@astrale-os/kernel-server 0.4.16 → 0.5.0-beta.1

package/dist/errors/response-body.js

@@ -0,0 +1,9 @@
+export class ResponseBodyTooLargeError extends Error {
+    maximumBytes;
+    constructor(maximumBytes) {
+        super(`Server response exceeds maximumResponseBytes (${maximumBytes}).`);
+        this.maximumBytes = maximumBytes;
+        this.name = 'ResponseBodyTooLargeError';
+    }
+}
+//# sourceMappingURL=response-body.js.map

package/dist/errors/response-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-body.js","sourceRoot":"","sources":["../../errors/response-body.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B,YAAY;IAAjC,YAAqB,YAAoB;QACvC,KAAK,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAA;4BADrD,YAAY;QAE/B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,12 +1,5 @@
-export { createKernelApp, type KernelAppConfig, type WsAdapter } from './app/create.js';
-export { createMultiplexedKernelApp, type MultiplexedKernelAppConfig, type DispatcherResolver, } from './app/multiplexed.js';
-export { walkDomain, type ServerHost, type MountedFunction, type MountedRoute, type MountPlan, } from './plan/index.js';
-export { buildCorsHeaders, type CorsConfig } from './cors.js';
-export { createKernelDispatcher, type KernelDispatcherOptions } from './envelope/http.js';
-export { KernelWsConnection, type WebSocketLike } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, type CapabilityHost, type CapabilityLifecycle, type Defer, type DeferredTask, type Capabilities, type Sleep, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, type Invocation, type InvocationPath, type InvocationReply, type InvocationResponse, type Dispatcher, } from './invocation/index.js';
-export { createRouteHandler, type RouteHandlerConfig } from './routed/index.js';
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, type JwksKeys, type MultiplexedJwks, type JwksConfig, type InstanceJwksConfig, type IssuerRegistryConfig, type InstanceIssuerRegistryConfig, } from './jwks/index.js';
-export { classifyError } from '@astrale-os/kernel-api';
+export { createServer, prepareServer } from './server.js';
+export { InstallationUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
+export type { Application, ApplicationHost, CorsConfig, Handler, HandlerRequest, HealthProbe, InstallationContext, InstallationProvider, InvocationContext, Issuer, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAI7D,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,UAAU,GAChB,MAAM,uBAAuB,CAAA;AAI9B,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAI/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,19 +1,4 @@
-// ─── App entry points ─────────────────────────────────────────────────────────
-export { createKernelApp } from './app/create.js';
-export { createMultiplexedKernelApp, } from './app/multiplexed.js';
-// ─── Plan ────────────────────────────────────────────────────────────────────
-export { walkDomain, } from './plan/index.js';
-// ─── Cross-cutting ───────────────────────────────────────────────────────────
-export { buildCorsHeaders } from './cors.js';
-// ─── Kernel envelope dispatcher ──────────────────────────────────────────────
-export { createKernelDispatcher } from './envelope/http.js';
-export { KernelWsConnection } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, } from './invocation/index.js';
-// ─── Routed HTTP handler (per-route) ─────────────────────────────────────────
-export { createRouteHandler } from './routed/index.js';
-// ─── JWKS (OIDC Discovery + JSON Web Key Set) ───────────────────────────────
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, } from './jwks/index.js';
-// ─── Dispatch (for custom integrations) ──────────────────────────────────────
-export { classifyError } from '@astrale-os/kernel-api';
+export { createServer, prepareServer } from './server.js';
+export { InstallationUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,EAAE,eAAe,EAAwC,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAA;AAE7B,gFAAgF;AAEhF,OAAO,EACL,UAAU,GAKX,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAA;AAE7D,gFAAgF;AAEhF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAsB,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GAOnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAEhF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAA;AAE/E,+EAA+E;AAE/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAO5B,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/installation/handler.d.ts

@@ -0,0 +1,10 @@
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { PreparedPublicationSnapshot } from '../publication/index.js';
+import type { InstallationProvider } from './types.js';
+export interface InstallationLimits {
+    readonly maximumInstallationBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/** Serve one installation request against the exact Publication snapshot that selected its URL. */
+export declare function handleInstallation(request: Request, snapshot: PreparedPublicationSnapshot, provider: InstallationProvider | undefined, active: ActiveOperations, limits: InstallationLimits, cors: Readonly<Record<string, string>>): Promise<Response>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/installation/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../installation/handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAMtD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;CACrC;AAED,mGAAmG;AACnG,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,2BAA2B,EACrC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACrC,OAAO,CAAC,QAAQ,CAAC,CAsGnB"}

package/dist/installation/handler.js

@@ -0,0 +1,126 @@
+import { codecs, installation } from '@astrale-os/kernel-protocol';
+import { InstallationUnavailableError } from '../errors/index.js';
+import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../errors/index.js';
+import { readBoundedBody } from '../transport/index.js';
+/** Serve one installation request against the exact Publication snapshot that selected its URL. */
+export async function handleInstallation(request, snapshot, provider, active, limits, cors) {
+    if (request.method !== 'POST') {
+        return response({ error: 'Installation requires POST.' }, 405, cors);
+    }
+    if (provider === undefined) {
+        return response({ error: 'Installation is unavailable.' }, 503, cors);
+    }
+    const advertised = snapshot.publication.installation;
+    if (advertised === undefined) {
+        return response({ error: 'Installation is unavailable.' }, 404, cors);
+    }
+    const operation = active.begin(limits.invocationTimeoutMs, request.signal);
+    if (operation === undefined)
+        return response({ error: 'Server is draining.' }, 503, cors);
+    try {
+        const authorization = request.headers.get('authorization');
+        const token = bearer(authorization);
+        if (advertised.authentication.kind === 'bearer' && token === undefined) {
+            return response({ error: 'Bearer authentication is required.' }, 401, cors);
+        }
+        if (advertised.authentication.kind === 'public' && authorization !== null) {
+            return response({ error: 'This installation endpoint is public.' }, 400, cors);
+        }
+        let body;
+        try {
+            body = await readBoundedBody(request, limits.maximumInstallationBytes, operation.signal);
+        }
+        catch (cause) {
+            if (cause instanceof RequestBodyTooLargeError) {
+                return response({ error: 'Installation request is too large.' }, 413, cors);
+            }
+            if (cause instanceof RequestBodyInvalidError) {
+                return response({ error: 'Installation request is invalid.' }, 400, cors);
+            }
+            if (operation.signal.aborted) {
+                return response({ error: 'Installation request was cancelled.' }, 503, cors);
+            }
+            throw cause;
+        }
+        let decoded;
+        try {
+            decoded = codecs.json.decode(body);
+        }
+        catch (cause) {
+            if (cause instanceof codecs.DecodeError) {
+                return response({ error: 'Installation request is invalid.' }, 400, cors);
+            }
+            throw cause;
+        }
+        let input;
+        try {
+            input = installation.acceptRequest(decoded);
+        }
+        catch (cause) {
+            if (cause instanceof installation.Error && cause.code === 'INSTALLATION_REQUEST_INVALID') {
+                return response({ error: 'Installation request is invalid.' }, 400, cors);
+            }
+            throw cause;
+        }
+        if (input.etag !== snapshot.publication.etag) {
+            return response({ error: 'Publication ETag differs from request.' }, 409, cors);
+        }
+        let candidate;
+        try {
+            candidate = await provider.create(input, {
+                ...(token === undefined ? {} : { token: Object.freeze({ kind: 'bearer', token }) }),
+                signal: operation.signal,
+            });
+        }
+        catch (cause) {
+            if (cause instanceof InstallationUnavailableError) {
+                return response({ error: 'Installation provider is unavailable.' }, 503, cors);
+            }
+            throw cause;
+        }
+        let created;
+        try {
+            created = installation.accept(candidate);
+        }
+        catch (cause) {
+            if (cause instanceof installation.Error) {
+                return response({ error: 'Installation provider returned an invalid response.' }, 500, cors);
+            }
+            throw cause;
+        }
+        if (created.publication.etag !== snapshot.publication.etag) {
+            return response({ error: 'Installation provider returned a different Publication.' }, 500, cors);
+        }
+        const encoded = codecs.json.encode(created);
+        if (encodedSize(encoded) > limits.maximumInstallationBytes) {
+            return response({ error: 'Installation response exceeds its serving limit.' }, 500, cors);
+        }
+        return new Response(encodedBody(encoded), {
+            headers: { ...cors, 'content-type': 'application/json' },
+        });
+    }
+    finally {
+        operation.settle();
+    }
+}
+function bearer(input) {
+    if (input === null)
+        return undefined;
+    return /^Bearer[ \t]+([^\s]+)$/iu.exec(input.trim())?.[1];
+}
+function response(body, status, cors) {
+    return new Response(encodedBody(codecs.json.encode(body)), {
+        status,
+        headers: { ...cors, 'content-type': 'application/json' },
+    });
+}
+function encodedBody(input) {
+    return typeof input === 'string' ? input : toBody(input);
+}
+function encodedSize(input) {
+    return typeof input === 'string' ? new TextEncoder().encode(input).byteLength : input.byteLength;
+}
+function toBody(input) {
+    return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}
+//# sourceMappingURL=handler.js.map

package/dist/installation/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../installation/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAMlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AACjE,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAOvD,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,QAAqC,EACrC,QAA0C,EAC1C,MAAwB,EACxB,MAA0B,EAC1B,IAAsC;IAEtC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAA;IACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACnC,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC1E,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAChF,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,KAA2B,CAAA;QAC/B,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBACzF,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,SAAkB,CAAA;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;gBACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACnF,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAChF,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,OAA+C,CAAA;QACnD,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9F,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,QAAQ,CACb,EAAE,KAAK,EAAE,yDAAyD,EAAE,EACpE,GAAG,EACH,IAAI,CACL,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,EAAE,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc,EAAE,IAAsC;IACrF,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE;QACzD,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;KACzD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAA0B;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAA0B;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}

package/dist/installation/index.d.ts

@@ -0,0 +1,3 @@
+export { handleInstallation, type InstallationLimits } from './handler.js';
+export type { InstallationContext, InstallationProvider } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/installation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../installation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC1E,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA"}

package/dist/installation/index.js

@@ -0,0 +1,2 @@
+export { handleInstallation } from './handler.js';
+//# sourceMappingURL=index.js.map

package/dist/installation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../installation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,cAAc,CAAA"}

package/dist/installation/types.d.ts

@@ -0,0 +1,12 @@
+import type { installation } from '@astrale-os/kernel-protocol';
+export interface InstallationContext {
+    /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
+    readonly token?: installation.InstallationToken;
+    readonly signal: AbortSignal;
+}
+/** Provider-owned retrieval, construction, and attestation signing. */
+export interface InstallationProvider {
+    /** Throw InstallationUnavailableError only for an expected dependency outage. */
+    create(request: installation.Request, context: InstallationContext): Promise<installation.Installation>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/installation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../installation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE/D,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,iBAAiB,CAAA;IAC/C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,MAAM,CACJ,OAAO,EAAE,YAAY,CAAC,OAAO,EAC7B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;CACtC"}

package/dist/installation/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/installation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../installation/types.ts"],"names":[],"mappings":""}

package/dist/invocation/context.d.ts

@@ -0,0 +1,7 @@
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
+import type { ApplicationHost, InvocationContext } from './types.js';
+export declare function invocationContext(operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey, refresh?: InvocationContext['refresh'], delegate?: InvocationContext['delegate']): InvocationContext;
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export declare function defaultSleep(durationMs: number): Promise<void>;
+//# sourceMappingURL=context.d.ts.map

package/dist/invocation/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../invocation/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEpE,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,gBAAgB,EACxB,IAAI,CAAC,EAAE,eAAe,EACtB,WAAW,CAAC,EAAE,UAAU,EACxB,cAAc,CAAC,EAAE,QAAQ,CAAC,cAAc,EACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,EACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,GACvC,iBAAiB,CAcnB;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}

package/dist/invocation/context.js

@@ -0,0 +1,62 @@
+export function invocationContext(operation, active, host, requestBody, idempotencyKey, refresh, delegate) {
+    const body = requestBody?.slice();
+    return Object.freeze({
+        execution: Object.freeze({ deadline: operation.deadline, signal: operation.signal }),
+        background: (task) => active.background(task, host?.waitUntil),
+        sleep: async (durationMs) => {
+            await interruptibleSleep(sleepDuration(durationMs), operation.signal, host?.sleep);
+        },
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        ...(refresh === undefined ? {} : { refresh }),
+        ...(delegate === undefined ? {} : { delegate }),
+        ...(body === undefined ? {} : { request: Object.freeze({ body: () => body.slice() }) }),
+    });
+}
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export async function defaultSleep(durationMs) {
+    await new Promise((resolve) => setTimeout(resolve, sleepDuration(durationMs)));
+}
+async function interruptibleSleep(durationMs, signal, sleep) {
+    if (signal.aborted)
+        throw abortCause(signal);
+    if (sleep === undefined) {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => finish(resolve), durationMs);
+            const abort = () => {
+                clearTimeout(timer);
+                finish(() => reject(abortCause(signal)));
+            };
+            const finish = (settle) => {
+                signal.removeEventListener('abort', abort);
+                settle();
+            };
+            signal.addEventListener('abort', abort, { once: true });
+        });
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (settle) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', abort);
+            settle();
+        };
+        const abort = () => finish(() => reject(abortCause(signal)));
+        signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve()
+            .then(() => sleep(durationMs))
+            .then(() => finish(resolve), (cause) => finish(() => reject(cause)));
+    });
+}
+function abortCause(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error('Invocation was cancelled.');
+}
+function sleepDuration(input) {
+    if (!Number.isFinite(input) || input < 0 || input > 2_147_483_647) {
+        throw new RangeError('Sleep duration must be finite, non-negative, and within timer range.');
+    }
+    return input;
+}
+//# sourceMappingURL=context.js.map

package/dist/invocation/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../invocation/context.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,iBAAiB,CAC/B,SAA0B,EAC1B,MAAwB,EACxB,IAAsB,EACtB,WAAwB,EACxB,cAAwC,EACxC,OAAsC,EACtC,QAAwC;IAExC,MAAM,IAAI,GAAG,WAAW,EAAE,KAAK,EAAE,CAAA;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACpF,UAAU,EAAE,CAAC,IAAuC,EAAE,EAAE,CACtD,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;QAC1C,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;YAClC,MAAM,kBAAkB,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACpF,CAAC;QACD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,UAAkB,EAClB,MAAmB,EACnB,KAA6C;IAE7C,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;gBACpC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC1C,MAAM,EAAE,CAAA;YACV,CAAC,CAAA;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC1C,MAAM,EAAE,CAAA;QACV,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;aAC7B,IAAI,CACH,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACvC,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;AAChG,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,sEAAsE,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/invocation/index.d.ts

@@ -1,3 +1,3 @@
-export { dispatchInvocation, executeInvocation, type InvocationReply, type InvocationResponse, } from './dispatch.js';
-export { kernelDispatcher, type Invocation, type InvocationPath, type Dispatcher, } from './dispatcher.js';
+export { defaultSleep, invocationContext } from './context.js';
+export type { ApplicationHost, Handler, HandlerRequest, InvocationContext } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC9D,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA"}

package/dist/invocation/index.js

@@ -1,3 +1,2 @@
-export { dispatchInvocation, executeInvocation, } from './dispatch.js';
-export { kernelDispatcher, } from './dispatcher.js';
+export { defaultSleep, invocationContext } from './context.js';
 //# sourceMappingURL=index.js.map

package/dist/invocation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/invocation/types.d.ts

@@ -0,0 +1,34 @@
+import type { CredentialInput } from '@astrale-os/kernel-core/auth';
+import type { InboundRequestOptions, RequestBackground, RequestSleep } from '@astrale-os/kernel-ports';
+import type { Call, Result } from '@astrale-os/kernel-ports/functions';
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { PublicationSnapshot } from '../publication/index.js';
+/** Optional platform retention and timer adaptation for one Fetch invocation. */
+export interface ApplicationHost {
+    waitUntil(promise: Promise<unknown>): void;
+    readonly sleep?: (durationMs: number) => Promise<void>;
+}
+/** Immutable lifetime and execution conveniences for one admitted dispatch. */
+export interface InvocationContext extends InboundRequestOptions {
+    readonly background: RequestBackground;
+    /** Rejects promptly when execution is cancelled or reaches its deadline. */
+    readonly sleep: RequestSleep;
+}
+/** Ready semantic capability invoked by canonical and advertised transport routes. */
+export interface HandlerRequest {
+    readonly call: Call;
+    readonly credential?: CredentialInput;
+    /** Source-only effective delegation forwarded unchanged to Runtime. */
+    readonly delegate?: protocol.Delegate;
+    /** Destination routing witness forwarded to a remote adapter after Server matching. */
+    readonly via?: protocol.Via;
+    /** Exact Server-pinned serving generation for a Publication-backed request. */
+    readonly publication?: PublicationSnapshot;
+    readonly context: InvocationContext;
+}
+export interface Handler {
+    dispatch(request: HandlerRequest): Promise<Result | {
+        readonly kind: 'miss';
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/invocation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../invocation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrC,uFAAuF;IACvF,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAA;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CACpC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/E"}

package/dist/invocation/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/invocation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../invocation/types.ts"],"names":[],"mappings":""}

package/dist/issuer/index.d.ts

@@ -0,0 +1,3 @@
+export { admitIssuer, issuerRouteReservations, mountIssuer, type IssuerRouteReservation, } from './routes.js';
+export type { Issuer } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../issuer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}

package/dist/issuer/index.js

@@ -0,0 +1,2 @@
+export { admitIssuer, issuerRouteReservations, mountIssuer, } from './routes.js';
+//# sourceMappingURL=index.js.map

package/dist/issuer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../issuer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,WAAW,GAEZ,MAAM,aAAa,CAAA"}

package/dist/issuer/routes.d.ts

@@ -0,0 +1,13 @@
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { ServerRouter } from '../transport/index.js';
+import type { Issuer } from './types.js';
+export interface IssuerRouteReservation {
+    readonly path: string;
+    readonly methods: readonly string[];
+}
+export declare function issuerRouteReservations(input: Issuer): readonly IssuerRouteReservation[];
+export declare function mountIssuer(app: ServerRouter, input: Issuer, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;
+/** Admit static discovery configuration before Runtime Boot performs any durable work. */
+export declare function admitIssuer(input: Issuer): Issuer;
+//# sourceMappingURL=routes.d.ts.map

package/dist/issuer/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../issuer/routes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAIxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,sBAAsB,EAAE,CAoBxF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,GAChB,IAAI,CAoIN;AAWD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBjD"}

package/dist/issuer/routes.js

@@ -0,0 +1,138 @@
+import { issuer as issuerDiscovery } from '@astrale-os/kernel-protocol';
+import { IssuerKeysUnavailableError } from '../errors/index.js';
+export function issuerRouteReservations(input) {
+    const paths = issuerDiscovery.paths(input.issuer);
+    const reservations = [
+        Object.freeze({ path: paths.configuration, methods: Object.freeze(['GET']) }),
+        Object.freeze({ path: paths.keys, methods: Object.freeze(['GET']) }),
+    ];
+    if (input.loadIssuerPublicKeys !== undefined) {
+        const base = new URL(input.issuer).pathname.replace(/\/+$/u, '');
+        reservations.push(Object.freeze({
+            path: `${base}/iss/{thumbprint}/.well-known/openid-configuration`,
+            methods: Object.freeze(['GET']),
+        }), Object.freeze({
+            path: `${base}/iss/{thumbprint}/.well-known/jwks.json`,
+            methods: Object.freeze(['GET']),
+        }));
+    }
+    return Object.freeze(reservations);
+}
+export function mountIssuer(app, input, cors, active, timeoutMs) {
+    const issuer = input.issuer;
+    const paths = issuerDiscovery.paths(issuer);
+    const headers = (request) => ({
+        ...cors.response(request),
+        'cache-control': 'no-cache',
+    });
+    const algorithm = input.signingAlgorithm ?? 'ES256';
+    const configuration = issuerDiscovery.configuration(issuer, [algorithm]);
+    app.get(paths.configuration, (context) => context.json(configuration, 200, headers(context.req.raw)));
+    if (cors.enabled) {
+        app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+        app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+    }
+    app.get(paths.keys, async (context) => {
+        const operation = active.begin(timeoutMs, context.req.raw.signal);
+        if (operation === undefined) {
+            return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+        }
+        try {
+            const keys = await input.loadPublicKeys(operation.signal);
+            return context.json(issuerDiscovery.keySet(keys, [algorithm]), 200, headers(context.req.raw));
+        }
+        catch (cause) {
+            if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+            }
+            throw cause;
+        }
+        finally {
+            operation.settle();
+        }
+    });
+    const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    if (loadIssuerPublicKeys !== undefined) {
+        const base = new URL(issuer).pathname.replace(/\/+$/, '');
+        if (cors.enabled) {
+            app.options(`${base}/iss/:thumbprint/.well-known/openid-configuration`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+            app.options(`${base}/iss/:thumbprint/.well-known/jwks.json`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+        }
+        app.get(`${base}/iss/:thumbprint/.well-known/openid-configuration`, async (context) => {
+            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            if (hostedIssuer === undefined)
+                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+            const operation = active.begin(timeoutMs, context.req.raw.signal);
+            if (operation === undefined) {
+                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            }
+            try {
+                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
+                if (keys.length === 0)
+                    return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+                return context.json(issuerDiscovery.configuration(hostedIssuer, [algorithm]), 200, headers(context.req.raw));
+            }
+            catch (cause) {
+                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                }
+                throw cause;
+            }
+            finally {
+                operation.settle();
+            }
+        });
+        app.get(`${base}/iss/:thumbprint/.well-known/jwks.json`, async (context) => {
+            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            if (hostedIssuer === undefined)
+                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+            const operation = active.begin(timeoutMs, context.req.raw.signal);
+            if (operation === undefined) {
+                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            }
+            try {
+                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
+                if (keys.length === 0)
+                    return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+                return context.json({ keys }, 200, headers(context.req.raw));
+            }
+            catch (cause) {
+                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                }
+                throw cause;
+            }
+            finally {
+                operation.settle();
+            }
+        });
+    }
+}
+async function hostedKeys(load, issuer, signal, algorithm) {
+    return issuerDiscovery.keySet(await load(issuer, signal), [algorithm]).keys;
+}
+/** Admit static discovery configuration before Runtime Boot performs any durable work. */
+export function admitIssuer(input) {
+    const signingAlgorithm = input.signingAlgorithm ?? 'ES256';
+    const issuer = issuerDiscovery.configuration(input.issuer, [signingAlgorithm]).issuer;
+    if (typeof input.loadPublicKeys !== 'function') {
+        throw new TypeError('Issuer public-key loader is invalid.');
+    }
+    if (input.loadIssuerPublicKeys !== undefined &&
+        typeof input.loadIssuerPublicKeys !== 'function') {
+        throw new TypeError('Hosted issuer discovery loader is invalid.');
+    }
+    const loadPublicKeys = input.loadPublicKeys;
+    const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    return Object.freeze({
+        issuer,
+        signingAlgorithm,
+        loadPublicKeys: (signal) => loadPublicKeys.call(input, signal),
+        ...(loadIssuerPublicKeys === undefined
+            ? {}
+            : {
+                loadIssuerPublicKeys: (hostedIssuer, signal) => loadIssuerPublicKeys.call(input, hostedIssuer, signal),
+            }),
+    });
+}
+//# sourceMappingURL=routes.js.map