@astrale-os/kernel-protocol 0.5.0-beta.67 → 0.5.0-beta.69

package/dist/schema/installation/introspection/codec.js

@@ -1,53 +1,83 @@
+import { is as isIssuer } from '@astrale-os/kernel-core/auth/issuer';
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
 import { revision as schemaRevision } from '@astrale-os/kernel-dsl/v1/schema/revision';
-import { admitCallableBinding, admitViewBinding } from '../../../publication/bindings/index.js';
-import * as publication from '../../../publication/index.js';
-export const MEDIA_TYPE = 'application/vnd.astrale.schema-introspection.v2+msgpack';
-const encodedBundles = new WeakMap();
+import { json } from '@astrale-os/kernel-dsl/value';
+import { admitCallableBinding, admitViewBinding } from '../../../release/bindings/index.js';
+import { withPublicationError } from '../../../release/legacy/error.js';
+import * as publication from '../../../release/legacy/index.js';
+export const MEDIA_TYPE = 'application/vnd.astrale.schema-introspection.v3+json';
+const encoder = new TextEncoder();
+const serializedBundles = new WeakMap();
 const admittedBundles = new Map();
 const MAXIMUM_ADMITTED_BUNDLES = 128;
+// The Bundle travels as its JSON text inside the evidence; string escaping at most doubles it.
+const BUNDLE_ESCAPE_FACTOR = 2;
+// Encoding is bounded by the Server response policy, not by the default portable-value limits.
+const ENCODE_LIMITS = Object.freeze({
+    maxBytes: Number.MAX_SAFE_INTEGER,
+    maxStringBytes: Number.MAX_SAFE_INTEGER,
+});
 export async function encode(input, result) {
     const request = admitRequest(input);
-    const wire = request.kind === 'bundle'
-        ? encodeDomainBundle(result)
-        : request.kind === 'dependencies'
-            ? encodeDomainDependencies(result)
-            : encodeDomainInfo(result);
-    proveRequestedOrigin(request, result);
-    // Non-literal specifiers keep msgpackr's Node-typed declarations out of consumers (see codecs/msgpack.ts).
-    const { pack } = await import('msgpackr/pack');
-    return new Uint8Array(pack(wire));
+    const wire = request.kind === 'installed'
+        ? acceptInstalledReleases(result)
+        : request.kind === 'bundle'
+            ? encodeDomainBundle(result)
+            : request.kind === 'dependencies'
+                ? encodeDomainDependencies(result)
+                : encodeDomainInfo(result);
+    if (request.kind !== 'installed') {
+        proveRequestedOrigin(request, result);
+    }
+    return encoder.encode(json.serialize(wire, { limits: ENCODE_LIMITS }));
 }
 export async function decode(input, bytes, limits) {
     const request = admitRequest(input);
     if (!(bytes instanceof Uint8Array))
         invalid('Schema introspection evidence must be binary.');
-    admitLimit(limits.maximumPublicationBytes, 'Publication');
-    if (request.kind === 'bundle')
-        admitLimit(limits.maximumBundleBytes, 'Bundle');
+    admitLimits(request, limits);
     const maximumEvidenceBytes = limits.maximumPublicationBytes +
-        (request.kind === 'bundle' ? limits.maximumBundleBytes : 0) +
+        (request.kind === 'bundle' ? BUNDLE_ESCAPE_FACTOR * limits.maximumBundleBytes : 0) +
         4_096;
     if (bytes.byteLength > maximumEvidenceBytes) {
         invalid('Schema introspection evidence exceeds its declared bounds.');
     }
-    const { unpack } = await import('msgpackr');
     let decoded;
     try {
-        decoded = unpack(bytes);
+        decoded = json.decode(bytes, {
+            limits: {
+                maxBytes: maximumEvidenceBytes,
+                ...(request.kind === 'bundle' ? { maxStringBytes: limits.maximumBundleBytes } : {}),
+            },
+        });
     }
     catch (cause) {
         throw new TypeError('Schema introspection evidence is malformed.', { cause });
     }
-    const result = (request.kind === 'bundle'
+    return acceptEvidence(request, decoded, limits);
+}
+/**
+ * Package-private: admit one decoded evidence value for an admitted request. Shared with the
+ * pre-R1 representation in `../legacy/`, which decodes other bytes into this same wire value.
+ */
+export function acceptEvidence(request, decoded, limits) {
+    if (request.kind === 'installed')
+        return acceptInstalledReleases(decoded);
+    const result = request.kind === 'bundle'
         ? decodeDomainBundle(decoded, limits.maximumBundleBytes)
         : request.kind === 'dependencies'
             ? acceptDomainDependencies(decoded)
-            : acceptDomainInfo(decoded));
+            : acceptDomainInfo(decoded);
     proveRequestedOrigin(request, result);
     return result;
 }
+/** Package-private: admit the evidence bounds a request declares. Shared with `../legacy/`. */
+export function admitLimits(request, limits) {
+    admitLimit(limits.maximumPublicationBytes, 'Publication');
+    if (request.kind === 'bundle')
+        admitLimit(limits.maximumBundleBytes, 'Bundle');
+}
 function proveRequestedOrigin(request, result) {
     const origin = request.kind === 'inspect'
         ? result.origin
@@ -102,49 +132,148 @@ function acceptDependencyBinding(input) {
         binding: expected,
     });
 }
+/** Admit the installed listing: origin-ordered, one release per origin, each pin of one kind. */
+function acceptInstalledReleases(input) {
+    if (!Array.isArray(input))
+        invalid('Installed releases are invalid.');
+    const releases = input.map(acceptInstalledRelease);
+    for (const [index, installed] of releases.entries()) {
+        const previous = releases[index - 1];
+        if (previous !== undefined && previous.origin >= installed.origin) {
+            invalid('Installed releases must be origin-ordered and unique.');
+        }
+    }
+    return Object.freeze(releases);
+}
+function acceptInstalledRelease(input) {
+    const value = record(input, 'Installed release');
+    exact(value, ['inFlight', 'issuer', 'origin', 'pin', 'revision', 'url'], 'Installed release');
+    if (typeof value.origin !== 'string' || !patterns.origin.test(value.origin)) {
+        invalid('Installed release origin is invalid.');
+    }
+    if (typeof value.revision !== 'string' || !patterns.revision.test(value.revision)) {
+        invalid('Installed release revision is invalid.');
+    }
+    const issuer = issuerId(value.issuer, 'Installed release issuer');
+    return Object.freeze({
+        origin: value.origin,
+        revision: value.revision,
+        issuer,
+        url: deploymentUrl(value.url),
+        pin: installedPin(value.pin),
+        inFlight: inFlightIssuers(value.inFlight, issuer),
+    });
+}
+function installedPin(input) {
+    const value = record(input, 'Installed pin');
+    if (value.kind === 'release') {
+        exact(value, ['build', 'kind', 'release'], 'Installed release pin');
+        return Object.freeze({
+            kind: 'release',
+            release: digest(value.release, 'Installed release'),
+            build: digest(value.build, 'Installed build'),
+        });
+    }
+    // Deprecated legacy v2/v3 pin: deleted with the `legacy` variant of `InstalledPin`, in the
+    // breaking release that deletes `runtime/schema/installation/source/legacy/`.
+    if (value.kind === 'legacy') {
+        exact(value, ['document', 'etag', 'kind'], 'Installed legacy pin');
+        if (value.document !== 2 && value.document !== 3) {
+            invalid('Installed legacy pin document version is invalid.');
+        }
+        return Object.freeze({
+            kind: 'legacy',
+            document: value.document,
+            etag: digest(value.etag, 'Installed legacy Publication'),
+        });
+    }
+    return invalid('Installed pin kind is invalid.');
+}
+function inFlightIssuers(input, current) {
+    if (!Array.isArray(input))
+        invalid('Installed release in-flight issuers are invalid.');
+    const entries = input.map((entry) => {
+        const value = record(entry, 'In-flight issuer');
+        exact(value, ['issuer', 'release', 'replacedAt'], 'In-flight issuer');
+        if (typeof value.replacedAt !== 'string' || !isInstant(value.replacedAt)) {
+            invalid('In-flight issuer replacement instant is invalid.');
+        }
+        return Object.freeze({
+            issuer: issuerId(value.issuer, 'In-flight issuer'),
+            release: digest(value.release, 'In-flight release'),
+            replacedAt: value.replacedAt,
+        });
+    });
+    for (const [index, entry] of entries.entries()) {
+        if (entry.issuer === current)
+            invalid('An in-flight issuer cannot be the current issuer.');
+        const previous = entries[index - 1];
+        if (previous !== undefined && previous.issuer >= entry.issuer) {
+            invalid('In-flight issuers must be issuer-ordered and unique.');
+        }
+    }
+    return Object.freeze(entries);
+}
+function issuerId(input, label) {
+    if (!isIssuer(input))
+        invalid(`${label} is invalid.`);
+    return input;
+}
+/** An HTTP(S) origin, spelled exactly as `URL.origin` spells it. */
+function deploymentUrl(input) {
+    let url;
+    try {
+        url = typeof input === 'string' ? new URL(input) : undefined;
+    }
+    catch {
+        url = undefined;
+    }
+    if (url === undefined || (url.protocol !== 'https:' && url.protocol !== 'http:')) {
+        invalid('Installed release URL is invalid.');
+    }
+    if (url.origin !== input)
+        invalid('Installed release URL must be an origin.');
+    return url.origin;
+}
+/** A UTC millisecond instant, spelled exactly as `Date.prototype.toISOString` spells it. */
+function isInstant(input) {
+    const time = Date.parse(input);
+    return Number.isFinite(time) && new Date(time).toISOString() === input;
+}
 function encodeDomainBundle(input) {
     exact(input, ['bundle', 'domain'], 'Domain Bundle result');
     const admittedDomain = acceptDomainInfo(input.domain);
     const domain = encodeDomainInfo(admittedDomain);
     proveBundle(input.bundle, admittedDomain);
-    const encoded = encodedBundles.get(input.bundle) ?? bundle.encode(input.bundle);
-    if (!encodedBundles.has(input.bundle))
-        encodedBundles.set(input.bundle, encoded);
-    return Object.freeze({ domain, bundle: encoded });
+    const text = serializedBundles.get(input.bundle) ?? bundle.serialize(input.bundle);
+    if (!serializedBundles.has(input.bundle))
+        serializedBundles.set(input.bundle, text);
+    return Object.freeze({ domain, bundle: text });
 }
 function decodeDomainBundle(input, maximum) {
     const value = record(input, 'Domain Bundle result');
     exact(value, ['bundle', 'domain'], 'Domain Bundle result');
     const domain = acceptDomainInfo(value.domain);
-    const encoded = boundedBytes(value.bundle, maximum, 'Bundle');
+    const text = boundedText(value.bundle, maximum, 'Bundle');
     const cached = admittedBundles.get(domain.generation);
-    if (cached !== undefined && sameBytes(cached.bytes, encoded)) {
+    if (cached !== undefined && cached.text === text) {
         return Object.freeze({ domain, bundle: cached.bundle });
     }
     let admitted;
     try {
-        admitted = bundle.decode(encoded);
+        admitted = bundle.decode(text);
     }
     catch (cause) {
         throw new TypeError('Installed Domain Bundle is invalid.', { cause });
     }
     proveBundle(admitted, domain);
     admittedBundles.delete(domain.generation);
-    admittedBundles.set(domain.generation, Object.freeze({ bytes: encoded, bundle: admitted }));
+    admittedBundles.set(domain.generation, Object.freeze({ text, bundle: admitted }));
     if (admittedBundles.size > MAXIMUM_ADMITTED_BUNDLES) {
         admittedBundles.delete(admittedBundles.keys().next().value);
     }
     return Object.freeze({ domain, bundle: admitted });
 }
-function sameBytes(left, right) {
-    if (left.byteLength !== right.byteLength)
-        return false;
-    for (let index = 0; index < left.byteLength; index += 1) {
-        if (left[index] !== right[index])
-            return false;
-    }
-    return true;
-}
 function encodeDomainInfo(input) {
     return acceptDomainInfo(input);
 }
@@ -188,14 +317,15 @@ function publicationReference(input, origin, revision) {
 function bindings(input, origin) {
     const value = record(input, 'Domain bindings');
     exact(value, ['callables', 'views'], 'Domain bindings');
-    if (!Array.isArray(value.callables) || !Array.isArray(value.views)) {
+    const { callables, views } = value;
+    if (!Array.isArray(callables) || !Array.isArray(views)) {
         invalid('Domain bindings are invalid.');
     }
     try {
-        return Object.freeze({
-            callables: Object.freeze(value.callables.map((entry) => admitCallableBinding(entry, origin))),
-            views: Object.freeze(value.views.map((entry) => admitViewBinding(entry, origin))),
-        });
+        return withPublicationError(() => Object.freeze({
+            callables: Object.freeze(callables.map((entry) => admitCallableBinding(entry, origin))),
+            views: Object.freeze(views.map((entry) => admitViewBinding(entry, origin))),
+        }));
     }
     catch (cause) {
         throw new TypeError('Domain bindings are invalid.', { cause });
@@ -220,8 +350,13 @@ function capabilities(input) {
         throw new TypeError('Domain capabilities are invalid.', { cause });
     }
 }
-function admitRequest(input) {
+/** Package-private: admit one introspection request. Shared with `../legacy/`. */
+export function admitRequest(input) {
     const value = record(input, 'Schema introspection request');
+    if (value.kind === 'installed') {
+        exact(value, ['kind'], 'Schema introspection request');
+        return Object.freeze({ kind: 'installed' });
+    }
     exact(value, ['kind', 'origin'], 'Schema introspection request');
     if (value.kind !== 'inspect' && value.kind !== 'bundle' && value.kind !== 'dependencies') {
         invalid('Schema introspection kind is invalid.');
@@ -237,11 +372,13 @@ function digest(input, label) {
     }
     return input;
 }
-function boundedBytes(input, maximum, label) {
-    if (!(input instanceof Uint8Array) || input.byteLength === 0 || input.byteLength > maximum) {
+function boundedText(input, maximum, label) {
+    if (typeof input !== 'string' ||
+        input.length === 0 ||
+        encoder.encode(input).byteLength > maximum) {
         invalid(`${label} evidence is invalid or exceeds its bound.`);
     }
-    return Uint8Array.from(input);
+    return input;
 }
 function admitLimit(input, label) {
     if (!Number.isSafeInteger(input) || input < 1)

package/dist/schema/installation/introspection/index.d.ts

@@ -1,2 +1,2 @@
 export { MEDIA_TYPE, acceptDomainDependencies, acceptDomainInfo, decode, encode } from './codec.js';
-export type { DependencyBinding, Digest, DomainBundle, DomainDependencies, DomainInfo, Limits, ResultFor, } from './result.js';
+export type { DependencyBinding, Digest, DomainBundle, DomainDependencies, DomainInfo, InFlightIssuer, InstalledPin, InstalledRelease, Limits, ResultFor, } from './result.js';

package/dist/schema/installation/introspection/result.d.ts

@@ -1,12 +1,21 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import type { introspection } from '@astrale-os/kernel-core/schema';
 import type { bundle, Key, Revision } from '@astrale-os/kernel-dsl/v1';
-import type { Publication, PublicationRef, PublicationRequirements } from '../../../publication/index.js';
+import type { BuildDigest, ReleaseDigest } from '../../../release/index.js';
+import type { Publication, PublicationRef, PublicationRequirements } from '../../../release/legacy/index.js';
 export type Digest = `sha256:${string}`;
 /** Lightweight proof of one exact ready installed Domain generation. */
 export interface DomainInfo {
     readonly origin: Key.Origin;
     readonly revision: Revision;
     readonly generation: Digest;
+    /**
+     * Installed Publication reference: the pinned document's own for a legacy pin, the reference of
+     * the frozen v3 projection for a v4 pin.
+     *
+     * @deprecated Successor: `DomainInfo.release`, the installed `ReleaseRef`, emitted by the
+     * breaking release (AM-1).
+     */
     readonly publication: PublicationRef | null;
     readonly readiness: Digest;
     readonly capabilities: {
@@ -36,7 +45,57 @@ export interface DomainDependencies {
     readonly domain: DomainInfo;
     readonly dependencies: readonly DependencyBinding[];
 }
+/**
+ * What one installation pins, one meaning per variant: a `DomainRelease` v4 by its release digest
+ * beside the build digest it runs, or a legacy v2/v3 Publication by its strong ETag.
+ */
+export type InstalledPin = ReleasePin | LegacyPin;
+/** A `DomainRelease` v4 pin: its release digest beside the build digest it runs. */
+interface ReleasePin {
+    readonly kind: 'release';
+    readonly release: ReleaseDigest;
+    readonly build: BuildDigest;
+}
+/**
+ * A legacy v2/v3 Publication pin: its document version and strong ETag.
+ *
+ * @deprecated Successor: the `release` pin. Short-term consumer: the installations that still pin
+ * a v2/v3 Publication, such as the astrale Host's v3 installs until Shell is republished as a
+ * release. Deleted, with its codec branch, in the separate breaking release that deletes
+ * `runtime/schema/installation/source/legacy/`, once no installation pins a v2/v3 Publication
+ * (the conditions of `protocol/release/legacy/index.ts`).
+ */
+interface LegacyPin {
+    readonly kind: 'legacy';
+    readonly document: 2 | 3;
+    readonly etag: Digest;
+}
+/**
+ * The issuer of a release one installation replaced, as the Kernel records it: accepted while its
+ * work drains, and listed until a later consented install re-pins or prunes it, drained or not.
+ */
+export interface InFlightIssuer {
+    readonly issuer: IssuerId;
+    /** Pinned document digest of the replaced release. */
+    readonly release: Digest;
+    /** UTC millisecond ISO 8601 instant of the activation commit that replaced it. */
+    readonly replacedAt: string;
+}
+/** One ready installation the Kernel pins to a deployment, as its caller can read it. */
+export interface InstalledRelease {
+    readonly origin: Key.Origin;
+    readonly revision: Revision;
+    /** Issuer of the installation's Domain principal. */
+    readonly issuer: IssuerId;
+    /** The deployment URL, an HTTP(S) origin, the Kernel discovered the pinned document at. */
+    readonly url: string;
+    readonly pin: InstalledPin;
+    /** Issuer-ordered, distinct, never the current issuer. */
+    readonly inFlight: readonly InFlightIssuer[];
+}
 export type ResultFor<Input extends introspection.Introspection> = Input extends {
+    readonly kind: 'installed';
+} ? readonly InstalledRelease[] : Input extends {
     readonly kind: 'bundle';
 } ? DomainBundle : Input extends {
     readonly kind: 'dependencies';
@@ -45,3 +104,4 @@ export interface Limits {
     readonly maximumPublicationBytes: number;
     readonly maximumBundleBytes: number;
 }
+export {};

package/dist/schema/installation/legacy/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Read-only decoders for the schema evidence of Hosts older than beta.127: MessagePack
+ * installation v1 (`application/vnd.astrale.schema-installation.v1+msgpack`) and introspection v2
+ * (`application/vnd.astrale.schema-introspection.v2+msgpack`). Each decodes its bytes into the same
+ * wire value as the canonical JSON evidence and admits it with the canonical checks, so it returns
+ * exactly the canonical `InstallResult` and introspection results. Nothing here encodes: Servers
+ * emit only the canonical JSON evidence.
+ *
+ * @deprecated Use `installation.decode` / `installation.introspection.decode` with their
+ * `MEDIA_TYPE`, the JSON evidence every Host from beta.127 serves.
+ *
+ * Short-term consumers, all through `@astrale-os/kernel-client` `SchemaApi`, which selects these
+ * decoders by the received media type:
+ * - Admin managing the 1Pact Host (Kernel beta.117) and the astrale Hosts on beta.121 and beta.126
+ *   (`schema.inspect` before every Manager call, child `install`/`inspect`, `bundle` reads);
+ * - the CLI used by 1Pact developers, and `adapter-astrale` 0.5.0-beta.148, which runs
+ *   `astrale introspect` before every 1Pact deploy (`introspect`, `view`,
+ *   `domain install --direct`, cold-cache `call`);
+ * - the Console back-office (`schema.bundle` of every installed Domain);
+ * - SDK Project tooling (`pnpm dev`, the Environment installation reconcile), which runs
+ *   `astrale introspect` and `astrale domain install --direct` through that same CLI against our
+ *   beta.121 and beta.126 Hosts.
+ *
+ * Removal, in a separate breaking release: once no supported Host is older than beta.127 (the
+ * 1Pact Host upgraded; astrale-01, shared-01 and admin-users replaced or upgraded). Then delete, in
+ * the same PR:
+ * - this folder with its tests, golden evidence and laws, its `legacy/` entry in
+ *   `../.spec/layout.ts`, and the `./schema/installation/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json` with the `schema/installation/legacy/**` include of
+ *   `protocol/tsconfig.json`;
+ * - the legacy media-type branches of `client/schema/schema.ts` and
+ *   `client/schema/introspection.ts`, and `client/schema/__tests__/legacy-evidence.test.ts`;
+ * - the legacy paragraphs of `client/schema/.spec/architecture.md` and
+ *   `../.spec/architecture.md`;
+ * - the package-private exports of `../codec.ts` (`accept`) and `../introspection/codec.ts`
+ *   (`acceptEvidence`, `admitLimits`, `admitRequest`), which return to module scope.
+ */
+export { MEDIA_TYPE, decode } from './installation.js';
+export * as introspection from './introspection.js';

package/dist/schema/installation/legacy/index.js

@@ -0,0 +1,39 @@
+/**
+ * Read-only decoders for the schema evidence of Hosts older than beta.127: MessagePack
+ * installation v1 (`application/vnd.astrale.schema-installation.v1+msgpack`) and introspection v2
+ * (`application/vnd.astrale.schema-introspection.v2+msgpack`). Each decodes its bytes into the same
+ * wire value as the canonical JSON evidence and admits it with the canonical checks, so it returns
+ * exactly the canonical `InstallResult` and introspection results. Nothing here encodes: Servers
+ * emit only the canonical JSON evidence.
+ *
+ * @deprecated Use `installation.decode` / `installation.introspection.decode` with their
+ * `MEDIA_TYPE`, the JSON evidence every Host from beta.127 serves.
+ *
+ * Short-term consumers, all through `@astrale-os/kernel-client` `SchemaApi`, which selects these
+ * decoders by the received media type:
+ * - Admin managing the 1Pact Host (Kernel beta.117) and the astrale Hosts on beta.121 and beta.126
+ *   (`schema.inspect` before every Manager call, child `install`/`inspect`, `bundle` reads);
+ * - the CLI used by 1Pact developers, and `adapter-astrale` 0.5.0-beta.148, which runs
+ *   `astrale introspect` before every 1Pact deploy (`introspect`, `view`,
+ *   `domain install --direct`, cold-cache `call`);
+ * - the Console back-office (`schema.bundle` of every installed Domain);
+ * - SDK Project tooling (`pnpm dev`, the Environment installation reconcile), which runs
+ *   `astrale introspect` and `astrale domain install --direct` through that same CLI against our
+ *   beta.121 and beta.126 Hosts.
+ *
+ * Removal, in a separate breaking release: once no supported Host is older than beta.127 (the
+ * 1Pact Host upgraded; astrale-01, shared-01 and admin-users replaced or upgraded). Then delete, in
+ * the same PR:
+ * - this folder with its tests, golden evidence and laws, its `legacy/` entry in
+ *   `../.spec/layout.ts`, and the `./schema/installation/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json` with the `schema/installation/legacy/**` include of
+ *   `protocol/tsconfig.json`;
+ * - the legacy media-type branches of `client/schema/schema.ts` and
+ *   `client/schema/introspection.ts`, and `client/schema/__tests__/legacy-evidence.test.ts`;
+ * - the legacy paragraphs of `client/schema/.spec/architecture.md` and
+ *   `../.spec/architecture.md`;
+ * - the package-private exports of `../codec.ts` (`accept`) and `../introspection/codec.ts`
+ *   (`acceptEvidence`, `admitLimits`, `admitRequest`), which return to module scope.
+ */
+export { MEDIA_TYPE, decode } from './installation.js';
+export * as introspection from './introspection.js';

package/dist/schema/installation/legacy/installation.d.ts

@@ -0,0 +1,9 @@
+import type { InstallResult } from '../result.js';
+/** @deprecated Read-only: Hosts older than beta.127 serve this; current Hosts serve `installation.MEDIA_TYPE`. */
+export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-installation.v1+msgpack';
+/**
+ * Decode version-one (MessagePack) installation evidence into the canonical result.
+ *
+ * @deprecated Read-only; use `installation.decode` with `installation.MEDIA_TYPE`.
+ */
+export declare function decode(bytes: Uint8Array, maximumBytes: number): Promise<InstallResult>;

package/dist/schema/installation/legacy/installation.js

@@ -0,0 +1,28 @@
+import { accept as acceptValue, defaultLimits } from '@astrale-os/kernel-dsl/value';
+import { accept } from '../codec.js';
+import { decode as decodeMessagePack } from './msgpack.js';
+/** @deprecated Read-only: Hosts older than beta.127 serve this; current Hosts serve `installation.MEDIA_TYPE`. */
+export const MEDIA_TYPE = 'application/vnd.astrale.schema-installation.v1+msgpack';
+/**
+ * Decode version-one (MessagePack) installation evidence into the canonical result.
+ *
+ * @deprecated Read-only; use `installation.decode` with `installation.MEDIA_TYPE`.
+ */
+export async function decode(bytes, maximumBytes) {
+    if (!(bytes instanceof Uint8Array) ||
+        !Number.isSafeInteger(maximumBytes) ||
+        maximumBytes < 1 ||
+        bytes.byteLength > maximumBytes) {
+        throw new TypeError('Schema installation evidence is invalid or exceeds its bound.');
+    }
+    let value;
+    try {
+        value = acceptValue(decodeMessagePack(bytes, defaultLimits.maxDepth), {
+            limits: { maxBytes: maximumBytes },
+        });
+    }
+    catch (cause) {
+        throw new TypeError('Schema installation evidence is malformed.', { cause });
+    }
+    return accept(value);
+}

package/dist/schema/installation/legacy/introspection.d.ts

@@ -0,0 +1,10 @@
+import type { introspection } from '@astrale-os/kernel-core/schema';
+import type { Limits, ResultFor } from '../introspection/result.js';
+/** @deprecated Read-only: Hosts older than beta.127 serve this; current Hosts serve `introspection.MEDIA_TYPE`. */
+export declare const MEDIA_TYPE: 'application/vnd.astrale.schema-introspection.v2+msgpack';
+/**
+ * Decode version-two (MessagePack) introspection evidence into the canonical result.
+ *
+ * @deprecated Read-only; use `introspection.decode` with `introspection.MEDIA_TYPE`.
+ */
+export declare function decode<Input extends introspection.Introspection>(input: Input, bytes: Uint8Array, limits: Limits): Promise<ResultFor<Input>>;

package/dist/schema/installation/legacy/introspection.js

@@ -0,0 +1,70 @@
+import { accept as acceptValue, defaultLimits } from '@astrale-os/kernel-dsl/value';
+import { acceptEvidence, admitLimits, admitRequest } from '../introspection/codec.js';
+import { decode as decodeMessagePack } from './msgpack.js';
+/** @deprecated Read-only: Hosts older than beta.127 serve this; current Hosts serve `introspection.MEDIA_TYPE`. */
+export const MEDIA_TYPE = 'application/vnd.astrale.schema-introspection.v2+msgpack';
+const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+/**
+ * Decode version-two (MessagePack) introspection evidence into the canonical result.
+ *
+ * @deprecated Read-only; use `introspection.decode` with `introspection.MEDIA_TYPE`.
+ */
+export async function decode(input, bytes, limits) {
+    const request = admitRequest(input);
+    if (!(bytes instanceof Uint8Array))
+        invalid('Schema introspection evidence must be binary.');
+    admitLimits(request, limits);
+    // Version two carried the Bundle as raw bytes: no escaping allowance.
+    const maximumEvidenceBytes = limits.maximumPublicationBytes +
+        (request.kind === 'bundle' ? limits.maximumBundleBytes : 0) +
+        4_096;
+    if (bytes.byteLength > maximumEvidenceBytes) {
+        invalid('Schema introspection evidence exceeds its declared bounds.');
+    }
+    let wire;
+    try {
+        wire = decodeMessagePack(bytes, defaultLimits.maxDepth);
+    }
+    catch (cause) {
+        throw new TypeError('Schema introspection evidence is malformed.', { cause });
+    }
+    if (request.kind === 'bundle')
+        wire = bundleAsText(wire);
+    let decoded;
+    try {
+        decoded = acceptValue(wire, {
+            limits: {
+                maxBytes: maximumEvidenceBytes,
+                ...(request.kind === 'bundle' ? { maxStringBytes: limits.maximumBundleBytes } : {}),
+            },
+        });
+    }
+    catch (cause) {
+        throw new TypeError('Schema introspection evidence is malformed.', { cause });
+    }
+    return acceptEvidence(request, decoded, limits);
+}
+/**
+ * Version two carried the Bundle as the UTF-8 bytes of its canonical JSON; the current wire value
+ * carries that JSON as text. Translate only that field; every other check stays canonical.
+ */
+function bundleAsText(wire) {
+    if (wire === null || typeof wire !== 'object' || Array.isArray(wire))
+        return wire;
+    if (!Object.hasOwn(wire, 'bundle'))
+        return wire;
+    const { bundle } = wire;
+    if (!(bundle instanceof Uint8Array))
+        invalid('Bundle evidence is invalid or exceeds its bound.');
+    let text;
+    try {
+        text = utf8.decode(bundle);
+    }
+    catch (cause) {
+        throw new TypeError('Installed Domain Bundle is invalid.', { cause });
+    }
+    return { ...wire, bundle: text };
+}
+function invalid(message) {
+    throw new TypeError(message);
+}

package/dist/schema/installation/legacy/msgpack.d.ts

@@ -0,0 +1 @@
+export declare function decode(bytes: Uint8Array, maximumDepth: number): unknown;