@astrale-os/kernel-protocol 0.5.0-beta.66 → 0.5.0-beta.68

package/dist/routes/routing.d.ts

@@ -1,22 +1,46 @@
 import type * as invocation from '../invocation/index.js';
-import type { Etag, PublicationRef } from '../publication/index.js';
+import type { Sha256Digest } from '../release/digest.js';
+import type { PublicationRef } from '../release/legacy/reference.js';
+import type { ReleaseRef } from '../release/reference.js';
 import type { HttpRequest } from './request.js';
 export interface StaleControl {
     readonly kind: 'stale';
-    readonly current: Etag;
+    /** Current Publication ETag; release-backed destinations report their frozen v3 projection's ETag. */
+    readonly current: Sha256Digest;
 }
 export interface MissControl {
     readonly kind: 'miss';
 }
-export declare const HTTP_ROUTE_PUBLICATION: 'if-match';
+/** The references one release-backed destination answers native routes for. */
+export interface ServedReferences {
+    readonly release: ReleaseRef;
+    /**
+     * Reference of the frozen v3 projection the destination serves at `domain.json`, which a
+     * legacy native-route If-Match names by its Publication ETag.
+     *
+     * @deprecated Successor: the release digest in If-Match, emitted by the breaking release (AM-1).
+     */
+    readonly projection: PublicationRef;
+}
+/** If-Match carries the routed digest of a native route request (`invocation.routedDigest`). */
+export declare const HTTP_ROUTE_DIGEST: 'if-match';
 export declare const HTTP_ROUTE_ISSUER: 'x-astrale-issuer';
 export declare const HTTP_ROUTE_STALE: 'x-astrale-route-stale';
 export declare const HTTP_ROUTE_STALE_STATUS: 412;
 export declare const HTTP_ROUTE_MISS: 'x-astrale-route-miss';
 export declare const HTTP_ROUTE_MISS_STATUS: 421;
-export declare function decodeRouting(input: Pick<HttpRequest, 'headers'>, publication: PublicationRef): invocation.Via | undefined;
-export declare function staleHeaders(current: Etag): Readonly<Record<string, string>>;
+/**
+ * Decode the native routing pair of one request against the references a release-backed
+ * destination serves: an If-Match naming its release digest is a `Via`, one naming its projection
+ * ETag a legacy `PublicationVia`. An If-Match naming any other strong digest is stale whether or
+ * not the issuer header is present, as a Server answers before decoding; otherwise both headers
+ * are required. Stale reports the projection ETag as current, the legacy meaning every
+ * native-route value keeps until the breaking release (AM-1).
+ */
+export declare function decodeRouting(input: Pick<HttpRequest, 'headers'>, served: ServedReferences): invocation.Via | invocation.PublicationVia | StaleControl | undefined;
+/** Emit the reserved stale header naming `current` (see `StaleControl.current`). */
+export declare function staleHeaders(current: Sha256Digest): Readonly<Record<string, string>>;
 export declare function decodeStale(status: number, headers: HttpRequest['headers']): StaleControl | undefined;
 export declare function missHeaders(): Readonly<Record<string, string>>;
 export declare function decodeMiss(status: number, headers: HttpRequest['headers']): MissControl | undefined;
-export declare function encodeStrongEtag(input: Etag): string;
+export declare function encodeStrongEtag(input: Sha256Digest): string;

package/dist/routes/routing.js

@@ -1,36 +1,41 @@
-import * as auth from '@astrale-os/kernel-core/auth';
 import { fail } from './error.js';
-export const HTTP_ROUTE_PUBLICATION = 'if-match';
+import { acceptIssuerHeader, reservedHeader, strongDigest } from './header.js';
+/** If-Match carries the routed digest of a native route request (`invocation.routedDigest`). */
+export const HTTP_ROUTE_DIGEST = 'if-match';
 export const HTTP_ROUTE_ISSUER = 'x-astrale-issuer';
 export const HTTP_ROUTE_STALE = 'x-astrale-route-stale';
 export const HTTP_ROUTE_STALE_STATUS = 412;
 export const HTTP_ROUTE_MISS = 'x-astrale-route-miss';
 export const HTTP_ROUTE_MISS_STATUS = 421;
-const STRONG_ETAG = /^"(sha256:[0-9a-f]{64})"$/u;
-export function decodeRouting(input, publication) {
-    const encodedEtag = routingHeader(input.headers, HTTP_ROUTE_PUBLICATION);
-    const encodedIssuer = routingHeader(input.headers, HTTP_ROUTE_ISSUER);
-    if (encodedEtag === undefined && encodedIssuer === undefined)
+/**
+ * Decode the native routing pair of one request against the references a release-backed
+ * destination serves: an If-Match naming its release digest is a `Via`, one naming its projection
+ * ETag a legacy `PublicationVia`. An If-Match naming any other strong digest is stale whether or
+ * not the issuer header is present, as a Server answers before decoding; otherwise both headers
+ * are required. Stale reports the projection ETag as current, the legacy meaning every
+ * native-route value keeps until the breaking release (AM-1).
+ */
+export function decodeRouting(input, served) {
+    const encodedDigest = reservedHeader(input.headers, HTTP_ROUTE_DIGEST);
+    const encodedIssuer = reservedHeader(input.headers, HTTP_ROUTE_ISSUER);
+    if (encodedDigest === undefined && encodedIssuer === undefined)
         return undefined;
-    if (encodedEtag === undefined || encodedIssuer === undefined) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_PUBLICATION} and ${HTTP_ROUTE_ISSUER} must occur together.`);
+    const named = encodedDigest === undefined ? undefined : strongDigest(encodedDigest);
+    if (named !== undefined && named !== served.release.digest && named !== served.projection.etag) {
+        return Object.freeze({ kind: 'stale', current: served.projection.etag });
     }
-    const etag = decodeStrongEtag(encodedEtag, 'If-Match');
-    if (etag !== publication.etag) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match does not name the compiled Publication.');
+    if (encodedDigest === undefined || encodedIssuer === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_DIGEST} and ${HTTP_ROUTE_ISSUER} must occur together.`);
     }
-    let issuer;
-    try {
-        issuer = auth.issuer.accept(encodedIssuer);
+    if (named === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match must contain exactly one strong quoted digest.');
     }
-    catch (cause) {
-        if (cause instanceof auth.AuthValueError) {
-            return fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_ISSUER} is invalid.`, cause);
-        }
-        throw cause;
-    }
-    return Object.freeze({ kind: 'via', publication, issuer });
+    const issuer = acceptIssuerHeader(encodedIssuer, HTTP_ROUTE_ISSUER);
+    return named === served.release.digest
+        ? Object.freeze({ kind: 'via', release: served.release, issuer })
+        : Object.freeze({ kind: 'via', publication: served.projection, issuer });
 }
+/** Emit the reserved stale header naming `current` (see `StaleControl.current`). */
 export function staleHeaders(current) {
     return Object.freeze({
         [HTTP_ROUTE_STALE]: encodeStrongEtag(current),
@@ -38,22 +43,23 @@ export function staleHeaders(current) {
     });
 }
 export function decodeStale(status, headers) {
-    const encoded = routingHeader(headers, HTTP_ROUTE_STALE);
+    const encoded = reservedHeader(headers, HTTP_ROUTE_STALE);
     if (encoded === undefined)
         return undefined;
     if (status !== HTTP_ROUTE_STALE_STATUS) {
         fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${HTTP_ROUTE_STALE} is reserved for status ${HTTP_ROUTE_STALE_STATUS}.`);
     }
-    return Object.freeze({
-        kind: 'stale',
-        current: decodeStrongEtag(encoded, HTTP_ROUTE_STALE),
-    });
+    const current = strongDigest(encoded);
+    if (current === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_STALE} must contain exactly one strong quoted digest.`);
+    }
+    return Object.freeze({ kind: 'stale', current });
 }
 export function missHeaders() {
     return Object.freeze({ [HTTP_ROUTE_MISS]: '1', 'cache-control': 'no-store' });
 }
 export function decodeMiss(status, headers) {
-    const encoded = routingHeader(headers, HTTP_ROUTE_MISS);
+    const encoded = reservedHeader(headers, HTTP_ROUTE_MISS);
     if (encoded === undefined)
         return undefined;
     if (status !== HTTP_ROUTE_MISS_STATUS || encoded !== '1') {
@@ -64,24 +70,3 @@ export function decodeMiss(status, headers) {
 export function encodeStrongEtag(input) {
     return `"${input}"`;
 }
-function decodeStrongEtag(input, label) {
-    const matched = STRONG_ETAG.exec(input);
-    if (matched === null) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', `${label} must contain exactly one strong quoted Publication ETag.`);
-    }
-    return matched[1];
-}
-function routingHeader(input, name) {
-    if (input instanceof Headers)
-        return input.get(name) ?? undefined;
-    let found;
-    for (const [candidate, value] of Object.entries(input ?? {})) {
-        if (candidate.toLowerCase() !== name || value === undefined)
-            continue;
-        if (found !== undefined || (Array.isArray(value) && value.length !== 1)) {
-            fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${name} must occur at most once.`);
-        }
-        found = typeof value === 'string' ? value : value[0];
-    }
-    return found;
-}

package/dist/routes/select.d.ts

@@ -1,3 +1,3 @@
 import type { Key } from '@astrale-os/kernel-dsl/v1';
 import type { Route, Table } from './table.js';
-export declare function select(table: Table, callable: Key.Callable, route?: string): Route | undefined;
+export declare function select(table: Pick<Table, 'entries'>, callable: Key.Callable, route?: string): Route | undefined;

package/dist/routes/table.d.ts

@@ -1,9 +1,10 @@
-import type { PublicationRef } from '../publication/index.js';
+import type { ReleaseRef } from '../release/reference.js';
 import type { PlanEntry } from './plan.js';
 export interface Route extends Omit<PlanEntry, 'path'> {
     readonly href: string;
 }
+/** Serving proof tied to one exact release and its resolved Domain. */
 export interface Table {
-    readonly publication: PublicationRef;
+    readonly release: ReleaseRef;
     readonly entries: readonly Route[];
 }

package/dist/routes/target.d.ts

@@ -1,3 +1,6 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { MeaningFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
 export type RouteTarget = {
     readonly kind: 'function';
 } | {
@@ -11,3 +14,5 @@ export type RouteTarget = {
 export declare function requiresReceiver(entry: {
     readonly target: RouteTarget;
 }): boolean;
+/** Fingerprint of the route Domain's callable meaning, which every native route Target pins. */
+export declare function routeFingerprint(domain: Pick<Domain, 'callable'>, callable: Key.Callable): MeaningFingerprint;

package/dist/routes/target.js

@@ -1,3 +1,19 @@
+import { callableFingerprint } from '@astrale-os/kernel-dsl/v1/schema/fingerprint';
+import { fail } from './error.js';
 export function requiresReceiver(entry) {
     return entry.target.kind === 'method' && entry.target.dispatch === 'instance';
 }
+const FINGERPRINTS = new WeakMap();
+/** Fingerprint of the route Domain's callable meaning, which every native route Target pins. */
+export function routeFingerprint(domain, callable) {
+    const meaning = domain.callable(callable);
+    if (meaning === undefined) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', `Route callable ${callable} is absent from its Domain.`);
+    }
+    let fingerprint = FINGERPRINTS.get(meaning);
+    if (fingerprint === undefined) {
+        fingerprint = callableFingerprint(meaning);
+        FINGERPRINTS.set(meaning, fingerprint);
+    }
+    return fingerprint;
+}

package/dist/runtime/artifact.d.ts

@@ -1,7 +1,7 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { Key, Revision } from '@astrale-os/kernel-dsl/v1';
 import type { Digest, Ref } from '../artifact/index.js';
-import type { PublicationRequirements } from '../publication/index.js';
+import type { Requirements } from '../release/requirements.js';
 export interface ExecutableDependency {
     readonly path: string;
     readonly ref: Ref;
@@ -34,7 +34,7 @@ export interface RuntimeArtifact {
     readonly version: 2 | 3;
     readonly issuer: IssuerId;
     readonly bundle: Ref;
-    readonly requirements: PublicationRequirements;
+    readonly requirements: Requirements;
     readonly modules: readonly [Module, ...Module[]];
 }
 export declare const MEDIA_TYPE: 'application/vnd.astrale.domain-runtime+json;v=3';

package/dist/runtime/artifact.js

@@ -3,8 +3,8 @@ import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as portable from '@astrale-os/kernel-dsl/value';
 import { sha256 } from '@noble/hashes/sha2.js';
 import * as artifact from '../artifact/index.js';
-import { admitRequirements } from '../publication/index.js';
-import { decodeLegacyRequirements, encodeLegacyRequirements, } from '../publication/legacy-requirements.js';
+import { decodeLegacyRequirements, encodeLegacyRequirements } from '../release/legacy/profiles.js';
+import { admitRequirements } from '../release/legacy/requirements.js';
 export const MEDIA_TYPE = 'application/vnd.astrale.domain-runtime+json;v=3';
 export const LEGACY_MEDIA_TYPE = 'application/vnd.astrale.domain-runtime+json;v=2';
 export function mediaType(input) {

package/dist/schema/installation/codec.d.ts

@@ -1,4 +1,9 @@
 import type { InstallResult } from './result.js';
-export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-installation.v1+msgpack';
+export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-installation.v2+json';
 export declare function encode(result: InstallResult): Promise<Uint8Array>;
 export declare function decode(bytes: Uint8Array, maximumBytes: number): Promise<InstallResult>;
+/**
+ * Package-private: admit one decoded installation result. Shared with the pre-R1 representation in
+ * `./legacy/`, which decodes other bytes into this same wire value.
+ */
+export declare function accept(input: unknown): InstallResult;

package/dist/schema/installation/codec.js

@@ -1,10 +1,10 @@
 import { installReceipt } from '@astrale-os/kernel-core/schema/kernel/syscalls/contracts';
+import { json } from '@astrale-os/kernel-dsl/value';
 import { acceptDomainInfo } from './introspection/index.js';
-export const MEDIA_TYPE = 'application/vnd.astrale.schema-installation.v1+msgpack';
+export const MEDIA_TYPE = 'application/vnd.astrale.schema-installation.v2+json';
+const encoder = new TextEncoder();
 export async function encode(result) {
-    // Non-literal specifiers keep msgpackr's Node-typed declarations out of consumers (see codecs/msgpack.ts).
-    const { pack } = await import('msgpackr/pack');
-    return new Uint8Array(pack(accept(result)));
+    return encoder.encode(json.serialize(accept(result)));
 }
 export async function decode(bytes, maximumBytes) {
     if (!(bytes instanceof Uint8Array) ||
@@ -13,17 +13,20 @@ export async function decode(bytes, maximumBytes) {
         bytes.byteLength > maximumBytes) {
         throw new TypeError('Schema installation evidence is invalid or exceeds its bound.');
     }
-    const { unpack } = await import('msgpackr');
     let value;
     try {
-        value = unpack(bytes);
+        value = json.decode(bytes, { limits: { maxBytes: maximumBytes } });
     }
     catch (cause) {
         throw new TypeError('Schema installation evidence is malformed.', { cause });
     }
     return accept(value);
 }
-function accept(input) {
+/**
+ * Package-private: admit one decoded installation result. Shared with the pre-R1 representation in
+ * `./legacy/`, which decodes other bytes into this same wire value.
+ */
+export function accept(input) {
     const value = record(input);
     if (value.changed === true) {
         exact(value, ['changed', 'receipt']);

package/dist/schema/installation/introspection/codec.d.ts

@@ -1,8 +1,17 @@
 import type { introspection } from '@astrale-os/kernel-core/schema';
-import type { DomainDependencies, DomainInfo, Limits, ResultFor } from './result.js';
-export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-introspection.v2+msgpack';
+import type { DomainBundle, DomainDependencies, DomainInfo, Limits, ResultFor } from './result.js';
+export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-introspection.v3+json';
 export declare function encode<Input extends introspection.Introspection>(input: Input, result: ResultFor<Input>): Promise<Uint8Array>;
 export declare function decode<Input extends introspection.Introspection>(input: Input, bytes: Uint8Array, limits: Limits): Promise<ResultFor<Input>>;
+/**
+ * Package-private: admit one decoded evidence value for an admitted request. Shared with the
+ * pre-R1 representation in `../legacy/`, which decodes other bytes into this same wire value.
+ */
+export declare function acceptEvidence(request: introspection.Introspection, decoded: unknown, limits: Limits): DomainInfo | DomainBundle | DomainDependencies;
+/** Package-private: admit the evidence bounds a request declares. Shared with `../legacy/`. */
+export declare function admitLimits(request: introspection.Introspection, limits: Limits): void;
 /** Admit dependency bindings: origin-ordered, one per origin, each label agreeing with its revisions. */
 export declare function acceptDomainDependencies(input: unknown): DomainDependencies;
 export declare function acceptDomainInfo(input: unknown): DomainInfo;
+/** Package-private: admit one introspection request. Shared with `../legacy/`. */
+export declare function admitRequest(input: introspection.Introspection): introspection.Introspection;

package/dist/schema/installation/introspection/codec.js

@@ -1,12 +1,22 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
 import { revision as schemaRevision } from '@astrale-os/kernel-dsl/v1/schema/revision';
-import { admitCallableBinding, admitViewBinding } from '../../../publication/bindings/index.js';
-import * as publication from '../../../publication/index.js';
-export const MEDIA_TYPE = 'application/vnd.astrale.schema-introspection.v2+msgpack';
-const encodedBundles = new WeakMap();
+import { json } from '@astrale-os/kernel-dsl/value';
+import { admitCallableBinding, admitViewBinding } from '../../../release/bindings/index.js';
+import { withPublicationError } from '../../../release/legacy/error.js';
+import * as publication from '../../../release/legacy/index.js';
+export const MEDIA_TYPE = 'application/vnd.astrale.schema-introspection.v3+json';
+const encoder = new TextEncoder();
+const serializedBundles = new WeakMap();
 const admittedBundles = new Map();
 const MAXIMUM_ADMITTED_BUNDLES = 128;
+// The Bundle travels as its JSON text inside the evidence; string escaping at most doubles it.
+const BUNDLE_ESCAPE_FACTOR = 2;
+// Encoding is bounded by the Server response policy, not by the default portable-value limits.
+const ENCODE_LIMITS = Object.freeze({
+    maxBytes: Number.MAX_SAFE_INTEGER,
+    maxStringBytes: Number.MAX_SAFE_INTEGER,
+});
 export async function encode(input, result) {
     const request = admitRequest(input);
     const wire = request.kind === 'bundle'
@@ -15,39 +25,52 @@ export async function encode(input, result) {
             ? encodeDomainDependencies(result)
             : encodeDomainInfo(result);
     proveRequestedOrigin(request, result);
-    // Non-literal specifiers keep msgpackr's Node-typed declarations out of consumers (see codecs/msgpack.ts).
-    const { pack } = await import('msgpackr/pack');
-    return new Uint8Array(pack(wire));
+    return encoder.encode(json.serialize(wire, { limits: ENCODE_LIMITS }));
 }
 export async function decode(input, bytes, limits) {
     const request = admitRequest(input);
     if (!(bytes instanceof Uint8Array))
         invalid('Schema introspection evidence must be binary.');
-    admitLimit(limits.maximumPublicationBytes, 'Publication');
-    if (request.kind === 'bundle')
-        admitLimit(limits.maximumBundleBytes, 'Bundle');
+    admitLimits(request, limits);
     const maximumEvidenceBytes = limits.maximumPublicationBytes +
-        (request.kind === 'bundle' ? limits.maximumBundleBytes : 0) +
+        (request.kind === 'bundle' ? BUNDLE_ESCAPE_FACTOR * limits.maximumBundleBytes : 0) +
         4_096;
     if (bytes.byteLength > maximumEvidenceBytes) {
         invalid('Schema introspection evidence exceeds its declared bounds.');
     }
-    const { unpack } = await import('msgpackr');
     let decoded;
     try {
-        decoded = unpack(bytes);
+        decoded = json.decode(bytes, {
+            limits: {
+                maxBytes: maximumEvidenceBytes,
+                ...(request.kind === 'bundle' ? { maxStringBytes: limits.maximumBundleBytes } : {}),
+            },
+        });
     }
     catch (cause) {
         throw new TypeError('Schema introspection evidence is malformed.', { cause });
     }
-    const result = (request.kind === 'bundle'
+    return acceptEvidence(request, decoded, limits);
+}
+/**
+ * Package-private: admit one decoded evidence value for an admitted request. Shared with the
+ * pre-R1 representation in `../legacy/`, which decodes other bytes into this same wire value.
+ */
+export function acceptEvidence(request, decoded, limits) {
+    const result = request.kind === 'bundle'
         ? decodeDomainBundle(decoded, limits.maximumBundleBytes)
         : request.kind === 'dependencies'
             ? acceptDomainDependencies(decoded)
-            : acceptDomainInfo(decoded));
+            : acceptDomainInfo(decoded);
     proveRequestedOrigin(request, result);
     return result;
 }
+/** Package-private: admit the evidence bounds a request declares. Shared with `../legacy/`. */
+export function admitLimits(request, limits) {
+    admitLimit(limits.maximumPublicationBytes, 'Publication');
+    if (request.kind === 'bundle')
+        admitLimit(limits.maximumBundleBytes, 'Bundle');
+}
 function proveRequestedOrigin(request, result) {
     const origin = request.kind === 'inspect'
         ? result.origin
@@ -107,44 +130,35 @@ function encodeDomainBundle(input) {
     const admittedDomain = acceptDomainInfo(input.domain);
     const domain = encodeDomainInfo(admittedDomain);
     proveBundle(input.bundle, admittedDomain);
-    const encoded = encodedBundles.get(input.bundle) ?? bundle.encode(input.bundle);
-    if (!encodedBundles.has(input.bundle))
-        encodedBundles.set(input.bundle, encoded);
-    return Object.freeze({ domain, bundle: encoded });
+    const text = serializedBundles.get(input.bundle) ?? bundle.serialize(input.bundle);
+    if (!serializedBundles.has(input.bundle))
+        serializedBundles.set(input.bundle, text);
+    return Object.freeze({ domain, bundle: text });
 }
 function decodeDomainBundle(input, maximum) {
     const value = record(input, 'Domain Bundle result');
     exact(value, ['bundle', 'domain'], 'Domain Bundle result');
     const domain = acceptDomainInfo(value.domain);
-    const encoded = boundedBytes(value.bundle, maximum, 'Bundle');
+    const text = boundedText(value.bundle, maximum, 'Bundle');
     const cached = admittedBundles.get(domain.generation);
-    if (cached !== undefined && sameBytes(cached.bytes, encoded)) {
+    if (cached !== undefined && cached.text === text) {
         return Object.freeze({ domain, bundle: cached.bundle });
     }
     let admitted;
     try {
-        admitted = bundle.decode(encoded);
+        admitted = bundle.decode(text);
     }
     catch (cause) {
         throw new TypeError('Installed Domain Bundle is invalid.', { cause });
     }
     proveBundle(admitted, domain);
     admittedBundles.delete(domain.generation);
-    admittedBundles.set(domain.generation, Object.freeze({ bytes: encoded, bundle: admitted }));
+    admittedBundles.set(domain.generation, Object.freeze({ text, bundle: admitted }));
     if (admittedBundles.size > MAXIMUM_ADMITTED_BUNDLES) {
         admittedBundles.delete(admittedBundles.keys().next().value);
     }
     return Object.freeze({ domain, bundle: admitted });
 }
-function sameBytes(left, right) {
-    if (left.byteLength !== right.byteLength)
-        return false;
-    for (let index = 0; index < left.byteLength; index += 1) {
-        if (left[index] !== right[index])
-            return false;
-    }
-    return true;
-}
 function encodeDomainInfo(input) {
     return acceptDomainInfo(input);
 }
@@ -188,14 +202,15 @@ function publicationReference(input, origin, revision) {
 function bindings(input, origin) {
     const value = record(input, 'Domain bindings');
     exact(value, ['callables', 'views'], 'Domain bindings');
-    if (!Array.isArray(value.callables) || !Array.isArray(value.views)) {
+    const { callables, views } = value;
+    if (!Array.isArray(callables) || !Array.isArray(views)) {
         invalid('Domain bindings are invalid.');
     }
     try {
-        return Object.freeze({
-            callables: Object.freeze(value.callables.map((entry) => admitCallableBinding(entry, origin))),
-            views: Object.freeze(value.views.map((entry) => admitViewBinding(entry, origin))),
-        });
+        return withPublicationError(() => Object.freeze({
+            callables: Object.freeze(callables.map((entry) => admitCallableBinding(entry, origin))),
+            views: Object.freeze(views.map((entry) => admitViewBinding(entry, origin))),
+        }));
     }
     catch (cause) {
         throw new TypeError('Domain bindings are invalid.', { cause });
@@ -220,7 +235,8 @@ function capabilities(input) {
         throw new TypeError('Domain capabilities are invalid.', { cause });
     }
 }
-function admitRequest(input) {
+/** Package-private: admit one introspection request. Shared with `../legacy/`. */
+export function admitRequest(input) {
     const value = record(input, 'Schema introspection request');
     exact(value, ['kind', 'origin'], 'Schema introspection request');
     if (value.kind !== 'inspect' && value.kind !== 'bundle' && value.kind !== 'dependencies') {
@@ -237,11 +253,13 @@ function digest(input, label) {
     }
     return input;
 }
-function boundedBytes(input, maximum, label) {
-    if (!(input instanceof Uint8Array) || input.byteLength === 0 || input.byteLength > maximum) {
+function boundedText(input, maximum, label) {
+    if (typeof input !== 'string' ||
+        input.length === 0 ||
+        encoder.encode(input).byteLength > maximum) {
         invalid(`${label} evidence is invalid or exceeds its bound.`);
     }
-    return Uint8Array.from(input);
+    return input;
 }
 function admitLimit(input, label) {
     if (!Number.isSafeInteger(input) || input < 1)

package/dist/schema/installation/introspection/result.d.ts

@@ -1,12 +1,19 @@
 import type { introspection } from '@astrale-os/kernel-core/schema';
 import type { bundle, Key, Revision } from '@astrale-os/kernel-dsl/v1';
-import type { Publication, PublicationRef, PublicationRequirements } from '../../../publication/index.js';
+import type { Publication, PublicationRef, PublicationRequirements } from '../../../release/legacy/index.js';
 export type Digest = `sha256:${string}`;
 /** Lightweight proof of one exact ready installed Domain generation. */
 export interface DomainInfo {
     readonly origin: Key.Origin;
     readonly revision: Revision;
     readonly generation: Digest;
+    /**
+     * Installed Publication reference: the pinned document's own for a legacy pin, the reference of
+     * the frozen v3 projection for a v4 pin.
+     *
+     * @deprecated Successor: `DomainInfo.release`, the installed `ReleaseRef`, emitted by the
+     * breaking release (AM-1).
+     */
     readonly publication: PublicationRef | null;
     readonly readiness: Digest;
     readonly capabilities: {

package/dist/schema/installation/legacy/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Read-only decoders for the schema evidence of Hosts older than beta.127: MessagePack
+ * installation v1 (`application/vnd.astrale.schema-installation.v1+msgpack`) and introspection v2
+ * (`application/vnd.astrale.schema-introspection.v2+msgpack`). Each decodes its bytes into the same
+ * wire value as the canonical JSON evidence and admits it with the canonical checks, so it returns
+ * exactly the canonical `InstallResult` and introspection results. Nothing here encodes: Servers
+ * emit only the canonical JSON evidence.
+ *
+ * @deprecated Use `installation.decode` / `installation.introspection.decode` with their
+ * `MEDIA_TYPE`, the JSON evidence every Host from beta.127 serves.
+ *
+ * Short-term consumers, all through `@astrale-os/kernel-client` `SchemaApi`, which selects these
+ * decoders by the received media type:
+ * - Admin managing the 1Pact Host (Kernel beta.117) and the astrale Hosts on beta.121 and beta.126
+ *   (`schema.inspect` before every Manager call, child `install`/`inspect`, `bundle` reads);
+ * - the CLI used by 1Pact developers, and `adapter-astrale` 0.5.0-beta.148, which runs
+ *   `astrale introspect` before every 1Pact deploy (`introspect`, `view`,
+ *   `domain install --direct`, cold-cache `call`);
+ * - the Console back-office (`schema.bundle` of every installed Domain);
+ * - SDK Project tooling (`pnpm dev`, the Environment installation reconcile), which runs
+ *   `astrale introspect` and `astrale domain install --direct` through that same CLI against our
+ *   beta.121 and beta.126 Hosts.
+ *
+ * Removal, in a separate breaking release: once no supported Host is older than beta.127 (the
+ * 1Pact Host upgraded; astrale-01, shared-01 and admin-users replaced or upgraded). Then delete, in
+ * the same PR:
+ * - this folder with its tests, golden evidence and laws, its `legacy/` entry in
+ *   `../.spec/layout.ts`, and the `./schema/installation/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json` with the `schema/installation/legacy/**` include of
+ *   `protocol/tsconfig.json`;
+ * - the legacy media-type branches of `client/schema/schema.ts` and
+ *   `client/schema/introspection.ts`, and `client/schema/__tests__/legacy-evidence.test.ts`;
+ * - the legacy paragraphs of `client/schema/.spec/architecture.md` and
+ *   `../.spec/architecture.md`;
+ * - the package-private exports of `../codec.ts` (`accept`) and `../introspection/codec.ts`
+ *   (`acceptEvidence`, `admitLimits`, `admitRequest`), which return to module scope.
+ */
+export { MEDIA_TYPE, decode } from './installation.js';
+export * as introspection from './introspection.js';

package/dist/schema/installation/legacy/index.js

@@ -0,0 +1,39 @@
+/**
+ * Read-only decoders for the schema evidence of Hosts older than beta.127: MessagePack
+ * installation v1 (`application/vnd.astrale.schema-installation.v1+msgpack`) and introspection v2
+ * (`application/vnd.astrale.schema-introspection.v2+msgpack`). Each decodes its bytes into the same
+ * wire value as the canonical JSON evidence and admits it with the canonical checks, so it returns
+ * exactly the canonical `InstallResult` and introspection results. Nothing here encodes: Servers
+ * emit only the canonical JSON evidence.
+ *
+ * @deprecated Use `installation.decode` / `installation.introspection.decode` with their
+ * `MEDIA_TYPE`, the JSON evidence every Host from beta.127 serves.
+ *
+ * Short-term consumers, all through `@astrale-os/kernel-client` `SchemaApi`, which selects these
+ * decoders by the received media type:
+ * - Admin managing the 1Pact Host (Kernel beta.117) and the astrale Hosts on beta.121 and beta.126
+ *   (`schema.inspect` before every Manager call, child `install`/`inspect`, `bundle` reads);
+ * - the CLI used by 1Pact developers, and `adapter-astrale` 0.5.0-beta.148, which runs
+ *   `astrale introspect` before every 1Pact deploy (`introspect`, `view`,
+ *   `domain install --direct`, cold-cache `call`);
+ * - the Console back-office (`schema.bundle` of every installed Domain);
+ * - SDK Project tooling (`pnpm dev`, the Environment installation reconcile), which runs
+ *   `astrale introspect` and `astrale domain install --direct` through that same CLI against our
+ *   beta.121 and beta.126 Hosts.
+ *
+ * Removal, in a separate breaking release: once no supported Host is older than beta.127 (the
+ * 1Pact Host upgraded; astrale-01, shared-01 and admin-users replaced or upgraded). Then delete, in
+ * the same PR:
+ * - this folder with its tests, golden evidence and laws, its `legacy/` entry in
+ *   `../.spec/layout.ts`, and the `./schema/installation/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json` with the `schema/installation/legacy/**` include of
+ *   `protocol/tsconfig.json`;
+ * - the legacy media-type branches of `client/schema/schema.ts` and
+ *   `client/schema/introspection.ts`, and `client/schema/__tests__/legacy-evidence.test.ts`;
+ * - the legacy paragraphs of `client/schema/.spec/architecture.md` and
+ *   `../.spec/architecture.md`;
+ * - the package-private exports of `../codec.ts` (`accept`) and `../introspection/codec.ts`
+ *   (`acceptEvidence`, `admitLimits`, `admitRequest`), which return to module scope.
+ */
+export { MEDIA_TYPE, decode } from './installation.js';
+export * as introspection from './introspection.js';

package/dist/schema/installation/legacy/installation.d.ts

@@ -0,0 +1,9 @@
+import type { InstallResult } from '../result.js';
+/** @deprecated Read-only: Hosts older than beta.127 serve this; current Hosts serve `installation.MEDIA_TYPE`. */
+export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-installation.v1+msgpack';
+/**
+ * Decode version-one (MessagePack) installation evidence into the canonical result.
+ *
+ * @deprecated Read-only; use `installation.decode` with `installation.MEDIA_TYPE`.
+ */
+export declare function decode(bytes: Uint8Array, maximumBytes: number): Promise<InstallResult>;