@astrale-os/kernel-server 0.4.17 → 0.5.0-beta.2

package/dist/issuer/routes.js

@@ -0,0 +1,147 @@
+import { issuer as issuerDiscovery } from '@astrale-os/kernel-protocol';
+import { IssuerKeysUnavailableError } from '../errors/index.js';
+import { mount } from './exchange.js';
+export function issuerRouteReservations(input, tokenExchange = false) {
+    const paths = issuerDiscovery.paths(input.issuer);
+    const reservations = [
+        Object.freeze({ path: paths.configuration, methods: Object.freeze(['GET']) }),
+        Object.freeze({ path: paths.keys, methods: Object.freeze(['GET']) }),
+    ];
+    if (tokenExchange) {
+        reservations.push(Object.freeze({ path: paths.tokenExchange, methods: Object.freeze(['POST']) }));
+    }
+    if (input.loadIssuerPublicKeys !== undefined) {
+        const base = new URL(input.issuer).pathname.replace(/\/+$/u, '');
+        reservations.push(Object.freeze({
+            path: `${base}/iss/{thumbprint}/.well-known/openid-configuration`,
+            methods: Object.freeze(['GET']),
+        }), Object.freeze({
+            path: `${base}/iss/{thumbprint}/.well-known/jwks.json`,
+            methods: Object.freeze(['GET']),
+        }));
+    }
+    return Object.freeze(reservations);
+}
+export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange) {
+    const issuer = input.issuer;
+    const paths = issuerDiscovery.paths(issuer);
+    const headers = (request) => ({
+        ...cors.response(request),
+        'cache-control': 'no-cache',
+    });
+    const algorithm = input.signingAlgorithm ?? 'ES256';
+    const configuration = issuerDiscovery.configuration(issuer, [algorithm], {
+        tokenExchange: tokenExchange !== undefined,
+    });
+    app.get(paths.configuration, (context) => context.json(configuration, 200, headers(context.req.raw)));
+    if (cors.enabled) {
+        app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+        app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+    }
+    app.get(paths.keys, async (context) => {
+        const operation = active.begin(timeoutMs, context.req.raw.signal);
+        if (operation === undefined) {
+            return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+        }
+        try {
+            const keys = await input.loadPublicKeys(operation.signal);
+            return context.json(issuerDiscovery.keySet(keys, [algorithm]), 200, headers(context.req.raw));
+        }
+        catch (cause) {
+            if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+            }
+            throw cause;
+        }
+        finally {
+            operation.settle();
+        }
+    });
+    if (tokenExchange !== undefined) {
+        mount(app, issuer, tokenExchange, cors, active, timeoutMs);
+    }
+    const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    if (loadIssuerPublicKeys !== undefined) {
+        const base = new URL(issuer).pathname.replace(/\/+$/, '');
+        if (cors.enabled) {
+            app.options(`${base}/iss/:thumbprint/.well-known/openid-configuration`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+            app.options(`${base}/iss/:thumbprint/.well-known/jwks.json`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
+        }
+        app.get(`${base}/iss/:thumbprint/.well-known/openid-configuration`, async (context) => {
+            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            if (hostedIssuer === undefined)
+                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+            const operation = active.begin(timeoutMs, context.req.raw.signal);
+            if (operation === undefined) {
+                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            }
+            try {
+                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
+                if (keys.length === 0)
+                    return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+                return context.json(issuerDiscovery.configuration(hostedIssuer, [algorithm]), 200, headers(context.req.raw));
+            }
+            catch (cause) {
+                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                }
+                throw cause;
+            }
+            finally {
+                operation.settle();
+            }
+        });
+        app.get(`${base}/iss/:thumbprint/.well-known/jwks.json`, async (context) => {
+            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            if (hostedIssuer === undefined)
+                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+            const operation = active.begin(timeoutMs, context.req.raw.signal);
+            if (operation === undefined) {
+                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            }
+            try {
+                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
+                if (keys.length === 0)
+                    return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+                return context.json({ keys }, 200, headers(context.req.raw));
+            }
+            catch (cause) {
+                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                }
+                throw cause;
+            }
+            finally {
+                operation.settle();
+            }
+        });
+    }
+}
+async function hostedKeys(load, issuer, signal, algorithm) {
+    return issuerDiscovery.keySet(await load(issuer, signal), [algorithm]).keys;
+}
+/** Admit static discovery configuration before Runtime Boot performs any durable work. */
+export function admitIssuer(input) {
+    const signingAlgorithm = input.signingAlgorithm ?? 'ES256';
+    const issuer = issuerDiscovery.configuration(input.issuer, [signingAlgorithm]).issuer;
+    if (typeof input.loadPublicKeys !== 'function') {
+        throw new TypeError('Issuer public-key loader is invalid.');
+    }
+    if (input.loadIssuerPublicKeys !== undefined &&
+        typeof input.loadIssuerPublicKeys !== 'function') {
+        throw new TypeError('Hosted issuer discovery loader is invalid.');
+    }
+    const loadPublicKeys = input.loadPublicKeys;
+    const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    return Object.freeze({
+        issuer,
+        signingAlgorithm,
+        loadPublicKeys: (signal) => loadPublicKeys.call(input, signal),
+        ...(loadIssuerPublicKeys === undefined
+            ? {}
+            : {
+                loadIssuerPublicKeys: (hostedIssuer, signal) => loadIssuerPublicKeys.call(input, hostedIssuer, signal),
+            }),
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/issuer/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../issuer/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAQvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAOrC,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,aAAa,GAAG,KAAK;IAErB,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,YAAY,GAA6B;QAC7C,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,YAAY,CAAC,IAAI,CACf,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAC/E,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAChE,YAAY,CAAC,IAAI,CACf,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,GAAG,IAAI,oDAAoD;YACjE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;SAChC,CAAC,EACF,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,GAAG,IAAI,yCAAyC;YACtD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;SAChC,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAiB,EACjB,KAAa,EACb,IAAgB,EAChB,MAAwB,EACxB,SAAiB,EACjB,aAAwB;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAA;IACnD,MAAM,aAAa,GAAG,eAAe,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE;QACvE,aAAa,EAAE,aAAa,KAAK,SAAS;KAC3C,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAA;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACtD,CAAA;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YACzD,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAC5E,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,EAAE,CAAA;QACpB,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAA;IACvD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACzD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,mDAAmD,EAAE,CAAC,OAAO,EAAE,EAAE,CAClF,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACtD,CAAA;YACD,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,wCAAwC,EAAE,CAAC,OAAO,EAAE,EAAE,CACvE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACtD,CAAA;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,mDAAmD,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpF,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;YACpF,IAAI,YAAY,KAAK,SAAS;gBAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YACpF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,oBAAoB,EACpB,YAAY,EACZ,SAAS,CAAC,MAAM,EAChB,SAAS,CACV,CAAA;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBACnB,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;gBACpF,OAAO,OAAO,CAAC,IAAI,CACjB,eAAe,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,EACxD,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBAC5E,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,MAAM,EAAE,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,wCAAwC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzE,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAA;YACpF,IAAI,YAAY,KAAK,SAAS;gBAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YACpF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,oBAAoB,EACpB,YAAY,EACZ,SAAS,CAAC,MAAM,EAChB,SAAS,CACV,CAAA;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBACnB,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;gBACpF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBAC5E,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,KAAK,EAAE,8BAA8B,EAAE,EACzC,GAAG,EACH,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CACzB,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,MAAM,EAAE,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAiD,EACjD,MAAgB,EAChB,MAAmB,EACnB,SAAiB;IAEjB,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7E,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAA;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAA;IACrF,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IACD,IACE,KAAK,CAAC,oBAAoB,KAAK,SAAS;QACxC,OAAO,KAAK,CAAC,oBAAoB,KAAK,UAAU,EAChD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAC3C,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,gBAAgB;QAChB,cAAc,EAAE,CAAC,MAAmB,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC3E,GAAG,CAAC,oBAAoB,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,oBAAoB,EAAE,CAAC,YAAsB,EAAE,MAAmB,EAAE,EAAE,CACpE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC;aACzD,CAAC;KACP,CAAC,CAAA;AACJ,CAAC"}

package/dist/issuer/types.d.ts

@@ -0,0 +1,11 @@
+import type { IssuerId, JsonWebKey } from '@astrale-os/kernel-core/auth';
+/** Public issuer material; Server never receives private signing material. */
+export interface Issuer {
+    readonly issuer: IssuerId;
+    readonly signingAlgorithm?: string;
+    /** Bounded request-time read; cancellation is owned by Server. */
+    loadPublicKeys(signal: AbortSignal): Promise<readonly JsonWebKey[]>;
+    /** Optional hosted-key discovery for issuers below `<issuer>/iss/:thumbprint`. */
+    readonly loadIssuerPublicKeys?: (issuer: IssuerId, signal: AbortSignal) => Promise<readonly JsonWebKey[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/issuer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../issuer/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAExE,8EAA8E;AAC9E,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;IACzB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,kEAAkE;IAClE,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IACnE,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;CACpC"}

package/dist/issuer/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/issuer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../issuer/types.ts"],"names":[],"mappings":""}

package/dist/lifecycle/active.d.ts

@@ -0,0 +1,40 @@
+type CancelWork = (reason: string) => void | Promise<void>;
+type BackgroundTask = () => void | PromiseLike<unknown>;
+/** Minimal close capability retained by Server lifecycle without importing transport. */
+export interface ActiveSocket {
+    close(code?: number, reason?: string): void;
+}
+/** One Server-owned operation from body admission through terminal result settlement. */
+export interface ActiveOperation {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+    readonly timedOut: boolean;
+    /** Register cooperative cleanup and return an idempotent unregistration function. */
+    onCancel(cancel: CancelWork): () => void;
+    cancel(reason: string): void;
+    settle(): void;
+    readonly finished: Promise<void>;
+}
+export declare class ActiveOperations {
+    private readonly maximumConcurrentOperations;
+    private accepting;
+    private closed;
+    private readonly operations;
+    private readonly sockets;
+    private readonly backgroundTasks;
+    private closing?;
+    private changed;
+    constructor(maximumConcurrentOperations: number);
+    get isAccepting(): boolean;
+    begin(timeoutMs: number, externalSignal?: AbortSignal): ActiveOperation | undefined;
+    attachSocket(socket: ActiveSocket): boolean;
+    detachSocket(socket: ActiveSocket): void;
+    background(task: BackgroundTask, retain?: (promise: Promise<unknown>) => void): void;
+    drain(): void;
+    close(deadline: number): Promise<void>;
+    private closeOnce;
+    private waitUntilIdleOr;
+    private closeSockets;
+}
+export {};
+//# sourceMappingURL=active.d.ts.map

package/dist/lifecycle/active.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active.d.ts","sourceRoot":"","sources":["../../lifecycle/active.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAC1D,KAAK,cAAc,GAAG,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;AAEvD,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,IAAI,CAAA;IACxC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,MAAM,IAAI,IAAI,CAAA;IACd,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC;AAED,qBAAa,gBAAgB;IASf,OAAO,CAAC,QAAQ,CAAC,2BAA2B;IARxD,OAAO,CAAC,SAAS,CAAO;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,OAAO,CAA0B;IAEzC,YAA6B,2BAA2B,EAAE,MAAM,EAAI;IAEpE,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAWlF;IAED,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAI1C;IAED,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAEvC;IAED,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAuBnF;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrC;YAEa,SAAS;YAkBT,eAAe;IAe7B,OAAO,CAAC,YAAY;CAUrB"}

package/dist/lifecycle/active.js

@@ -0,0 +1,200 @@
+export class ActiveOperations {
+    maximumConcurrentOperations;
+    accepting = true;
+    closed = false;
+    operations = new Set();
+    sockets = new Set();
+    backgroundTasks = new Set();
+    closing;
+    changed;
+    constructor(maximumConcurrentOperations) {
+        this.maximumConcurrentOperations = maximumConcurrentOperations;
+    }
+    get isAccepting() {
+        return this.accepting;
+    }
+    begin(timeoutMs, externalSignal) {
+        if (!this.accepting || this.operations.size >= this.maximumConcurrentOperations) {
+            return undefined;
+        }
+        const operation = new Operation(Date.now() + timeoutMs, () => {
+            this.operations.delete(operation);
+            this.changed?.();
+        });
+        this.operations.add(operation);
+        operation.link(externalSignal);
+        return operation;
+    }
+    attachSocket(socket) {
+        if (!this.accepting)
+            return false;
+        this.sockets.add(socket);
+        return true;
+    }
+    detachSocket(socket) {
+        this.sockets.delete(socket);
+    }
+    background(task, retain) {
+        if (typeof task !== 'function')
+            throw new TypeError('Background task must be a function.');
+        if (this.closed)
+            throw new Error('Server is closed.');
+        const tracked = Promise.resolve()
+            .then(task)
+            .then(() => undefined, (cause) => {
+            // Background work has no response channel; report without creating an unhandled rejection.
+            // oxlint-disable-next-line no-console
+            console.error('[server] background task failed:', cause);
+        })
+            .finally(() => {
+            this.backgroundTasks.delete(tracked);
+            this.changed?.();
+        });
+        this.backgroundTasks.add(tracked);
+        try {
+            retain?.(tracked);
+        }
+        catch {
+            // Server retention remains authoritative when a platform bridge refuses the registration.
+        }
+    }
+    drain() {
+        this.accepting = false;
+    }
+    close(deadline) {
+        this.drain();
+        this.closing ??= this.closeOnce(deadline);
+        return this.closing;
+    }
+    async closeOnce(deadline) {
+        await this.waitUntilIdleOr(deadline);
+        if (this.operations.size > 0) {
+            for (const operation of this.operations)
+                operation.cancel('server closing');
+        }
+        this.closeSockets();
+        // Give cooperative cancellation and iterator returns one turn to settle. The absolute deadline
+        // has already elapsed; an uncooperative operation must reject close rather than pin Host forever.
+        await Promise.resolve();
+        if (this.operations.size > 0 || this.backgroundTasks.size > 0) {
+            this.closed = true;
+            throw new Error(`Server close deadline elapsed with ${this.operations.size} active operation(s) and ${this.backgroundTasks.size} background task(s).`);
+        }
+        this.closed = true;
+    }
+    async waitUntilIdleOr(deadline) {
+        while (this.operations.size > 0 || this.backgroundTasks.size > 0) {
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return;
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, Math.min(remaining, 2_147_483_647));
+                this.changed = () => {
+                    clearTimeout(timer);
+                    resolve();
+                };
+            });
+            this.changed = undefined;
+        }
+    }
+    closeSockets() {
+        for (const socket of this.sockets) {
+            try {
+                socket.close(1012, 'Server restarting');
+            }
+            catch {
+                // The platform already owns a broken socket; no further work is possible.
+            }
+        }
+        this.sockets.clear();
+    }
+}
+class Operation {
+    deadline;
+    onSettled;
+    controller = new AbortController();
+    cancelWork = new Set();
+    timer;
+    external;
+    settled = false;
+    cancelled = false;
+    timeout = false;
+    resolveFinished;
+    finished;
+    constructor(deadline, onSettled) {
+        this.deadline = deadline;
+        this.onSettled = onSettled;
+        this.finished = new Promise((resolve) => {
+            this.resolveFinished = resolve;
+        });
+        this.timer = setTimeout(() => {
+            this.timeout = true;
+            this.cancel('invocation deadline exceeded');
+        }, Math.min(Math.max(0, deadline - Date.now()), 2_147_483_647));
+    }
+    link(signal) {
+        if (signal === undefined)
+            return;
+        const abort = () => this.cancel('transport disconnected');
+        this.external = [signal, abort];
+        if (signal.aborted)
+            abort();
+        else
+            signal.addEventListener('abort', abort, { once: true });
+    }
+    get signal() {
+        return this.controller.signal;
+    }
+    get timedOut() {
+        return this.timeout;
+    }
+    onCancel(cancel) {
+        if (this.cancelled) {
+            void settleCancellation(cancel, abortReason(this.controller.signal));
+            return () => undefined;
+        }
+        this.cancelWork.add(cancel);
+        return () => {
+            this.cancelWork.delete(cancel);
+        };
+    }
+    cancel(reason) {
+        if (this.cancelled || this.settled)
+            return;
+        this.cancelled = true;
+        clearTimeout(this.timer);
+        this.detachExternal();
+        this.controller.abort(new Error(reason));
+        for (const cancel of this.cancelWork)
+            void settleCancellation(cancel, reason);
+        this.cancelWork.clear();
+    }
+    settle() {
+        if (this.settled)
+            return;
+        this.settled = true;
+        clearTimeout(this.timer);
+        this.detachExternal();
+        this.cancelWork.clear();
+        this.onSettled();
+        this.resolveFinished();
+    }
+    detachExternal() {
+        if (this.external === undefined)
+            return;
+        this.external[0].removeEventListener('abort', this.external[1]);
+        this.external = undefined;
+    }
+}
+async function settleCancellation(cancel, reason) {
+    try {
+        await cancel(reason);
+    }
+    catch {
+        // Cancellation is best-effort; the owning operation still settles through its execution path.
+    }
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason.message : 'operation cancelled';
+}
+//# sourceMappingURL=active.js.map

package/dist/lifecycle/active.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active.js","sourceRoot":"","sources":["../../lifecycle/active.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,gBAAgB;IASE,2BAA2B;IARhD,SAAS,GAAG,IAAI,CAAA;IAChB,MAAM,GAAG,KAAK,CAAA;IACL,UAAU,GAAG,IAAI,GAAG,EAAa,CAAA;IACjC,OAAO,GAAG,IAAI,GAAG,EAAgB,CAAA;IACjC,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAA;IACnD,OAAO,CAAgB;IACvB,OAAO,CAA0B;IAEzC,YAA6B,2BAAmC;2CAAnC,2BAA2B;IAAW,CAAC;IAEpE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,cAA4B;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAChF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE;YAC3D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC9B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,YAAY,CAAC,MAAoB;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,YAAY,CAAC,MAAoB;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,UAAU,CAAC,IAAoB,EAAE,MAA4C;QAC3E,IAAI,OAAO,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;QAC1F,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE;aAC9B,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAK,EAAE,EAAE;YACR,2FAA2F;YAC3F,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;QAC1D,CAAC,CACF;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAA;QAClB,CAAC,CAAC,CAAA;QACJ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;QAC5F,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,QAAgB;QACpB,IAAI,CAAC,KAAK,EAAE,CAAA;QACZ,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;gBAAE,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,+FAA+F;QAC/F,kGAAkG;QAClG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;YAClB,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,UAAU,CAAC,IAAI,4BAA4B,IAAI,CAAC,eAAe,CAAC,IAAI,sBAAsB,CACtI,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAAgB;QAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACvC,IAAI,SAAS,IAAI,CAAC;gBAAE,OAAM;YAC1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;gBACrE,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE;oBAClB,YAAY,CAAC,KAAK,CAAC,CAAA;oBACnB,OAAO,EAAE,CAAA;gBACX,CAAC,CAAA;YACH,CAAC,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;YAC5E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;CACF;AAED,MAAM,SAAS;IAYF,QAAQ;IACA,SAAS;IAZX,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,UAAU,GAAG,IAAI,GAAG,EAAc,CAAA;IAClC,KAAK,CAA+B;IAC7C,QAAQ,CAAqC;IAC7C,OAAO,GAAG,KAAK,CAAA;IACf,SAAS,GAAG,KAAK,CAAA;IACjB,OAAO,GAAG,KAAK,CAAA;IACf,eAAe,CAAa;IAC3B,QAAQ,CAAe;IAEhC,YACW,QAAgB,EACR,SAAqB;wBAD7B,QAAQ;yBACA,SAAS;QAE1B,IAAI,CAAC,QAAQ,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAA;QAChC,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,GAAG,UAAU,CACrB,GAAG,EAAE;YACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;YACnB,IAAI,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAC7C,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,CAC5D,CAAA;IACH,CAAC;IAED,IAAI,CAAC,MAA+B;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAM;QAChC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC/B,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAA;;YACtB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAA;IAC/B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,QAAQ,CAAC,MAAkB;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,KAAK,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;YACpE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC,CAAA;IACH,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,CAAC,cAAc,EAAE,CAAA;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QACxC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU;YAAE,KAAK,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAM;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,CAAC,cAAc,EAAE,CAAA;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACvB,IAAI,CAAC,SAAS,EAAE,CAAA;QAChB,IAAI,CAAC,eAAe,EAAE,CAAA;IACxB,CAAC;IAEO,cAAc;QACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAM;QACvC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC3B,CAAC;CACF;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,MAAc;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;IAChG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAA;AACvF,CAAC"}

package/dist/lifecycle/index.d.ts

@@ -0,0 +1,2 @@
+export { ActiveOperations, type ActiveOperation, type ActiveSocket } from './active.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../lifecycle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA"}

package/dist/lifecycle/index.js

@@ -0,0 +1,2 @@
+export { ActiveOperations } from './active.js';
+//# sourceMappingURL=index.js.map

package/dist/lifecycle/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lifecycle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA2C,MAAM,aAAa,CAAA"}

package/dist/publication/delivery/handler.d.ts

@@ -0,0 +1,10 @@
+import type { ActiveOperations } from '../../lifecycle/index.js';
+import type { PreparedPublicationSnapshot } from '../snapshot.js';
+import type { Provider } from './types.js';
+export interface Limits {
+    readonly maximumDeliveryBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/** Serve one delivery request against the exact Publication snapshot that selected its URL. */
+export declare function handleDelivery(request: Request, snapshot: PreparedPublicationSnapshot, provider: Provider | undefined, active: ActiveOperations, limits: Limits, cors: Readonly<Record<string, string>>): Promise<Response>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/publication/delivery/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../publication/delivery/handler.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAQ1C,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;CACrC;AAED,+FAA+F;AAC/F,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,2BAA2B,EACrC,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACrC,OAAO,CAAC,QAAQ,CAAC,CAkGnB"}

package/dist/publication/delivery/handler.js

@@ -0,0 +1,127 @@
+import { codecs, publication as protocolPublication } from '@astrale-os/kernel-protocol';
+import { DeliveryUnavailableError } from '../../errors/index.js';
+import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../../errors/index.js';
+import { readBoundedBody } from '../../transport/index.js';
+const delivery = protocolPublication.delivery;
+/** Serve one delivery request against the exact Publication snapshot that selected its URL. */
+export async function handleDelivery(request, snapshot, provider, active, limits, cors) {
+    if (request.method !== 'POST') {
+        return response({ error: 'Delivery requires POST.' }, 405, cors);
+    }
+    if (provider === undefined) {
+        return response({ error: 'Delivery is unavailable.' }, 503, cors);
+    }
+    const advertised = snapshot.publication.delivery;
+    if (advertised === undefined) {
+        return response({ error: 'Delivery is unavailable.' }, 404, cors);
+    }
+    const operation = active.begin(limits.invocationTimeoutMs, request.signal);
+    if (operation === undefined)
+        return response({ error: 'Server is draining.' }, 503, cors);
+    try {
+        const authorization = request.headers.get('authorization');
+        const token = bearer(authorization);
+        if (advertised.authentication.kind === 'bearer' && token === undefined) {
+            return response({ error: 'Bearer authentication is required.' }, 401, cors);
+        }
+        if (advertised.authentication.kind === 'public' && authorization !== null) {
+            return response({ error: 'This delivery endpoint is public.' }, 400, cors);
+        }
+        let body;
+        try {
+            body = await readBoundedBody(request, limits.maximumDeliveryBytes, operation.signal);
+        }
+        catch (cause) {
+            if (cause instanceof RequestBodyTooLargeError) {
+                return response({ error: 'Delivery request is too large.' }, 413, cors);
+            }
+            if (cause instanceof RequestBodyInvalidError) {
+                return response({ error: 'Delivery request is invalid.' }, 400, cors);
+            }
+            if (operation.signal.aborted) {
+                return response({ error: 'Delivery request was cancelled.' }, 503, cors);
+            }
+            throw cause;
+        }
+        let decoded;
+        try {
+            decoded = codecs.json.decode(body);
+        }
+        catch (cause) {
+            if (cause instanceof codecs.DecodeError) {
+                return response({ error: 'Delivery request is invalid.' }, 400, cors);
+            }
+            throw cause;
+        }
+        let input;
+        try {
+            input = delivery.acceptRequest(decoded);
+        }
+        catch (cause) {
+            if (cause instanceof delivery.Error && cause.code === 'DELIVERY_REQUEST_INVALID') {
+                return response({ error: 'Delivery request is invalid.' }, 400, cors);
+            }
+            throw cause;
+        }
+        if (input.etag !== snapshot.publication.etag) {
+            return response({ error: 'Publication ETag differs from request.' }, 409, cors);
+        }
+        let candidate;
+        try {
+            candidate = await provider.create(input, {
+                ...(token === undefined ? {} : { token: Object.freeze({ kind: 'bearer', token }) }),
+                signal: operation.signal,
+            });
+        }
+        catch (cause) {
+            if (cause instanceof DeliveryUnavailableError) {
+                return response({ error: 'Delivery provider is unavailable.' }, 503, cors);
+            }
+            throw cause;
+        }
+        let created;
+        try {
+            created = delivery.accept(candidate);
+        }
+        catch (cause) {
+            if (cause instanceof delivery.Error) {
+                return response({ error: 'Delivery provider returned an invalid response.' }, 500, cors);
+            }
+            throw cause;
+        }
+        if (created.publication.etag !== snapshot.publication.etag) {
+            return response({ error: 'Delivery provider returned a different Publication.' }, 500, cors);
+        }
+        const encoded = codecs.json.encode(created);
+        if (encodedSize(encoded) > limits.maximumDeliveryBytes) {
+            return response({ error: 'Delivery response exceeds its serving limit.' }, 500, cors);
+        }
+        return new Response(encodedBody(encoded), {
+            headers: { ...cors, 'content-type': 'application/json' },
+        });
+    }
+    finally {
+        operation.settle();
+    }
+}
+function bearer(input) {
+    if (input === null)
+        return undefined;
+    return /^Bearer[ \t]+([^\s]+)$/iu.exec(input.trim())?.[1];
+}
+function response(body, status, cors) {
+    return new Response(encodedBody(codecs.json.encode(body)), {
+        status,
+        headers: { ...cors, 'content-type': 'application/json' },
+    });
+}
+function encodedBody(input) {
+    return typeof input === 'string' ? input : toBody(input);
+}
+function encodedSize(input) {
+    return typeof input === 'string' ? new TextEncoder().encode(input).byteLength : input.byteLength;
+}
+function toBody(input) {
+    return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}
+//# sourceMappingURL=handler.js.map

package/dist/publication/delivery/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../publication/delivery/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAMxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAE1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAA;AAO7C,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,QAAqC,EACrC,QAA8B,EAC9B,MAAwB,EACxB,MAAc,EACd,IAAsC;IAEtC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAA;IAChD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACzF,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACnC,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC1E,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACvE,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACvE,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,KAA2C,CAAA;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;gBACjF,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACvE,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QACjF,CAAC;QAED,IAAI,SAAkB,CAAA;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;gBACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACnF,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,OAA2C,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpC,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1F,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE;YACxC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,EAAE,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc,EAAE,IAAsC;IACrF,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE;QACzD,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;KACzD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAA0B;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAA0B;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAA;AACjG,CAAC"}

package/dist/publication/delivery/index.d.ts

@@ -0,0 +1,3 @@
+export { handleDelivery, type Limits } from './handler.js';
+export type { Context, Provider } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/publication/delivery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../publication/delivery/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1D,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA"}

package/dist/publication/delivery/index.js

@@ -0,0 +1,2 @@
+export { handleDelivery } from './handler.js';
+//# sourceMappingURL=index.js.map

package/dist/publication/delivery/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../publication/delivery/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAe,MAAM,cAAc,CAAA"}

package/dist/publication/delivery/types.d.ts

@@ -0,0 +1,12 @@
+import type { publication } from '@astrale-os/kernel-protocol';
+export interface Context {
+    /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
+    readonly token?: publication.delivery.Token;
+    readonly signal: AbortSignal;
+}
+/** Provider-owned retrieval, construction, and attestation signing. */
+export interface Provider {
+    /** Throw DeliveryUnavailableError only for an expected dependency outage. */
+    create(request: publication.delivery.Request, context: Context): Promise<publication.delivery.Delivery>;
+}
+//# sourceMappingURL=types.d.ts.map