/**
 * Canonicalize a worker's serving URL into its `iss` identity.
 *
 * Returns the full URL with trailing slash(es) stripped — the base path is
 * preserved (an issuer may carry a non-empty path, like `…/kernel/host`). This
 * is the single canonical form used for outbound signing, the JWKS issuer,
 * `/meta`, the install credential, and any `Identity.iss` a domain seeds, so the
 * value a worker SIGNS always matches the value the kernel LOOKS UP (the kernel
 * canonicalizes the verified `iss` the same way and does an exact-match lookup).
 *
 * Throws if `url` is not a parseable absolute URL.
 */
// INVARIANT (cross-repo): issuer PRODUCERS must strip trailing path slashes
// BEFORE a value becomes an iss. kernel-core's `normalizeIssuerId` only strips
// a lone trailing slash on an EMPTY path, so `https://x/base/` and
// `https://x/base` are distinct issuer identities to the kernel — this
// function and the kernel's `installSourceBase` both pre-strip with the same
// rule so the two sides can never mint diverging identities for one worker.
export function canonicalizeServingUrl(url: string): string {
  try {
    return new URL(url).href.replace(/\/+$/, '')
  } catch {
    throw new Error(
      `canonicalizeServingUrl: expected a full URL (got "${url}") — ` +
        'it is the worker serving URL and its JWT issuer identity.',
    )
  }
}