@astrale-os/kernel-protocol 0.5.0-beta.7 → 0.5.0-beta.70

package/dist/routes/encode.js

@@ -1,33 +1,36 @@
+import { targetPath } from '@astrale-os/kernel-core/callable';
 import { Path } from '@astrale-os/kernel-core/path';
-import { Key, Ref } from '@astrale-os/kernel-dsl/v1/addressing';
+import { callableAddress } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as portable from '@astrale-os/kernel-dsl/value';
+import { routedDigest } from '../invocation/index.js';
 import { firstCredentialIsAmbient, putCredential, specificHeaderWires, withoutCredentialHeaders, } from './credential.js';
 import { fail, invalidRequest } from './error.js';
 import { isReservedHeader } from './mapping.js';
-import { encodeStrongEtag, HTTP_ROUTE_ISSUER, HTTP_ROUTE_PUBLICATION } from './routing.js';
+import { encodeStrongEtag, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER } from './routing.js';
 import { asObject, encodeScalar, scalar } from './scalar.js';
-import { requiresReceiver } from './target.js';
+import { requiresReceiver, routeFingerprint } from './target.js';
 import { authorityEnd, encodeTemplate, PLACEHOLDER } from './template.js';
-export function encode(entry, invocation, validator) {
+export function encode(entry, invocation, domain) {
+    if (typeof invocation.call.target !== 'string' &&
+        invocation.call.target.fingerprint !== undefined &&
+        invocation.call.target.fingerprint !== routeFingerprint(domain, entry.callable)) {
+        invalidRequest('Invocation Target fingerprint does not match the selected route Domain.');
+    }
     const input = asObject(invocation.call.input);
-    const target = Path.from(invocation.call.target);
+    const target = Path.from(targetPath(invocation.call.target));
     const needsReceiver = requiresReceiver(entry);
-    const ref = Key.ref(entry.callable);
-    const methodName = Ref.isMethod(ref) ? Ref.child(ref) : undefined;
+    const coordinate = callableAddress(entry.callable);
+    const methodName = coordinate.kind === 'method' ? coordinate.name : undefined;
     const receiver = needsReceiver ? instanceSource(target, methodName) : undefined;
     const source = receiver?.raw;
     const expected = needsReceiver
-        ? Path.instanceMethod(receiver, methodName).raw
-        : Ref.isMethod(ref)
-            ? Path.staticMethod(Path.project({
-                origin: Key.origin(entry.callable),
-                kind: Ref.namespace(ref),
-                name: Ref.member(ref),
-            }), methodName).raw
+        ? Path.instanceMethod(receiver, entry.callable).raw
+        : coordinate.kind === 'method'
+            ? Path.staticMethod(Path.project(coordinate.owner), methodName).raw
             : Path.project({
-                origin: Key.origin(entry.callable),
+                origin: coordinate.origin,
                 kind: 'function',
-                name: Ref.member(ref),
+                name: coordinate.name,
             }).raw;
     if (target.raw !== expected)
         invalidRequest('Invocation Path does not match the selected route.');
@@ -35,7 +38,7 @@ export function encode(entry, invocation, validator) {
         ? entry.target.receiver
         : undefined;
     const field = (name) => (name === receiverName ? source : input[name]);
-    const wireField = (name) => encodeScalar(entry, name, field(name), validator);
+    const wireField = (name) => encodeScalar(entry, name, field(name), domain);
     const hostEnd = authorityEnd(entry.href);
     let url = entry.href.replaceAll(PLACEHOLDER, (_whole, name, catchall, offset) => encodeTemplate(wireField(name), catchall, offset < hostEnd));
     const parsed = new URL(url);
@@ -107,13 +110,13 @@ export function encode(entry, invocation, validator) {
         }
     }
     if (invocation.routing !== undefined) {
-        headers[HTTP_ROUTE_PUBLICATION] = encodeStrongEtag(invocation.routing.publication.etag);
+        headers[HTTP_ROUTE_DIGEST] = encodeStrongEtag(routedDigest(invocation.routing));
         headers[HTTP_ROUTE_ISSUER] = invocation.routing.issuer;
     }
     url = parsed.toString();
     const mappedMethod = entry.requestMethod === undefined
         ? undefined
-        : encodeScalar(entry, entry.requestMethod, input[entry.requestMethod], validator).toUpperCase();
+        : encodeScalar(entry, entry.requestMethod, input[entry.requestMethod], domain).toUpperCase();
     const requestedMethod = invocation.method?.toUpperCase();
     if (mappedMethod !== undefined &&
         requestedMethod !== undefined &&
@@ -147,4 +150,3 @@ function instanceSource(target, name) {
     }
     return Path.fromAST({ anchor: target.ast.anchor, steps: steps.slice(0, -1) });
 }
-//# sourceMappingURL=encode.js.map

package/dist/routes/entries.d.ts

@@ -0,0 +1,23 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { Object as JsonObject, Value as JsonValue } from '@astrale-os/kernel-dsl/value';
+import type { Plan } from './plan.js';
+import type { Placed } from './reservation.js';
+import type { Route } from './table.js';
+type Meaning = Pick<Domain, 'origin' | 'revision' | 'callable'>;
+/**
+ * The coordinate in which a served document differs from one Plan placed at `publicUrl`: its
+ * origin or schema revision (`identity`), or its route wire (`routes`). Each Table words its own
+ * refusal after the document it binds.
+ */
+export declare function placementMismatch(plan: Plan, deployed: Placed, domain: Domain, publicUrl: string): 'identity' | 'routes' | undefined;
+/** The entries of one placed Plan at the hrefs its served document publishes. */
+export declare function placedEntries(plan: Plan, deployed: Pick<Placed, 'routes'>): readonly Route[];
+/** Whether entries carry exactly the route wire and Domain identity of one served document. */
+export declare function sameServedWire(entries: readonly Route[], deployed: Pick<Placed, 'origin' | 'schema' | 'routes'>, domain: Meaning): boolean;
+/** Refuse an entry whose target, auth or output differs from the Domain's callable meaning. */
+export declare function verifyMeaning(entries: readonly Route[], domain: Meaning): void;
+/** Admit one portable Table object holding exactly `fields`. */
+export declare function tableObject(input: unknown, fields: readonly string[]): JsonObject;
+/** Admit the entries of one Table bound to `origin`; an invalid route wire is a `ReleaseError`. */
+export declare function acceptEntries(input: JsonValue | undefined, origin: string): readonly Route[];
+export {};

package/dist/routes/entries.js

@@ -0,0 +1,150 @@
+import { accept as acceptPortable, json } from '@astrale-os/kernel-dsl/value';
+import { admitRoute } from '../release/route.js';
+import { fail } from './error.js';
+import { place } from './placement.js';
+const AUTH = new Set(['anonymous', 'authenticated', 'authorized']);
+const OUTPUT = new Set(['value', 'stream', 'binary']);
+/**
+ * The coordinate in which a served document differs from one Plan placed at `publicUrl`: its
+ * origin or schema revision (`identity`), or its route wire (`routes`). Each Table words its own
+ * refusal after the document it binds.
+ */
+export function placementMismatch(plan, deployed, domain, publicUrl) {
+    if (plan.origin !== deployed.origin ||
+        plan.origin !== domain.origin ||
+        plan.revision !== deployed.schema.revision ||
+        plan.revision !== domain.revision) {
+        return 'identity';
+    }
+    return json.serialize(place(plan, publicUrl)) ===
+        json.serialize(deployed.routes)
+        ? undefined
+        : 'routes';
+}
+/** The entries of one placed Plan at the hrefs its served document publishes. */
+export function placedEntries(plan, deployed) {
+    return Object.freeze(plan.entries.map((entry, index) => {
+        const { path: _path, ...portable } = entry;
+        return Object.freeze({ ...portable, href: deployed.routes[index].href });
+    }));
+}
+/** Whether entries carry exactly the route wire and Domain identity of one served document. */
+export function sameServedWire(entries, deployed, domain) {
+    return (domain.origin === deployed.origin &&
+        domain.revision === deployed.schema.revision &&
+        json.serialize(entries.map(wireRoute)) === json.serialize(deployed.routes));
+}
+/** Refuse an entry whose target, auth or output differs from the Domain's callable meaning. */
+export function verifyMeaning(entries, domain) {
+    for (const entry of entries) {
+        const meaning = domain.callable(entry.callable);
+        const targetMatches = meaning !== undefined &&
+            ((entry.target.kind === 'function' && !isMethod(meaning)) ||
+                (entry.target.kind === 'method' &&
+                    isMethod(meaning) &&
+                    meaning.executable &&
+                    entry.target.dispatch === (meaning.static ? 'static' : 'instance')));
+        if (!targetMatches || meaning.auth !== entry.auth || meaning.output.mode !== entry.output) {
+            fail('NATIVE_ROUTE_BINDING_INVALID', `Route ${entry.name} differs from Domain meaning.`);
+        }
+    }
+}
+/** Admit one portable Table object holding exactly `fields`. */
+export function tableObject(input, fields) {
+    const value = object(acceptPortable(input), 'Route Table');
+    exact(value, fields, 'Route Table');
+    return value;
+}
+/** Admit the entries of one Table bound to `origin`; an invalid route wire is a `ReleaseError`. */
+export function acceptEntries(input, origin) {
+    if (!Array.isArray(input))
+        invalid('Route Table entries');
+    const entries = input.map((entry) => acceptRoute(entry, origin));
+    if (new Set(entries.map(({ name }) => name)).size !== entries.length) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table names must be unique.');
+    }
+    return Object.freeze(entries);
+}
+function acceptRoute(input, origin) {
+    const value = object(input, 'Route Table entry');
+    exact(value, ['name', 'callable', 'target', 'auth', 'output', 'href', 'method', 'default'], 'Route Table entry', ['requestMethod', 'query', 'headers', 'body', 'credential']);
+    if (typeof value.default !== 'boolean')
+        invalid('Route Table default');
+    if (typeof value.auth !== 'string' || !AUTH.has(value.auth)) {
+        invalid('Route Table auth');
+    }
+    if (typeof value.output !== 'string' || !OUTPUT.has(value.output))
+        invalid('Route Table output');
+    const wire = admitRoute({
+        name: value.name,
+        callable: value.callable,
+        href: value.href,
+        method: value.method,
+        ...(value.default === true ? { default: true } : {}),
+        ...(value.requestMethod === undefined ? {} : { requestMethod: value.requestMethod }),
+        ...(value.query === undefined ? {} : { query: value.query }),
+        ...(value.headers === undefined ? {} : { headers: value.headers }),
+        ...(value.body === undefined ? {} : { body: value.body }),
+        ...(value.credential === undefined ? {} : { credential: value.credential }),
+        ...receiver(value.target),
+    }, origin);
+    const { default: _default, receiver: _receiver, ...common } = wire;
+    return Object.freeze({
+        ...common,
+        target: target(value.target),
+        auth: value.auth,
+        output: value.output,
+        default: value.default,
+    });
+}
+function target(input) {
+    const value = object(input, 'Route target');
+    if (value.kind === 'function') {
+        exact(value, ['kind'], 'Route Function target');
+        return Object.freeze({ kind: 'function' });
+    }
+    if (value.kind !== 'method' || (value.dispatch !== 'static' && value.dispatch !== 'instance')) {
+        invalid('Route Method target');
+    }
+    if (value.dispatch === 'static') {
+        exact(value, ['kind', 'dispatch'], 'Route static Method target');
+        return Object.freeze({ kind: 'method', dispatch: 'static' });
+    }
+    exact(value, ['kind', 'dispatch', 'receiver'], 'Route instance Method target');
+    if (typeof value.receiver !== 'string')
+        invalid('Route receiver');
+    return Object.freeze({ kind: 'method', dispatch: 'instance', receiver: value.receiver });
+}
+function receiver(input) {
+    const admitted = target(input);
+    return admitted.kind === 'method' && admitted.dispatch === 'instance'
+        ? { receiver: admitted.receiver }
+        : {};
+}
+function isMethod(meaning) {
+    return 'owner' in meaning;
+}
+function wireRoute(entry) {
+    const { target, auth: _auth, output: _output, default: isDefault, ...wire } = entry;
+    return {
+        ...wire,
+        ...(isDefault ? { default: true } : {}),
+        ...(target.kind === 'method' && target.dispatch === 'instance'
+            ? { receiver: target.receiver }
+            : {}),
+    };
+}
+function object(input, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(label);
+    return input;
+}
+function exact(value, required, label, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    if (Object.keys(value).some((key) => !allowed.has(key)) ||
+        required.some((key) => !Object.hasOwn(value, key)))
+        invalid(label);
+}
+function invalid(label) {
+    return fail('NATIVE_ROUTE_BINDING_INVALID', `${label} is invalid.`);
+}

package/dist/routes/error-response.d.ts

@@ -3,4 +3,3 @@ export interface ErrorResponse {
     readonly error: ErrorPayload;
 }
 export declare function decodeErrorResponse(input: unknown): ErrorResponse;
-//# sourceMappingURL=error-response.d.ts.map

package/dist/routes/error-response.js

@@ -29,4 +29,3 @@ function isValueObject(value) {
 function invalid(cause) {
     return fail('NATIVE_ROUTE_RESPONSE_INVALID', 'Native route error response is invalid.', cause);
 }
-//# sourceMappingURL=error-response.js.map

package/dist/routes/error.d.ts

@@ -6,4 +6,3 @@ export declare class RouteError extends Error {
 }
 export declare function fail(code: ErrorCode, message: string, cause?: unknown): never;
 export declare function invalidRequest(message: string): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/routes/error.js

@@ -12,4 +12,3 @@ export function fail(code, message, cause) {
 export function invalidRequest(message) {
     return fail('NATIVE_ROUTE_REQUEST_INVALID', message);
 }
-//# sourceMappingURL=error.js.map

package/dist/routes/evidence.d.ts

@@ -1,6 +1,5 @@
-import type { schema } from '@astrale-os/kernel-dsl/v1';
-import type { Publication } from '../publication/publication.js';
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { DomainRelease } from '../release/release.js';
 import type { Table } from './table.js';
-/** Verify that an admitted Table carries the exact published wire and Validator meaning. */
-export declare function verifyTable(table: Table, deployed: Publication, validator: schema.Validator): Table;
-//# sourceMappingURL=evidence.d.ts.map
+/** Verify that an admitted Table carries the exact released wire and Domain meaning. */
+export declare function verifyTable(table: Table, deployed: DomainRelease, domain: Pick<Domain, 'origin' | 'revision' | 'callable'>): Table;

package/dist/routes/evidence.js

@@ -1,38 +1,12 @@
-import { json } from '@astrale-os/kernel-dsl/value';
-import { compareReferences, reference } from '../publication/reference.js';
+import { compareReferences, reference } from '../release/reference.js';
+import { sameServedWire, verifyMeaning } from './entries.js';
 import { fail } from './error.js';
-/** Verify that an admitted Table carries the exact published wire and Validator meaning. */
-export function verifyTable(table, deployed, validator) {
-    if (compareReferences(table.publication, reference(deployed)) !== 'exact' ||
-        validator.origin !== deployed.origin ||
-        validator.revision !== deployed.schema.revision ||
-        json.serialize(table.entries.map(wireRoute)) !==
-            json.serialize(deployed.routes)) {
-        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table evidence differs from its Publication.');
-    }
-    for (const entry of table.entries) {
-        const meaning = validator.callable(entry.callable);
-        const targetMatches = meaning !== undefined &&
-            ((entry.target.kind === 'function' && meaning.target.kind === 'function') ||
-                (entry.target.kind === 'method' &&
-                    meaning.target.kind === 'method' &&
-                    entry.target.dispatch === meaning.target.dispatch));
-        if (!targetMatches ||
-            meaning.authentication !== entry.authentication ||
-            meaning.output !== entry.output) {
-            fail('NATIVE_ROUTE_BINDING_INVALID', `Route ${entry.name} differs from Validator meaning.`);
-        }
+/** Verify that an admitted Table carries the exact released wire and Domain meaning. */
+export function verifyTable(table, deployed, domain) {
+    if (compareReferences(table.release, reference(deployed)) !== 'exact' ||
+        !sameServedWire(table.entries, deployed, domain)) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table evidence differs from its Release.');
     }
+    verifyMeaning(table.entries, domain);
     return table;
 }
-function wireRoute(entry) {
-    const { target, authentication: _authentication, output: _output, default: isDefault, ...wire } = entry;
-    return {
-        ...wire,
-        ...(isDefault ? { default: true } : {}),
-        ...(target.kind === 'method' && target.dispatch === 'instance'
-            ? { receiver: target.receiver }
-            : {}),
-    };
-}
-//# sourceMappingURL=evidence.js.map

package/dist/routes/header.d.ts

@@ -0,0 +1,9 @@
+import * as auth from '@astrale-os/kernel-core/auth';
+import type { Sha256Digest } from '../release/digest.js';
+import type { HttpRequest } from './request.js';
+/** The digest one header value names as exactly one strong quoted digest, else undefined. */
+export declare function strongDigest(input: string): Sha256Digest | undefined;
+/** Read one reserved header, which occurs at most once in any spelling. */
+export declare function reservedHeader(input: HttpRequest['headers'], name: string): string | undefined;
+/** Admit the routing Kernel issuer one native route request names in header `name`. */
+export declare function acceptIssuerHeader(encoded: string, name: string): auth.IssuerId;

package/dist/routes/header.js

@@ -0,0 +1,34 @@
+import * as auth from '@astrale-os/kernel-core/auth';
+import { fail } from './error.js';
+const STRONG_DIGEST = /^"(sha256:[0-9a-f]{64})"$/u;
+/** The digest one header value names as exactly one strong quoted digest, else undefined. */
+export function strongDigest(input) {
+    return STRONG_DIGEST.exec(input)?.[1];
+}
+/** Read one reserved header, which occurs at most once in any spelling. */
+export function reservedHeader(input, name) {
+    if (input instanceof Headers)
+        return input.get(name) ?? undefined;
+    let found;
+    for (const [candidate, value] of Object.entries(input ?? {})) {
+        if (candidate.toLowerCase() !== name || value === undefined)
+            continue;
+        if (found !== undefined || (Array.isArray(value) && value.length !== 1)) {
+            fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${name} must occur at most once.`);
+        }
+        found = typeof value === 'string' ? value : value[0];
+    }
+    return found;
+}
+/** Admit the routing Kernel issuer one native route request names in header `name`. */
+export function acceptIssuerHeader(encoded, name) {
+    try {
+        return auth.issuer.accept(encoded);
+    }
+    catch (cause) {
+        if (cause instanceof auth.AuthValueError) {
+            return fail('NATIVE_ROUTE_ROUTING_INVALID', `${name} is invalid.`, cause);
+        }
+        throw cause;
+    }
+}

package/dist/routes/index.d.ts

@@ -12,9 +12,11 @@ export type { Plan, PlanEntry } from './plan.js';
 export type { Route, Table } from './table.js';
 export type { RouteTarget } from './target.js';
 export { place } from './placement.js';
-export { decodeReleaseUnavailable, HTTP_ROUTE_RELEASE_UNAVAILABLE, HTTP_ROUTE_RELEASE_UNAVAILABLE_STATUS, releaseUnavailableHeaders, type ReleaseUnavailable, } from './release-unavailable.js';
-export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_PUBLICATION, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, type MissControl, type StaleControl, } from './routing.js';
+export { decodeDeploymentRetired, deploymentRetiredBody, deploymentRetiredHeaders, HTTP_DEPLOYMENT_RETIRED, HTTP_DEPLOYMENT_RETIRED_STATUS, type DeploymentRetired, } from './deployment-retired.js';
+export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, type MissControl, type ServedReferences, type StaleControl, } from './routing.js';
 export { select } from './select.js';
 export { decodeStreamFrame, encodeStreamFrame, STREAM_MEDIA_TYPE, type StreamFrame, } from './stream.js';
 export { templatesOverlap } from './template.js';
-//# sourceMappingURL=index.d.ts.map
+/** @deprecated Native routes of a v3-input destination; use the release-bound Table and decoders. */
+export * as legacy from './legacy/index.js';
+export { HTTP_ROUTE_PUBLICATION } from './legacy/index.js';

package/dist/routes/index.js

@@ -9,9 +9,11 @@ export { RouteError } from './error.js';
 export { match } from './match.js';
 export {} from './request.js';
 export { place } from './placement.js';
-export { decodeReleaseUnavailable, HTTP_ROUTE_RELEASE_UNAVAILABLE, HTTP_ROUTE_RELEASE_UNAVAILABLE_STATUS, releaseUnavailableHeaders, } from './release-unavailable.js';
-export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_PUBLICATION, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, } from './routing.js';
+export { decodeDeploymentRetired, deploymentRetiredBody, deploymentRetiredHeaders, HTTP_DEPLOYMENT_RETIRED, HTTP_DEPLOYMENT_RETIRED_STATUS, } from './deployment-retired.js';
+export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, } from './routing.js';
 export { select } from './select.js';
 export { decodeStreamFrame, encodeStreamFrame, STREAM_MEDIA_TYPE, } from './stream.js';
 export { templatesOverlap } from './template.js';
-//# sourceMappingURL=index.js.map
+/** @deprecated Native routes of a v3-input destination; use the release-bound Table and decoders. */
+export * as legacy from './legacy/index.js';
+export { HTTP_ROUTE_PUBLICATION } from './legacy/index.js';

package/dist/routes/legacy/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Native routes bound to a v2/v3 Publication and its ETag. Binding also reserves `release.json`
+ * to prevent routes from shadowing the release document.
+ * Superseded by release-based Tables and routing from `@astrale-os/kernel-protocol/routes`.
+ *
+ * Short-term consumers: every destination sealed from a v2/v3 Publication, the legacy stable
+ * Workers and the SDK's v3 seal and preflight (`legacy.bind`, `legacy.verifyTable`,
+ * `legacy.Table`, adopted at its Kernel pin bump), and the Server's Publication-backed native
+ * routes (`server/routes/routes.ts`, `server/release/legacy/`) that serve them.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one) and every supported
+ * client relays `Via`. Then delete, in the same PR:
+ * - this folder with its tests and laws, the `legacy` namespace and `HTTP_ROUTE_PUBLICATION`
+ *   re-export of `routes/index.ts`, and the `./routes/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json`;
+ * - the projection branch of the canonical `decodeRouting` (`routing.ts`) with
+ *   `ServedReferences.projection`, so stale reports the release digest as `current`, and the
+ *   projection vectors of TEST-DECODES-ROUTING-BY-SERVED-REFERENCE;
+ * - the Publication-backed native routes of the Server (`server/routes/routes.ts`,
+ *   `server/release/legacy/`, and #508 in `server/invocation/legacy/`), which read this module;
+ * - rebase `protocol/__tests__/publication-routes.test.ts`, which exercises the shared compile,
+ *   placement and reservation laws through this Table, on the release Table;
+ * - `ServedReferences.projection` from law PROTOCOL-LEGACY-WIRE-FIELDS and its test.
+ * The shared entry mechanics (`entries.ts`, `header.ts`) and `reservation.ts` stay: they carry no
+ * document label.
+ */
+export { acceptTable, bind, verifyTable, type Table } from './table.js';
+export { decode, decodeRouting, HTTP_ROUTE_PUBLICATION } from './routing.js';

package/dist/routes/legacy/index.js

@@ -0,0 +1,29 @@
+/**
+ * Native routes bound to a v2/v3 Publication and its ETag. Binding also reserves `release.json`
+ * to prevent routes from shadowing the release document.
+ * Superseded by release-based Tables and routing from `@astrale-os/kernel-protocol/routes`.
+ *
+ * Short-term consumers: every destination sealed from a v2/v3 Publication, the legacy stable
+ * Workers and the SDK's v3 seal and preflight (`legacy.bind`, `legacy.verifyTable`,
+ * `legacy.Table`, adopted at its Kernel pin bump), and the Server's Publication-backed native
+ * routes (`server/routes/routes.ts`, `server/release/legacy/`) that serve them.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one) and every supported
+ * client relays `Via`. Then delete, in the same PR:
+ * - this folder with its tests and laws, the `legacy` namespace and `HTTP_ROUTE_PUBLICATION`
+ *   re-export of `routes/index.ts`, and the `./routes/legacy` subpaths (source and `dist`) of
+ *   `protocol/package.json`;
+ * - the projection branch of the canonical `decodeRouting` (`routing.ts`) with
+ *   `ServedReferences.projection`, so stale reports the release digest as `current`, and the
+ *   projection vectors of TEST-DECODES-ROUTING-BY-SERVED-REFERENCE;
+ * - the Publication-backed native routes of the Server (`server/routes/routes.ts`,
+ *   `server/release/legacy/`, and #508 in `server/invocation/legacy/`), which read this module;
+ * - rebase `protocol/__tests__/publication-routes.test.ts`, which exercises the shared compile,
+ *   placement and reservation laws through this Table, on the release Table;
+ * - `ServedReferences.projection` from law PROTOCOL-LEGACY-WIRE-FIELDS and its test.
+ * The shared entry mechanics (`entries.ts`, `header.ts`) and `reservation.ts` stay: they carry no
+ * document label.
+ */
+export { acceptTable, bind, verifyTable } from './table.js';
+export { decode, decodeRouting, HTTP_ROUTE_PUBLICATION } from './routing.js';

package/dist/routes/legacy/routing.d.ts

@@ -0,0 +1,24 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { PublicationVia } from '../../invocation/index.js';
+import type { PublicationRef } from '../../release/legacy/reference.js';
+import type { HttpRequest, Invocation } from '../request.js';
+import type { Route } from '../table.js';
+/**
+ * The If-Match header native routing reads, named for the Publication ETag it carried.
+ *
+ * @deprecated Successor: `HTTP_ROUTE_DIGEST`, the same header named for the routed digest.
+ */
+export declare const HTTP_ROUTE_PUBLICATION: "if-match";
+/**
+ * Decode only the native strong If-Match representation of Publication routing, served by a
+ * v3-input destination; a mismatched ETag is invalid here because the Server answers stale first.
+ *
+ * @deprecated Successor: `decodeRouting`, which serves a release and its v3 projection.
+ */
+export declare function decodeRouting(input: Pick<HttpRequest, 'headers'>, publication: PublicationRef): PublicationVia | undefined;
+/**
+ * Decode one native route request served by a v3-input destination.
+ *
+ * @deprecated Successor: `decode`, which serves a release and its v3 projection.
+ */
+export declare function decode(entry: Route, request: HttpRequest, domain: Domain, served: PublicationRef): Invocation;

package/dist/routes/legacy/routing.js

@@ -0,0 +1,45 @@
+import { decodeInvocation } from '../decode.js';
+import { fail } from '../error.js';
+import { acceptIssuerHeader, reservedHeader, strongDigest } from '../header.js';
+import { HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER } from '../routing.js';
+/**
+ * The If-Match header native routing reads, named for the Publication ETag it carried.
+ *
+ * @deprecated Successor: `HTTP_ROUTE_DIGEST`, the same header named for the routed digest.
+ */
+export const HTTP_ROUTE_PUBLICATION = HTTP_ROUTE_DIGEST;
+/**
+ * Decode only the native strong If-Match representation of Publication routing, served by a
+ * v3-input destination; a mismatched ETag is invalid here because the Server answers stale first.
+ *
+ * @deprecated Successor: `decodeRouting`, which serves a release and its v3 projection.
+ */
+export function decodeRouting(input, publication) {
+    const encodedEtag = reservedHeader(input.headers, HTTP_ROUTE_DIGEST);
+    const encodedIssuer = reservedHeader(input.headers, HTTP_ROUTE_ISSUER);
+    if (encodedEtag === undefined && encodedIssuer === undefined)
+        return undefined;
+    if (encodedEtag === undefined || encodedIssuer === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_DIGEST} and ${HTTP_ROUTE_ISSUER} must occur together.`);
+    }
+    const etag = strongDigest(encodedEtag);
+    if (etag === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match must contain exactly one strong quoted Publication ETag.');
+    }
+    if (etag !== publication.etag) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match does not name the compiled Publication.');
+    }
+    return Object.freeze({
+        kind: 'via',
+        publication,
+        issuer: acceptIssuerHeader(encodedIssuer, HTTP_ROUTE_ISSUER),
+    });
+}
+/**
+ * Decode one native route request served by a v3-input destination.
+ *
+ * @deprecated Successor: `decode`, which serves a release and its v3 projection.
+ */
+export function decode(entry, request, domain, served) {
+    return decodeInvocation(entry, request, domain, (input) => decodeRouting(input, served));
+}

package/dist/routes/legacy/table.d.ts

@@ -0,0 +1,34 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { Publication } from '../../release/legacy/publication.js';
+import type { PublicationRef } from '../../release/legacy/reference.js';
+import type { Plan } from '../plan.js';
+import type { Route } from '../table.js';
+/**
+ * Serving proof tied to one exact v2/v3 Publication and its resolved Domain.
+ *
+ * @deprecated Successor: `Table`, bound to the `ReleaseRef` of a `DomainRelease`.
+ */
+export interface Table {
+    readonly publication: PublicationRef;
+    readonly entries: readonly Route[];
+}
+/**
+ * Bind one Plan to an exact placed Publication and matching resolved Domain. Like the release
+ * Table, it also reserves `release.json`, so a v3 Domain cannot claim the document a v4 Kernel
+ * reads first.
+ *
+ * @deprecated Successor: `bind`, which binds a `DomainRelease`.
+ */
+export declare function bind(plan: Plan, deployed: Publication, domain: Domain, publicUrl?: string): Table;
+/**
+ * Admit one emitted portable Publication Table before Server composition.
+ *
+ * @deprecated Successor: `acceptTable`, which admits a release Table.
+ */
+export declare function acceptTable(input: unknown): Table;
+/**
+ * Verify exact Publication bytes and callable meaning before Server trusts one Table.
+ *
+ * @deprecated Successor: `verifyTable`, which verifies a release Table.
+ */
+export declare function verifyTable(table: Table, deployed: Publication, domain: Pick<Domain, 'origin' | 'revision' | 'callable'>): Table;

package/dist/routes/legacy/table.js

@@ -0,0 +1,50 @@
+import { withPublicationError } from '../../release/legacy/error.js';
+import { acceptReference, compareReferences, reference } from '../../release/legacy/reference.js';
+import { acceptEntries, placedEntries, placementMismatch, sameServedWire, tableObject, verifyMeaning, } from '../entries.js';
+import { fail } from '../error.js';
+import { rejectReserved } from '../reservation.js';
+/**
+ * Bind one Plan to an exact placed Publication and matching resolved Domain. Like the release
+ * Table, it also reserves `release.json`, so a v3 Domain cannot claim the document a v4 Kernel
+ * reads first.
+ *
+ * @deprecated Successor: `bind`, which binds a `DomainRelease`.
+ */
+export function bind(plan, deployed, domain, publicUrl = deployed.identity.issuer) {
+    const mismatch = placementMismatch(plan, deployed, domain, publicUrl);
+    if (mismatch === 'identity') {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Plan, Publication, and Domain identity differ.');
+    }
+    if (mismatch === 'routes') {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Publication routes differ from the placed Route Plan.');
+    }
+    const entries = placedEntries(plan, deployed);
+    withPublicationError(() => rejectReserved(deployed, entries));
+    return Object.freeze({ publication: reference(deployed), entries });
+}
+/**
+ * Admit one emitted portable Publication Table before Server composition.
+ *
+ * @deprecated Successor: `acceptTable`, which admits a release Table.
+ */
+export function acceptTable(input) {
+    const value = tableObject(input, ['publication', 'entries']);
+    const publication = acceptReference(value.publication);
+    return Object.freeze({
+        publication,
+        entries: withPublicationError(() => acceptEntries(value.entries, publication.origin)),
+    });
+}
+/**
+ * Verify exact Publication bytes and callable meaning before Server trusts one Table.
+ *
+ * @deprecated Successor: `verifyTable`, which verifies a release Table.
+ */
+export function verifyTable(table, deployed, domain) {
+    if (compareReferences(table.publication, reference(deployed)) !== 'exact' ||
+        !sameServedWire(table.entries, deployed, domain)) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table evidence differs from its Publication.');
+    }
+    verifyMeaning(table.entries, domain);
+    return table;
+}