@astrale-os/kernel-server 0.4.1

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,QAAQ,CAAA;AAIf,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAA;AAI1D,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAItE,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAItE,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,QAAQ,CAAA;AAIf,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAChE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/index.js

@@ -0,0 +1,17 @@
+// ─── App entry points ─────────────────────────────────────────────────────────
+export { createKernelApp } from './app/create';
+export { createMultiplexedKernelApp, } from './app/multiplexed';
+// ─── Plan ────────────────────────────────────────────────────────────────────
+export { walkDomain, } from './plan';
+// ─── Cross-cutting ───────────────────────────────────────────────────────────
+export { buildCorsHeaders } from './cors';
+// ─── Kernel envelope dispatcher ──────────────────────────────────────────────
+export { createKernelDispatcher } from './envelope/http';
+export { KernelWsConnection } from './envelope/ws';
+// ─── Routed HTTP handler (per-route) ─────────────────────────────────────────
+export { createRouteHandler } from './routed';
+// ─── JWKS (OIDC Discovery + JSON Web Key Set) ───────────────────────────────
+export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, } from './jwks';
+// ─── Dispatch (for custom integrations) ──────────────────────────────────────
+export { dispatch, classifyError } from '@astrale-os/kernel-api';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,EAAE,eAAe,EAAwC,MAAM,cAAc,CAAA;AACpF,OAAO,EACL,0BAA0B,GAG3B,MAAM,mBAAmB,CAAA;AAE1B,gFAAgF;AAEhF,OAAO,EACL,UAAU,GAKX,MAAM,QAAQ,CAAA;AAEf,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,QAAQ,CAAA;AAE1D,gFAAgF;AAEhF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAsB,MAAM,eAAe,CAAA;AAEtE,gFAAgF;AAEhF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,UAAU,CAAA;AAEtE,+EAA+E;AAE/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAO5B,MAAM,QAAQ,CAAA;AAEf,gFAAgF;AAEhF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/jwks/discovery.d.ts

@@ -0,0 +1,40 @@
+/**
+ * OIDC discovery-document construction — the `issuer`/`jwks_uri` pair and the
+ * reachable-URL derivation behind it. Shared by `mountJwks`,
+ * `mountInstanceJwks`, and the issuer-registry mounts.
+ *
+ * Identity vs reachability — the two published fields are intentionally
+ * asymmetric, and that asymmetry is load-bearing:
+ *   • `issuer` is the IDENTITY claim, published VERBATIM. OIDC Discovery /
+ *     RFC 8414 require it to equal the issuer used to build the discovery URL
+ *     and the `iss` claim the kernel signs into tokens. Normalizing it would
+ *     break token validation whenever the configured issuer is non-canonical
+ *     (a bare slug, odd casing, …) — so it is never rewritten here.
+ *   • `jwks_uri` is a REACHABILITY concern: it must be a fetchable absolute URL.
+ *     It is derived from the canonical issuer URL when that is usable, else from
+ *     the request's externally-reachable origin (proxy headers). A bare-slug or
+ *     port-0 issuer is a valid identity but an unfetchable URL — hence the
+ *     divergence. (Regression coverage: M-19, host `jwks-keys.test.ts`.)
+ *
+ * Edge-topology contract — KEEP IN SYNC with kernel/host/network/Caddyfile:
+ *   In the Caddy-only edge the host kernel is mounted publicly under
+ *   `/kernel/{slug}` (the issuer carries that path) but served internally at the
+ *   stripped path (`/` for the host, `/{id}` for children). `jwks_uri` is built
+ *   from the ISSUER's path, never the request path, so the edge only strips the
+ *   prefix on the way IN — no response-body rewrite. If a future edge stops
+ *   stripping `/kernel/{slug}`, or a kernel is mounted at a different public
+ *   path, the issuer's path and that edge rule must move together.
+ */
+export interface DiscoveryDoc {
+    issuer: string;
+    jwks_uri: string;
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+}
+/**
+ * Build the OIDC discovery document served at `/.well-known/openid-configuration`.
+ * `issuer` is echoed verbatim (identity); `jwks_uri` is derived to be reachable.
+ * See the file header for why the two diverge.
+ */
+export declare function discoveryDoc(req: Request, issuer: string, signingAlgorithm: string): DiscoveryDoc;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/jwks/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../jwks/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;CAChD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,YAAY,CAOjG"}

package/dist/jwks/discovery.js

@@ -0,0 +1,113 @@
+/**
+ * OIDC discovery-document construction — the `issuer`/`jwks_uri` pair and the
+ * reachable-URL derivation behind it. Shared by `mountJwks`,
+ * `mountInstanceJwks`, and the issuer-registry mounts.
+ *
+ * Identity vs reachability — the two published fields are intentionally
+ * asymmetric, and that asymmetry is load-bearing:
+ *   • `issuer` is the IDENTITY claim, published VERBATIM. OIDC Discovery /
+ *     RFC 8414 require it to equal the issuer used to build the discovery URL
+ *     and the `iss` claim the kernel signs into tokens. Normalizing it would
+ *     break token validation whenever the configured issuer is non-canonical
+ *     (a bare slug, odd casing, …) — so it is never rewritten here.
+ *   • `jwks_uri` is a REACHABILITY concern: it must be a fetchable absolute URL.
+ *     It is derived from the canonical issuer URL when that is usable, else from
+ *     the request's externally-reachable origin (proxy headers). A bare-slug or
+ *     port-0 issuer is a valid identity but an unfetchable URL — hence the
+ *     divergence. (Regression coverage: M-19, host `jwks-keys.test.ts`.)
+ *
+ * Edge-topology contract — KEEP IN SYNC with kernel/host/network/Caddyfile:
+ *   In the Caddy-only edge the host kernel is mounted publicly under
+ *   `/kernel/{slug}` (the issuer carries that path) but served internally at the
+ *   stripped path (`/` for the host, `/{id}` for children). `jwks_uri` is built
+ *   from the ISSUER's path, never the request path, so the edge only strips the
+ *   prefix on the way IN — no response-body rewrite. If a future edge stops
+ *   stripping `/kernel/{slug}`, or a kernel is mounted at a different public
+ *   path, the issuer's path and that edge rule must move together.
+ */
+import { normalizeIssuerId } from '@astrale-os/kernel-core';
+/**
+ * Build the OIDC discovery document served at `/.well-known/openid-configuration`.
+ * `issuer` is echoed verbatim (identity); `jwks_uri` is derived to be reachable.
+ * See the file header for why the two diverge.
+ */
+export function discoveryDoc(req, issuer, signingAlgorithm) {
+    return {
+        issuer,
+        jwks_uri: jwksUriFor(req, issuer),
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: [signingAlgorithm],
+    };
+}
+// Public URL of a discovery document's sibling `jwks.json`. Three cases, in
+// priority order:
+//   1. `issuer` is a usable http(s) URL WITH a path → that path is this
+//      kernel/instance's full public mount (e.g. `…/kernel/host`). jwks lives
+//      directly under it (`{issuer}/.well-known/jwks.json`) — the OIDC invariant
+//      that needs no proxy body-rewrite.
+//   2. `issuer` is a usable http(s) URL but origin-only → the public mount path
+//      comes from the request path (kernel reached at its canonical origin).
+//   3. `issuer` is a bare slug / non-URL / port-0 fixture → fall back to the
+//      request's externally-reachable origin (proxy headers) plus its own path.
+function jwksUriFor(req, issuer) {
+    const requestJwksPath = new URL(req.url).pathname.replace(/\/openid-configuration$/, '/jwks.json');
+    const canonical = canonicalIssuerUrl(issuer);
+    if (!canonical) {
+        return `${externalOriginFromRequest(req)}${requestJwksPath}`;
+    }
+    if (canonical.pathname && canonical.pathname !== '/') {
+        return `${canonical.origin}${canonical.pathname.replace(/\/+$/, '')}/.well-known/jwks.json`;
+    }
+    return `${canonical.origin}${requestJwksPath}`;
+}
+// Parse `issuer` into its canonical http(s) URL, or null when it is not a
+// verifier-reachable origin: a bare slug (no scheme), a non-http(s) scheme, or
+// the `:0` placeholder port that test/dev fixtures use as a non-canonical stand-in.
+function canonicalIssuerUrl(issuer) {
+    try {
+        const u = new URL(normalizeIssuerId(issuer));
+        if (!u.host)
+            return null;
+        if (u.protocol !== 'http:' && u.protocol !== 'https:')
+            return null;
+        if (u.port === '0')
+            return null;
+        return u;
+    }
+    catch {
+        return null;
+    }
+}
+// Externally-reachable origin of the request. Reverse proxies commonly
+// terminate TLS and rewrite Host to an internal hostname; prefer the forwarding
+// headers (X-Forwarded-* then RFC 7239 Forwarded) before the request URL, so
+// discovery never publishes an unreachable jwks_uri.
+function externalOriginFromRequest(req) {
+    const xfHost = firstHeaderValue(req.headers.get('x-forwarded-host'));
+    if (xfHost) {
+        const proto = (firstHeaderValue(req.headers.get('x-forwarded-proto')) ?? 'https').toLowerCase();
+        return `${proto}://${xfHost}`;
+    }
+    const fwd = firstHeaderValue(req.headers.get('forwarded'));
+    if (fwd) {
+        const map = {};
+        for (const part of fwd.split(';')) {
+            const [k, v] = part.split('=');
+            if (k && v)
+                map[k.trim().toLowerCase()] = stripQuotes(v.trim());
+        }
+        if (map.host) {
+            const proto = (map.proto ?? 'https').toLowerCase();
+            return `${proto}://${map.host}`;
+        }
+    }
+    return new URL(req.url).origin;
+}
+function firstHeaderValue(value) {
+    const first = value?.split(',')[0]?.trim();
+    return first ? stripQuotes(first) : null;
+}
+function stripQuotes(value) {
+    return value.replace(/^"|"$/g, '');
+}
+//# sourceMappingURL=discovery.js.map

package/dist/jwks/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../jwks/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAS3D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,MAAc,EAAE,gBAAwB;IACjF,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,gBAAgB,CAAC;KAC1D,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,kBAAkB;AAClB,wEAAwE;AACxE,8EAA8E;AAC9E,iFAAiF;AACjF,yCAAyC;AACzC,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,SAAS,UAAU,CAAC,GAAY,EAAE,MAAc;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAA;IAC7F,CAAC;IACD,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,eAAe,EAAE,CAAA;AAChD,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,gFAAgF;AAChF,6EAA6E;AAC7E,qDAAqD;AACrD,SAAS,yBAAyB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/F,OAAO,GAAG,KAAK,MAAM,MAAM,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAA2B,EAAE,CAAA;QACtC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YAClD,OAAO,GAAG,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}

package/dist/jwks/index.d.ts

@@ -0,0 +1,3 @@
+export { mountJwks, mountInstanceJwks, type JwksKeys, type MultiplexedJwks, type JwksConfig, type InstanceJwksConfig, } from './keys';
+export { mountIssuerRegistry, mountInstanceIssuerRegistry, type IssuerRegistryConfig, type InstanceIssuerRegistryConfig, } from './issuers';
+//# sourceMappingURL=index.d.ts.map

package/dist/jwks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../jwks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,GACxB,MAAM,QAAQ,CAAA;AAEf,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,WAAW,CAAA"}

package/dist/jwks/index.js

@@ -0,0 +1,3 @@
+export { mountJwks, mountInstanceJwks, } from './keys';
+export { mountIssuerRegistry, mountInstanceIssuerRegistry, } from './issuers';
+//# sourceMappingURL=index.js.map

package/dist/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jwks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,iBAAiB,GAKlB,MAAM,QAAQ,CAAA;AAEf,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAG5B,MAAM,WAAW,CAAA"}

package/dist/jwks/issuers.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Issuer Registry — kernel-specific convention for hosting external issuers' keys.
+ *
+ * The kernel allows external identities to publish their public keys via
+ * `Authentication.publishIssuer()`. Those issuers get stable URLs of the form
+ * `{kernel}/iss/{issId}`, and their JWKS is served at
+ * `{kernel}/iss/{issId}/.well-known/jwks.json`.
+ *
+ * This is NOT standard OIDC — it's a kernel-specific trust model. Only kernels
+ * with an issuer store should mount these routes. Generic services that just
+ * sign their own JWTs don't need this.
+ */
+import type { Hono } from 'hono';
+import { type CorsConfig } from '../cors';
+export type IssuerRegistryConfig = {
+    /** Base issuer URL — registered issuer URLs are constructed as `${issuer}/iss/{issId}`. */
+    issuer: string;
+    /** Load a registered external issuer's keys. Empty array if unknown. */
+    loadKeys: (issuerId: string) => Promise<Record<string, unknown>[]>;
+    /** Signing algorithm (used in openid-configuration). Defaults to 'ES256'. */
+    signingAlgorithm?: string;
+    cors?: CorsConfig;
+};
+/**
+ * Mount issuer registry endpoints — kernel-specific convention for hosting
+ * externally-registered issuers' keys.
+ *
+ * - GET /iss/:issId/.well-known/openid-configuration → external issuer discovery
+ * - GET /iss/:issId/.well-known/jwks.json             → external issuer keys
+ */
+export declare function mountIssuerRegistry(app: Hono, config: IssuerRegistryConfig): void;
+export type InstanceIssuerRegistryConfig = {
+    /** Resolve the instance's base issuer URL. Return null if unknown. */
+    resolveIssuer: (instanceId: string) => string | null;
+    /** Load a registered external issuer's keys for an instance. */
+    loadKeys: (instanceId: string, issuerId: string) => Promise<Record<string, unknown>[]>;
+    signingAlgorithm?: string;
+    cors?: CorsConfig;
+};
+/**
+ * Mount per-instance issuer registry endpoints (multiplexed kernel-specific).
+ *
+ * - GET /:id/iss/:issId/.well-known/openid-configuration
+ * - GET /:id/iss/:issId/.well-known/jwks.json
+ */
+export declare function mountInstanceIssuerRegistry(app: Hono, instancePrefix: string, config: InstanceIssuerRegistryConfig): void;
+//# sourceMappingURL=issuers.d.ts.map

package/dist/jwks/issuers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuers.d.ts","sourceRoot":"","sources":["../../jwks/issuers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AAK3D,MAAM,MAAM,oBAAoB,GAAG;IACjC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAoBjF;AAID,MAAM,MAAM,4BAA4B,GAAG;IACzC,sEAAsE;IACtE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACpD,gEAAgE;IAChE,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,4BAA4B,GACnC,IAAI,CAyBN"}

package/dist/jwks/issuers.js

@@ -0,0 +1,76 @@
+/**
+ * Issuer Registry — kernel-specific convention for hosting external issuers' keys.
+ *
+ * The kernel allows external identities to publish their public keys via
+ * `Authentication.publishIssuer()`. Those issuers get stable URLs of the form
+ * `{kernel}/iss/{issId}`, and their JWKS is served at
+ * `{kernel}/iss/{issId}/.well-known/jwks.json`.
+ *
+ * This is NOT standard OIDC — it's a kernel-specific trust model. Only kernels
+ * with an issuer store should mount these routes. Generic services that just
+ * sign their own JWTs don't need this.
+ */
+import { buildCorsHeaders } from '../cors';
+import { discoveryDoc } from './discovery';
+/**
+ * Mount issuer registry endpoints — kernel-specific convention for hosting
+ * externally-registered issuers' keys.
+ *
+ * - GET /iss/:issId/.well-known/openid-configuration → external issuer discovery
+ * - GET /iss/:issId/.well-known/jwks.json             → external issuer keys
+ */
+export function mountIssuerRegistry(app, config) {
+    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
+    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
+    const alg = config.signingAlgorithm ?? 'ES256';
+    app.get('/iss/:issId/.well-known/openid-configuration', (c) => {
+        const issId = c.req.param('issId');
+        const issuerUrl = `${config.issuer}/iss/${issId}`;
+        return c.json(discoveryDoc(c.req.raw, issuerUrl, alg), 200, headers);
+    });
+    app.get('/iss/:issId/.well-known/jwks.json', async (c) => {
+        const issId = c.req.param('issId');
+        const issuerUrl = `${config.issuer}/iss/${issId}`;
+        const keys = await config.loadKeys(issuerUrl);
+        if (keys.length === 0) {
+            return c.json({ error: 'Issuer not found' }, 404, headers);
+        }
+        return c.json({ keys }, 200, headers);
+    });
+}
+/**
+ * Mount per-instance issuer registry endpoints (multiplexed kernel-specific).
+ *
+ * - GET /:id/iss/:issId/.well-known/openid-configuration
+ * - GET /:id/iss/:issId/.well-known/jwks.json
+ */
+export function mountInstanceIssuerRegistry(app, instancePrefix, config) {
+    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
+    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
+    const alg = config.signingAlgorithm ?? 'ES256';
+    app.get(`${instancePrefix}/iss/:issId/.well-known/openid-configuration`, (c) => {
+        const id = c.req.param('id');
+        const issId = c.req.param('issId');
+        if (!id || !issId)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const issuer = config.resolveIssuer(id);
+        if (!issuer)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const issuerUrl = `${issuer}/iss/${issId}`;
+        return c.json(discoveryDoc(c.req.raw, issuerUrl, alg), 200, headers);
+    });
+    app.get(`${instancePrefix}/iss/:issId/.well-known/jwks.json`, async (c) => {
+        const id = c.req.param('id');
+        const issId = c.req.param('issId');
+        if (!id || !issId)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const issuer = config.resolveIssuer(id);
+        if (!issuer)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const keys = await config.loadKeys(id, `${issuer}/iss/${issId}`);
+        if (keys.length === 0)
+            return c.json({ error: 'Issuer not found' }, 404, headers);
+        return c.json({ keys }, 200, headers);
+    });
+}
+//# sourceMappingURL=issuers.js.map

package/dist/jwks/issuers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuers.js","sourceRoot":"","sources":["../../jwks/issuers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAS,EAAE,MAA4B;IACzE,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,8CAA8C,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,MAAM,QAAQ,KAAK,EAAE,CAAA;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,MAAM,QAAQ,KAAK,EAAE,CAAA;QACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,GAAS,EACT,cAAsB,EACtB,MAAoC;IAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,8CAA8C,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7E,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,GAAG,MAAM,QAAQ,KAAK,EAAE,CAAA;QAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,MAAM,QAAQ,KAAK,EAAE,CAAC,CAAA;QAChE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/jwks/keys.d.ts

@@ -0,0 +1,44 @@
+/**
+ * JWKS — generic OpenID Connect Discovery + JSON Web Key Set exposure.
+ *
+ * Mounts the standard OIDC discovery and JWKS endpoints for the server's
+ * own signing keys. Used by every server that signs JWTs.
+ */
+import type { Hono } from 'hono';
+import { type CorsConfig } from '../cors';
+export type JwksKeys = {
+    /** The server's own issuer URL. */
+    issuer: string;
+    /** Return the server's own public signing key(s). */
+    loadOwnKeys: () => Promise<Record<string, unknown>[]>;
+};
+export type MultiplexedJwks = {
+    /** Resolve the issuer URL for an instance. Return null if unknown. */
+    resolveIssuer: (instanceId: string) => string | null;
+    /** Load the instance's own public keys. Empty array if unknown. */
+    loadOwnKeys: (instanceId: string) => Promise<Record<string, unknown>[]>;
+};
+export type JwksConfig = JwksKeys & {
+    /** Signing algorithm (used in openid-configuration). Defaults to 'ES256'. */
+    signingAlgorithm?: string;
+    cors?: CorsConfig;
+};
+/**
+ * Mount OpenID Connect Discovery and JWKS endpoints for the server's own keys.
+ *
+ * - GET /.well-known/openid-configuration → OIDC discovery document
+ * - GET /.well-known/jwks.json            → server's own public keys
+ */
+export declare function mountJwks(app: Hono, config: JwksConfig): void;
+export type InstanceJwksConfig = MultiplexedJwks & {
+    signingAlgorithm?: string;
+    cors?: CorsConfig;
+};
+/**
+ * Mount per-instance OpenID Connect Discovery and JWKS endpoints (own keys).
+ *
+ * Routes are prefixed with the instance path (e.g. `/:id`).
+ * The instance ID is extracted from the Hono `:id` param.
+ */
+export declare function mountInstanceJwks(app: Hono, instancePrefix: string, config: InstanceJwksConfig): void;
+//# sourceMappingURL=keys.d.ts.map

package/dist/jwks/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../jwks/keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AAK3D,MAAM,MAAM,QAAQ,GAAG;IACrB,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,qDAAqD;IACrD,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,sEAAsE;IACtE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACpD,mEAAmE;IACnE,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CACxE,CAAA;AAID,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG;IAClC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAa7D;AAID,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,IAAI,CAoBN"}

package/dist/jwks/keys.js

@@ -0,0 +1,56 @@
+/**
+ * JWKS — generic OpenID Connect Discovery + JSON Web Key Set exposure.
+ *
+ * Mounts the standard OIDC discovery and JWKS endpoints for the server's
+ * own signing keys. Used by every server that signs JWTs.
+ */
+import { buildCorsHeaders } from '../cors';
+import { discoveryDoc } from './discovery';
+/**
+ * Mount OpenID Connect Discovery and JWKS endpoints for the server's own keys.
+ *
+ * - GET /.well-known/openid-configuration → OIDC discovery document
+ * - GET /.well-known/jwks.json            → server's own public keys
+ */
+export function mountJwks(app, config) {
+    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
+    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
+    const alg = config.signingAlgorithm ?? 'ES256';
+    app.get('/.well-known/openid-configuration', (c) => {
+        return c.json(discoveryDoc(c.req.raw, config.issuer, alg), 200, headers);
+    });
+    app.get('/.well-known/jwks.json', async (c) => {
+        const keys = await config.loadOwnKeys();
+        return c.json({ keys }, 200, headers);
+    });
+}
+/**
+ * Mount per-instance OpenID Connect Discovery and JWKS endpoints (own keys).
+ *
+ * Routes are prefixed with the instance path (e.g. `/:id`).
+ * The instance ID is extracted from the Hono `:id` param.
+ */
+export function mountInstanceJwks(app, instancePrefix, config) {
+    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
+    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
+    const alg = config.signingAlgorithm ?? 'ES256';
+    app.get(`${instancePrefix}/.well-known/openid-configuration`, (c) => {
+        const id = c.req.param('id');
+        if (!id)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const issuer = config.resolveIssuer(id);
+        if (!issuer)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        return c.json(discoveryDoc(c.req.raw, issuer, alg), 200, headers);
+    });
+    app.get(`${instancePrefix}/.well-known/jwks.json`, async (c) => {
+        const id = c.req.param('id');
+        if (!id)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        const keys = await config.loadOwnKeys(id);
+        if (keys.length === 0)
+            return c.json({ error: 'Instance not found' }, 404, headers);
+        return c.json({ keys }, 200, headers);
+    });
+}
+//# sourceMappingURL=keys.js.map

package/dist/jwks/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../jwks/keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AA0B1C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,MAAkB;IACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAA;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAS,EACT,cAAsB,EACtB,MAA0B;IAE1B,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/plan/host-params.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Extract host placeholder values from an incoming request's Host header.
+ *
+ * Used by request-time middleware to merge tenant identifiers from the host
+ * into the dispatched params (at lowest priority).
+ *
+ * Returns:
+ *  - `null` when the matcher exists but the host doesn't match (caller 404s)
+ *  - `{}` when there are no placeholders (single-tenant server)
+ *  - the captured groups otherwise
+ */
+export declare function extractHostParams(matcher: RegExp | null, request: Request): Record<string, string> | null;
+//# sourceMappingURL=host-params.d.ts.map

package/dist/plan/host-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-params.d.ts","sourceRoot":"","sources":["../../plan/host-params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAO/B"}

package/dist/plan/host-params.js

@@ -0,0 +1,23 @@
+/**
+ * Extract host placeholder values from an incoming request's Host header.
+ *
+ * Used by request-time middleware to merge tenant identifiers from the host
+ * into the dispatched params (at lowest priority).
+ *
+ * Returns:
+ *  - `null` when the matcher exists but the host doesn't match (caller 404s)
+ *  - `{}` when there are no placeholders (single-tenant server)
+ *  - the captured groups otherwise
+ */
+export function extractHostParams(matcher, request) {
+    if (!matcher)
+        return {};
+    const host = request.headers.get('host');
+    if (!host)
+        return null;
+    const result = matcher.exec(host);
+    if (!result)
+        return null;
+    return { ...result.groups };
+}
+//# sourceMappingURL=host-params.js.map

package/dist/plan/host-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-params.js","sourceRoot":"","sources":["../../plan/host-params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/plan/host.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Server host URL and its parsed form.
+ *
+ * The server host URL is the canonical address of THIS kernel server. It may
+ * contain host placeholders (`{tenant}.example.com`) for multi-tenant servers.
+ * `parseServerHost` extracts the pieces needed by the walker and the
+ * request-time host param extractor.
+ */
+export type ServerHost = {
+    /** Full server URL — may contain host placeholders for multi-tenant servers. */
+    url: string;
+};
+export type ParsedServerHost = {
+    /** Canonical host pattern (with `{name}` placeholders) used for anchoring checks. */
+    hostPattern: string;
+    /** Base path stripped of any trailing slash. */
+    basePath: string;
+    /** Compiled Host header matcher, or `null` when there are no placeholders. */
+    hostMatcher: RegExp | null;
+    /** Host placeholder names in source order. */
+    hostPlaceholders: string[];
+};
+export declare function parseServerHost(host: ServerHost): ParsedServerHost;
+//# sourceMappingURL=host.d.ts.map

package/dist/plan/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../plan/host.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,MAAM,UAAU,GAAG;IACvB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAQlE"}

package/dist/plan/host.js

@@ -0,0 +1,24 @@
+/**
+ * Server host URL and its parsed form.
+ *
+ * The server host URL is the canonical address of THIS kernel server. It may
+ * contain host placeholders (`{tenant}.example.com`) for multi-tenant servers.
+ * `parseServerHost` extracts the pieces needed by the walker and the
+ * request-time host param extractor.
+ */
+import { compileHostMatcher, parseUrlTemplate } from '@astrale-os/kernel-api/routed';
+export function parseServerHost(host) {
+    const parsed = parseUrlTemplate(host.url);
+    return {
+        hostPattern: parsed.hostPattern,
+        basePath: stripTrailingSlash(parsed.basePath),
+        hostMatcher: parsed.hostPlaceholders.length > 0 ? compileHostMatcher(parsed.hostPattern) : null,
+        hostPlaceholders: parsed.hostPlaceholders,
+    };
+}
+function stripTrailingSlash(p) {
+    if (p.length > 1 && p.endsWith('/'))
+        return p.slice(0, -1);
+    return p;
+}
+//# sourceMappingURL=host.js.map

package/dist/plan/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../plan/host.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAkBpF,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/F,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/plan/index.d.ts

@@ -0,0 +1,4 @@
+export { walkDomain, type MountedFunction, type MountedRoute, type MountPlan } from './walk';
+export { parseServerHost, type ServerHost, type ParsedServerHost } from './host';
+export { extractHostParams } from './host-params';
+//# sourceMappingURL=index.d.ts.map

package/dist/plan/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../plan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAA;AAC5F,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA"}

package/dist/plan/index.js

@@ -0,0 +1,4 @@
+export { walkDomain } from './walk';
+export { parseServerHost } from './host';
+export { extractHostParams } from './host-params';
+//# sourceMappingURL=index.js.map

package/dist/plan/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../plan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA2D,MAAM,QAAQ,CAAA;AAC5F,OAAO,EAAE,eAAe,EAA0C,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA"}