@astrale-os/kernel-server 0.4.17 → 0.5.0-beta.2

package/dist/jwks/keys.d.ts

@@ -1,44 +0,0 @@
-/**
- * JWKS — generic OpenID Connect Discovery + JSON Web Key Set exposure.
- *
- * Mounts the standard OIDC discovery and JWKS endpoints for the server's
- * own signing keys. Used by every server that signs JWTs.
- */
-import type { Hono } from 'hono';
-import { type CorsConfig } from '../cors.js';
-export type JwksKeys = {
-    /** The server's own issuer URL. */
-    issuer: string;
-    /** Return the server's own public signing key(s). */
-    loadOwnKeys: () => Promise<Record<string, unknown>[]>;
-};
-export type MultiplexedJwks = {
-    /** Resolve the issuer URL for an instance. Return null if unknown. */
-    resolveIssuer: (instanceId: string) => string | null;
-    /** Load the instance's own public keys. Empty array if unknown. */
-    loadOwnKeys: (instanceId: string) => Promise<Record<string, unknown>[]>;
-};
-export type JwksConfig = JwksKeys & {
-    /** Signing algorithm (used in openid-configuration). Defaults to 'ES256'. */
-    signingAlgorithm?: string;
-    cors?: CorsConfig;
-};
-/**
- * Mount OpenID Connect Discovery and JWKS endpoints for the server's own keys.
- *
- * - GET /.well-known/openid-configuration → OIDC discovery document
- * - GET /.well-known/jwks.json            → server's own public keys
- */
-export declare function mountJwks(app: Hono, config: JwksConfig): void;
-export type InstanceJwksConfig = MultiplexedJwks & {
-    signingAlgorithm?: string;
-    cors?: CorsConfig;
-};
-/**
- * Mount per-instance OpenID Connect Discovery and JWKS endpoints (own keys).
- *
- * Routes are prefixed with the instance path (e.g. `/:id`).
- * The instance ID is extracted from the Hono `:id` param.
- */
-export declare function mountInstanceJwks(app: Hono, instancePrefix: string, config: InstanceJwksConfig): void;
-//# sourceMappingURL=keys.d.ts.map

package/dist/jwks/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../jwks/keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAK9D,MAAM,MAAM,QAAQ,GAAG;IACrB,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,qDAAqD;IACrD,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CACtD,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,sEAAsE;IACtE,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACpD,mEAAmE;IACnE,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;CACxE,CAAA;AAID,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG;IAClC,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAa7D;AAID,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,EACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,kBAAkB,GACzB,IAAI,CAoBN"}

package/dist/jwks/keys.js

@@ -1,56 +0,0 @@
-/**
- * JWKS — generic OpenID Connect Discovery + JSON Web Key Set exposure.
- *
- * Mounts the standard OIDC discovery and JWKS endpoints for the server's
- * own signing keys. Used by every server that signs JWTs.
- */
-import { buildCorsHeaders } from '../cors.js';
-import { discoveryDoc } from './discovery.js';
-/**
- * Mount OpenID Connect Discovery and JWKS endpoints for the server's own keys.
- *
- * - GET /.well-known/openid-configuration → OIDC discovery document
- * - GET /.well-known/jwks.json            → server's own public keys
- */
-export function mountJwks(app, config) {
-    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
-    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
-    const alg = config.signingAlgorithm ?? 'ES256';
-    app.get('/.well-known/openid-configuration', (c) => {
-        return c.json(discoveryDoc(c.req.raw, config.issuer, alg), 200, headers);
-    });
-    app.get('/.well-known/jwks.json', async (c) => {
-        const keys = await config.loadOwnKeys();
-        return c.json({ keys }, 200, headers);
-    });
-}
-/**
- * Mount per-instance OpenID Connect Discovery and JWKS endpoints (own keys).
- *
- * Routes are prefixed with the instance path (e.g. `/:id`).
- * The instance ID is extracted from the Hono `:id` param.
- */
-export function mountInstanceJwks(app, instancePrefix, config) {
-    const corsHeaders = buildCorsHeaders(config.cors ?? { origin: '*' });
-    const headers = { 'cache-control': 'no-cache', ...corsHeaders };
-    const alg = config.signingAlgorithm ?? 'ES256';
-    app.get(`${instancePrefix}/.well-known/openid-configuration`, (c) => {
-        const id = c.req.param('id');
-        if (!id)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const issuer = config.resolveIssuer(id);
-        if (!issuer)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        return c.json(discoveryDoc(c.req.raw, issuer, alg), 200, headers);
-    });
-    app.get(`${instancePrefix}/.well-known/jwks.json`, async (c) => {
-        const id = c.req.param('id');
-        if (!id)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        const keys = await config.loadOwnKeys(id);
-        if (keys.length === 0)
-            return c.json({ error: 'Instance not found' }, 404, headers);
-        return c.json({ keys }, 200, headers);
-    });
-}
-//# sourceMappingURL=keys.js.map

package/dist/jwks/keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../jwks/keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AA0B7C;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,MAAkB;IACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAA;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAS,EACT,cAAsB,EACtB,MAA0B;IAE1B,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,CAAA;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAE9C,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/plan/host-params.d.ts

@@ -1,13 +0,0 @@
-/**
- * Extract host placeholder values from an incoming request's Host header.
- *
- * Used by request-time middleware to merge tenant identifiers from the host
- * into the dispatched params (at lowest priority).
- *
- * Returns:
- *  - `null` when the matcher exists but the host doesn't match (caller 404s)
- *  - `{}` when there are no placeholders (single-tenant server)
- *  - the captured groups otherwise
- */
-export declare function extractHostParams(matcher: RegExp | null, request: Request): Record<string, string> | null;
-//# sourceMappingURL=host-params.d.ts.map

package/dist/plan/host-params.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-params.d.ts","sourceRoot":"","sources":["../../plan/host-params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAO/B"}

package/dist/plan/host-params.js

@@ -1,23 +0,0 @@
-/**
- * Extract host placeholder values from an incoming request's Host header.
- *
- * Used by request-time middleware to merge tenant identifiers from the host
- * into the dispatched params (at lowest priority).
- *
- * Returns:
- *  - `null` when the matcher exists but the host doesn't match (caller 404s)
- *  - `{}` when there are no placeholders (single-tenant server)
- *  - the captured groups otherwise
- */
-export function extractHostParams(matcher, request) {
-    if (!matcher)
-        return {};
-    const host = request.headers.get('host');
-    if (!host)
-        return null;
-    const result = matcher.exec(host);
-    if (!result)
-        return null;
-    return { ...result.groups };
-}
-//# sourceMappingURL=host-params.js.map

package/dist/plan/host-params.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host-params.js","sourceRoot":"","sources":["../../plan/host-params.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/plan/host.d.ts

@@ -1,24 +0,0 @@
-/**
- * Server host URL and its parsed form.
- *
- * The server host URL is the canonical address of THIS kernel server. It may
- * contain host placeholders (`{tenant}.example.com`) for multi-tenant servers.
- * `parseServerHost` extracts the pieces needed by the walker and the
- * request-time host param extractor.
- */
-export type ServerHost = {
-    /** Full server URL — may contain host placeholders for multi-tenant servers. */
-    url: string;
-};
-export type ParsedServerHost = {
-    /** Canonical host pattern (with `{name}` placeholders) used for anchoring checks. */
-    hostPattern: string;
-    /** Base path stripped of any trailing slash. */
-    basePath: string;
-    /** Compiled Host header matcher, or `null` when there are no placeholders. */
-    hostMatcher: RegExp | null;
-    /** Host placeholder names in source order. */
-    hostPlaceholders: string[];
-};
-export declare function parseServerHost(host: ServerHost): ParsedServerHost;
-//# sourceMappingURL=host.d.ts.map

package/dist/plan/host.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../plan/host.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,MAAM,UAAU,GAAG;IACvB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qFAAqF;IACrF,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAQlE"}

package/dist/plan/host.js

@@ -1,24 +0,0 @@
-/**
- * Server host URL and its parsed form.
- *
- * The server host URL is the canonical address of THIS kernel server. It may
- * contain host placeholders (`{tenant}.example.com`) for multi-tenant servers.
- * `parseServerHost` extracts the pieces needed by the walker and the
- * request-time host param extractor.
- */
-import { compileHostMatcher, parseUrlTemplate } from '@astrale-os/kernel-api/routed';
-export function parseServerHost(host) {
-    const parsed = parseUrlTemplate(host.url);
-    return {
-        hostPattern: parsed.hostPattern,
-        basePath: stripTrailingSlash(parsed.basePath),
-        hostMatcher: parsed.hostPlaceholders.length > 0 ? compileHostMatcher(parsed.hostPattern) : null,
-        hostPlaceholders: parsed.hostPlaceholders,
-    };
-}
-function stripTrailingSlash(p) {
-    if (p.length > 1 && p.endsWith('/'))
-        return p.slice(0, -1);
-    return p;
-}
-//# sourceMappingURL=host.js.map

package/dist/plan/host.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../plan/host.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAkBpF,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/F,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/plan/index.d.ts

@@ -1,4 +0,0 @@
-export { walkDomain, type MountedFunction, type MountedRoute, type MountPlan } from './walk.js';
-export { parseServerHost, type ServerHost, type ParsedServerHost } from './host.js';
-export { extractHostParams } from './host-params.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/plan/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../plan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AAC/F,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/plan/index.js

@@ -1,4 +0,0 @@
-export { walkDomain } from './walk.js';
-export { parseServerHost } from './host.js';
-export { extractHostParams } from './host-params.js';
-//# sourceMappingURL=index.js.map

package/dist/plan/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../plan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA2D,MAAM,WAAW,CAAA;AAC/F,OAAO,EAAE,eAAe,EAA0C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/plan/walk.d.ts

@@ -1,51 +0,0 @@
-/**
- * Domain walker — turns a list of MountableContract into a mount plan.
- *
- * For each contract, decide whether it mounts on THIS server:
- * - ambient (no binding.remoteUrl) → always mount
- * - anchored (binding.remoteUrl set) → match host pattern against host.url
- *
- * Then bucket by base URL to compute one kernel mount per unique (host+basePath).
- * Collect route bindings and check for path collisions.
- *
- * See docs/protocol-redesign.md §6 ("Server").
- */
-import type { MountableContract, RouteBinding } from '@astrale-os/kernel-api/routed';
-import { type ServerHost } from './host.js';
-export type MountedFunction = {
-    contract: MountableContract;
-    /**
-     * Base URL template for this function's kernel mount.
-     *
-     * Ambient functions share the server host URL. Anchored functions use
-     * their own `binding.remoteUrl` (verified to match the server host).
-     */
-    baseUrl: string;
-    /** Anchored functions only — the parsed base path from remoteUrl. */
-    basePath: string;
-};
-export type MountedRoute = {
-    contract: MountableContract;
-    route: RouteBinding;
-    /** Full path from base URL (host stripped) + route.path. */
-    fullPath: string;
-    /** Normalized pattern: `{name}` → `:p`, `{name+}` → `*` — used for collision detection. */
-    normalizedKey: string;
-};
-export type MountPlan = {
-    /** Kernel mounts keyed by their base path (relative to the server host URL). */
-    kernelMounts: Map<string, MountedFunction[]>;
-    /** Route mounts. */
-    routes: MountedRoute[];
-    /** Fully-qualified method name → mounted function (for dispatch lookup). */
-    methodIndex: Map<string, MountedFunction>;
-    /**
-     * Compiled Host header matcher when the server host URL contains placeholders.
-     * Used at request time to extract host params and merge into params.
-     */
-    hostMatcher: RegExp | null;
-    /** Names of host placeholders, in source order. */
-    hostPlaceholders: string[];
-};
-export declare function walkDomain(contracts: MountableContract[], host: ServerHost): MountPlan;
-//# sourceMappingURL=walk.d.ts.map

package/dist/plan/walk.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../plan/walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAIpF,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAI5D,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAA;IAC3B;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,KAAK,EAAE,YAAY,CAAA;IACnB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,gFAAgF;IAChF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IAC5C,oBAAoB;IACpB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,4EAA4E;IAC5E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzC;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAID,wBAAgB,UAAU,CAAC,SAAS,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAgGtF"}

package/dist/plan/walk.js

@@ -1,110 +0,0 @@
-/**
- * Domain walker — turns a list of MountableContract into a mount plan.
- *
- * For each contract, decide whether it mounts on THIS server:
- * - ambient (no binding.remoteUrl) → always mount
- * - anchored (binding.remoteUrl set) → match host pattern against host.url
- *
- * Then bucket by base URL to compute one kernel mount per unique (host+basePath).
- * Collect route bindings and check for path collisions.
- *
- * See docs/protocol-redesign.md §6 ("Server").
- */
-import { isSubdomainOf, parseUrlTemplate } from '@astrale-os/kernel-api/routed';
-import { parseServerHost } from './host.js';
-// ─── Walk ────────────────────────────────────────────────────────────────────
-export function walkDomain(contracts, host) {
-    const parsed = parseServerHost(host);
-    const kernelMounts = new Map();
-    const routes = [];
-    const methodIndex = new Map();
-    const routeCollisionKeys = new Map();
-    for (const contract of contracts) {
-        const binding = contract.binding;
-        const remoteUrl = binding?.remoteUrl;
-        let basePath;
-        let baseUrl;
-        if (!remoteUrl) {
-            // Ambient — mounts at the server host URL.
-            basePath = parsed.basePath;
-            baseUrl = host.url;
-        }
-        else {
-            // Anchored — must match or be a subdomain of the server's host pattern.
-            const fnParsed = parseUrlTemplate(remoteUrl);
-            if (!isSubdomainOf(fnParsed.hostPattern, parsed.hostPattern)) {
-                // Not this server's responsibility — skip (debug log).
-                // oxlint-disable-next-line no-console
-                console.debug(`[server] Skipping ${contract.ref}: remoteUrl host "${fnParsed.hostPattern}" does not match server host "${parsed.hostPattern}"`);
-                continue;
-            }
-            basePath = stripTrailingSlash(fnParsed.basePath);
-            baseUrl = remoteUrl;
-        }
-        const mounted = { contract, baseUrl, basePath };
-        methodIndex.set(contract.ref, mounted);
-        // Add to the kernel mount bucket for this basePath.
-        const bucket = kernelMounts.get(basePath) ?? [];
-        bucket.push(mounted);
-        kernelMounts.set(basePath, bucket);
-        // Route binding?
-        if (binding?.route) {
-            const route = binding.route;
-            const fullPath = joinPath(basePath, route.path);
-            const normalizedPath = normalizePath(fullPath);
-            const normalizedKey = `${route.method} ${normalizedPath}`;
-            if (route.method === '*') {
-                // Wildcard: collides with ANY existing route on this path.
-                const wildcardKey = `* ${normalizedPath}`;
-                const existingWild = routeCollisionKeys.get(wildcardKey);
-                if (existingWild) {
-                    throw new Error(`Route collision: ${contract.ref} and ${existingWild} both mount at ${wildcardKey}`);
-                }
-                for (const m of ['GET', 'POST', 'PUT', 'PATCH', 'DELETE']) {
-                    const specificKey = `${m} ${normalizedPath}`;
-                    const existingSpecific = routeCollisionKeys.get(specificKey);
-                    if (existingSpecific) {
-                        throw new Error(`Route collision: ${contract.ref} (wildcard) and ${existingSpecific} both mount at ${specificKey}`);
-                    }
-                }
-                routeCollisionKeys.set(wildcardKey, contract.ref);
-            }
-            else {
-                // Specific method: check same method AND existing wildcard.
-                const existing = routeCollisionKeys.get(normalizedKey);
-                if (existing) {
-                    throw new Error(`Route collision: ${contract.ref} and ${existing} both mount at ${normalizedKey}`);
-                }
-                const existingWild = routeCollisionKeys.get(`* ${normalizedPath}`);
-                if (existingWild) {
-                    throw new Error(`Route collision: ${contract.ref} and ${existingWild} (wildcard) both mount at * ${normalizedPath}`);
-                }
-                routeCollisionKeys.set(normalizedKey, contract.ref);
-            }
-            routes.push({ contract, route, fullPath, normalizedKey });
-        }
-    }
-    return {
-        kernelMounts,
-        routes,
-        methodIndex,
-        hostMatcher: parsed.hostMatcher,
-        hostPlaceholders: parsed.hostPlaceholders,
-    };
-}
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-function stripTrailingSlash(p) {
-    if (p.length > 1 && p.endsWith('/'))
-        return p.slice(0, -1);
-    return p;
-}
-function joinPath(base, child) {
-    const b = stripTrailingSlash(base);
-    // child is guaranteed to start with '/'
-    return `${b}${child}` || '/';
-}
-/** Normalize a path template for collision detection. */
-function normalizePath(path) {
-    return path.replace(/\{[a-zA-Z_]\w*[+*]\}/g, '*').replace(/\{[a-zA-Z_]\w*\}/g, ':p');
-}
-//# sourceMappingURL=walk.js.map

package/dist/plan/walk.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../plan/walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAmB,MAAM,WAAW,CAAA;AA0C5D,gFAAgF;AAEhF,MAAM,UAAU,UAAU,CAAC,SAA8B,EAAE,IAAgB;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAEpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAA;IACzD,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAA;IACtD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEpD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAChC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAA;QAEpC,IAAI,QAAgB,CAAA;QACpB,IAAI,OAAe,CAAA;QAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,2CAA2C;YAC3C,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;YAC1B,OAAO,GAAG,IAAI,CAAC,GAAG,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;YAC5C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,uDAAuD;gBACvD,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CACX,qBAAqB,QAAQ,CAAC,GAAG,qBAAqB,QAAQ,CAAC,WAAW,iCAAiC,MAAM,CAAC,WAAW,GAAG,CACjI,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAChD,OAAO,GAAG,SAAS,CAAA;QACrB,CAAC;QAED,MAAM,OAAO,GAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;QAChE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAEtC,oDAAoD;QACpD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpB,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAElC,iBAAiB;QACjB,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;YAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/C,MAAM,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC9C,MAAM,aAAa,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,CAAA;YAEzD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzB,2DAA2D;gBAC3D,MAAM,WAAW,GAAG,KAAK,cAAc,EAAE,CAAA;gBACzC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACxD,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,GAAG,QAAQ,YAAY,kBAAkB,WAAW,EAAE,CACpF,CAAA;gBACH,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;oBACnE,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,cAAc,EAAE,CAAA;oBAC5C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;oBAC5D,IAAI,gBAAgB,EAAE,CAAC;wBACrB,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,GAAG,mBAAmB,gBAAgB,kBAAkB,WAAW,EAAE,CACnG,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;YACnD,CAAC;iBAAM,CAAC;gBACN,4DAA4D;gBAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,GAAG,QAAQ,QAAQ,kBAAkB,aAAa,EAAE,CAClF,CAAA;gBACH,CAAC;gBACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,cAAc,EAAE,CAAC,CAAA;gBAClE,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,GAAG,QAAQ,YAAY,+BAA+B,cAAc,EAAE,CACpG,CAAA;gBACH,CAAC;gBACD,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;YACrD,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,MAAM;QACN,WAAW;QACX,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAA;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1D,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC3C,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAClC,wCAAwC;IACxC,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAA;AAC9B,CAAC;AAED,yDAAyD;AACzD,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;AACtF,CAAC"}

package/dist/render/binary.d.ts

@@ -1,19 +0,0 @@
-/**
- * Binary HTTP response — `BinaryResult` → `Response`.
- *
- * Tags binary responses with `x-binary-result: true` so kernel-client can
- * distinguish them from accidental opaque blobs (the kernel envelope is
- * bypassed for binary results).
- *
- * Header precedence (low → high, later wins):
- *   CORS headers  <  `br.headers`  <  canonical `content-type` + `x-binary-result`
- *
- * This lets a handler pass through any framing-specific headers its body
- * needs (e.g. `x-vercel-ai-ui-message-stream`, `x-accel-buffering`, a tuned
- * `cache-control`) while guaranteeing the kernel's own invariants
- * (`content-type` matches `br.contentType`, `x-binary-result` is always
- * set) cannot be accidentally clobbered.
- */
-import type { BinaryResult } from '@astrale-os/kernel-api';
-export declare function buildBinaryResponse(br: BinaryResult, corsHeaders: Record<string, string>): Response;
-//# sourceMappingURL=binary.d.ts.map

package/dist/render/binary.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../render/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAM1D,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,QAAQ,CAcV"}

package/dist/render/binary.js

@@ -1,33 +0,0 @@
-/**
- * Binary HTTP response — `BinaryResult` → `Response`.
- *
- * Tags binary responses with `x-binary-result: true` so kernel-client can
- * distinguish them from accidental opaque blobs (the kernel envelope is
- * bypassed for binary results).
- *
- * Header precedence (low → high, later wins):
- *   CORS headers  <  `br.headers`  <  canonical `content-type` + `x-binary-result`
- *
- * This lets a handler pass through any framing-specific headers its body
- * needs (e.g. `x-vercel-ai-ui-message-stream`, `x-accel-buffering`, a tuned
- * `cache-control`) while guaranteeing the kernel's own invariants
- * (`content-type` matches `br.contentType`, `x-binary-result` is always
- * set) cannot be accidentally clobbered.
- */
-import { BINARY_RESULT_HEADER } from '@astrale-os/kernel-api';
-import { toBody } from './body.js';
-export function buildBinaryResponse(br, corsHeaders) {
-    const body = br.body instanceof Uint8Array
-        ? toBody(br.body)
-        : br.body;
-    return new Response(body, {
-        status: br.status ?? 200,
-        headers: {
-            ...corsHeaders,
-            ...br.headers,
-            'content-type': br.contentType,
-            [BINARY_RESULT_HEADER]: 'true',
-        },
-    });
-}
-//# sourceMappingURL=binary.js.map

package/dist/render/binary.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"binary.js","sourceRoot":"","sources":["../../render/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAElC,MAAM,UAAU,mBAAmB,CACjC,EAAgB,EAChB,WAAmC;IAEnC,MAAM,IAAI,GACR,EAAE,CAAC,IAAI,YAAY,UAAU;QAC3B,CAAC,CAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAiB;QAClC,CAAC,CAAE,EAAE,CAAC,IAAmC,CAAA;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG;QACxB,OAAO,EAAE;YACP,GAAG,WAAW;YACd,GAAG,EAAE,CAAC,OAAO;YACb,cAAc,EAAE,EAAE,CAAC,WAAW;YAC9B,CAAC,oBAAoB,CAAC,EAAE,MAAM;SAC/B;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/render/body.d.ts

@@ -1,10 +0,0 @@
-/**
- * Convert codec output (string or Uint8Array) to a Response-compatible body.
- *
- * Text codecs (JSON) return strings — passed through.
- * Binary codecs (MsgPack) return Uint8Array — narrowed to ArrayBuffer for
- * tsgo's stricter `BodyInit` typing. The fast path avoids a copy when the
- * Uint8Array is a full view of its backing buffer.
- */
-export declare function toBody(data: string | Uint8Array): string | ArrayBuffer;
-//# sourceMappingURL=body.d.ts.map

package/dist/render/body.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../render/body.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,WAAW,CAMtE"}

package/dist/render/body.js

@@ -1,17 +0,0 @@
-/**
- * Convert codec output (string or Uint8Array) to a Response-compatible body.
- *
- * Text codecs (JSON) return strings — passed through.
- * Binary codecs (MsgPack) return Uint8Array — narrowed to ArrayBuffer for
- * tsgo's stricter `BodyInit` typing. The fast path avoids a copy when the
- * Uint8Array is a full view of its backing buffer.
- */
-export function toBody(data) {
-    if (typeof data === 'string')
-        return data;
-    if (data.byteOffset === 0 && data.byteLength === data.buffer.byteLength) {
-        return data.buffer;
-    }
-    return data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
-}
-//# sourceMappingURL=body.js.map

package/dist/render/body.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"body.js","sourceRoot":"","sources":["../../render/body.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,IAAyB;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,MAAqB,CAAA;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAgB,CAAA;AAC7F,CAAC"}

package/dist/render/index.d.ts

@@ -1,3 +0,0 @@
-export { toBody } from './body.js';
-export { buildBinaryResponse } from './binary.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/render/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../render/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA"}

package/dist/render/index.js

@@ -1,3 +0,0 @@
-export { toBody } from './body.js';
-export { buildBinaryResponse } from './binary.js';
-//# sourceMappingURL=index.js.map

package/dist/render/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../render/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA"}

package/dist/routed/credential.d.ts

@@ -1,10 +0,0 @@
-/**
- * Credential extraction for route bindings.
- *
- * A route binding declares where to find the request credential — header,
- * cookie, or query parameter — via its `route.credential` field. This module
- * implements the lookup, including cookie splitting and URL decoding.
- */
-import type { CredentialSource } from '@astrale-os/kernel-api';
-export declare function readCredential(req: Request, source: CredentialSource): string;
-//# sourceMappingURL=credential.d.ts.map

package/dist/routed/credential.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../routed/credential.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAA0B,MAAM,wBAAwB,CAAA;AAEtF,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAS7E"}

package/dist/routed/credential.js

@@ -1,55 +0,0 @@
-/**
- * Credential extraction for route bindings.
- *
- * A route binding declares where to find the request credential — header,
- * cookie, or query parameter — via its `route.credential` field. This module
- * implements the lookup, including cookie splitting and URL decoding.
- */
-export function readCredential(req, source) {
-    if (Array.isArray(source)) {
-        for (const s of source) {
-            const value = readSingle(req, s);
-            if (value)
-                return value;
-        }
-        return '';
-    }
-    return readSingle(req, source);
-}
-function readSingle(req, source) {
-    switch (source.in) {
-        case 'header': {
-            const raw = req.headers.get(source.name ?? 'authorization') ?? '';
-            return stripBearerPrefix(raw);
-        }
-        case 'query':
-            return new URL(req.url).searchParams.get(source.name ?? 'credential') ?? '';
-        case 'cookie': {
-            const header = req.headers.get('cookie');
-            if (!header || !source.name)
-                return '';
-            const cookies = header.split(';').map((c) => c.trim());
-            for (const c of cookies) {
-                const [k, v] = c.split('=', 2);
-                if (k === source.name)
-                    return decodeURIComponent(v ?? '');
-            }
-            return '';
-        }
-    }
-}
-/**
- * Strip an optional `Bearer ` (case-insensitive) prefix from an
- * Authorization-header value. Other values pass through as-is —
- * validation is the auth layer's responsibility, not extraction's.
- *
- * Header-source credentials are interpreted per RFC 7235: the header value is
- * `<scheme> <credentials>`, so an optional leading `Bearer ` prefix is
- * stripped. This keeps the reader HTTP-standard-compliant and lets route
- * bindings interoperate with any client that sends `Authorization: Bearer
- * <token>`
- */
-function stripBearerPrefix(value) {
-    return value.trim().replace(/^Bearer\s+/i, '');
-}
-//# sourceMappingURL=credential.js.map

package/dist/routed/credential.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../routed/credential.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,MAAwB;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAChC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,MAA8B;IAC9D,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAClB,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,CAAA;YACjE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,OAAO;YACV,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,CAAA;QAC7E,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACxC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAA;YACtC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC9B,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI;oBAAE,OAAO,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC3D,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC"}