@astrale-os/kernel-server 0.4.17 → 0.5.0-beta.10

package/dist/envelope/ws.js

@@ -1,142 +0,0 @@
-/**
- * Kernel envelope WS connection — universal RPC envelope over WebSockets.
- *
- * Each frame is a kernel envelope. Codec is fixed for the lifetime of the
- * connection (negotiated at upgrade via `?codec=`). Stream responses use
- * kernel stream framing (`{stream:{id,index,data}}`). Per-message credentials
- * live in the top-level `creds` field.
- *
- * Binary output mode is partially supported: small Uint8Array bodies are
- * delivered as a single stream chunk + end frame; ReadableStream bodies are
- * marked TODO and rejected with INTERNAL_ERROR for now.
- */
-import { KERNEL_ERROR_CODES, classifyError, decodeKernelRequest, encodeKernelError, encodeKernelRedirect, encodeKernelResponse, encodeStreamChunk, encodeStreamEnd, encodeStreamError, isBinaryResult, } from '@astrale-os/kernel-api';
-import { dispatchInvocation } from '../invocation/index.js';
-const WS_OPEN = 1;
-// ─── Connection ─────────────────────────────────────────────────────────────
-export class KernelWsConnection {
-    ws;
-    codec;
-    dispatcher;
-    host;
-    constructor(ws, codec, dispatcher, host) {
-        this.ws = ws;
-        this.codec = codec;
-        this.dispatcher = dispatcher;
-        this.host = host;
-    }
-    start() {
-        /* no-op — protocol-level ping handled by transport */
-    }
-    handleMessage(data) {
-        this.processMessage(data).catch((err) => {
-            // oxlint-disable-next-line no-console
-            console.error('[ws] message handler crashed:', err);
-        });
-    }
-    async processMessage(data) {
-        // 1. Decode codec frame
-        let raw;
-        try {
-            const input = typeof data === 'string' ? data : data instanceof Uint8Array ? data : new Uint8Array(data);
-            raw = this.codec.decode(input);
-        }
-        catch {
-            this.sendFrame(encodeKernelError(null, {
-                code: KERNEL_ERROR_CODES.PARSE_ERROR,
-                message: 'Parse error',
-            }));
-            return;
-        }
-        // 2. Decode envelope
-        let request;
-        try {
-            request = decodeKernelRequest(raw);
-        }
-        catch (e) {
-            this.sendFrame(encodeKernelError(null, {
-                code: KERNEL_ERROR_CODES.INVALID_REQUEST,
-                message: e instanceof Error ? e.message : 'Invalid request',
-            }));
-            return;
-        }
-        // 3. Credential — fixed `creds` top-level field on each frame.
-        const cred = request.creds ?? '';
-        // 4. Dispatch
-        const isAck = request.id === undefined;
-        const result = await dispatchInvocation(this.dispatcher, {
-            path: request.method,
-            credential: cred,
-            params: request.params,
-            ...(request.self === undefined ? {} : { self: request.self }),
-        }, isAck ? { ack: true } : { id: request.id }, this.host);
-        // 5. Send result
-        switch (result.kind) {
-            case 'ack':
-                return;
-            case 'success': {
-                if (isBinaryResult(result.data)) {
-                    // Binary output over WS: only handle Uint8Array bodies inline.
-                    // ReadableStream / AsyncIterable bodies require duplex framing — TODO.
-                    const br = result.data;
-                    if (br.body instanceof Uint8Array) {
-                        // Frame as a stream chunk + end so the client knows it's the full body.
-                        // Use the kernel stream id semantics: id from request, single chunk.
-                        this.sendFrame(encodeStreamChunk(result.id, 0, {
-                            _binary: true,
-                            contentType: br.contentType,
-                            bytes: Array.from(br.body),
-                        }));
-                        this.sendFrame(encodeStreamEnd(result.id));
-                    }
-                    else {
-                        this.sendFrame(encodeKernelError(result.id, {
-                            code: KERNEL_ERROR_CODES.INTERNAL_ERROR,
-                            message: 'Streaming binary bodies over WS are not yet supported',
-                        }));
-                    }
-                    return;
-                }
-                this.sendFrame(encodeKernelResponse(result.id, result.data));
-                return;
-            }
-            case 'error':
-                this.sendFrame(encodeKernelError(result.id, result.error));
-                return;
-            case 'redirect':
-                this.sendFrame(encodeKernelRedirect(result.id, result.redirection));
-                return;
-            case 'stream':
-                await this.sendStream(result.id, result.generator);
-                return;
-        }
-    }
-    async sendStream(id, generator) {
-        try {
-            let index = 0;
-            for await (const chunk of generator) {
-                if (this.ws.readyState !== WS_OPEN)
-                    return;
-                this.sendFrame(encodeStreamChunk(id, index++, chunk));
-            }
-            this.sendFrame(encodeStreamEnd(id));
-        }
-        catch (err) {
-            const error = classifyError(err);
-            this.sendFrame(encodeStreamError(id, error));
-        }
-    }
-    sendFrame(obj) {
-        if (this.ws.readyState !== WS_OPEN)
-            return;
-        this.ws.send(this.codec.encode(obj));
-    }
-    handleClose() {
-        /* future: cancel in-flight dispatches */
-    }
-    handleError(error) {
-        // oxlint-disable-next-line no-console
-        console.error('[ws] connection error:', error.message);
-    }
-}
-//# sourceMappingURL=ws.js.map

package/dist/envelope/ws.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ws.js","sourceRoot":"","sources":["../../envelope/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAK/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAU3D,MAAM,OAAO,GAAG,CAAC,CAAA;AAEjB,+EAA+E;AAE/E,MAAM,OAAO,kBAAkB;IAEV,EAAE;IACF,KAAK;IACL,UAAU;IACV,IAAI;IAJvB,YACmB,EAAiB,EACjB,KAAY,EACZ,UAAsB,EACtB,IAAqB;kBAHrB,EAAE;qBACF,KAAK;0BACL,UAAU;oBACV,IAAI;IACpB,CAAC;IAEJ,KAAK;QACH,sDAAsD;IACxD,CAAC;IAED,aAAa,CAAC,IAAuC;QACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtC,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAuC;QAClE,wBAAwB;QACxB,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;YAC5F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,CACZ,iBAAiB,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,kBAAkB,CAAC,WAAW;gBACpC,OAAO,EAAE,aAAa;aACvB,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,qBAAqB;QACrB,IAAI,OAA+C,CAAA;QACnD,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CACZ,iBAAiB,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,kBAAkB,CAAC,eAAe;gBACxC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB;aAC5D,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAA;QAEhC,cAAc;QACd,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,SAAS,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,IAAI,CAAC,UAAU,EACf;YACE,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;SAC9D,EACD,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAG,EAAE,EAC3C,IAAI,CAAC,IAAI,CACV,CAAA;QAED,iBAAiB;QACjB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,KAAK;gBACR,OAAM;YACR,KAAK,SAAS,EAAE,CAAC;gBACf,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,+DAA+D;oBAC/D,uEAAuE;oBACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;oBACtB,IAAI,EAAE,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC;wBAClC,wEAAwE;wBACxE,qEAAqE;wBACrE,IAAI,CAAC,SAAS,CACZ,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE;4BAC9B,OAAO,EAAE,IAAI;4BACb,WAAW,EAAE,EAAE,CAAC,WAAW;4BAC3B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;yBAC3B,CAAC,CACH,CAAA;wBACD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;oBAC5C,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,SAAS,CACZ,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE;4BAC3B,IAAI,EAAE,kBAAkB,CAAC,cAAc;4BACvC,OAAO,EAAE,uDAAuD;yBACjE,CAAC,CACH,CAAA;oBACH,CAAC;oBACD,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;gBAC5D,OAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,OAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;gBACnE,OAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;gBAClD,OAAM;QACV,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAa,EAAE,SAAkC;QACxE,IAAI,CAAC;YACH,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,OAAO;oBAAE,OAAM;gBAC1C,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;YACvD,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAuB,aAAa,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,GAAY;QAC5B,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,OAAO;YAAE,OAAM;QAC1C,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,WAAW;QACT,yCAAyC;IAC3C,CAAC;IAED,WAAW,CAAC,KAAY;QACtB,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACxD,CAAC;CACF"}

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAI7D,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,UAAU,GAChB,MAAM,uBAAuB,CAAA;AAI9B,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAI/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,EAAE,eAAe,EAAwC,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAA;AAE7B,gFAAgF;AAEhF,OAAO,EACL,UAAU,GAKX,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAA;AAE7D,gFAAgF;AAEhF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAsB,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GAOnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAEhF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAA;AAE/E,+EAA+E;AAE/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAO5B,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/invocation/dispatch.d.ts

@@ -1,32 +0,0 @@
-import type { CallRedirection, DispatchResult, KernelErrorPayload, RequestId } from '@astrale-os/kernel-api';
-import type { CapabilityHost } from '../capabilities/index.js';
-import type { Invocation, Dispatcher } from './dispatcher.js';
-export type InvocationResponse = {
-    kind: 'success';
-    id: RequestId;
-    data: unknown;
-} | {
-    kind: 'error';
-    id: RequestId;
-    error: KernelErrorPayload;
-} | {
-    kind: 'stream';
-    id: RequestId;
-    generator: AsyncGenerator<unknown>;
-} | {
-    kind: 'redirect';
-    id: RequestId;
-    redirection: CallRedirection;
-} | {
-    kind: 'ack';
-};
-export type InvocationReply = {
-    ack: true;
-} | {
-    id: RequestId;
-};
-/** Execute one invocation with unconditional, host-adapted capabilities. */
-export declare function executeInvocation(dispatcher: Dispatcher, invocation: Invocation, host?: CapabilityHost): Promise<DispatchResult>;
-/** Add request correlation, acknowledgement, and error classification. */
-export declare function dispatchInvocation(dispatcher: Dispatcher, invocation: Invocation, reply: InvocationReply, host?: CapabilityHost): Promise<InvocationResponse>;
-//# sourceMappingURL=dispatch.d.ts.map

package/dist/invocation/dispatch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../invocation/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,SAAS,EACV,MAAM,wBAAwB,CAAA;AAI/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAI7D,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,eAAe,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAA;AAEnB,MAAM,MAAM,eAAe,GAAG;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,SAAS,CAAA;CAAE,CAAA;AAE/D,4EAA4E;AAC5E,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,cAAc,CAAC,CAgBzB;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,eAAe,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA+B7B"}

package/dist/invocation/dispatch.js

@@ -1,68 +0,0 @@
-import { classifyError } from '@astrale-os/kernel-api';
-import { createCapabilityLifecycle } from '../capabilities/index.js';
-/** Execute one invocation with unconditional, host-adapted capabilities. */
-export async function executeInvocation(dispatcher, invocation, host) {
-    const lifecycle = createCapabilityLifecycle(host);
-    try {
-        const result = await dispatcher.invoke(invocation, lifecycle.capabilities);
-        if (result.kind === 'stream') {
-            return {
-                kind: 'stream',
-                generator: settleStream(result.generator, lifecycle.settle),
-            };
-        }
-        await lifecycle.settle();
-        return result;
-    }
-    catch (error) {
-        await lifecycle.settle();
-        throw error;
-    }
-}
-/** Add request correlation, acknowledgement, and error classification. */
-export async function dispatchInvocation(dispatcher, invocation, reply, host) {
-    if ('ack' in reply) {
-        const lifecycle = createCapabilityLifecycle(host);
-        const background = Promise.resolve().then(async () => {
-            try {
-                await dispatcher.invoke(invocation, lifecycle.capabilities);
-            }
-            catch (error) {
-                // There is no response channel for acknowledged invocations.
-                // oxlint-disable-next-line no-console
-                console.error(`[invocation] Ack-mode error (${pathToString(invocation.path)}):`, error);
-            }
-            finally {
-                await lifecycle.settle();
-            }
-        });
-        host?.register(background);
-        return { kind: 'ack' };
-    }
-    try {
-        const result = await executeInvocation(dispatcher, invocation, host);
-        switch (result.kind) {
-            case 'value':
-                return { kind: 'success', id: reply.id, data: result.value };
-            case 'stream':
-                return { kind: 'stream', id: reply.id, generator: result.generator };
-            case 'redirect':
-                return { kind: 'redirect', id: reply.id, redirection: result.redirection };
-        }
-    }
-    catch (error) {
-        return { kind: 'error', id: reply.id, error: classifyError(error) };
-    }
-}
-async function* settleStream(generator, settle) {
-    try {
-        yield* generator;
-    }
-    finally {
-        await settle();
-    }
-}
-function pathToString(path) {
-    return typeof path === 'string' ? path : path.raw;
-}
-//# sourceMappingURL=dispatch.js.map

package/dist/invocation/dispatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../invocation/dispatch.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAKtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAWpE,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAsB,EACtB,UAAsB,EACtB,IAAqB;IAErB,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;aAC5D,CAAA;QACH,CAAC;QACD,MAAM,SAAS,CAAC,MAAM,EAAE,CAAA;QACxB,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,MAAM,EAAE,CAAA;QACxB,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAsB,EACtB,UAAsB,EACtB,KAAsB,EACtB,IAAqB;IAErB,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,6DAA6D;gBAC7D,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,gCAAgC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACzF,CAAC;oBAAS,CAAC;gBACT,MAAM,SAAS,CAAC,MAAM,EAAE,CAAA;YAC1B,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QACpE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;YAC9D,KAAK,QAAQ;gBACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;YACtE,KAAK,UAAU;gBACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;IACrE,CAAC;AACH,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,YAAY,CAC1B,SAAkC,EAClC,MAA2B;IAE3B,IAAI,CAAC;QACH,KAAK,CAAC,CAAC,SAAS,CAAA;IAClB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB;IAC5C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;AACnD,CAAC"}

package/dist/invocation/dispatcher.d.ts

@@ -1,19 +0,0 @@
-import type { DispatchResult, KernelAPI } from '@astrale-os/kernel-api';
-import type { CredentialInput, Path } from '@astrale-os/kernel-core';
-import type { Capabilities } from '../capabilities/index.js';
-/** Accepts canonical strings and any Path implementation exposing its raw form. */
-export type InvocationPath = string | Pick<Path, 'raw'>;
-/** A transport-neutral call entering a hosted Astrale dispatcher. */
-export type Invocation = {
-    path: InvocationPath;
-    credential: CredentialInput;
-    params: unknown;
-    self?: string;
-};
-/** The sole invocation contract required by kernel-server transports. */
-export type Dispatcher = {
-    invoke(invocation: Invocation, caps: Capabilities): Promise<DispatchResult>;
-};
-/** Adapt a canonical kernel dispatcher to the narrower hosting contract. */
-export declare function kernelDispatcher(kernel: Pick<KernelAPI, 'dispatch'>): Dispatcher;
-//# sourceMappingURL=dispatcher.d.ts.map

package/dist/invocation/dispatcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../invocation/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE5D,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAEvD,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,cAAc,CAAA;IACpB,UAAU,EAAE,eAAe,CAAA;IAC3B,MAAM,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CAC5E,CAAA;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,UAAU,CAMhF"}

package/dist/invocation/dispatcher.js

@@ -1,9 +0,0 @@
-/** Adapt a canonical kernel dispatcher to the narrower hosting contract. */
-export function kernelDispatcher(kernel) {
-    return {
-        invoke({ path, credential, params, self }) {
-            return kernel.dispatch(typeof path === 'string' ? path : path.raw, credential, params, self);
-        },
-    };
-}
-//# sourceMappingURL=dispatcher.js.map

package/dist/invocation/dispatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../invocation/dispatcher.ts"],"names":[],"mappings":"AAqBA,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,MAAmC;IAClE,OAAO;QACL,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;YACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAC9F,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/invocation/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAA"}

package/dist/invocation/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,iBAAiB,CAAA"}

package/dist/jwks/discovery.d.ts

@@ -1,40 +0,0 @@
-/**
- * OIDC discovery-document construction — the `issuer`/`jwks_uri` pair and the
- * reachable-URL derivation behind it. Shared by `mountJwks`,
- * `mountInstanceJwks`, and the issuer-registry mounts.
- *
- * Identity vs reachability — the two published fields are intentionally
- * asymmetric, and that asymmetry is load-bearing:
- *   • `issuer` is the IDENTITY claim, published VERBATIM. OIDC Discovery /
- *     RFC 8414 require it to equal the issuer used to build the discovery URL
- *     and the `iss` claim the kernel signs into tokens. Normalizing it would
- *     break token validation whenever the configured issuer is non-canonical
- *     (a bare slug, odd casing, …) — so it is never rewritten here.
- *   • `jwks_uri` is a REACHABILITY concern: it must be a fetchable absolute URL.
- *     It is derived from the canonical issuer URL when that is usable, else from
- *     the request's externally-reachable origin (proxy headers). A bare-slug or
- *     port-0 issuer is a valid identity but an unfetchable URL — hence the
- *     divergence. (Regression coverage: M-19, host `jwks-keys.test.ts`.)
- *
- * Edge-topology contract — KEEP IN SYNC with kernel/host/network/Caddyfile:
- *   In the Caddy-only edge the host kernel is mounted publicly under
- *   `/kernel/{slug}` (the issuer carries that path) but served internally at the
- *   stripped path (`/` for the host, `/{id}` for children). `jwks_uri` is built
- *   from the ISSUER's path, never the request path, so the edge only strips the
- *   prefix on the way IN — no response-body rewrite. If a future edge stops
- *   stripping `/kernel/{slug}`, or a kernel is mounted at a different public
- *   path, the issuer's path and that edge rule must move together.
- */
-export interface DiscoveryDoc {
-    issuer: string;
-    jwks_uri: string;
-    subject_types_supported: string[];
-    id_token_signing_alg_values_supported: string[];
-}
-/**
- * Build the OIDC discovery document served at `/.well-known/openid-configuration`.
- * `issuer` is echoed verbatim (identity); `jwks_uri` is derived to be reachable.
- * See the file header for why the two diverge.
- */
-export declare function discoveryDoc(req: Request, issuer: string, signingAlgorithm: string): DiscoveryDoc;
-//# sourceMappingURL=discovery.d.ts.map

package/dist/jwks/discovery.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../jwks/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,uBAAuB,EAAE,MAAM,EAAE,CAAA;IACjC,qCAAqC,EAAE,MAAM,EAAE,CAAA;CAChD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,YAAY,CAOjG"}

package/dist/jwks/discovery.js

@@ -1,113 +0,0 @@
-/**
- * OIDC discovery-document construction — the `issuer`/`jwks_uri` pair and the
- * reachable-URL derivation behind it. Shared by `mountJwks`,
- * `mountInstanceJwks`, and the issuer-registry mounts.
- *
- * Identity vs reachability — the two published fields are intentionally
- * asymmetric, and that asymmetry is load-bearing:
- *   • `issuer` is the IDENTITY claim, published VERBATIM. OIDC Discovery /
- *     RFC 8414 require it to equal the issuer used to build the discovery URL
- *     and the `iss` claim the kernel signs into tokens. Normalizing it would
- *     break token validation whenever the configured issuer is non-canonical
- *     (a bare slug, odd casing, …) — so it is never rewritten here.
- *   • `jwks_uri` is a REACHABILITY concern: it must be a fetchable absolute URL.
- *     It is derived from the canonical issuer URL when that is usable, else from
- *     the request's externally-reachable origin (proxy headers). A bare-slug or
- *     port-0 issuer is a valid identity but an unfetchable URL — hence the
- *     divergence. (Regression coverage: M-19, host `jwks-keys.test.ts`.)
- *
- * Edge-topology contract — KEEP IN SYNC with kernel/host/network/Caddyfile:
- *   In the Caddy-only edge the host kernel is mounted publicly under
- *   `/kernel/{slug}` (the issuer carries that path) but served internally at the
- *   stripped path (`/` for the host, `/{id}` for children). `jwks_uri` is built
- *   from the ISSUER's path, never the request path, so the edge only strips the
- *   prefix on the way IN — no response-body rewrite. If a future edge stops
- *   stripping `/kernel/{slug}`, or a kernel is mounted at a different public
- *   path, the issuer's path and that edge rule must move together.
- */
-import { normalizeIssuerId } from '@astrale-os/kernel-core';
-/**
- * Build the OIDC discovery document served at `/.well-known/openid-configuration`.
- * `issuer` is echoed verbatim (identity); `jwks_uri` is derived to be reachable.
- * See the file header for why the two diverge.
- */
-export function discoveryDoc(req, issuer, signingAlgorithm) {
-    return {
-        issuer,
-        jwks_uri: jwksUriFor(req, issuer),
-        subject_types_supported: ['public'],
-        id_token_signing_alg_values_supported: [signingAlgorithm],
-    };
-}
-// Public URL of a discovery document's sibling `jwks.json`. Three cases, in
-// priority order:
-//   1. `issuer` is a usable http(s) URL WITH a path → that path is this
-//      kernel/instance's full public mount (e.g. `…/kernel/host`). jwks lives
-//      directly under it (`{issuer}/.well-known/jwks.json`) — the OIDC invariant
-//      that needs no proxy body-rewrite.
-//   2. `issuer` is a usable http(s) URL but origin-only → the public mount path
-//      comes from the request path (kernel reached at its canonical origin).
-//   3. `issuer` is a bare slug / non-URL / port-0 fixture → fall back to the
-//      request's externally-reachable origin (proxy headers) plus its own path.
-function jwksUriFor(req, issuer) {
-    const requestJwksPath = new URL(req.url).pathname.replace(/\/openid-configuration$/, '/jwks.json');
-    const canonical = canonicalIssuerUrl(issuer);
-    if (!canonical) {
-        return `${externalOriginFromRequest(req)}${requestJwksPath}`;
-    }
-    if (canonical.pathname && canonical.pathname !== '/') {
-        return `${canonical.origin}${canonical.pathname.replace(/\/+$/, '')}/.well-known/jwks.json`;
-    }
-    return `${canonical.origin}${requestJwksPath}`;
-}
-// Parse `issuer` into its canonical http(s) URL, or null when it is not a
-// verifier-reachable origin: a bare slug (no scheme), a non-http(s) scheme, or
-// the `:0` placeholder port that test/dev fixtures use as a non-canonical stand-in.
-function canonicalIssuerUrl(issuer) {
-    try {
-        const u = new URL(normalizeIssuerId(issuer));
-        if (!u.host)
-            return null;
-        if (u.protocol !== 'http:' && u.protocol !== 'https:')
-            return null;
-        if (u.port === '0')
-            return null;
-        return u;
-    }
-    catch {
-        return null;
-    }
-}
-// Externally-reachable origin of the request. Reverse proxies commonly
-// terminate TLS and rewrite Host to an internal hostname; prefer the forwarding
-// headers (X-Forwarded-* then RFC 7239 Forwarded) before the request URL, so
-// discovery never publishes an unreachable jwks_uri.
-function externalOriginFromRequest(req) {
-    const xfHost = firstHeaderValue(req.headers.get('x-forwarded-host'));
-    if (xfHost) {
-        const proto = (firstHeaderValue(req.headers.get('x-forwarded-proto')) ?? 'https').toLowerCase();
-        return `${proto}://${xfHost.toLowerCase()}`;
-    }
-    const fwd = firstHeaderValue(req.headers.get('forwarded'));
-    if (fwd) {
-        const map = {};
-        for (const part of fwd.split(';')) {
-            const [k, v] = part.split('=');
-            if (k && v)
-                map[k.trim().toLowerCase()] = stripQuotes(v.trim());
-        }
-        if (map.host) {
-            const proto = (map.proto ?? 'https').toLowerCase();
-            return `${proto}://${map.host.toLowerCase()}`;
-        }
-    }
-    return new URL(req.url).origin;
-}
-function firstHeaderValue(value) {
-    const first = value?.split(',')[0]?.trim();
-    return first ? stripQuotes(first) : null;
-}
-function stripQuotes(value) {
-    return value.replace(/^"|"$/g, '');
-}
-//# sourceMappingURL=discovery.js.map

package/dist/jwks/discovery.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../jwks/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAS3D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,MAAc,EAAE,gBAAwB;IACjF,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,uBAAuB,EAAE,CAAC,QAAQ,CAAC;QACnC,qCAAqC,EAAE,CAAC,gBAAgB,CAAC;KAC1D,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,kBAAkB;AAClB,wEAAwE;AACxE,8EAA8E;AAC9E,iFAAiF;AACjF,yCAAyC;AACzC,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,SAAS,UAAU,CAAC,GAAY,EAAE,MAAc;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,CAAA;IAC9D,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrD,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAA;IAC7F,CAAC;IACD,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,eAAe,EAAE,CAAA;AAChD,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACxB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,gFAAgF;AAChF,6EAA6E;AAC7E,qDAAqD;AACrD,SAAS,yBAAyB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IACpE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/F,OAAO,GAAG,KAAK,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1D,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAA2B,EAAE,CAAA;QACtC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YAClD,OAAO,GAAG,KAAK,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}

package/dist/jwks/index.d.ts

@@ -1,3 +0,0 @@
-export { mountJwks, mountInstanceJwks, type JwksKeys, type MultiplexedJwks, type JwksConfig, type InstanceJwksConfig, } from './keys.js';
-export { mountIssuerRegistry, mountInstanceIssuerRegistry, type IssuerRegistryConfig, type InstanceIssuerRegistryConfig, } from './issuers.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/jwks/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../jwks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,cAAc,CAAA"}

package/dist/jwks/index.js

@@ -1,3 +0,0 @@
-export { mountJwks, mountInstanceJwks, } from './keys.js';
-export { mountIssuerRegistry, mountInstanceIssuerRegistry, } from './issuers.js';
-//# sourceMappingURL=index.js.map

package/dist/jwks/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../jwks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,iBAAiB,GAKlB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,mBAAmB,EACnB,2BAA2B,GAG5B,MAAM,cAAc,CAAA"}

package/dist/jwks/issuers.d.ts

@@ -1,47 +0,0 @@
-/**
- * Issuer Registry — kernel-specific convention for hosting external issuers' keys.
- *
- * The kernel allows external identities to publish their public keys via
- * `Authentication.publishIssuer()`. Those issuers get stable URLs of the form
- * `{kernel}/iss/{issId}`, and their JWKS is served at
- * `{kernel}/iss/{issId}/.well-known/jwks.json`.
- *
- * This is NOT standard OIDC — it's a kernel-specific trust model. Only kernels
- * with an issuer store should mount these routes. Generic services that just
- * sign their own JWTs don't need this.
- */
-import type { Hono } from 'hono';
-import { type CorsConfig } from '../cors.js';
-export type IssuerRegistryConfig = {
-    /** Base issuer URL — registered issuer URLs are constructed as `${issuer}/iss/{issId}`. */
-    issuer: string;
-    /** Load a registered external issuer's keys. Empty array if unknown. */
-    loadKeys: (issuerId: string) => Promise<Record<string, unknown>[]>;
-    /** Signing algorithm (used in openid-configuration). Defaults to 'ES256'. */
-    signingAlgorithm?: string;
-    cors?: CorsConfig;
-};
-/**
- * Mount issuer registry endpoints — kernel-specific convention for hosting
- * externally-registered issuers' keys.
- *
- * - GET /iss/:issId/.well-known/openid-configuration → external issuer discovery
- * - GET /iss/:issId/.well-known/jwks.json             → external issuer keys
- */
-export declare function mountIssuerRegistry(app: Hono, config: IssuerRegistryConfig): void;
-export type InstanceIssuerRegistryConfig = {
-    /** Resolve the instance's base issuer URL. Return null if unknown. */
-    resolveIssuer: (instanceId: string) => string | null;
-    /** Load a registered external issuer's keys for an instance. */
-    loadKeys: (instanceId: string, issuerId: string) => Promise<Record<string, unknown>[]>;
-    signingAlgorithm?: string;
-    cors?: CorsConfig;
-};
-/**
- * Mount per-instance issuer registry endpoints (multiplexed kernel-specific).
- *
- * - GET /:id/iss/:issId/.well-known/openid-configuration
- * - GET /:id/iss/:issId/.well-known/jwks.json
- */
-export declare function mountInstanceIssuerRegistry(app: Hono, instancePrefix: string, config: InstanceIssuerRegistryConfig): void;
-//# sourceMappingURL=issuers.d.ts.map

package/dist/jwks/issuers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuers.d.ts","sourceRoot":"","sources":["../../jwks/issuers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAK9D,MAAM,MAAM,oBAAoB,GAAG;IACjC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IAClE,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAoBjF;AAID,MAAM,MAAM,4BAA4B,GAAG;IACzC,sEAAsE;IACtE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACpD,gEAAgE;IAChE,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,4BAA4B,GACnC,IAAI,CAyBN"}

package/dist/jwks/issuers.js

@@ -1,76 +0,0 @@
-/**
- * Issuer Registry — kernel-specific convention for hosting external issuers' keys.
- *
- * The kernel allows external identities to publish their public keys via
- * `Authentication.publishIssuer()`. Those issuers get stable URLs of the form
- * `{kernel}/iss/{issId}`, and their JWKS is served at
- * `{kernel}/iss/{issId}/.well-known/jwks.json`.
- *
- * This is NOT standard OIDC — it's a kernel-specific trust model. Only kernels
- * with an issuer store should mount these routes. Generic services that just
- * sign their own JWTs don't need this.
- */
-import { buildCorsHeaders } from '../cors.js';
-import { discoveryDoc } from './discovery.js';
-/**
- * Mount issuer registry endpoints — kernel-specific convention for hosting
- * externally-registered issuers' keys.
- *
- * - GET /iss/:issId/.well-known/openid-configuration → external issuer discovery
- * - GET /iss/:issId/.well-known/jwks.json             → external issuer keys
- */
-export function mountIssuerRegistry(app, config) {
-    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
-    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
-    const alg = config.signingAlgorithm ?? 'ES256';
-    app.get('/iss/:issId/.well-known/openid-configuration', (c) => {
-        const issId = c.req.param('issId');
-        const issuerUrl = `${config.issuer}/iss/${issId}`;
-        return c.json(discoveryDoc(c.req.raw, issuerUrl, alg), 200, headers);
-    });
-    app.get('/iss/:issId/.well-known/jwks.json', async (c) => {
-        const issId = c.req.param('issId');
-        const issuerUrl = `${config.issuer}/iss/${issId}`;
-        const keys = await config.loadKeys(issuerUrl);
-        if (keys.length === 0) {
-            return c.json({ error: 'Issuer not found' }, 404, headers);
-        }
-        return c.json({ keys }, 200, headers);
-    });
-}
-/**
- * Mount per-instance issuer registry endpoints (multiplexed kernel-specific).
- *
- * - GET /:id/iss/:issId/.well-known/openid-configuration
- * - GET /:id/iss/:issId/.well-known/jwks.json
- */
-export function mountInstanceIssuerRegistry(app, instancePrefix, config) {
-    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
-    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
-    const alg = config.signingAlgorithm ?? 'ES256';
-    app.get(`${instancePrefix}/iss/:issId/.well-known/openid-configuration`, (c) => {
-        const id = c.req.param('id');
-        const issId = c.req.param('issId');
-        if (!id || !issId)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const issuer = config.resolveIssuer(id);
-        if (!issuer)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const issuerUrl = `${issuer}/iss/${issId}`;
-        return c.json(discoveryDoc(c.req.raw, issuerUrl, alg), 200, headers);
-    });
-    app.get(`${instancePrefix}/iss/:issId/.well-known/jwks.json`, async (c) => {
-        const id = c.req.param('id');
-        const issId = c.req.param('issId');
-        if (!id || !issId)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const issuer = config.resolveIssuer(id);
-        if (!issuer)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const keys = await config.loadKeys(id, `${issuer}/iss/${issId}`);
-        if (keys.length === 0)
-            return c.json({ error: 'Issuer not found' }, 404, headers);
-        return c.json({ keys }, 200, headers);
-    });
-}
-//# sourceMappingURL=issuers.js.map