmC;IAEnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,aAAa,CAClB,UAAU,EACV,EAAE,IAAI,EAAE,kBAAkB,CAAC,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,EACpE,WAAW,EACX,GAAG,CACJ,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,OAAO,GAAuB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAElF,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,OAA+C,CAAA;QACnD,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE;gBACnC,IAAI,EAAE,kBAAkB,CAAC,eAAe;gBACxC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;aAC5D,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,SAAS,CAAA;QACtC,IAAI,IAAY,CAAA;QAChB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAA;QACtB,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE;gBACjD,IAAI,EAAE,kBAAkB,CAAC,YAAY;gBACrC,OAAO,EAAE,qCAAqC,IAAI,CAAC,MAAM,EAAE;aAC5D,CAAC,CAAA;YACF,OAAM;QACR,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAiC,EACzC,IAAI,EACJ,MAAM,EACN,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAC7D,CAAA;QAED,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;YAAE,OAAM;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAG,EAAE;gBAC1C,IAAI,EAAE,kBAAkB,CAAC,eAAe;gBACxC,OAAO,EAAE,2CAA2C;aACrD,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,kBAAkB,CAAC,eAAe;oBACxC,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YACD,OAAO,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YACnD,OAAM;QACR,CAAC;QACD,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IACnD,CAAC,CAAC,CACH,CAAA;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC9C,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACjC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,UAAU,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,UAAsB,EACtB,KAAyB,EACzB,WAAmC,EACnC,UAAkB;IAElB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACrE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACjC,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,UAAU,EAAE;KACnE,CAAC,CAAA;AACJ,CAAC"}