@astrale-os/kernel-server 0.5.0-beta.4 → 0.5.0-beta.41

package/dist/capture.d.ts

@@ -1,3 +1,2 @@
 /** Capture one receiver-bound method while preserving the capability's exact method type. */
 export declare function captureMethod<Receiver extends object, Name extends keyof Receiver>(input: Receiver, name: Name, invalidMessage: string): Receiver[Name];
-//# sourceMappingURL=capture.d.ts.map

package/dist/capture.js

@@ -7,4 +7,3 @@ export function captureMethod(input, name, invalidMessage) {
         throw new TypeError(invalidMessage);
     return method.bind(input);
 }
-//# sourceMappingURL=capture.js.map

package/dist/cors/cors.d.ts

@@ -19,4 +19,3 @@ export interface CorsPolicy {
 }
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export declare function prepareCors(input: CorsConfig | false | undefined): CorsPolicy;
-//# sourceMappingURL=cors.d.ts.map

package/dist/cors/cors.js

@@ -1,5 +1,6 @@
 /** Request-aware CORS admission shared by every Server-owned HTTP surface. */
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const PREFLIGHT_MAX_AGE_SECONDS = 24 * 60 * 60;
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export function prepareCors(input) {
     if (input === false)
@@ -64,6 +65,7 @@ export function prepareCors(input) {
             const allowedHeaders = requestedHeaders.length > 0 ? requestedHeaders : [...routeHeaders];
             const output = new Headers(response(request));
             output.set('access-control-allow-methods', [...allowedMethods, 'OPTIONS'].join(', '));
+            output.set('access-control-max-age', String(PREFLIGHT_MAX_AGE_SECONDS));
             if (allowedHeaders.length > 0) {
                 output.set('access-control-allow-headers', allowedHeaders.join(', '));
             }
@@ -133,4 +135,3 @@ function appendVary(headers, value) {
     names.add(value);
     headers.set('vary', [...names].join(', '));
 }
-//# sourceMappingURL=cors.js.map

package/dist/cors/index.d.ts

@@ -1,3 +1,2 @@
 export { prepareCors, type CorsPolicy, type CorsRoute } from './cors.js';
 export type { CorsConfig } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/cors/index.js

@@ -1,2 +1 @@
 export { prepareCors } from './cors.js';
-//# sourceMappingURL=index.js.map

package/dist/cors/types.d.ts

@@ -9,4 +9,3 @@ export interface CorsConfig {
     /** Emit Access-Control-Allow-Credentials; requires one explicit origin rather than `*`. */
     readonly credentials?: boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/cors/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/errors/availability.d.ts

@@ -8,4 +8,3 @@ export declare class IssuerKeysUnavailableError extends Error {
     readonly name = "IssuerKeysUnavailableError";
     constructor(message?: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=availability.d.ts.map

package/dist/errors/availability.js

@@ -12,4 +12,3 @@ export class IssuerKeysUnavailableError extends Error {
         super(message, options);
     }
 }
-//# sourceMappingURL=availability.js.map

package/dist/errors/classify.d.ts

@@ -1,4 +1,3 @@
-import { errors } from '@astrale-os/kernel-protocol';
+import * as errors from '@astrale-os/kernel-protocol/errors';
 /** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
 export declare function classifyError(input: unknown): errors.ErrorPayload;
-//# sourceMappingURL=classify.d.ts.map

package/dist/errors/classify.js

@@ -1,5 +1,5 @@
 import { PathError } from '@astrale-os/kernel-core/path';
-import { errors } from '@astrale-os/kernel-protocol';
+import * as errors from '@astrale-os/kernel-protocol/errors';
 import { RequestBodyTooLargeError } from './request-body.js';
 import { ResponseBodyTooLargeError } from './response-body.js';
 /** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
@@ -39,4 +39,3 @@ function reportInternal(input) {
         code: stableCode(input),
     });
 }
-//# sourceMappingURL=classify.js.map

package/dist/errors/index.d.ts

@@ -2,4 +2,3 @@ export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availabi
 export { classifyError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.js

@@ -2,4 +2,3 @@ export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availabi
 export { classifyError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.js.map

package/dist/errors/request-body.d.ts

@@ -5,4 +5,3 @@ export declare class RequestBodyTooLargeError extends Error {
 export declare class RequestBodyInvalidError extends Error {
     constructor(message: string);
 }
-//# sourceMappingURL=request-body.d.ts.map

package/dist/errors/request-body.js

@@ -12,4 +12,3 @@ export class RequestBodyInvalidError extends Error {
         this.name = 'RequestBodyInvalidError';
     }
 }
-//# sourceMappingURL=request-body.js.map

package/dist/errors/response-body.d.ts

@@ -2,4 +2,3 @@ export declare class ResponseBodyTooLargeError extends Error {
     readonly maximumBytes: number;
     constructor(maximumBytes: number);
 }
-//# sourceMappingURL=response-body.d.ts.map

package/dist/errors/response-body.js

@@ -6,4 +6,3 @@ export class ResponseBodyTooLargeError extends Error {
         this.name = 'ResponseBodyTooLargeError';
     }
 }
-//# sourceMappingURL=response-body.js.map

package/dist/index.d.ts

@@ -3,4 +3,3 @@ export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/i
 export { preparePublicationSnapshot } from './publication/index.js';
 export * as publication from './publication/index.js';
 export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -2,4 +2,3 @@ export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
 export { preparePublicationSnapshot } from './publication/index.js';
 export * as publication from './publication/index.js';
-//# sourceMappingURL=index.js.map

package/dist/invocation/context.d.ts

@@ -1,7 +1,6 @@
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
 import type { ApplicationHost, InvocationContext } from './types.js';
 export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey): InvocationContext;
 /** Default non-durable timer used when the application host supplies no timer capability. */
 export declare function defaultSleep(durationMs: number): Promise<void>;
-//# sourceMappingURL=context.d.ts.map

package/dist/invocation/context.js

@@ -58,4 +58,3 @@ function sleepDuration(input) {
     }
     return input;
 }
-//# sourceMappingURL=context.js.map

package/dist/invocation/identity.d.ts

@@ -1,5 +1,5 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 /** Injected source-owned identity allocator captured before Server readiness. */
 export interface InvocationSource {
     readonly source: IssuerId;
@@ -7,4 +7,3 @@ export interface InvocationSource {
 }
 export type NextInvocationId = () => protocol.InvocationId;
 export declare function captureInvocationSource(input: InvocationSource): NextInvocationId;
-//# sourceMappingURL=identity.d.ts.map

package/dist/invocation/identity.js

@@ -1,5 +1,5 @@
 import { issuer } from '@astrale-os/kernel-core/auth';
-import { invocation as protocolInvocation } from '@astrale-os/kernel-protocol';
+import * as protocolInvocation from '@astrale-os/kernel-protocol/invocation';
 import { captureMethod } from '../capture.js';
 export function captureInvocationSource(input) {
     if (input === null || typeof input !== 'object') {
@@ -9,4 +9,3 @@ export function captureInvocationSource(input) {
     const next = captureMethod(input, 'next', 'Server Invocation source is invalid.');
     return () => protocolInvocation.acceptInvocationId({ source, id: next() });
 }
-//# sourceMappingURL=identity.js.map

package/dist/invocation/index.d.ts

@@ -2,4 +2,3 @@ export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, type InvocationSource, type NextInvocationId, } from './identity.js';
 export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
 export type { ApplicationHost, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, InvocationContext, RequestBackground, RequestEvidence, RequestSleep, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.js

@@ -1,4 +1,3 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, } from './identity.js';
 export { publicationRouteDecision } from './publication-route.js';
-//# sourceMappingURL=index.js.map

package/dist/invocation/publication-route.d.ts

@@ -1,12 +1,11 @@
-import type { errors, publication } from '@astrale-os/kernel-protocol';
+import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
+import type { Publication } from '@astrale-os/kernel-protocol/publication/publication';
+import type { PublicationRef } from '@astrale-os/kernel-protocol/publication/reference';
 export type PublicationRouteDecision = {
-    readonly kind: 'exact';
-} | {
-    readonly kind: 'same-schema';
+    readonly kind: 'admitted';
 } | {
     readonly kind: 'rejected';
-    readonly error: errors.ErrorPayload;
+    readonly error: ErrorPayload;
 };
 /** Compare untrusted installed routing evidence with the one captured serving Publication. */
-export declare function publicationRouteDecision(current: publication.Publication, installed: publication.PublicationRef): PublicationRouteDecision;
-//# sourceMappingURL=publication-route.d.ts.map
+export declare function publicationRouteDecision(current: Publication, installed: PublicationRef): PublicationRouteDecision;

package/dist/invocation/publication-route.js

@@ -1,23 +1,16 @@
-import { errors as protocolErrors, invocation, publication as publications, } from '@astrale-os/kernel-protocol';
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { SERVICE_TRUST_REQUIRED } from '@astrale-os/kernel-protocol/invocation/service-reason';
+import { compareReference } from '@astrale-os/kernel-protocol/publication/reference';
 /** Compare untrusted installed routing evidence with the one captured serving Publication. */
 export function publicationRouteDecision(current, installed) {
-    switch (publications.compareReference(current, installed)) {
+    switch (compareReference(current, installed)) {
         case 'exact':
-            return Object.freeze({ kind: 'exact' });
         case 'same-schema':
-            return Object.freeze({ kind: 'same-schema' });
         case 'schema-drift':
-            return rejected('Installed Domain schema requires an explicit upgrade.', Object.freeze({
-                code: invocation.SCHEMA_UPGRADE_REQUIRED,
-                details: Object.freeze({
-                    origin: installed.origin,
-                    installedRevision: installed.revision,
-                    candidateRevision: current.schema.revision,
-                }),
-            }));
+            return Object.freeze({ kind: 'admitted' });
         case 'identity-drift':
             return rejected('Installed Domain Service identity requires explicit trust.', Object.freeze({
-                code: invocation.SERVICE_TRUST_REQUIRED,
+                code: SERVICE_TRUST_REQUIRED,
                 details: Object.freeze({
                     origin: installed.origin,
                     installedIssuer: installed.identity.issuer,
@@ -28,7 +21,7 @@ export function publicationRouteDecision(current, installed) {
             return Object.freeze({
                 kind: 'rejected',
                 error: Object.freeze({
-                    code: protocolErrors.CODES.INVALID_REQUEST,
+                    code: CODES.INVALID_REQUEST,
                     message: 'Routed Publication origin differs from the served Domain.',
                 }),
             });
@@ -37,7 +30,6 @@ export function publicationRouteDecision(current, installed) {
 function rejected(message, data) {
     return Object.freeze({
         kind: 'rejected',
-        error: Object.freeze({ code: protocolErrors.CODES.CONFLICT, message, data }),
+        error: Object.freeze({ code: CODES.CONFLICT, message, data }),
     });
 }
-//# sourceMappingURL=publication-route.js.map

package/dist/invocation/types.d.ts

@@ -1,7 +1,7 @@
 import type { CredentialInput } from '@astrale-os/kernel-core/auth';
-import type { CallableResult } from '@astrale-os/kernel-core/domain';
+import type { CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 import type { PublicationSnapshot } from '../publication/index.js';
 /** Optional platform retention and timer adaptation for one Fetch invocation. */
 export interface ApplicationHost {
@@ -49,7 +49,7 @@ export interface HandlerRequest {
     readonly credential?: CredentialInput;
     /** Source-only effective delegation forwarded unchanged to Runtime. */
     readonly delegate?: protocol.Delegate;
-    /** Destination routing witness forwarded after exact or same-schema Server admission. */
+    /** Destination routing witness forwarded after same-origin, same-identity Server admission. */
     readonly via?: protocol.Via;
     /** Source-only local-target or remote-revision Schema Registration precondition. */
     readonly schema?: protocol.SchemaTarget;
@@ -60,4 +60,3 @@ export interface HandlerRequest {
 export interface Handler {
     dispatch(request: HandlerRequest): Promise<HandlerResult>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/invocation/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/issuer/exchange.d.ts

@@ -1,4 +1,4 @@
-import { issuer as protocolIssuer } from '@astrale-os/kernel-protocol';
+import * as exchangeProtocol from '@astrale-os/kernel-protocol/issuer/exchange';
 import type { CorsPolicy } from '../cors/index.js';
 import type { ActiveOperations } from '../lifecycle/index.js';
 import type { ServerRouter } from '../transport/index.js';
@@ -6,8 +6,7 @@ export interface Context {
     readonly signal: AbortSignal;
 }
 export interface Provider {
-    exchange(request: protocolIssuer.exchange.Request, context: Context): Promise<protocolIssuer.exchange.Response>;
+    exchange(request: exchangeProtocol.Request, context: Context): Promise<exchangeProtocol.Response>;
 }
 export declare function capture(input: Provider): Provider;
 export declare function mount(app: ServerRouter, issuer: string, provider: Provider, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -1,5 +1,7 @@
-import { credential } from '@astrale-os/kernel-core/auth';
-import { errors, issuer as protocolIssuer } from '@astrale-os/kernel-protocol';
+import { inspect as inspectCredential } from '@astrale-os/kernel-core/auth/credential';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as exchangeProtocol from '@astrale-os/kernel-protocol/issuer/exchange';
+import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
 const PROVIDER_CODES = new Set([
     errors.CODES.AUTH_INVALID,
     errors.CODES.AUTH_EXPIRED,
@@ -16,7 +18,7 @@ export function capture(input) {
     });
 }
 export function mount(app, issuer, provider, cors, active, timeoutMs) {
-    const path = protocolIssuer.paths(issuer).tokenExchange;
+    const path = issuerPaths(issuer).tokenExchange;
     if (cors.enabled) {
         app.options(path, (context) => cors.preflight(context.req.raw, { methods: ['POST'], headers: ['authorization', 'accept'] }));
     }
@@ -25,7 +27,7 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
         const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, extra);
         let admitted;
         try {
-            admitted = protocolIssuer.exchange.acceptHttpRequest({
+            admitted = exchangeProtocol.acceptHttpRequest({
                 method: request.method,
                 url: request.url,
                 authorization: request.headers.get('authorization'),
@@ -34,7 +36,7 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
         }
         catch (cause) {
             if (cause instanceof errors.ProtocolError) {
-                return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }), cause.payload.code === errors.CODES.METHOD_NOT_ALLOWED ? { allow: 'POST' } : undefined);
+                return respond(exchangeProtocol.acceptErrorResponse({ error: cause.payload }), cause.payload.code === errors.CODES.METHOD_NOT_ALLOWED ? { allow: 'POST' } : undefined);
             }
             throw cause;
         }
@@ -54,10 +56,15 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                     return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
                 }
                 if (cause instanceof errors.ProtocolError) {
-                    return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }));
+                    return respond(exchangeProtocol.acceptErrorResponse({ error: cause.payload }));
                 }
                 throw cause;
             }
+            if (operation.timedOut) {
+                return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+            }
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
             let output;
             try {
                 output = await provider.exchange(admitted, { signal: operation.signal });
@@ -66,16 +73,20 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                 if (operation.timedOut) {
                     return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
                 }
+                if (operation.signal.aborted)
+                    throw operation.signal.reason;
                 if (cause instanceof errors.ProtocolError && PROVIDER_CODES.has(cause.payload.code)) {
-                    return respond(protocolIssuer.exchange.acceptErrorResponse({ error: cause.payload }));
+                    return respond(exchangeProtocol.acceptErrorResponse({ error: cause.payload }));
                 }
                 throw cause;
             }
             if (operation.timedOut) {
                 return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
             }
-            const response = protocolIssuer.exchange.acceptResponse(output);
-            if (credential.inspect(response.token).claims.exp !== response.expiresAt) {
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
+            const response = exchangeProtocol.acceptResponse(output);
+            if (inspectCredential(response.token).claims.exp !== response.expiresAt) {
                 throw new TypeError('Token-exchange provider returned inconsistent expiry evidence.');
             }
             return json(response, 200, request, cors);
@@ -118,12 +129,12 @@ function invalidRequest() {
     });
 }
 function error(code, message) {
-    return protocolIssuer.exchange.acceptErrorResponse({
+    return exchangeProtocol.acceptErrorResponse({
         error: { code: errors.CODES[code], message },
     });
 }
 function json(value, status, request, cors, extra) {
-    const headers = new Headers(protocolIssuer.exchange.responseHeaders());
+    const headers = new Headers(exchangeProtocol.responseHeaders());
     for (const [name, value] of Object.entries(cors.response(request)))
         headers.set(name, value);
     if (extra !== undefined) {
@@ -132,4 +143,3 @@ function json(value, status, request, cors, extra) {
     }
     return new Response(JSON.stringify(value), { status, headers });
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/index.d.ts

@@ -1,4 +1,3 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, type IssuerRouteReservation, } from './routes.js';
 export type * as exchange from './exchange.js';
 export type { Issuer } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -1,2 +1 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, } from './routes.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/routes.d.ts

@@ -11,4 +11,3 @@ export declare function issuerRouteReservations(input: Issuer, tokenExchange?: b
 export declare function mountIssuer(app: ServerRouter, input: Issuer, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number, tokenExchange?: Provider): void;
 /** Admit static discovery configuration before Runtime Boot performs any durable work. */
 export declare function admitIssuer(input: Issuer): Issuer;
-//# sourceMappingURL=routes.d.ts.map

package/dist/issuer/routes.js

@@ -1,8 +1,11 @@
-import { issuer as issuerDiscovery } from '@astrale-os/kernel-protocol';
+import { configuration } from '@astrale-os/kernel-protocol/issuer/configuration';
+import { hosted } from '@astrale-os/kernel-protocol/issuer/hosted';
+import { keySet } from '@astrale-os/kernel-protocol/issuer/key-set';
+import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
 import { IssuerKeysUnavailableError } from '../errors/index.js';
 import { mount } from './exchange.js';
 export function issuerRouteReservations(input, tokenExchange = false) {
-    const paths = issuerDiscovery.paths(input.issuer);
+    const paths = issuerPaths(input.issuer);
     const reservations = [
         Object.freeze({ path: paths.configuration, methods: Object.freeze(['GET']) }),
         Object.freeze({ path: paths.keys, methods: Object.freeze(['GET']) }),
@@ -24,16 +27,16 @@ export function issuerRouteReservations(input, tokenExchange = false) {
 }
 export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange) {
     const issuer = input.issuer;
-    const paths = issuerDiscovery.paths(issuer);
+    const paths = issuerPaths(issuer);
     const headers = (request) => ({
         ...cors.response(request),
         'cache-control': 'no-cache',
     });
     const algorithm = input.signingAlgorithm ?? 'ES256';
-    const configuration = issuerDiscovery.configuration(issuer, [algorithm], {
+    const discovery = configuration(issuer, [algorithm], {
         tokenExchange: tokenExchange !== undefined,
     });
-    app.get(paths.configuration, (context) => context.json(configuration, 200, headers(context.req.raw)));
+    app.get(paths.configuration, (context) => context.json(discovery, 200, headers(context.req.raw)));
     if (cors.enabled) {
         app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
@@ -45,7 +48,7 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
         }
         try {
             const keys = await input.loadPublicKeys(operation.signal);
-            return context.json(issuerDiscovery.keySet(keys, [algorithm]), 200, headers(context.req.raw));
+            return context.json(keySet(keys, [algorithm]), 200, headers(context.req.raw));
         }
         catch (cause) {
             if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
@@ -68,7 +71,7 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
             app.options(`${base}/iss/:thumbprint/.well-known/jwks.json`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         }
         app.get(`${base}/iss/:thumbprint/.well-known/openid-configuration`, async (context) => {
-            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            const hostedIssuer = hosted(issuer, context.req.param('thumbprint'));
             if (hostedIssuer === undefined)
                 return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
             const operation = active.begin(timeoutMs, context.req.raw.signal);
@@ -79,7 +82,7 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
                 const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
                 if (keys.length === 0)
                     return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
-                return context.json(issuerDiscovery.configuration(hostedIssuer, [algorithm]), 200, headers(context.req.raw));
+                return context.json(configuration(hostedIssuer, [algorithm]), 200, headers(context.req.raw));
             }
             catch (cause) {
                 if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
@@ -92,7 +95,7 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
             }
         });
         app.get(`${base}/iss/:thumbprint/.well-known/jwks.json`, async (context) => {
-            const hostedIssuer = issuerDiscovery.hosted(issuer, context.req.param('thumbprint'));
+            const hostedIssuer = hosted(issuer, context.req.param('thumbprint'));
             if (hostedIssuer === undefined)
                 return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
             const operation = active.begin(timeoutMs, context.req.raw.signal);
@@ -118,12 +121,12 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
     }
 }
 async function hostedKeys(load, issuer, signal, algorithm) {
-    return issuerDiscovery.keySet(await load(issuer, signal), [algorithm]).keys;
+    return keySet(await load(issuer, signal), [algorithm]).keys;
 }
 /** Admit static discovery configuration before Runtime Boot performs any durable work. */
 export function admitIssuer(input) {
     const signingAlgorithm = input.signingAlgorithm ?? 'ES256';
-    const issuer = issuerDiscovery.configuration(input.issuer, [signingAlgorithm]).issuer;
+    const issuer = configuration(input.issuer, [signingAlgorithm]).issuer;
     if (typeof input.loadPublicKeys !== 'function') {
         throw new TypeError('Issuer public-key loader is invalid.');
     }
@@ -144,4 +147,3 @@ export function admitIssuer(input) {
             }),
     });
 }
-//# sourceMappingURL=routes.js.map

package/dist/issuer/types.d.ts

@@ -1,4 +1,5 @@
-import type { IssuerId, JsonWebKey } from '@astrale-os/kernel-core/auth';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { JsonWebKey } from '@astrale-os/kernel-core/auth/jwk';
 /** Public issuer material; Server never receives private signing material. */
 export interface Issuer {
     readonly issuer: IssuerId;
@@ -8,4 +9,3 @@ export interface Issuer {
     /** Optional hosted-key discovery for issuers below `<issuer>/iss/:thumbprint`. */
     readonly loadIssuerPublicKeys?: (issuer: IssuerId, signal: AbortSignal) => Promise<readonly JsonWebKey[]>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/issuer/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/lifecycle/active.d.ts

@@ -26,6 +26,8 @@ export declare class ActiveOperations {
     private changed;
     constructor(maximumConcurrentOperations: number);
     get isAccepting(): boolean;
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable(): boolean;
     begin(timeoutMs: number, externalSignal?: AbortSignal): ActiveOperation | undefined;
     attachSocket(socket: ActiveSocket): boolean;
     detachSocket(socket: ActiveSocket): void;
@@ -37,4 +39,3 @@ export declare class ActiveOperations {
     private closeSockets;
 }
 export {};
-//# sourceMappingURL=active.d.ts.map

package/dist/lifecycle/active.js

@@ -13,10 +13,13 @@ export class ActiveOperations {
     get isAccepting() {
         return this.accepting;
     }
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable() {
+        return this.accepting && this.operations.size < this.maximumConcurrentOperations;
+    }
     begin(timeoutMs, externalSignal) {
-        if (!this.accepting || this.operations.size >= this.maximumConcurrentOperations) {
+        if (!this.isAvailable)
             return undefined;
-        }
         const operation = new Operation(Date.now() + timeoutMs, () => {
             this.operations.delete(operation);
             this.changed?.();
@@ -197,4 +200,3 @@ async function settleCancellation(cancel, reason) {
 function abortReason(signal) {
     return signal.reason instanceof Error ? signal.reason.message : 'operation cancelled';
 }
-//# sourceMappingURL=active.js.map

package/dist/lifecycle/index.d.ts

@@ -1,2 +1 @@
 export { ActiveOperations, type ActiveOperation, type ActiveSocket } from './active.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.js

@@ -1,2 +1 @@
 export { ActiveOperations } from './active.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/delivery/handler.d.ts

@@ -7,4 +7,3 @@ export interface Limits {
 }
 /** Serve one delivery request against the exact Publication snapshot that selected its URL. */
 export declare function handleDelivery(request: Request, snapshot: PreparedPublicationSnapshot, provider: Provider | undefined, active: ActiveOperations, limits: Limits, cors: Readonly<Record<string, string>>): Promise<Response>;
-//# sourceMappingURL=handler.d.ts.map

package/dist/publication/delivery/handler.js

@@ -1,4 +1,5 @@
-import { codecs, publication as protocolPublication } from '@astrale-os/kernel-protocol';
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as protocolPublication from '@astrale-os/kernel-protocol/publication';
 import { DeliveryUnavailableError } from '../../errors/index.js';
 import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../../errors/index.js';
 import { readBoundedBody } from '../../transport/index.js';
@@ -124,4 +125,3 @@ function encodedSize(input) {
 function toBody(input) {
     return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
 }
-//# sourceMappingURL=handler.js.map

package/dist/publication/delivery/index.d.ts

@@ -1,3 +1,2 @@
 export { handleDelivery, type Limits } from './handler.js';
 export type { Context, Provider } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/publication/delivery/index.js

@@ -1,2 +1 @@
 export { handleDelivery } from './handler.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/delivery/types.d.ts

@@ -1,4 +1,4 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type * as publication from '@astrale-os/kernel-protocol/publication';
 export interface Context {
     /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
     readonly token?: publication.delivery.Token;
@@ -9,4 +9,3 @@ export interface Provider {
     /** Throw DeliveryUnavailableError only for an expected dependency outage. */
     create(request: publication.delivery.Request, context: Context): Promise<publication.delivery.Delivery>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/publication/delivery/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map