@astrale-os/kernel-protocol 0.5.0-beta.8 → 0.5.0

package/dist/routes/admission.js

@@ -1,90 +1,11 @@
-import { accept as acceptPortable } from '@astrale-os/kernel-dsl/value';
-import { acceptReference } from '../publication/reference.js';
-import { admitRoute } from '../publication/route.js';
-import { fail } from './error.js';
-const AUTH = new Set(['anonymous', 'authenticated', 'authorized']);
-const OUTPUT = new Set(['value', 'stream', 'binary']);
-/** Admit one emitted portable Table before Server composition. */
+import { acceptReference } from '../release/reference.js';
+import { acceptEntries, tableObject } from './entries.js';
+/** Admit one emitted portable release Table before Server composition. */
 export function acceptTable(input) {
-    const value = object(acceptPortable(input), 'Route Table');
-    exact(value, ['publication', 'entries'], 'Route Table');
-    const reference = acceptReference(value.publication);
-    if (!Array.isArray(value.entries))
-        invalid('Route Table entries');
-    const entries = value.entries.map((entry) => acceptRoute(entry, reference.origin));
-    if (new Set(entries.map(({ name }) => name)).size !== entries.length) {
-        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table names must be unique.');
-    }
-    return Object.freeze({ publication: reference, entries: Object.freeze(entries) });
-}
-function acceptRoute(input, origin) {
-    const value = object(input, 'Route Table entry');
-    exact(value, ['name', 'callable', 'target', 'auth', 'output', 'href', 'method', 'default'], 'Route Table entry', ['requestMethod', 'query', 'headers', 'body', 'credential']);
-    if (typeof value.default !== 'boolean')
-        invalid('Route Table default');
-    if (typeof value.auth !== 'string' || !AUTH.has(value.auth)) {
-        invalid('Route Table auth');
-    }
-    if (typeof value.output !== 'string' || !OUTPUT.has(value.output))
-        invalid('Route Table output');
-    const wire = admitRoute({
-        name: value.name,
-        callable: value.callable,
-        href: value.href,
-        method: value.method,
-        ...(value.default === true ? { default: true } : {}),
-        ...(value.requestMethod === undefined ? {} : { requestMethod: value.requestMethod }),
-        ...(value.query === undefined ? {} : { query: value.query }),
-        ...(value.headers === undefined ? {} : { headers: value.headers }),
-        ...(value.body === undefined ? {} : { body: value.body }),
-        ...(value.credential === undefined ? {} : { credential: value.credential }),
-        ...receiver(value.target),
-    }, origin);
-    const { default: _default, receiver: _receiver, ...common } = wire;
+    const value = tableObject(input, ['release', 'entries']);
+    const reference = acceptReference(value.release);
     return Object.freeze({
-        ...common,
-        target: target(value.target),
-        auth: value.auth,
-        output: value.output,
-        default: value.default,
+        release: reference,
+        entries: acceptEntries(value.entries, reference.origin),
     });
 }
-function target(input) {
-    const value = object(input, 'Route target');
-    if (value.kind === 'function') {
-        exact(value, ['kind'], 'Route Function target');
-        return Object.freeze({ kind: 'function' });
-    }
-    if (value.kind !== 'method' || (value.dispatch !== 'static' && value.dispatch !== 'instance')) {
-        invalid('Route Method target');
-    }
-    if (value.dispatch === 'static') {
-        exact(value, ['kind', 'dispatch'], 'Route static Method target');
-        return Object.freeze({ kind: 'method', dispatch: 'static' });
-    }
-    exact(value, ['kind', 'dispatch', 'receiver'], 'Route instance Method target');
-    if (typeof value.receiver !== 'string')
-        invalid('Route receiver');
-    return Object.freeze({ kind: 'method', dispatch: 'instance', receiver: value.receiver });
-}
-function receiver(input) {
-    const admitted = target(input);
-    return admitted.kind === 'method' && admitted.dispatch === 'instance'
-        ? { receiver: admitted.receiver }
-        : {};
-}
-function object(input, label) {
-    if (input === null || typeof input !== 'object' || Array.isArray(input))
-        invalid(label);
-    return input;
-}
-function exact(value, required, label, optional = []) {
-    const allowed = new Set([...required, ...optional]);
-    if (Object.keys(value).some((key) => !allowed.has(key)) ||
-        required.some((key) => !Object.hasOwn(value, key)))
-        invalid(label);
-}
-function invalid(label) {
-    return fail('NATIVE_ROUTE_BINDING_INVALID', `${label} is invalid.`);
-}
-//# sourceMappingURL=admission.js.map

package/dist/routes/binding.d.ts

@@ -1,7 +1,6 @@
 import type { Domain } from '@astrale-os/kernel-dsl/v1';
-import type { Publication } from '../publication/publication.js';
+import type { DomainRelease } from '../release/release.js';
 import type { Plan } from './plan.js';
 import type { Table } from './table.js';
-/** Bind one Plan to an exact placed Publication and matching resolved Domain. */
-export declare function bind(plan: Plan, deployed: Publication, domain: Domain): Table;
-//# sourceMappingURL=binding.d.ts.map
+/** Bind one Plan to an exact placed release and matching resolved Domain. */
+export declare function bind(plan: Plan, deployed: DomainRelease, domain: Domain, publicUrl?: string): Table;

package/dist/routes/binding.js

@@ -1,28 +1,17 @@
-import { json } from '@astrale-os/kernel-dsl/value';
-import { reference } from '../publication/reference.js';
+import { reference } from '../release/reference.js';
+import { placedEntries, placementMismatch } from './entries.js';
 import { fail } from './error.js';
-import { place } from './placement.js';
 import { rejectReserved } from './reservation.js';
-/** Bind one Plan to an exact placed Publication and matching resolved Domain. */
-export function bind(plan, deployed, domain) {
-    if (plan.origin !== deployed.origin ||
-        plan.origin !== domain.origin ||
-        plan.revision !== deployed.schema.revision ||
-        plan.revision !== domain.revision) {
-        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Plan, Publication, and Domain identity differ.');
+/** Bind one Plan to an exact placed release and matching resolved Domain. */
+export function bind(plan, deployed, domain, publicUrl = deployed.identity.issuer) {
+    const mismatch = placementMismatch(plan, deployed, domain, publicUrl);
+    if (mismatch === 'identity') {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Plan, Release, and Domain identity differ.');
     }
-    if (json.serialize(place(plan, deployed.identity.issuer)) !==
-        json.serialize(deployed.routes)) {
-        fail('NATIVE_ROUTE_BINDING_INVALID', 'Publication routes differ from the placed Route Plan.');
+    if (mismatch === 'routes') {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Release routes differ from the placed Route Plan.');
     }
-    const entries = plan.entries.map((entry, index) => {
-        const { path: _path, ...portable } = entry;
-        return Object.freeze({ ...portable, href: deployed.routes[index].href });
-    });
+    const entries = placedEntries(plan, deployed);
     rejectReserved(deployed, entries);
-    return Object.freeze({
-        publication: reference(deployed),
-        entries: Object.freeze(entries),
-    });
+    return Object.freeze({ release: reference(deployed), entries });
 }
-//# sourceMappingURL=binding.js.map

package/dist/routes/collision.d.ts

@@ -1,3 +1,2 @@
 import type { Route } from './table.js';
 export declare function rejectCollisions(entries: readonly Route[]): void;
-//# sourceMappingURL=collision.d.ts.map

package/dist/routes/collision.js

@@ -14,4 +14,3 @@ export function rejectCollisions(entries) {
 function overlap(left, right) {
     return left === '*' || right === '*' || left === right;
 }
-//# sourceMappingURL=collision.js.map

package/dist/routes/compiler.d.ts

@@ -1,9 +1,8 @@
 import type { Domain } from '@astrale-os/kernel-dsl/v1';
-import type * as publication from '../publication/index.js';
+import type { HttpRouteDeclaration } from '../release/route.js';
 import type { Plan } from './plan.js';
 export interface CompileInput {
-    readonly routes: readonly publication.HttpRouteDeclaration[];
+    readonly routes: readonly HttpRouteDeclaration[];
     readonly domain: Domain;
 }
 export declare function compile(input: CompileInput): Plan;
-//# sourceMappingURL=compiler.d.ts.map

package/dist/routes/compiler.js

@@ -1,4 +1,5 @@
-import { admitRouteDeclaration } from '../publication/route.js';
+import { isBinaryInput } from '@astrale-os/kernel-dsl/v1/language';
+import { admitRouteDeclaration } from '../release/route.js';
 import { rejectCollisions } from './collision.js';
 import { fail } from './error.js';
 import { validateCredentialMapping, validateMapping, validateWireMapping } from './mapping.js';
@@ -11,8 +12,11 @@ export function compile(input) {
     const authored = input.routes.map((entry) => admitRouteDeclaration(entry, input.domain.origin));
     const entries = authored.map((declaration) => {
         const meaning = input.domain.callable(declaration.callable);
-        if (meaning === undefined) {
-            fail('NATIVE_ROUTE_BINDING_INVALID', `Unknown callable ${declaration.callable}.`);
+        if (meaning === undefined || (isMethod(meaning) && !meaning.executable)) {
+            fail('NATIVE_ROUTE_BINDING_INVALID', `Unavailable callable ${declaration.callable}.`);
+        }
+        if (isBinaryInput(meaning.definition.input)) {
+            fail('NATIVE_ROUTE_BINDING_INVALID', `Native route ${declaration.name} cannot bind a binary-input Function.`);
         }
         const href = placePath(declaration.path, 'https://routes.invalid');
         const route = { ...declaration, href };
@@ -48,4 +52,3 @@ export function compile(input) {
 function isMethod(meaning) {
     return 'owner' in meaning;
 }
-//# sourceMappingURL=compiler.js.map

package/dist/routes/credential.d.ts

@@ -1,9 +1,18 @@
-import type { HttpRoute, SingleCredentialSource } from '../publication/index.js';
+import type { HttpRoute, SingleCredentialSource } from '../release/route.js';
 import type { Route } from './table.js';
 export declare function credentialSources(route: Pick<HttpRoute, 'credential'>): readonly SingleCredentialSource[];
 export declare function firstCredentialIsAmbient(entry: Route): boolean;
 export declare function specificHeaderWires(entry: Route): ReadonlySet<string>;
 export declare function putCredential(entry: Route, url: URL, headers: Record<string, string>, credential: string): void;
 export declare function withoutCredentialHeaders(entry: Route, input: Readonly<Record<string, string>>): Record<string, string>;
-export declare function readCredential(entry: Route, url: URL, headers: Record<string, string>): string | undefined;
-//# sourceMappingURL=credential.d.ts.map
+/** A credential value together with the request channel that actually carried it. */
+export interface LocatedCredential {
+    readonly value: string;
+    readonly in: SingleCredentialSource['in'];
+}
+/**
+ * Read the request credential and report which declared channel supplied it. A `cookie` channel is
+ * ambient (the browser attaches it automatically), which the Server uses to decide CSRF defense; a
+ * `header` (Bearer) or `query` channel is caller-chosen and not CSRF-exposed.
+ */
+export declare function locateCredential(entry: Route, url: URL, headers: Record<string, string>): LocatedCredential | undefined;

package/dist/routes/credential.js

@@ -51,8 +51,12 @@ export function withoutCredentialHeaders(entry, input) {
     }
     return output;
 }
-export function readCredential(entry, url, headers) {
-    const found = [];
+/**
+ * Read the request credential and report which declared channel supplied it. A `cookie` channel is
+ * ambient (the browser attaches it automatically), which the Server uses to decide CSRF defense; a
+ * `header` (Bearer) or `query` channel is caller-chosen and not CSRF-exposed.
+ */
+export function locateCredential(entry, url, headers) {
     if (entry.credential === undefined) {
         const authorization = headers.authorization;
         if (authorization === undefined)
@@ -60,8 +64,9 @@ export function readCredential(entry, url, headers) {
         const matched = /^Bearer[ \t]+([^\s]+)$/iu.exec(authorization.trim());
         if (matched === null)
             invalidRequest('Authorization must contain one Bearer credential.');
-        return matched[1];
+        return { value: matched[1], in: 'header' };
     }
+    const found = [];
     for (const source of credentialSources(entry)) {
         let value;
         if (source.in === 'header') {
@@ -78,7 +83,7 @@ export function readCredential(entry, url, headers) {
             value = cookie(headers.cookie, source.name);
         }
         if (value !== undefined)
-            found.push(value);
+            found.push({ value, in: source.in });
     }
     if (found.length > 1)
         invalidRequest('Request supplies more than one Astrale credential channel.');
@@ -116,4 +121,3 @@ function withoutCookie(header, name) {
         .join('; ');
     return value.length === 0 ? undefined : value;
 }
-//# sourceMappingURL=credential.js.map

package/dist/routes/decode.d.ts

@@ -1,6 +1,8 @@
 import type { Domain } from '@astrale-os/kernel-dsl/v1';
-import type { PublicationRef } from '../publication/index.js';
 import type { HttpRequest, Invocation } from './request.js';
+import type { ServedReferences } from './routing.js';
 import type { Route } from './table.js';
-export declare function decode(entry: Route, request: HttpRequest, domain: Domain, served: PublicationRef): Invocation;
-//# sourceMappingURL=decode.d.ts.map
+/** Decode one native route request served by a release-backed destination. */
+export declare function decode(entry: Route, request: HttpRequest, domain: Domain, served: ServedReferences): Invocation;
+/** Decode one native route request, reading its routing pair with `routing` at its fixed step. */
+export declare function decodeInvocation(entry: Route, request: HttpRequest, domain: Domain, routing: (input: HttpRequest) => Invocation['routing']): Invocation;

package/dist/routes/decode.js

@@ -1,16 +1,26 @@
-import { NodePath, Path } from '@astrale-os/kernel-core/path';
-import { callableAddress } from '@astrale-os/kernel-dsl/v1/addressing';
+import { NodePath } from '@astrale-os/kernel-core/path';
 import * as portable from '@astrale-os/kernel-dsl/value';
-import { readCredential, specificHeaderWires, withoutCredentialHeaders } from './credential.js';
+import { locateCredential, specificHeaderWires, withoutCredentialHeaders } from './credential.js';
 import { fail, invalidRequest } from './error.js';
 import { isReservedHeader } from './mapping.js';
 import { methodMatches } from './match.js';
 import { bodyText, normalizeHeaders, parseJsonObject } from './request.js';
 import { decodeRouting } from './routing.js';
 import { decodeScalar } from './scalar.js';
-import { requiresReceiver } from './target.js';
+import { requiresReceiver, routeFingerprint } from './target.js';
 import { matchTemplate, PLACEHOLDER } from './template.js';
+/** Decode one native route request served by a release-backed destination. */
 export function decode(entry, request, domain, served) {
+    return decodeInvocation(entry, request, domain, (input) => {
+        const routing = decodeRouting(input, served);
+        if (routing?.kind === 'stale') {
+            fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match does not name the served release.');
+        }
+        return routing;
+    });
+}
+/** Decode one native route request, reading its routing pair with `routing` at its fixed step. */
+export function decodeInvocation(entry, request, domain, routing) {
     if (!methodMatches(entry, request.method))
         invalidRequest('HTTP method does not match the route.');
     const matched = matchTemplate(entry.href, request.url);
@@ -34,8 +44,9 @@ export function decode(entry, request, domain, served) {
         throw cause;
     }
     const headers = normalizeHeaders(request.headers);
-    const credential = readCredential(entry, url, headers);
-    const routing = decodeRouting(request, served);
+    const located = locateCredential(entry, url, headers);
+    const credential = located?.value;
+    const routed = routing(request);
     const applicationHeaders = withoutCredentialHeaders(entry, headers);
     for (const [name, wire] of Object.entries(entry.query ?? {})) {
         const found = url.searchParams.getAll(wire);
@@ -112,20 +123,16 @@ export function decode(entry, request, domain, served) {
         }
         throw cause;
     }
-    const coordinate = callableAddress(entry.callable);
-    const target = coordinate.kind === 'method'
-        ? receiver === undefined
-            ? Path.staticMethod(Path.project(coordinate.owner), coordinate.name).raw
-            : Path.instanceMethod(Path.from(receiver), coordinate.name).raw
-        : Path.project({
-            origin: coordinate.origin,
-            kind: 'function',
-            name: coordinate.name,
-        }).raw;
+    const target = Object.freeze({
+        callable: entry.callable,
+        fingerprint: routeFingerprint(domain, entry.callable),
+        ...(receiver === undefined ? {} : { instance: receiver }),
+    });
     return Object.freeze({
         call: Object.freeze({ target, input }),
         ...(credential === undefined ? {} : { credential }),
-        ...(routing === undefined ? {} : { routing }),
+        ...(located === undefined ? {} : { credentialIn: located.in }),
+        ...(routed === undefined ? {} : { routing: routed }),
     });
 }
 function remainderFields(entry, domain) {
@@ -145,4 +152,3 @@ function remainderFields(entry, domain) {
     }
     return allowed;
 }
-//# sourceMappingURL=decode.js.map

package/dist/routes/deployment-retired.d.ts

@@ -0,0 +1,30 @@
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { DeploymentRetiredReason, ErrorResponse } from '../invocation/index.js';
+import type { ReleaseDigest } from '../release/digest.js';
+import type { HttpRequest } from './request.js';
+/**
+ * Reserved control of a deployment that no longer serves. Every emitter (the deployment
+ * dispatchers, a release-snapshot server) answers every path with the same 410, headers and
+ * envelope, and never runs other code in its place.
+ */
+export interface DeploymentRetired {
+    readonly kind: 'deployment-retired';
+    readonly reason: DeploymentRetiredReason;
+}
+export declare const HTTP_DEPLOYMENT_RETIRED: 'x-astrale-deployment-retired';
+export declare const HTTP_DEPLOYMENT_RETIRED_STATUS: 410;
+export declare function deploymentRetiredHeaders(): Readonly<Record<string, string>>;
+/**
+ * The envelope every deployed client already decodes from any status: a not-found Service error
+ * carrying `DEPLOYMENT_RETIRED`, attributed to the deployment rather than to one request. An
+ * emitter passing a deployment that is not a canonical issuer origin, or a release that is not a
+ * release digest, gets a `TypeError` naming that argument.
+ */
+export declare function deploymentRetiredBody(deployment: IssuerId, release?: ReleaseDigest): ErrorResponse;
+/**
+ * Recognize only the reserved status, header, `no-store` and envelope together. A 410 without the
+ * header is ordinary application behavior; the header with another status or value, without
+ * `Cache-Control: no-store`, or beside any other body (including one correlated to a request or
+ * whose invocation source is not the retired deployment), is an invalid response.
+ */
+export declare function decodeDeploymentRetired(status: number, headers: HttpRequest['headers'], body: unknown): DeploymentRetired | undefined;

package/dist/routes/deployment-retired.js

@@ -0,0 +1,96 @@
+import { is as isIssuer } from '@astrale-os/kernel-core/auth/issuer';
+import { CONTENT_TYPE_JSON } from '../codecs/media-types.js';
+import { CODES, ProtocolError } from '../errors/index.js';
+import { DEPLOYMENT_RETIRED, decodeResponse, serviceErrorOf } from '../invocation/index.js';
+import { fail } from './error.js';
+import { reservedHeader } from './header.js';
+export const HTTP_DEPLOYMENT_RETIRED = 'x-astrale-deployment-retired';
+export const HTTP_DEPLOYMENT_RETIRED_STATUS = 410;
+const MESSAGE = 'This deployment is retired.';
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+export function deploymentRetiredHeaders() {
+    return Object.freeze({
+        [HTTP_DEPLOYMENT_RETIRED]: '1',
+        'cache-control': 'no-store',
+        'content-type': CONTENT_TYPE_JSON,
+    });
+}
+/**
+ * The envelope every deployed client already decodes from any status: a not-found Service error
+ * carrying `DEPLOYMENT_RETIRED`, attributed to the deployment rather than to one request. An
+ * emitter passing a deployment that is not a canonical issuer origin, or a release that is not a
+ * release digest, gets a `TypeError` naming that argument.
+ */
+export function deploymentRetiredBody(deployment, release) {
+    assertEmitterInput(deployment, release);
+    return decodeRetired({
+        requestId: null,
+        invocation: { source: deployment, id: 'unavailable' },
+        error: {
+            code: CODES.NOT_FOUND,
+            message: MESSAGE,
+            data: {
+                code: DEPLOYMENT_RETIRED,
+                details: { deployment, ...(release === undefined ? {} : { release }) },
+            },
+        },
+    }).envelope;
+}
+/**
+ * Recognize only the reserved status, header, `no-store` and envelope together. A 410 without the
+ * header is ordinary application behavior; the header with another status or value, without
+ * `Cache-Control: no-store`, or beside any other body (including one correlated to a request or
+ * whose invocation source is not the retired deployment), is an invalid response.
+ */
+export function decodeDeploymentRetired(status, headers, body) {
+    const encoded = reservedHeader(headers, HTTP_DEPLOYMENT_RETIRED);
+    if (encoded === undefined)
+        return undefined;
+    if (status !== HTTP_DEPLOYMENT_RETIRED_STATUS || encoded !== '1') {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_DEPLOYMENT_RETIRED} is reserved for status ${HTTP_DEPLOYMENT_RETIRED_STATUS} with value 1.`);
+    }
+    if (!cacheDirectives(headers).includes('no-store')) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_DEPLOYMENT_RETIRED} requires Cache-Control: no-store.`);
+    }
+    return Object.freeze({ kind: 'deployment-retired', reason: decodeRetired(body).reason });
+}
+function decodeRetired(input) {
+    let envelope;
+    try {
+        envelope = decodeResponse(input);
+    }
+    catch (cause) {
+        if (cause instanceof ProtocolError)
+            return invalid(cause);
+        throw cause;
+    }
+    const failure = 'error' in envelope ? serviceErrorOf(envelope.error) : undefined;
+    if (failure === undefined ||
+        failure.data.code !== DEPLOYMENT_RETIRED ||
+        envelope.requestId !== null ||
+        envelope.invocation.source !== failure.data.details.deployment) {
+        return invalid();
+    }
+    return { envelope: envelope, reason: failure.data };
+}
+/** Every `Cache-Control` directive, lower-cased, across repeated fields in any spelling. */
+function cacheDirectives(input) {
+    const fields = input instanceof Headers
+        ? [input.get('cache-control') ?? '']
+        : Object.entries(input ?? {})
+            .filter(([name]) => name.toLowerCase() === 'cache-control')
+            .flatMap(([, value]) => value ?? []);
+    return fields.flatMap((field) => field.split(',').map((d) => d.trim().toLowerCase()));
+}
+/** Emitter-side programmer invariant: never reported as a received-response decode failure. */
+function assertEmitterInput(deployment, release) {
+    if (!isIssuer(deployment)) {
+        throw new TypeError('deploymentRetiredBody: deployment must be a canonical issuer origin.');
+    }
+    if (release !== undefined && (typeof release !== 'string' || !DIGEST.test(release))) {
+        throw new TypeError('deploymentRetiredBody: release must be a sha256 release digest.');
+    }
+}
+function invalid(cause) {
+    return fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_DEPLOYMENT_RETIRED} requires the deployment-retired error envelope.`, cause);
+}

package/dist/routes/encode.d.ts

@@ -2,4 +2,3 @@ import type { Domain } from '@astrale-os/kernel-dsl/v1';
 import type { Invocation, Request } from './request.js';
 import type { Route } from './table.js';
 export declare function encode(entry: Route, invocation: Invocation, domain: Domain): Request;
-//# sourceMappingURL=encode.d.ts.map

package/dist/routes/encode.js

@@ -1,23 +1,30 @@
+import { targetPath } from '@astrale-os/kernel-core/callable';
 import { Path } from '@astrale-os/kernel-core/path';
 import { callableAddress } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as portable from '@astrale-os/kernel-dsl/value';
+import { routedDigest } from '../invocation/index.js';
 import { firstCredentialIsAmbient, putCredential, specificHeaderWires, withoutCredentialHeaders, } from './credential.js';
 import { fail, invalidRequest } from './error.js';
 import { isReservedHeader } from './mapping.js';
-import { encodeStrongEtag, HTTP_ROUTE_ISSUER, HTTP_ROUTE_PUBLICATION } from './routing.js';
+import { encodeStrongEtag, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER } from './routing.js';
 import { asObject, encodeScalar, scalar } from './scalar.js';
-import { requiresReceiver } from './target.js';
+import { requiresReceiver, routeFingerprint } from './target.js';
 import { authorityEnd, encodeTemplate, PLACEHOLDER } from './template.js';
 export function encode(entry, invocation, domain) {
+    if (typeof invocation.call.target !== 'string' &&
+        invocation.call.target.fingerprint !== undefined &&
+        invocation.call.target.fingerprint !== routeFingerprint(domain, entry.callable)) {
+        invalidRequest('Invocation Target fingerprint does not match the selected route Domain.');
+    }
     const input = asObject(invocation.call.input);
-    const target = Path.from(invocation.call.target);
+    const target = Path.from(targetPath(invocation.call.target));
     const needsReceiver = requiresReceiver(entry);
     const coordinate = callableAddress(entry.callable);
     const methodName = coordinate.kind === 'method' ? coordinate.name : undefined;
     const receiver = needsReceiver ? instanceSource(target, methodName) : undefined;
     const source = receiver?.raw;
     const expected = needsReceiver
-        ? Path.instanceMethod(receiver, methodName).raw
+        ? Path.instanceMethod(receiver, entry.callable).raw
         : coordinate.kind === 'method'
             ? Path.staticMethod(Path.project(coordinate.owner), methodName).raw
             : Path.project({
@@ -103,7 +110,7 @@ export function encode(entry, invocation, domain) {
         }
     }
     if (invocation.routing !== undefined) {
-        headers[HTTP_ROUTE_PUBLICATION] = encodeStrongEtag(invocation.routing.publication.etag);
+        headers[HTTP_ROUTE_DIGEST] = encodeStrongEtag(routedDigest(invocation.routing));
         headers[HTTP_ROUTE_ISSUER] = invocation.routing.issuer;
     }
     url = parsed.toString();
@@ -143,4 +150,3 @@ function instanceSource(target, name) {
     }
     return Path.fromAST({ anchor: target.ast.anchor, steps: steps.slice(0, -1) });
 }
-//# sourceMappingURL=encode.js.map

package/dist/routes/entries.d.ts

@@ -0,0 +1,23 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { Object as JsonObject, Value as JsonValue } from '@astrale-os/kernel-dsl/value';
+import type { Plan } from './plan.js';
+import type { Placed } from './reservation.js';
+import type { Route } from './table.js';
+type Meaning = Pick<Domain, 'origin' | 'revision' | 'callable'>;
+/**
+ * The coordinate in which a served document differs from one Plan placed at `publicUrl`: its
+ * origin or schema revision (`identity`), or its route wire (`routes`). Each Table words its own
+ * refusal after the document it binds.
+ */
+export declare function placementMismatch(plan: Plan, deployed: Placed, domain: Domain, publicUrl: string): 'identity' | 'routes' | undefined;
+/** The entries of one placed Plan at the hrefs its served document publishes. */
+export declare function placedEntries(plan: Plan, deployed: Pick<Placed, 'routes'>): readonly Route[];
+/** Whether entries carry exactly the route wire and Domain identity of one served document. */
+export declare function sameServedWire(entries: readonly Route[], deployed: Pick<Placed, 'origin' | 'schema' | 'routes'>, domain: Meaning): boolean;
+/** Refuse an entry whose target, auth or output differs from the Domain's callable meaning. */
+export declare function verifyMeaning(entries: readonly Route[], domain: Meaning): void;
+/** Admit one portable Table object holding exactly `fields`. */
+export declare function tableObject(input: unknown, fields: readonly string[]): JsonObject;
+/** Admit the entries of one Table bound to `origin`; an invalid route wire is a `ReleaseError`. */
+export declare function acceptEntries(input: JsonValue | undefined, origin: string): readonly Route[];
+export {};