@astrale-os/kernel-server 0.4.17 → 0.5.0-beta.2

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/errors/index.js

@@ -0,0 +1,5 @@
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
+export { classifyError } from './classify.js';
+export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
+export { ResponseBodyTooLargeError } from './response-body.js';
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/errors/request-body.d.ts

@@ -0,0 +1,8 @@
+export declare class RequestBodyTooLargeError extends Error {
+    readonly maximumBytes: number;
+    constructor(maximumBytes: number);
+}
+export declare class RequestBodyInvalidError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=request-body.d.ts.map

package/dist/errors/request-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.d.ts","sourceRoot":"","sources":["../../errors/request-body.ts"],"names":[],"mappings":"AAAA,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM;IAAzC,YAAqB,YAAY,EAAE,MAAM,EAGxC;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/errors/request-body.js

@@ -0,0 +1,15 @@
+export class RequestBodyTooLargeError extends Error {
+    maximumBytes;
+    constructor(maximumBytes) {
+        super(`Request body exceeds ${maximumBytes} bytes.`);
+        this.maximumBytes = maximumBytes;
+        this.name = 'RequestBodyTooLargeError';
+    }
+}
+export class RequestBodyInvalidError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RequestBodyInvalidError';
+    }
+}
+//# sourceMappingURL=request-body.js.map

package/dist/errors/request-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.js","sourceRoot":"","sources":["../../errors/request-body.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B,YAAY;IAAjC,YAAqB,YAAoB;QACvC,KAAK,CAAC,wBAAwB,YAAY,SAAS,CAAC,CAAA;4BADjC,YAAY;QAE/B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF"}

package/dist/errors/response-body.d.ts

@@ -0,0 +1,5 @@
+export declare class ResponseBodyTooLargeError extends Error {
+    readonly maximumBytes: number;
+    constructor(maximumBytes: number);
+}
+//# sourceMappingURL=response-body.d.ts.map

package/dist/errors/response-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-body.d.ts","sourceRoot":"","sources":["../../errors/response-body.ts"],"names":[],"mappings":"AAAA,qBAAa,yBAA0B,SAAQ,KAAK;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM;IAAzC,YAAqB,YAAY,EAAE,MAAM,EAGxC;CACF"}

package/dist/errors/response-body.js

@@ -0,0 +1,9 @@
+export class ResponseBodyTooLargeError extends Error {
+    maximumBytes;
+    constructor(maximumBytes) {
+        super(`Server response exceeds maximumResponseBytes (${maximumBytes}).`);
+        this.maximumBytes = maximumBytes;
+        this.name = 'ResponseBodyTooLargeError';
+    }
+}
+//# sourceMappingURL=response-body.js.map

package/dist/errors/response-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-body.js","sourceRoot":"","sources":["../../errors/response-body.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B,YAAY;IAAjC,YAAqB,YAAoB;QACvC,KAAK,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAA;4BADrD,YAAY;QAE/B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,12 +1,6 @@
-export { createKernelApp, type KernelAppConfig, type WsAdapter } from './app/create.js';
-export { createMultiplexedKernelApp, type MultiplexedKernelAppConfig, type DispatcherResolver, } from './app/multiplexed.js';
-export { walkDomain, type ServerHost, type MountedFunction, type MountedRoute, type MountPlan, } from './plan/index.js';
-export { buildCorsHeaders, type CorsConfig } from './cors.js';
-export { createKernelDispatcher, type KernelDispatcherOptions } from './envelope/http.js';
-export { KernelWsConnection, type WebSocketLike } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, type CapabilityHost, type CapabilityLifecycle, type Defer, type DeferredTask, type Capabilities, type Sleep, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, type Invocation, type InvocationPath, type InvocationReply, type InvocationResponse, type Dispatcher, } from './invocation/index.js';
-export { createRouteHandler, type RouteHandlerConfig } from './routed/index.js';
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, type JwksKeys, type MultiplexedJwks, type JwksConfig, type InstanceJwksConfig, type IssuerRegistryConfig, type InstanceIssuerRegistryConfig, } from './jwks/index.js';
-export { classifyError } from '@astrale-os/kernel-api';
+export { createServer, prepareServer } from './server.js';
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
+export * as publication from './publication/index.js';
+export type { Application, ApplicationHost, CorsConfig, Handler, HandlerRequest, HealthProbe, InvocationContext, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,UAAU,EACV,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAI7D,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,KAAK,GACX,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,UAAU,GAChB,MAAM,uBAAuB,CAAA;AAI9B,OAAO,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAI/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAC3B,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,GAClC,MAAM,iBAAiB,CAAA;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACnE,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA;AACrD,YAAY,EACV,WAAW,EACX,eAAe,EACf,UAAU,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,19 +1,5 @@
-// ─── App entry points ─────────────────────────────────────────────────────────
-export { createKernelApp } from './app/create.js';
-export { createMultiplexedKernelApp, } from './app/multiplexed.js';
-// ─── Plan ────────────────────────────────────────────────────────────────────
-export { walkDomain, } from './plan/index.js';
-// ─── Cross-cutting ───────────────────────────────────────────────────────────
-export { buildCorsHeaders } from './cors.js';
-// ─── Kernel envelope dispatcher ──────────────────────────────────────────────
-export { createKernelDispatcher } from './envelope/http.js';
-export { KernelWsConnection } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, } from './invocation/index.js';
-// ─── Routed HTTP handler (per-route) ─────────────────────────────────────────
-export { createRouteHandler } from './routed/index.js';
-// ─── JWKS (OIDC Discovery + JSON Web Key Set) ───────────────────────────────
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, } from './jwks/index.js';
-// ─── Dispatch (for custom integrations) ──────────────────────────────────────
-export { classifyError } from '@astrale-os/kernel-api';
+export { createServer, prepareServer } from './server.js';
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
+export * as publication from './publication/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,EAAE,eAAe,EAAwC,MAAM,iBAAiB,CAAA;AACvF,OAAO,EACL,0BAA0B,GAG3B,MAAM,sBAAsB,CAAA;AAE7B,gFAAgF;AAEhF,OAAO,EACL,UAAU,GAKX,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAA;AAE7D,gFAAgF;AAEhF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAsB,MAAM,kBAAkB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GAOnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,uBAAuB,CAAA;AAE9B,gFAAgF;AAEhF,OAAO,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAA;AAE/E,+EAA+E;AAE/E,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAO5B,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACxF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AACnE,OAAO,KAAK,WAAW,MAAM,wBAAwB,CAAA"}

package/dist/invocation/context.d.ts

@@ -0,0 +1,7 @@
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
+import type { ApplicationHost, InvocationContext } from './types.js';
+export declare function invocationContext(operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey, delegate?: InvocationContext['delegate']): InvocationContext;
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export declare function defaultSleep(durationMs: number): Promise<void>;
+//# sourceMappingURL=context.d.ts.map

package/dist/invocation/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../invocation/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEpE,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,gBAAgB,EACxB,IAAI,CAAC,EAAE,eAAe,EACtB,WAAW,CAAC,EAAE,UAAU,EACxB,cAAc,CAAC,EAAE,QAAQ,CAAC,cAAc,EACxC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,GACvC,iBAAiB,CAanB;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE"}

package/dist/invocation/context.js

@@ -0,0 +1,61 @@
+export function invocationContext(operation, active, host, requestBody, idempotencyKey, delegate) {
+    const body = requestBody?.slice();
+    return Object.freeze({
+        execution: Object.freeze({ deadline: operation.deadline, signal: operation.signal }),
+        background: (task) => active.background(task, host?.waitUntil),
+        sleep: async (durationMs) => {
+            await interruptibleSleep(sleepDuration(durationMs), operation.signal, host?.sleep);
+        },
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        ...(delegate === undefined ? {} : { delegate }),
+        ...(body === undefined ? {} : { request: Object.freeze({ body: () => body.slice() }) }),
+    });
+}
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export async function defaultSleep(durationMs) {
+    await new Promise((resolve) => setTimeout(resolve, sleepDuration(durationMs)));
+}
+async function interruptibleSleep(durationMs, signal, sleep) {
+    if (signal.aborted)
+        throw abortCause(signal);
+    if (sleep === undefined) {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => finish(resolve), durationMs);
+            const abort = () => {
+                clearTimeout(timer);
+                finish(() => reject(abortCause(signal)));
+            };
+            const finish = (settle) => {
+                signal.removeEventListener('abort', abort);
+                settle();
+            };
+            signal.addEventListener('abort', abort, { once: true });
+        });
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (settle) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', abort);
+            settle();
+        };
+        const abort = () => finish(() => reject(abortCause(signal)));
+        signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve()
+            .then(() => sleep(durationMs))
+            .then(() => finish(resolve), (cause) => finish(() => reject(cause)));
+    });
+}
+function abortCause(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error('Invocation was cancelled.');
+}
+function sleepDuration(input) {
+    if (!Number.isFinite(input) || input < 0 || input > 2_147_483_647) {
+        throw new RangeError('Sleep duration must be finite, non-negative, and within timer range.');
+    }
+    return input;
+}
+//# sourceMappingURL=context.js.map

package/dist/invocation/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../invocation/context.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,iBAAiB,CAC/B,SAA0B,EAC1B,MAAwB,EACxB,IAAsB,EACtB,WAAwB,EACxB,cAAwC,EACxC,QAAwC;IAExC,MAAM,IAAI,GAAG,WAAW,EAAE,KAAK,EAAE,CAAA;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACpF,UAAU,EAAE,CAAC,IAAuC,EAAE,EAAE,CACtD,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;QAC1C,KAAK,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;YAClC,MAAM,kBAAkB,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACpF,CAAC;QACD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,UAAkB,EAClB,MAAmB,EACnB,KAA6C;IAE7C,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC1C,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;gBACpC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC1C,MAAM,EAAE,CAAA;YACV,CAAC,CAAA;YACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC1C,MAAM,EAAE,CAAA;QACV,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;aAC7B,IAAI,CACH,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACvC,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;AAChG,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,sEAAsE,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/invocation/index.d.ts

@@ -1,3 +1,4 @@
-export { dispatchInvocation, executeInvocation, type InvocationReply, type InvocationResponse, } from './dispatch.js';
-export { kernelDispatcher, type Invocation, type InvocationPath, type Dispatcher, } from './dispatcher.js';
+export { defaultSleep, invocationContext } from './context.js';
+export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
+export type { ApplicationHost, Handler, HandlerRequest, InvocationContext } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,KAAK,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAChG,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA"}

package/dist/invocation/index.js

@@ -1,3 +1,3 @@
-export { dispatchInvocation, executeInvocation, } from './dispatch.js';
-export { kernelDispatcher, } from './dispatcher.js';
+export { defaultSleep, invocationContext } from './context.js';
+export { publicationRouteDecision } from './publication-route.js';
 //# sourceMappingURL=index.js.map

package/dist/invocation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,gBAAgB,GAIjB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../invocation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAiC,MAAM,wBAAwB,CAAA"}

package/dist/invocation/publication-route.d.ts

@@ -0,0 +1,12 @@
+import type { errors, publication } from '@astrale-os/kernel-protocol';
+export type PublicationRouteDecision = {
+    readonly kind: 'exact';
+} | {
+    readonly kind: 'same-schema';
+} | {
+    readonly kind: 'rejected';
+    readonly error: errors.ErrorPayload;
+};
+/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+export declare function publicationRouteDecision(current: publication.Publication, installed: publication.PublicationRef): PublicationRouteDecision;
+//# sourceMappingURL=publication-route.d.ts.map

package/dist/invocation/publication-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-route.d.ts","sourceRoot":"","sources":["../../invocation/publication-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAQtE,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAA;CAAE,CAAA;AAEtE,8FAA8F;AAC9F,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,CAAC,WAAW,EAChC,SAAS,EAAE,WAAW,CAAC,cAAc,GACpC,wBAAwB,CAuC1B"}

package/dist/invocation/publication-route.js

@@ -0,0 +1,43 @@
+import { errors as protocolErrors, invocation, publication as publications, } from '@astrale-os/kernel-protocol';
+/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+export function publicationRouteDecision(current, installed) {
+    switch (publications.compareReference(current, installed)) {
+        case 'exact':
+            return Object.freeze({ kind: 'exact' });
+        case 'same-schema':
+            return Object.freeze({ kind: 'same-schema' });
+        case 'schema-drift':
+            return rejected('Installed Domain schema requires an explicit upgrade.', Object.freeze({
+                code: invocation.SCHEMA_UPGRADE_REQUIRED,
+                details: Object.freeze({
+                    origin: installed.origin,
+                    installedRevision: installed.revision,
+                    candidateRevision: current.schema.revision,
+                }),
+            }));
+        case 'identity-drift':
+            return rejected('Installed Domain Service identity requires explicit trust.', Object.freeze({
+                code: invocation.SERVICE_TRUST_REQUIRED,
+                details: Object.freeze({
+                    origin: installed.origin,
+                    installedIssuer: installed.identity.issuer,
+                    candidateIssuer: current.identity.issuer,
+                }),
+            }));
+        case 'origin-drift':
+            return Object.freeze({
+                kind: 'rejected',
+                error: Object.freeze({
+                    code: protocolErrors.CODES.INVALID_REQUEST,
+                    message: 'Routed Publication origin differs from the served Domain.',
+                }),
+            });
+    }
+}
+function rejected(message, data) {
+    return Object.freeze({
+        kind: 'rejected',
+        error: Object.freeze({ code: protocolErrors.CODES.CONFLICT, message, data }),
+    });
+}
+//# sourceMappingURL=publication-route.js.map

package/dist/invocation/publication-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-route.js","sourceRoot":"","sources":["../../invocation/publication-route.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,MAAM,IAAI,cAAc,EACxB,UAAU,EACV,WAAW,IAAI,YAAY,GAC5B,MAAM,6BAA6B,CAAA;AAOpC,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB,CACtC,OAAgC,EAChC,SAAqC;IAErC,QAAQ,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QACzC,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;QAC/C,KAAK,cAAc;YACjB,OAAO,QAAQ,CACb,uDAAuD,EACvD,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,UAAU,CAAC,uBAAuB;gBACxC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,iBAAiB,EAAE,SAAS,CAAC,QAAQ;oBACrC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;iBAC3C,CAAC;aACH,CAAC,CACH,CAAA;QACH,KAAK,gBAAgB;YACnB,OAAO,QAAQ,CACb,4DAA4D,EAC5D,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,UAAU,CAAC,sBAAsB;gBACvC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACrB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM;oBAC1C,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;iBACzC,CAAC;aACH,CAAC,CACH,CAAA;QACH,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;oBACnB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe;oBAC1C,OAAO,EAAE,2DAA2D;iBACrE,CAAC;aACH,CAAC,CAAA;IACN,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAwB;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;KAC7E,CAAC,CAAA;AACJ,CAAC"}

package/dist/invocation/types.d.ts

@@ -0,0 +1,38 @@
+import type { CredentialInput } from '@astrale-os/kernel-core/auth';
+import type { InboundRequestOptions, RequestBackground, RequestSleep } from '@astrale-os/kernel-ports';
+import type { Call, Result } from '@astrale-os/kernel-ports/functions';
+import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { PublicationSnapshot } from '../publication/index.js';
+/** Optional platform retention and timer adaptation for one Fetch invocation. */
+export interface ApplicationHost {
+    waitUntil(promise: Promise<unknown>): void;
+    readonly sleep?: (durationMs: number) => Promise<void>;
+}
+/** Immutable lifetime and execution conveniences for one admitted dispatch. */
+export interface InvocationContext extends InboundRequestOptions {
+    readonly background: RequestBackground;
+    /** Rejects promptly when execution is cancelled or reaches its deadline. */
+    readonly sleep: RequestSleep;
+}
+/** Ready semantic capability invoked by canonical and advertised transport routes. */
+export interface HandlerRequest {
+    readonly call: Call;
+    /** Admitted transport correlation syntax, separate from semantic execution options. */
+    readonly trace?: protocol.Trace;
+    readonly credential?: CredentialInput;
+    /** Source-only effective delegation forwarded unchanged to Runtime. */
+    readonly delegate?: protocol.Delegate;
+    /** Destination routing witness forwarded after exact or same-schema Server admission. */
+    readonly via?: protocol.Via;
+    /** Source-only local-target or remote-revision Schema Registration precondition. */
+    readonly schema?: protocol.SchemaTarget;
+    /** Exact Server-pinned serving generation for a Publication-backed request. */
+    readonly publication?: PublicationSnapshot;
+    readonly context: InvocationContext;
+}
+export interface Handler {
+    dispatch(request: HandlerRequest): Promise<Result | {
+        readonly kind: 'miss';
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/invocation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../invocation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,IAAI,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrC,yFAAyF;IACzF,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAA;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAA;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CACpC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/E"}

package/dist/invocation/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/invocation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../invocation/types.ts"],"names":[],"mappings":""}

package/dist/issuer/exchange.d.ts

@@ -0,0 +1,13 @@
+import { issuer as protocolIssuer } from '@astrale-os/kernel-protocol';
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { ServerRouter } from '../transport/index.js';
+export interface Context {
+    readonly signal: AbortSignal;
+}
+export interface Provider {
+    exchange(request: protocolIssuer.exchange.Request, context: Context): Promise<protocolIssuer.exchange.Response>;
+}
+export declare function capture(input: Provider): Provider;
+export declare function mount(app: ServerRouter, issuer: string, provider: Provider, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;
+//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.d.ts","sourceRoot":"","sources":["../../issuer/exchange.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,MAAM,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAE9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEzD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CACN,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,EACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;CAC7C;AASD,wBAAgB,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,QAAQ,CASjD;AAED,wBAAgB,KAAK,CACnB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,GAChB,IAAI,CA8EN"}

package/dist/issuer/exchange.js

@@ -0,0 +1,135 @@
+import { credential } from '@astrale-os/kernel-core/auth';
+import { errors, issuer as protocolIssuer } from '@astrale-os/kernel-protocol';
+const PROVIDER_CODES = new Set([
+    errors.CODES.AUTH_INVALID,
+    errors.CODES.AUTH_EXPIRED,
+    errors.CODES.BACKEND_UNAVAILABLE,
+    errors.CODES.DEADLINE_EXCEEDED,
+]);
+export function capture(input) {
+    if (input === null || typeof input !== 'object' || typeof input.exchange !== 'function') {
+        throw new TypeError('Token-exchange provider is invalid.');
+    }
+    const exchange = input.exchange;
+    return Object.freeze({
+        exchange: (request, context) => exchange.call(input, request, context),
+    });
+}
+export function mount(app, issuer, provider, cors, active, timeoutMs) {
+    const path = protocolIssuer.paths(issuer).tokenExchange;
+    if (cors.enabled) {
+        app.options(path, (context) => cors.preflight(context.req.raw, { methods: ['POST'], headers: ['authorization', 'accept'] }));
+    }
+    app.all(path, async (context) => {
+        const request = context.req.raw;
+        const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, extra);
+        let admitted;
+        try {
+            admitted = protocolIssuer.exchange.acceptHttpRequest({
+                method: request.method,
+                url: request.url,
+                authorization: request.headers.get('authorization'),
+                accept: request.headers.get('accept'),
+            });
+        }
+        catch (cause) {
+            if (cause instanceof errors.ProtocolError) {
+                return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }), cause.payload.code === errors.CODES.METHOD_NOT_ALLOWED ? { allow: 'POST' } : undefined);
+            }
+            throw cause;
+        }
+        if (!active.isAccepting) {
+            return respond(error('BACKEND_UNAVAILABLE', 'Token exchange is unavailable.'));
+        }
+        const operation = active.begin(timeoutMs, request.signal);
+        if (operation === undefined) {
+            return respond(error('LIMIT_EXCEEDED', 'Token-exchange limit exceeded.'));
+        }
+        try {
+            try {
+                await requireEmptyBody(request, operation.signal);
+            }
+            catch (cause) {
+                if (operation.timedOut) {
+                    return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+                }
+                if (cause instanceof errors.ProtocolError) {
+                    return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }));
+                }
+                throw cause;
+            }
+            let output;
+            try {
+                output = await provider.exchange(admitted, { signal: operation.signal });
+            }
+            catch (cause) {
+                if (operation.timedOut) {
+                    return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+                }
+                if (cause instanceof errors.ProtocolError && PROVIDER_CODES.has(cause.payload.code)) {
+                    return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }));
+                }
+                throw cause;
+            }
+            if (operation.timedOut) {
+                return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+            }
+            const response = protocolIssuer.exchange.acceptResponse(output);
+            if (credential.inspect(response.token).claims.exp !== response.expiresAt) {
+                throw new TypeError('Token-exchange provider returned inconsistent expiry evidence.');
+            }
+            return json(response, 200, request, cors);
+        }
+        catch {
+            return respond(error('INTERNAL_ERROR', 'Internal token-exchange failure.'));
+        }
+        finally {
+            operation.settle();
+        }
+    });
+}
+async function requireEmptyBody(request, signal) {
+    const declared = request.headers.get('content-length');
+    if (declared !== null && declared !== '0')
+        invalidRequest();
+    const reader = request.body?.getReader();
+    if (reader === undefined)
+        return;
+    const abort = () => void reader.cancel(signal.reason).catch(() => undefined);
+    signal.addEventListener('abort', abort, { once: true });
+    try {
+        if (signal.aborted)
+            throw signal.reason;
+        const first = await reader.read();
+        if (!first.done) {
+            await reader.cancel('token exchange requires an empty body').catch(() => undefined);
+            invalidRequest();
+        }
+    }
+    finally {
+        signal.removeEventListener('abort', abort);
+        reader.releaseLock();
+    }
+}
+function invalidRequest() {
+    throw new errors.ProtocolError({
+        code: errors.CODES.INVALID_REQUEST,
+        message: 'Token exchange requires an empty request body.',
+    });
+}
+function error(code, message) {
+    return protocolIssuer.exchange.acceptErrorResponse({
+        error: { code: errors.CODES[code], message },
+    });
+}
+function json(value, status, request, cors, extra) {
+    const headers = new Headers(protocolIssuer.exchange.responseHeaders());
+    for (const [name, value] of Object.entries(cors.response(request)))
+        headers.set(name, value);
+    if (extra !== undefined) {
+        for (const [name, value] of new Headers(extra))
+            headers.set(name, value);
+    }
+    return new Response(JSON.stringify(value), { status, headers });
+}
+//# sourceMappingURL=exchange.js.map

package/dist/issuer/exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange.js","sourceRoot":"","sources":["../../issuer/exchange.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAiB9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,MAAM,CAAC,KAAK,CAAC,YAAY;IACzB,MAAM,CAAC,KAAK,CAAC,YAAY;IACzB,MAAM,CAAC,KAAK,CAAC,mBAAmB;IAChC,MAAM,CAAC,KAAK,CAAC,iBAAiB;CAC/B,CAAC,CAAA;AAEF,MAAM,UAAU,OAAO,CAAC,KAAe;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IAC/B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,OAAwC,EAAE,OAAgB,EAAE,EAAE,CACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;KACzC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,GAAiB,EACjB,MAAc,EACd,QAAkB,EAClB,IAAgB,EAChB,MAAwB,EACxB,SAAiB;IAEjB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,aAAa,CAAA;IAEvD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC7F,CAAA;IACH,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAA;QAC/B,MAAM,OAAO,GAAG,CAAC,OAA8C,EAAE,KAAmB,EAAE,EAAE,CACtF,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAEzE,IAAI,QAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACnD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBACnD,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;aACtC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1C,OAAO,OAAO,CACZ,cAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EACrE,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACvF,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,gCAAgC,CAAC,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC,CAAA;QAC3E,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAA;gBAChF,CAAC;gBACD,IAAI,KAAK,YAAY,MAAM,CAAC,aAAa,EAAE,CAAC;oBAC1C,OAAO,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACvF,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAA;gBAChF,CAAC;gBACD,IAAI,KAAK,YAAY,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpF,OAAO,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACvF,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAA;YAChF,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAC/D,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACzE,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAA;YACvF,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC,CAAA;QAC7E,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAAmB;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG;QAAE,cAAc,EAAE,CAAA;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAM;IAChC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5E,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAA;QACvC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACnF,cAAc,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe;QAClC,OAAO,EAAE,gDAAgD;KAC1D,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,KAAK,CACZ,IAAuF,EACvF,OAAe;IAEf,OAAO,cAAc,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACjD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE;KAC7C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,IAAI,CACX,KAA+E,EAC/E,MAAc,EACd,OAAgB,EAChB,IAAgB,EAChB,KAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAA;IACtE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AACjE,CAAC"}

package/dist/issuer/index.d.ts

@@ -0,0 +1,4 @@
+export { admitIssuer, issuerRouteReservations, mountIssuer, type IssuerRouteReservation, } from './routes.js';
+export type * as exchange from './exchange.js';
+export type { Issuer } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../issuer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,YAAY,KAAK,QAAQ,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}

package/dist/issuer/index.js

@@ -0,0 +1,2 @@
+export { admitIssuer, issuerRouteReservations, mountIssuer, } from './routes.js';
+//# sourceMappingURL=index.js.map

package/dist/issuer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../issuer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,WAAW,GAEZ,MAAM,aAAa,CAAA"}

package/dist/issuer/routes.d.ts

@@ -0,0 +1,14 @@
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { ServerRouter } from '../transport/index.js';
+import type { Provider } from './exchange.js';
+import type { Issuer } from './types.js';
+export interface IssuerRouteReservation {
+    readonly path: string;
+    readonly methods: readonly string[];
+}
+export declare function issuerRouteReservations(input: Issuer, tokenExchange?: boolean): readonly IssuerRouteReservation[];
+export declare function mountIssuer(app: ServerRouter, input: Issuer, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number, tokenExchange?: Provider): void;
+/** Admit static discovery configuration before Runtime Boot performs any durable work. */
+export declare function admitIssuer(input: Issuer): Issuer;
+//# sourceMappingURL=routes.d.ts.map

package/dist/issuer/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../issuer/routes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAKxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,aAAa,UAAQ,GACpB,SAAS,sBAAsB,EAAE,CAyBnC;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,QAAQ,GACvB,IAAI,CA0IN;AAWD,0FAA0F;AAC1F,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBjD"}