@astrale-os/kernel-protocol 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/invocation/http/negotiation.js

@@ -1,4 +1,4 @@
-import { CONTENT_TYPE_JSON, CONTENT_TYPE_MSGPACK } from '../../codecs/index.js';
+import { CONTENT_TYPE_JSON } from '../../codecs/index.js';
 import { admitSupportedCodecs } from '../binding-codecs.js';
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
 const QVALUE = /^(?:0(?:\.\d{0,3})?|1(?:\.0{0,3})?)$/u;
@@ -9,11 +9,7 @@ export function codecForContentType(contentType, supported) {
     const mediaType = parseContentType(contentType);
     if (mediaType === undefined)
         return undefined;
-    const profile = mediaType === CONTENT_TYPE_JSON
-        ? 'json'
-        : mediaType === CONTENT_TYPE_MSGPACK
-            ? 'msgpack'
-            : undefined;
+    const profile = mediaType === CONTENT_TYPE_JSON ? 'json' : undefined;
     return admitted.find((entry) => entry.profile === profile)?.codec;
 }
 export function negotiateResponseCodec(accept, requestCodec, supported) {
@@ -27,7 +23,7 @@ export function negotiateResponseCodec(accept, requestCodec, supported) {
     if (ranges.length === 0)
         return undefined;
     const candidates = admitted.flatMap((entry) => {
-        const [type, subtype] = contentTypeOf(entry.profile).split('/');
+        const [type, subtype] = CONTENT_TYPE_JSON.split('/');
         const governing = ranges
             .filter((range) => range.mediaParameters === 0 &&
             (range.type === '*' || range.type === type) &&
@@ -56,9 +52,6 @@ export function negotiateResponseCodec(accept, requestCodec, supported) {
     });
     return candidates[0]?.codec;
 }
-function contentTypeOf(profile) {
-    return profile === 'json' ? CONTENT_TYPE_JSON : CONTENT_TYPE_MSGPACK;
-}
 function parseContentType(input) {
     if (splitOutsideQuotes(input, ',')?.length !== 1)
         return undefined;
@@ -205,4 +198,3 @@ function splitOutsideQuotes(input, separator) {
     parts.push(input.slice(start));
     return parts;
 }
-//# sourceMappingURL=negotiation.js.map

package/dist/invocation/http/request.d.ts

@@ -0,0 +1,11 @@
+import { type Request } from '../request.js';
+export declare const REQUEST_ENVELOPE_FIELD: 'x-astrale-request';
+export declare const BINARY_LENGTH_FIELD: 'x-astrale-binary-length';
+export declare const BINARY_REQUEST_CONTENT_TYPE: 'application/octet-stream';
+export declare const MAXIMUM_REQUEST_ENVELOPE_BYTES = 8192;
+/** Decode one declared byte count: a canonical unsigned decimal within the safe integer range. */
+export declare function decodeBinaryLength(input: string): number | undefined;
+/** Encode one canonical V2 Request into the binary-request HTTP field. */
+export declare function encodeBinaryRequestEnvelope(input: Request): string;
+/** Decode one bounded base64url JSON V2 Request from the binary-request HTTP field. */
+export declare function decodeBinaryRequestEnvelope(input: string | null): Request;

package/dist/invocation/http/request.js

@@ -0,0 +1,69 @@
+import { json } from '../../codecs/index.js';
+import { CODES, ProtocolError } from '../../errors/index.js';
+import { decodeRequest } from '../request.js';
+export const REQUEST_ENVELOPE_FIELD = 'x-astrale-request';
+export const BINARY_LENGTH_FIELD = 'x-astrale-binary-length';
+export const BINARY_REQUEST_CONTENT_TYPE = 'application/octet-stream';
+export const MAXIMUM_REQUEST_ENVELOPE_BYTES = 8_192;
+const BASE64URL = /^[A-Za-z0-9_-]+$/u;
+const MAXIMUM_ENCODED_BYTES = Math.ceil(MAXIMUM_REQUEST_ENVELOPE_BYTES / 3) * 4;
+const DECIMAL = /^(?:0|[1-9][0-9]*)$/u;
+/** Decode one declared byte count: a canonical unsigned decimal within the safe integer range. */
+export function decodeBinaryLength(input) {
+    if (!DECIMAL.test(input))
+        return undefined;
+    const length = Number(input);
+    return Number.isSafeInteger(length) ? length : undefined;
+}
+/** Encode one canonical V2 Request into the binary-request HTTP field. */
+export function encodeBinaryRequestEnvelope(input) {
+    const request = decodeRequest(input);
+    const encoded = json.encode(request);
+    if (typeof encoded !== 'string')
+        throw new TypeError('JSON Request codec returned non-text output.');
+    const bytes = new TextEncoder().encode(encoded);
+    if (bytes.byteLength > MAXIMUM_REQUEST_ENVELOPE_BYTES)
+        return invalid();
+    return btoa(String.fromCharCode(...bytes))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/u, '');
+}
+/** Decode one bounded base64url JSON V2 Request from the binary-request HTTP field. */
+export function decodeBinaryRequestEnvelope(input) {
+    if (input === null ||
+        input.length === 0 ||
+        input.length > MAXIMUM_ENCODED_BYTES ||
+        !BASE64URL.test(input)) {
+        return invalid();
+    }
+    let bytes;
+    try {
+        const binary = atob(input.replaceAll('-', '+').replaceAll('_', '/') + '='.repeat((4 - (input.length % 4)) % 4));
+        bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    }
+    catch {
+        return invalid();
+    }
+    if (bytes.byteLength > MAXIMUM_REQUEST_ENVELOPE_BYTES)
+        return invalid();
+    try {
+        // Require canonical base64url so alternate encodings cannot name the same envelope.
+        const canonical = btoa(String.fromCharCode(...bytes))
+            .replaceAll('+', '-')
+            .replaceAll('/', '_')
+            .replace(/=+$/u, '');
+        if (canonical !== input)
+            return invalid();
+        return decodeRequest(json.decode(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+function invalid() {
+    throw new ProtocolError({
+        code: CODES.INVALID_REQUEST,
+        message: 'HTTP binary Request envelope is invalid.',
+    });
+}

package/dist/invocation/http/stream.d.ts

@@ -3,4 +3,3 @@ import type { StreamFrame } from '../stream.js';
 export declare const STREAM_FRAMING_FIELD: 'x-astrale-stream-framing';
 export declare const LENGTH_PREFIX_V1: 'length-prefix-v1';
 export declare function encodeStreamFrame(codec: Codec, frame: StreamFrame): Uint8Array;
-//# sourceMappingURL=stream.d.ts.map

package/dist/invocation/http/stream.js

@@ -13,4 +13,3 @@ export function encodeStreamFrame(codec, frame) {
     output.set(payload, 4);
     return output;
 }
-//# sourceMappingURL=stream.js.map

package/dist/invocation/http/trace.d.ts

@@ -4,4 +4,3 @@ export declare const TRACESTATE_FIELD = "tracestate";
 export declare const BAGGAGE_FIELD = "baggage";
 export declare function decodeTraceHeaders(traceparent: string | null, tracestate: string | null): Trace | undefined;
 export declare function encodeTraceHeaders(carrier: Trace | undefined): Readonly<Record<string, string>>;
-//# sourceMappingURL=trace.d.ts.map

package/dist/invocation/http/trace.js

@@ -22,4 +22,3 @@ export function encodeTraceHeaders(carrier) {
         ...(admitted.tracestate === undefined ? {} : { [TRACESTATE_FIELD]: admitted.tracestate }),
     });
 }
-//# sourceMappingURL=trace.js.map

package/dist/invocation/idempotency.d.ts

@@ -8,4 +8,3 @@ export declare const MAXIMUM_IDEMPOTENCY_KEY_LENGTH = 128;
 /** Admit an opaque URL-safe ASCII key without assigning it semantic structure. */
 export declare function acceptIdempotencyKey(input: unknown, label?: string): IdempotencyKey;
 export {};
-//# sourceMappingURL=idempotency.d.ts.map

package/dist/invocation/idempotency.js

@@ -11,4 +11,3 @@ export function acceptIdempotencyKey(input, label = 'idempotency key') {
     }
     return input;
 }
-//# sourceMappingURL=idempotency.js.map

package/dist/invocation/identity.d.ts

@@ -14,4 +14,3 @@ export declare class InvocationError extends TypeError {
 export declare function acceptInvocationId(input: unknown): InvocationId;
 /** Compare both canonical coordinate fields exactly. */
 export declare function sameInvocationId(left: InvocationId, right: InvocationId): boolean;
-//# sourceMappingURL=identity.d.ts.map

package/dist/invocation/identity.js

@@ -53,4 +53,3 @@ function isLocalInvocationId(input) {
 function invalid(input) {
     throw new InvocationError(input);
 }
-//# sourceMappingURL=identity.js.map

package/dist/invocation/index.d.ts

@@ -5,17 +5,19 @@ export { acceptIdempotencyKey, HTTP_IDEMPOTENCY_KEY, MAXIMUM_IDEMPOTENCY_KEY_LEN
 export { acceptInvocationId, InvocationError, MAXIMUM_INVOCATION_ID_LENGTH, sameInvocationId, type InvocationId, } from './identity.js';
 export * as http from './http/index.js';
 export { acceptDelegate, type Delegate } from './delegate.js';
+export type { PublicationBindingInput, PublicationVia } from './legacy/index.js';
+/** @deprecated The legacy routed witness every Kernel emits until the breaking release (AM-1). */
+export * as legacy from './legacy/index.js';
 export { decodeMiss, miss, type Miss } from './miss.js';
 export { acceptRoute, acceptRedirection, decodeRedirectResponse, remoteRoute, type RemoteBindingInput, type Redirection, type RedirectResponse, type Route, } from './redirect.js';
 export { decodeRequest, type Request } from './request.js';
 export { admitTrace, MAXIMUM_TRACEPARENT_BYTES, MAXIMUM_TRACESTATE_BYTES, MAXIMUM_TRACESTATE_MEMBERS, type Trace, } from './trace.js';
-export { acceptRouting, type Refresh, type Routing, type Via } from './routing.js';
+export { acceptRouting, routedDigest, routedRevision, type Refresh, type Routing, type Via, } from './routing.js';
 export { acceptSchemaTarget, type SchemaTarget } from './schema.js';
 export { decodeResponse, type ErrorResponse, type Response, type ResponseContext, type SuccessResponse, } from './response.js';
-export { SCHEMA_UPGRADE_REQUIRED, SCHEMA_REVISION_MISMATCH, SERVICE_CANDIDATE_INVALID, SERVICE_TRUST_REQUIRED, SERVICE_UNAVAILABLE, serviceErrorOf, type SchemaUpgradeRequiredDetails, type SchemaUpgradeRequiredReason, type SchemaRevisionMismatchDetails, type SchemaRevisionMismatchReason, type ServiceCandidateInvalidDetails, type ServiceCandidateInvalidReason, type ServiceErrorPayload, type ServiceReason, type ServiceTrustRequiredDetails, type ServiceTrustRequiredReason, type ServiceUnavailableDetails, type ServiceUnavailableReason, } from './service-reason.js';
+export { CALLABLE_FINGERPRINT_MISMATCH, DEPLOYMENT_RETIRED, SERVICE_CANDIDATE_INVALID, SERVICE_TRUST_REQUIRED, SERVICE_UNAVAILABLE, serviceErrorOf, type CallableFingerprintMismatchDetails, type CallableFingerprintMismatchReason, type DeploymentRetiredDetails, type DeploymentRetiredReason, type ServiceCandidateInvalidDetails, type ServiceCandidateInvalidReason, type ServiceErrorPayload, type ServiceReason, type ServiceTrustRequiredDetails, type ServiceTrustRequiredReason, type ServiceUnavailableDetails, type ServiceUnavailableReason, } from './service-reason.js';
 export { decodeStale, stale, type Stale } from './stale-route.js';
 export { decodeStreamFrame, type StreamEndFrame, type StreamErrorFrame, type StreamFrame, type StreamItemFrame, type StreamStartFrame, } from './stream.js';
-export { acceptCall, type Call } from './target.js';
+export { Target, targetPath, acceptCall, type Call } from './target.js';
 export { VERSION, type Version } from './version.js';
 export * as websocket from './websocket/index.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.js

@@ -5,17 +5,18 @@ export { acceptIdempotencyKey, HTTP_IDEMPOTENCY_KEY, MAXIMUM_IDEMPOTENCY_KEY_LEN
 export { acceptInvocationId, InvocationError, MAXIMUM_INVOCATION_ID_LENGTH, sameInvocationId, } from './identity.js';
 export * as http from './http/index.js';
 export { acceptDelegate } from './delegate.js';
+/** @deprecated The legacy routed witness every Kernel emits until the breaking release (AM-1). */
+export * as legacy from './legacy/index.js';
 export { decodeMiss, miss } from './miss.js';
 export { acceptRoute, acceptRedirection, decodeRedirectResponse, remoteRoute, } from './redirect.js';
 export { decodeRequest } from './request.js';
 export { admitTrace, MAXIMUM_TRACEPARENT_BYTES, MAXIMUM_TRACESTATE_BYTES, MAXIMUM_TRACESTATE_MEMBERS, } from './trace.js';
-export { acceptRouting } from './routing.js';
+export { acceptRouting, routedDigest, routedRevision, } from './routing.js';
 export { acceptSchemaTarget } from './schema.js';
 export { decodeResponse, } from './response.js';
-export { SCHEMA_UPGRADE_REQUIRED, SCHEMA_REVISION_MISMATCH, SERVICE_CANDIDATE_INVALID, SERVICE_TRUST_REQUIRED, SERVICE_UNAVAILABLE, serviceErrorOf, } from './service-reason.js';
+export { CALLABLE_FINGERPRINT_MISMATCH, DEPLOYMENT_RETIRED, SERVICE_CANDIDATE_INVALID, SERVICE_TRUST_REQUIRED, SERVICE_UNAVAILABLE, serviceErrorOf, } from './service-reason.js';
 export { decodeStale, stale } from './stale-route.js';
 export { decodeStreamFrame, } from './stream.js';
-export { acceptCall } from './target.js';
+export { Target, targetPath, acceptCall } from './target.js';
 export { VERSION } from './version.js';
 export * as websocket from './websocket/index.js';
-//# sourceMappingURL=index.js.map

package/dist/invocation/legacy/delegate.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A source `Delegate` may still carry `attenuation` with the self expression
+ * `{ kind: 'identity', self: true }`, the one value published Clients and SDK Workers send. It names
+ * the caller every Delegate preserves anyway, so `acceptDelegate` drops it and returns the same
+ * `Delegate` as without it. Every other value, `undefined` and `null` included, stays refused.
+ *
+ * @deprecated Omit `attenuation`; a Delegate always preserves the authenticated caller (ADR-3).
+ *
+ * Short-term consumers: Domain Workers built with `@astrale-os/sdk` 0.6.0-beta.0 to beta.3, whose
+ * `Function.admit` callback sends it (the Shell v3 Worker included), and callers that pass it in
+ * `delegate` to `@astrale-os/kernel-client` 0.6.0-beta.85 or earlier.
+ *
+ * Removal, in a separate breaking release, once those Workers are redeployed with a later SDK and
+ * every consumer runs a Client that omits the field: delete this file, its call in `../delegate.ts`
+ * and its vectors in INVOCATION-DELEGATE-OMISSION-EVIDENCE.
+ */
+export declare function withoutSelfAttenuation(object: Record<string, unknown>): Record<string, unknown>;

package/dist/invocation/legacy/delegate.js

@@ -0,0 +1,37 @@
+/**
+ * A source `Delegate` may still carry `attenuation` with the self expression
+ * `{ kind: 'identity', self: true }`, the one value published Clients and SDK Workers send. It names
+ * the caller every Delegate preserves anyway, so `acceptDelegate` drops it and returns the same
+ * `Delegate` as without it. Every other value, `undefined` and `null` included, stays refused.
+ *
+ * @deprecated Omit `attenuation`; a Delegate always preserves the authenticated caller (ADR-3).
+ *
+ * Short-term consumers: Domain Workers built with `@astrale-os/sdk` 0.6.0-beta.0 to beta.3, whose
+ * `Function.admit` callback sends it (the Shell v3 Worker included), and callers that pass it in
+ * `delegate` to `@astrale-os/kernel-client` 0.6.0-beta.85 or earlier.
+ *
+ * Removal, in a separate breaking release, once those Workers are redeployed with a later SDK and
+ * every consumer runs a Client that omits the field: delete this file, its call in `../delegate.ts`
+ * and its vectors in INVOCATION-DELEGATE-OMISSION-EVIDENCE.
+ */
+export function withoutSelfAttenuation(object) {
+    if (!Object.hasOwn(object, 'attenuation') || !isSelf(object.attenuation))
+        return object;
+    const { attenuation: _self, ...rest } = object;
+    return rest;
+}
+function isSelf(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    if (Reflect.ownKeys(value).length !== 2)
+        return false;
+    const kind = Object.getOwnPropertyDescriptor(value, 'kind');
+    const self = Object.getOwnPropertyDescriptor(value, 'self');
+    return (kind?.enumerable === true &&
+        kind.value === 'identity' &&
+        self?.enumerable === true &&
+        self.value === true);
+}

package/dist/invocation/legacy/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Publication-based routing, retained for v2/v3 pins and frozen v3 projections of v4 pins.
+ * The Kernel emits this shape while decoders also accept release-based `Via`.
+ * Superseded by `Via` and `remoteRoute` from `@astrale-os/kernel-protocol/invocation`.
+ *
+ * Short-term consumers:
+ * - the Runtime redirect (`runtime/functions/runtime.ts`), the Kernel's only emitter until the
+ *   breaking release (AM-1, CT5-E), because every client and View built before K5 decodes only
+ *   this shape: the pinned document's own reference for a v2/v3 pin, the frozen v3 projection's
+ *   for a v4 pin. The breaking release switches v4 pins to `remoteRoute`; v2/v3 pins keep this;
+ * - servers built from a v2/v3 Publication, which admit only this shape (the SDK's `requireVia`,
+ *   the Server's `HandlerRequest.via`).
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no installation pins a v2/v3 document) and every supported client relays `Via`. Then
+ * delete, in the same PR:
+ * - this folder, the `legacy` namespace of `invocation/index.ts` and its `PublicationVia` and
+ *   `PublicationBindingInput` type exports;
+ * - the `publication` branch of `acceptVia` and of `routedRevision`/`routedDigest` in `routing.ts`;
+ * - the `PublicationVia` member of `Routing` (`routing.ts`) and of `Route.via` (`redirect.ts`);
+ * - the `PublicationVia` member of `routes.Invocation.routing` (`routes/request.ts`) and of the
+ *   Server's `HandlerRequest.via` (`server/invocation/types.ts`), with the refusal of a release
+ *   `Via` at a Publication-backed destination (law SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the legacy vectors of TEST-VIA-NAMES-EXACTLY-ONE-REFERENCE, and the Runtime redirect's last
+ *   `legacy.remoteRoute` call with its dispatch test;
+ * - `PublicationVia` and `Route.via` from law PROTOCOL-LEGACY-WIRE-FIELDS and its test.
+ */
+export { remoteRoute } from './route.js';
+export type { PublicationBindingInput, PublicationVia } from './via.js';

package/dist/invocation/legacy/index.js

@@ -0,0 +1,28 @@
+/**
+ * Publication-based routing, retained for v2/v3 pins and frozen v3 projections of v4 pins.
+ * The Kernel emits this shape while decoders also accept release-based `Via`.
+ * Superseded by `Via` and `remoteRoute` from `@astrale-os/kernel-protocol/invocation`.
+ *
+ * Short-term consumers:
+ * - the Runtime redirect (`runtime/functions/runtime.ts`), the Kernel's only emitter until the
+ *   breaking release (AM-1, CT5-E), because every client and View built before K5 decodes only
+ *   this shape: the pinned document's own reference for a v2/v3 pin, the frozen v3 projection's
+ *   for a v4 pin. The breaking release switches v4 pins to `remoteRoute`; v2/v3 pins keep this;
+ * - servers built from a v2/v3 Publication, which admit only this shape (the SDK's `requireVia`,
+ *   the Server's `HandlerRequest.via`).
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no installation pins a v2/v3 document) and every supported client relays `Via`. Then
+ * delete, in the same PR:
+ * - this folder, the `legacy` namespace of `invocation/index.ts` and its `PublicationVia` and
+ *   `PublicationBindingInput` type exports;
+ * - the `publication` branch of `acceptVia` and of `routedRevision`/`routedDigest` in `routing.ts`;
+ * - the `PublicationVia` member of `Routing` (`routing.ts`) and of `Route.via` (`redirect.ts`);
+ * - the `PublicationVia` member of `routes.Invocation.routing` (`routes/request.ts`) and of the
+ *   Server's `HandlerRequest.via` (`server/invocation/types.ts`), with the refusal of a release
+ *   `Via` at a Publication-backed destination (law SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the legacy vectors of TEST-VIA-NAMES-EXACTLY-ONE-REFERENCE, and the Runtime redirect's last
+ *   `legacy.remoteRoute` call with its dispatch test;
+ * - `PublicationVia` and `Route.via` from law PROTOCOL-LEGACY-WIRE-FIELDS and its test.
+ */
+export { remoteRoute } from './route.js';

package/dist/invocation/legacy/route.d.ts

@@ -0,0 +1,14 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Key } from '@astrale-os/kernel-dsl/v1';
+import type { Route } from '../redirect.js';
+import type { PublicationBindingInput } from './via.js';
+/**
+ * Project one remote binding into the route every Kernel emits until the breaking release (AM-1):
+ * a `PublicationVia` naming the v3 reference, the pinned document's own for a legacy pin and the
+ * frozen projection's for a v4 pin. It reads only the binding's Publication coordinates, so a
+ * binding that also carries a release digest still projects to its v3 reference.
+ *
+ * @deprecated Successor: `remoteRoute`, which projects a release binding to `Via`; the breaking
+ * release calls it instead.
+ */
+export declare function remoteRoute(origin: Key.Origin, binding: PublicationBindingInput, issuer: IssuerId): Route;

package/dist/invocation/legacy/route.js

@@ -0,0 +1,25 @@
+import { acceptRoute } from '../redirect.js';
+/**
+ * Project one remote binding into the route every Kernel emits until the breaking release (AM-1):
+ * a `PublicationVia` naming the v3 reference, the pinned document's own for a legacy pin and the
+ * frozen projection's for a v4 pin. It reads only the binding's Publication coordinates, so a
+ * binding that also carries a release digest still projects to its v3 reference.
+ *
+ * @deprecated Successor: `remoteRoute`, which projects a release binding to `Via`; the breaking
+ * release calls it instead.
+ */
+export function remoteRoute(origin, binding, issuer) {
+    return acceptRoute({
+        endpoint: binding.endpoint,
+        via: {
+            kind: 'via',
+            publication: {
+                origin,
+                identity: { issuer: binding.issuer, subject: binding.subject },
+                revision: binding.revision,
+                etag: binding.etag,
+            },
+            issuer,
+        },
+    });
+}

package/dist/invocation/legacy/via.d.ts

@@ -0,0 +1,30 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { InvocationEndpoints } from '../../release/bindings/invocation.js';
+import type { Etag } from '../../release/legacy/etag.js';
+import type { PublicationRef } from '../../release/legacy/reference.js';
+/**
+ * Routed witness of a legacy pin, or of the v3 projection of a v4 pin: the reference keeps its
+ * Publication meaning (origin, identity, schema revision, Publication ETag).
+ *
+ * @deprecated Successor: `Via.release`, emitted by the breaking release (AM-1).
+ */
+export interface PublicationVia {
+    readonly kind: 'via';
+    readonly publication: PublicationRef;
+    readonly issuer: IssuerId;
+}
+/**
+ * Remote binding of a legacy pin, or of a v4 pin projected to its v3 Publication: the endpoint
+ * and the Publication reference coordinates the Kernel routes it with.
+ *
+ * @deprecated Successor: `RemoteBindingInput`, which carries the release digest.
+ */
+export interface PublicationBindingInput {
+    readonly endpoint: InvocationEndpoints;
+    readonly issuer: IssuerId;
+    readonly subject: string;
+    readonly revision: PublicationRef['revision'];
+    readonly etag: Etag;
+}
+/** Admit the Publication reference of one received `PublicationVia`. */
+export declare function acceptPublicationReference(input: unknown, label: string): PublicationRef;

package/dist/invocation/legacy/via.js

@@ -0,0 +1,15 @@
+import { PublicationError } from '../../release/legacy/error.js';
+import { acceptReference } from '../../release/legacy/reference.js';
+import { invalid } from '../admission.js';
+/** Admit the Publication reference of one received `PublicationVia`. */
+export function acceptPublicationReference(input, label) {
+    try {
+        return acceptReference(input);
+    }
+    catch (cause) {
+        if (cause instanceof PublicationError) {
+            return invalid(`${label} is invalid: ${cause.message}`);
+        }
+        throw cause;
+    }
+}

package/dist/invocation/miss.d.ts

@@ -7,4 +7,3 @@ export interface Miss {
 }
 export declare function decodeMiss(input: unknown): Miss;
 export declare function miss(requestId: RequestId, assigned: InvocationId): Miss;
-//# sourceMappingURL=miss.d.ts.map

package/dist/invocation/miss.js

@@ -15,4 +15,3 @@ export function decodeMiss(input) {
 export function miss(requestId, assigned) {
     return decodeMiss({ kind: 'miss', requestId, invocation: assigned });
 }
-//# sourceMappingURL=miss.js.map

package/dist/invocation/redirect.d.ts

@@ -1,18 +1,20 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
-import type { Key } from '@astrale-os/kernel-dsl/v1';
-import type { InvocationEndpoints } from '../publication/bindings/invocation.js';
-import type { Etag } from '../publication/etag.js';
-import type { PublicationRef } from '../publication/reference.js';
+import type { Key, Revision } from '@astrale-os/kernel-dsl/v1';
+import type { InvocationEndpoints } from '../release/bindings/invocation.js';
+import type { ReleaseDigest } from '../release/digest.js';
 import type { RequestId } from './correlation.js';
 import type { InvocationId } from './identity.js';
+import type { PublicationVia } from './legacy/via.js';
+import type { Via } from './routing.js';
 import type { Trace } from './trace.js';
 export interface Route {
     readonly endpoint: InvocationEndpoints;
-    readonly via: {
-        readonly kind: 'via';
-        readonly publication: PublicationRef;
-        readonly issuer: IssuerId;
-    };
+    /**
+     * Routed witness of the installed release. Its `PublicationVia` shape is deprecated (legacy
+     * pins and the v3 projection of v4 pins); successor: `Via`, emitted by the breaking release
+     * (AM-1).
+     */
+    readonly via: Via | PublicationVia;
 }
 export interface Redirection {
     readonly route: Route;
@@ -26,16 +28,16 @@ export interface RedirectResponse {
     readonly invocation: InvocationId;
     readonly redirect: Redirection;
 }
+/** Remote binding of one installed release: the endpoint and the release it routes to. */
 export interface RemoteBindingInput {
     readonly endpoint: InvocationEndpoints;
     readonly issuer: IssuerId;
     readonly subject: string;
-    readonly revision: PublicationRef['revision'];
-    readonly etag: Etag;
+    readonly revision: Revision;
+    readonly release: ReleaseDigest;
 }
 export declare function acceptRoute(input: unknown): Route;
-/** Project one semantic remote binding into its admitted protocol route representation. */
+/** Project an installed release binding into a release `Via`; legacy emitters use `legacy.remoteRoute`. */
 export declare function remoteRoute(origin: Key.Origin, binding: RemoteBindingInput, issuer: IssuerId): Route;
 export declare function acceptRedirection(input: unknown): Redirection;
 export declare function decodeRedirectResponse(input: unknown): RedirectResponse;
-//# sourceMappingURL=redirect.d.ts.map

package/dist/invocation/redirect.js

@@ -1,30 +1,18 @@
-import { acceptInvocationEndpoints } from '../publication/bindings/invocation.js';
-import { PublicationError } from '../publication/error.js';
-import { acceptReference } from '../publication/reference.js';
-import { exactFields, invalid, issuerId, invocation, portableObject, requestId, required, string, } from './admission.js';
+import { acceptInvocationEndpoints } from '../release/legacy/bindings.js';
+import { PublicationError } from '../release/legacy/error.js';
+import { exactFields, invalid, invocation, portableObject, requestId, required, string, } from './admission.js';
+import { acceptVia } from './routing.js';
 import { admitTrace } from './trace.js';
 const ROUTE_FIELDS = new Set(['endpoint', 'via']);
-const VIA_FIELDS = new Set(['kind', 'publication', 'issuer']);
 const REDIRECTION_FIELDS = new Set(['route', 'credential', 'trace']);
 const REDIRECT_RESPONSE_FIELDS = new Set(['kind', 'requestId', 'invocation', 'redirect']);
 export function acceptRoute(input) {
     const object = portableObject(input, 'route');
     exactFields(object, ROUTE_FIELDS, 'route');
     required(object, ['endpoint', 'via'], 'route');
+    const via = acceptVia(portableObject(object.via, 'route.via'), 'route.via');
     try {
-        const via = portableObject(object.via, 'route.via');
-        exactFields(via, VIA_FIELDS, 'route.via');
-        required(via, ['kind', 'publication', 'issuer'], 'route.via');
-        if (via.kind !== 'via')
-            invalid('route.via.kind must be "via"');
-        return Object.freeze({
-            endpoint: acceptInvocationEndpoints(object.endpoint),
-            via: Object.freeze({
-                kind: 'via',
-                publication: acceptReference(via.publication),
-                issuer: issuerId(via.issuer, 'route.via.issuer'),
-            }),
-        });
+        return Object.freeze({ endpoint: acceptInvocationEndpoints(object.endpoint), via });
     }
     catch (cause) {
         if (cause instanceof PublicationError) {
@@ -33,17 +21,17 @@ export function acceptRoute(input) {
         throw cause;
     }
 }
-/** Project one semantic remote binding into its admitted protocol route representation. */
+/** Project an installed release binding into a release `Via`; legacy emitters use `legacy.remoteRoute`. */
 export function remoteRoute(origin, binding, issuer) {
     return acceptRoute({
         endpoint: binding.endpoint,
         via: {
             kind: 'via',
-            publication: {
+            release: {
                 origin,
                 identity: { issuer: binding.issuer, subject: binding.subject },
                 revision: binding.revision,
-                etag: binding.etag,
+                digest: binding.release,
             },
             issuer,
         },
@@ -79,4 +67,3 @@ export function decodeRedirectResponse(input) {
         redirect: acceptRedirection(object.redirect),
     });
 }
-//# sourceMappingURL=redirect.js.map

package/dist/invocation/request.d.ts

@@ -19,4 +19,3 @@ export interface Request {
     readonly trace?: Trace;
 }
 export declare function decodeRequest(input: unknown): Request;
-//# sourceMappingURL=request.d.ts.map

package/dist/invocation/request.js

@@ -3,7 +3,7 @@ import { acceptDelegate } from './delegate.js';
 import { acceptIdempotencyKey } from './idempotency.js';
 import { acceptRouting } from './routing.js';
 import { acceptSchemaTarget } from './schema.js';
-import { acceptCall } from './target.js';
+import { callFromSnapshot } from './target.js';
 import { admitTrace } from './trace.js';
 const REQUEST_FIELDS = new Set([
     'version',
@@ -39,7 +39,7 @@ export function decodeRequest(input) {
     return Object.freeze({
         version: 2,
         requestId: requestId(object.requestId, 'request.requestId'),
-        call: acceptCall(object.call),
+        call: callFromSnapshot(object.call),
         ...(credential === undefined ? {} : { credential }),
         ...(delegate === undefined ? {} : { delegate }),
         ...(routing === undefined ? {} : { routing }),
@@ -52,4 +52,3 @@ export function decodeRequest(input) {
         ...(trace === undefined ? {} : { trace }),
     });
 }
-//# sourceMappingURL=request.js.map

package/dist/invocation/response.d.ts

@@ -17,4 +17,3 @@ export interface ErrorResponse extends ResponseContext {
 }
 export type Response<Result extends Value = Value> = SuccessResponse<Result> | ErrorResponse | RedirectResponse | Stale | Miss;
 export declare function decodeResponse(input: unknown): Response;
-//# sourceMappingURL=response.d.ts.map

package/dist/invocation/response.js

@@ -36,4 +36,3 @@ export function decodeResponse(input) {
         return decodeMiss(object);
     return invalid('response must contain a result, error, redirect, stale, or miss control');
 }
-//# sourceMappingURL=response.js.map