@astrale-os/kernel-protocol 0.5.0-beta.8 → 1.0.0-beta.1

package/dist/routes/entries.js

@@ -0,0 +1,150 @@
+import { accept as acceptPortable, json } from '@astrale-os/kernel-dsl/value';
+import { admitRoute } from '../release/route.js';
+import { fail } from './error.js';
+import { place } from './placement.js';
+const AUTH = new Set(['anonymous', 'authenticated', 'authorized']);
+const OUTPUT = new Set(['value', 'stream', 'binary']);
+/**
+ * The coordinate in which a served document differs from one Plan placed at `publicUrl`: its
+ * origin or schema revision (`identity`), or its route wire (`routes`). Each Table words its own
+ * refusal after the document it binds.
+ */
+export function placementMismatch(plan, deployed, domain, publicUrl) {
+    if (plan.origin !== deployed.origin ||
+        plan.origin !== domain.origin ||
+        plan.revision !== deployed.schema.revision ||
+        plan.revision !== domain.revision) {
+        return 'identity';
+    }
+    return json.serialize(place(plan, publicUrl)) ===
+        json.serialize(deployed.routes)
+        ? undefined
+        : 'routes';
+}
+/** The entries of one placed Plan at the hrefs its served document publishes. */
+export function placedEntries(plan, deployed) {
+    return Object.freeze(plan.entries.map((entry, index) => {
+        const { path: _path, ...portable } = entry;
+        return Object.freeze({ ...portable, href: deployed.routes[index].href });
+    }));
+}
+/** Whether entries carry exactly the route wire and Domain identity of one served document. */
+export function sameServedWire(entries, deployed, domain) {
+    return (domain.origin === deployed.origin &&
+        domain.revision === deployed.schema.revision &&
+        json.serialize(entries.map(wireRoute)) === json.serialize(deployed.routes));
+}
+/** Refuse an entry whose target, auth or output differs from the Domain's callable meaning. */
+export function verifyMeaning(entries, domain) {
+    for (const entry of entries) {
+        const meaning = domain.callable(entry.callable);
+        const targetMatches = meaning !== undefined &&
+            ((entry.target.kind === 'function' && !isMethod(meaning)) ||
+                (entry.target.kind === 'method' &&
+                    isMethod(meaning) &&
+                    meaning.executable &&
+                    entry.target.dispatch === (meaning.static ? 'static' : 'instance')));
+        if (!targetMatches || meaning.auth !== entry.auth || meaning.output.mode !== entry.output) {
+            fail('NATIVE_ROUTE_BINDING_INVALID', `Route ${entry.name} differs from Domain meaning.`);
+        }
+    }
+}
+/** Admit one portable Table object holding exactly `fields`. */
+export function tableObject(input, fields) {
+    const value = object(acceptPortable(input), 'Route Table');
+    exact(value, fields, 'Route Table');
+    return value;
+}
+/** Admit the entries of one Table bound to `origin`; an invalid route wire is a `ReleaseError`. */
+export function acceptEntries(input, origin) {
+    if (!Array.isArray(input))
+        invalid('Route Table entries');
+    const entries = input.map((entry) => acceptRoute(entry, origin));
+    if (new Set(entries.map(({ name }) => name)).size !== entries.length) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table names must be unique.');
+    }
+    return Object.freeze(entries);
+}
+function acceptRoute(input, origin) {
+    const value = object(input, 'Route Table entry');
+    exact(value, ['name', 'callable', 'target', 'auth', 'output', 'href', 'method', 'default'], 'Route Table entry', ['requestMethod', 'query', 'headers', 'body', 'credential']);
+    if (typeof value.default !== 'boolean')
+        invalid('Route Table default');
+    if (typeof value.auth !== 'string' || !AUTH.has(value.auth)) {
+        invalid('Route Table auth');
+    }
+    if (typeof value.output !== 'string' || !OUTPUT.has(value.output))
+        invalid('Route Table output');
+    const wire = admitRoute({
+        name: value.name,
+        callable: value.callable,
+        href: value.href,
+        method: value.method,
+        ...(value.default === true ? { default: true } : {}),
+        ...(value.requestMethod === undefined ? {} : { requestMethod: value.requestMethod }),
+        ...(value.query === undefined ? {} : { query: value.query }),
+        ...(value.headers === undefined ? {} : { headers: value.headers }),
+        ...(value.body === undefined ? {} : { body: value.body }),
+        ...(value.credential === undefined ? {} : { credential: value.credential }),
+        ...receiver(value.target),
+    }, origin);
+    const { default: _default, receiver: _receiver, ...common } = wire;
+    return Object.freeze({
+        ...common,
+        target: target(value.target),
+        auth: value.auth,
+        output: value.output,
+        default: value.default,
+    });
+}
+function target(input) {
+    const value = object(input, 'Route target');
+    if (value.kind === 'function') {
+        exact(value, ['kind'], 'Route Function target');
+        return Object.freeze({ kind: 'function' });
+    }
+    if (value.kind !== 'method' || (value.dispatch !== 'static' && value.dispatch !== 'instance')) {
+        invalid('Route Method target');
+    }
+    if (value.dispatch === 'static') {
+        exact(value, ['kind', 'dispatch'], 'Route static Method target');
+        return Object.freeze({ kind: 'method', dispatch: 'static' });
+    }
+    exact(value, ['kind', 'dispatch', 'receiver'], 'Route instance Method target');
+    if (typeof value.receiver !== 'string')
+        invalid('Route receiver');
+    return Object.freeze({ kind: 'method', dispatch: 'instance', receiver: value.receiver });
+}
+function receiver(input) {
+    const admitted = target(input);
+    return admitted.kind === 'method' && admitted.dispatch === 'instance'
+        ? { receiver: admitted.receiver }
+        : {};
+}
+function isMethod(meaning) {
+    return 'owner' in meaning;
+}
+function wireRoute(entry) {
+    const { target, auth: _auth, output: _output, default: isDefault, ...wire } = entry;
+    return {
+        ...wire,
+        ...(isDefault ? { default: true } : {}),
+        ...(target.kind === 'method' && target.dispatch === 'instance'
+            ? { receiver: target.receiver }
+            : {}),
+    };
+}
+function object(input, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(label);
+    return input;
+}
+function exact(value, required, label, optional = []) {
+    const allowed = new Set([...required, ...optional]);
+    if (Object.keys(value).some((key) => !allowed.has(key)) ||
+        required.some((key) => !Object.hasOwn(value, key)))
+        invalid(label);
+}
+function invalid(label) {
+    return fail('NATIVE_ROUTE_BINDING_INVALID', `${label} is invalid.`);
+}

package/dist/routes/error-response.d.ts

@@ -3,4 +3,3 @@ export interface ErrorResponse {
     readonly error: ErrorPayload;
 }
 export declare function decodeErrorResponse(input: unknown): ErrorResponse;
-//# sourceMappingURL=error-response.d.ts.map

package/dist/routes/error-response.js

@@ -29,4 +29,3 @@ function isValueObject(value) {
 function invalid(cause) {
     return fail('NATIVE_ROUTE_RESPONSE_INVALID', 'Native route error response is invalid.', cause);
 }
-//# sourceMappingURL=error-response.js.map

package/dist/routes/error.d.ts

@@ -6,4 +6,3 @@ export declare class RouteError extends Error {
 }
 export declare function fail(code: ErrorCode, message: string, cause?: unknown): never;
 export declare function invalidRequest(message: string): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/routes/error.js

@@ -12,4 +12,3 @@ export function fail(code, message, cause) {
 export function invalidRequest(message) {
     return fail('NATIVE_ROUTE_REQUEST_INVALID', message);
 }
-//# sourceMappingURL=error.js.map

package/dist/routes/evidence.d.ts

@@ -1,6 +1,5 @@
 import type { Domain } from '@astrale-os/kernel-dsl/v1';
-import type { Publication } from '../publication/publication.js';
+import type { DomainRelease } from '../release/release.js';
 import type { Table } from './table.js';
-/** Verify that an admitted Table carries the exact published wire and Domain meaning. */
-export declare function verifyTable(table: Table, deployed: Publication, domain: Pick<Domain, 'origin' | 'revision' | 'callable'>): Table;
-//# sourceMappingURL=evidence.d.ts.map
+/** Verify that an admitted Table carries the exact released wire and Domain meaning. */
+export declare function verifyTable(table: Table, deployed: DomainRelease, domain: Pick<Domain, 'origin' | 'revision' | 'callable'>): Table;

package/dist/routes/evidence.js

@@ -1,39 +1,12 @@
-import { json } from '@astrale-os/kernel-dsl/value';
-import { compareReferences, reference } from '../publication/reference.js';
+import { compareReferences, reference } from '../release/reference.js';
+import { sameServedWire, verifyMeaning } from './entries.js';
 import { fail } from './error.js';
-/** Verify that an admitted Table carries the exact published wire and Domain meaning. */
+/** Verify that an admitted Table carries the exact released wire and Domain meaning. */
 export function verifyTable(table, deployed, domain) {
-    if (compareReferences(table.publication, reference(deployed)) !== 'exact' ||
-        domain.origin !== deployed.origin ||
-        domain.revision !== deployed.schema.revision ||
-        json.serialize(table.entries.map(wireRoute)) !==
-            json.serialize(deployed.routes)) {
-        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table evidence differs from its Publication.');
-    }
-    for (const entry of table.entries) {
-        const meaning = domain.callable(entry.callable);
-        const targetMatches = meaning !== undefined &&
-            ((entry.target.kind === 'function' && !isMethod(meaning)) ||
-                (entry.target.kind === 'method' &&
-                    isMethod(meaning) &&
-                    entry.target.dispatch === (meaning.static ? 'static' : 'instance')));
-        if (!targetMatches || meaning.auth !== entry.auth || meaning.output.mode !== entry.output) {
-            fail('NATIVE_ROUTE_BINDING_INVALID', `Route ${entry.name} differs from Domain meaning.`);
-        }
+    if (compareReferences(table.release, reference(deployed)) !== 'exact' ||
+        !sameServedWire(table.entries, deployed, domain)) {
+        fail('NATIVE_ROUTE_BINDING_INVALID', 'Route Table evidence differs from its Release.');
     }
+    verifyMeaning(table.entries, domain);
     return table;
 }
-function isMethod(meaning) {
-    return 'owner' in meaning;
-}
-function wireRoute(entry) {
-    const { target, auth: _auth, output: _output, default: isDefault, ...wire } = entry;
-    return {
-        ...wire,
-        ...(isDefault ? { default: true } : {}),
-        ...(target.kind === 'method' && target.dispatch === 'instance'
-            ? { receiver: target.receiver }
-            : {}),
-    };
-}
-//# sourceMappingURL=evidence.js.map

package/dist/routes/header.d.ts

@@ -0,0 +1,9 @@
+import * as auth from '@astrale-os/kernel-core/auth';
+import type { Sha256Digest } from '../release/digest.js';
+import type { HttpRequest } from './request.js';
+/** The digest one header value names as exactly one strong quoted digest, else undefined. */
+export declare function strongDigest(input: string): Sha256Digest | undefined;
+/** Read one reserved header, which occurs at most once in any spelling. */
+export declare function reservedHeader(input: HttpRequest['headers'], name: string): string | undefined;
+/** Admit the routing Kernel issuer one native route request names in header `name`. */
+export declare function acceptIssuerHeader(encoded: string, name: string): auth.IssuerId;

package/dist/routes/header.js

@@ -0,0 +1,34 @@
+import * as auth from '@astrale-os/kernel-core/auth';
+import { fail } from './error.js';
+const STRONG_DIGEST = /^"(sha256:[0-9a-f]{64})"$/u;
+/** The digest one header value names as exactly one strong quoted digest, else undefined. */
+export function strongDigest(input) {
+    return STRONG_DIGEST.exec(input)?.[1];
+}
+/** Read one reserved header, which occurs at most once in any spelling. */
+export function reservedHeader(input, name) {
+    if (input instanceof Headers)
+        return input.get(name) ?? undefined;
+    let found;
+    for (const [candidate, value] of Object.entries(input ?? {})) {
+        if (candidate.toLowerCase() !== name || value === undefined)
+            continue;
+        if (found !== undefined || (Array.isArray(value) && value.length !== 1)) {
+            fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${name} must occur at most once.`);
+        }
+        found = typeof value === 'string' ? value : value[0];
+    }
+    return found;
+}
+/** Admit the routing Kernel issuer one native route request names in header `name`. */
+export function acceptIssuerHeader(encoded, name) {
+    try {
+        return auth.issuer.accept(encoded);
+    }
+    catch (cause) {
+        if (cause instanceof auth.AuthValueError) {
+            return fail('NATIVE_ROUTE_ROUTING_INVALID', `${name} is invalid.`, cause);
+        }
+        throw cause;
+    }
+}

package/dist/routes/index.d.ts

@@ -12,9 +12,8 @@ export type { Plan, PlanEntry } from './plan.js';
 export type { Route, Table } from './table.js';
 export type { RouteTarget } from './target.js';
 export { place } from './placement.js';
-export { decodeReleaseUnavailable, HTTP_ROUTE_RELEASE_UNAVAILABLE, HTTP_ROUTE_RELEASE_UNAVAILABLE_STATUS, releaseUnavailableHeaders, type ReleaseUnavailable, } from './release-unavailable.js';
-export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_PUBLICATION, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, type MissControl, type StaleControl, } from './routing.js';
+export { decodeDeploymentRetired, deploymentRetiredBody, deploymentRetiredHeaders, HTTP_DEPLOYMENT_RETIRED, HTTP_DEPLOYMENT_RETIRED_STATUS, type DeploymentRetired, } from './deployment-retired.js';
+export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, type MissControl, type ServedReferences, type StaleControl, } from './routing.js';
 export { select } from './select.js';
 export { decodeStreamFrame, encodeStreamFrame, STREAM_MEDIA_TYPE, type StreamFrame, } from './stream.js';
 export { templatesOverlap } from './template.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/routes/index.js

@@ -9,9 +9,8 @@ export { RouteError } from './error.js';
 export { match } from './match.js';
 export {} from './request.js';
 export { place } from './placement.js';
-export { decodeReleaseUnavailable, HTTP_ROUTE_RELEASE_UNAVAILABLE, HTTP_ROUTE_RELEASE_UNAVAILABLE_STATUS, releaseUnavailableHeaders, } from './release-unavailable.js';
-export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_PUBLICATION, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, } from './routing.js';
+export { decodeDeploymentRetired, deploymentRetiredBody, deploymentRetiredHeaders, HTTP_DEPLOYMENT_RETIRED, HTTP_DEPLOYMENT_RETIRED_STATUS, } from './deployment-retired.js';
+export { decodeRouting, decodeMiss, decodeStale, HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_MISS_STATUS, HTTP_ROUTE_STALE, HTTP_ROUTE_STALE_STATUS, missHeaders, staleHeaders, } from './routing.js';
 export { select } from './select.js';
 export { decodeStreamFrame, encodeStreamFrame, STREAM_MEDIA_TYPE, } from './stream.js';
 export { templatesOverlap } from './template.js';
-//# sourceMappingURL=index.js.map

package/dist/routes/mapping.d.ts

@@ -1,6 +1,5 @@
-import type { HttpRoute } from '../publication/index.js';
+import type { HttpRoute } from '../release/route.js';
 export declare function validateMapping(route: HttpRoute, fields: readonly string[] | undefined, instanceMethod: boolean): void;
 export declare function validateWireMapping(route: HttpRoute): void;
 export declare function validateCredentialMapping(route: HttpRoute): void;
 export declare function isReservedHeader(input: string): boolean;
-//# sourceMappingURL=mapping.d.ts.map

package/dist/routes/mapping.js

@@ -1,8 +1,8 @@
 import { HTTP_IDEMPOTENCY_KEY } from '../invocation/index.js';
 import { credentialSources } from './credential.js';
+import { HTTP_DEPLOYMENT_RETIRED } from './deployment-retired.js';
 import { fail } from './error.js';
-import { HTTP_ROUTE_RELEASE_UNAVAILABLE } from './release-unavailable.js';
-import { HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_PUBLICATION, HTTP_ROUTE_STALE, } from './routing.js';
+import { HTTP_ROUTE_DIGEST, HTTP_ROUTE_ISSUER, HTTP_ROUTE_MISS, HTTP_ROUTE_STALE, } from './routing.js';
 import { PLACEHOLDER } from './template.js';
 export function validateMapping(route, fields, instanceMethod) {
     if (fields === undefined) {
@@ -110,10 +110,10 @@ export function validateCredentialMapping(route) {
 }
 const RESERVED_HEADERS = new Set([
     HTTP_IDEMPOTENCY_KEY,
+    HTTP_DEPLOYMENT_RETIRED,
+    HTTP_ROUTE_DIGEST,
     HTTP_ROUTE_ISSUER,
     HTTP_ROUTE_MISS,
-    HTTP_ROUTE_PUBLICATION,
-    HTTP_ROUTE_RELEASE_UNAVAILABLE,
     HTTP_ROUTE_STALE,
 ]);
 export function isReservedHeader(input) {
@@ -124,4 +124,3 @@ function uniqueWires(route, kind, wires) {
         fail('NATIVE_ROUTE_MAPPING_AMBIGUOUS', `Route ${route.name} maps one ${kind} wire source more than once.`);
     }
 }
-//# sourceMappingURL=mapping.js.map

package/dist/routes/match.d.ts

@@ -1,5 +1,4 @@
 import type { HttpRequest } from './request.js';
 import type { Route, Table } from './table.js';
-export declare function match(table: Table, request: Pick<HttpRequest, 'url' | 'method'>): Route | undefined;
+export declare function match(table: Pick<Table, 'entries'>, request: Pick<HttpRequest, 'url' | 'method'>): Route | undefined;
 export declare function methodMatches(entry: Route, method: string): boolean;
-//# sourceMappingURL=match.d.ts.map

package/dist/routes/match.js

@@ -5,4 +5,3 @@ export function match(table, request) {
 export function methodMatches(entry, method) {
     return entry.method === '*' || entry.method === method.toUpperCase();
 }
-//# sourceMappingURL=match.js.map

package/dist/routes/placement.d.ts

@@ -1,6 +1,5 @@
-import type * as publication from '../publication/index.js';
+import type { HttpRoute } from '../release/route.js';
 import type { Plan } from './plan.js';
 /** Resolve a provider-neutral Plan beneath one exact serving issuer. */
-export declare function place(plan: Plan, issuer: string): readonly publication.HttpRoute[];
+export declare function place(plan: Plan, issuer: string): readonly HttpRoute[];
 export declare function placePath(path: string, issuer: string): string;
-//# sourceMappingURL=placement.d.ts.map

package/dist/routes/placement.js

@@ -16,4 +16,3 @@ export function placePath(path, issuer) {
     const base = new URL(issuer);
     return `${base.origin}${path}`;
 }
-//# sourceMappingURL=placement.js.map

package/dist/routes/plan.d.ts

@@ -1,6 +1,6 @@
 import type { FunctionAuth, Key, Revision } from '@astrale-os/kernel-dsl/v1';
 import type { OutputMode } from '@astrale-os/kernel-dsl/v1/language';
-import type { CredentialSource, HttpMethod, RouteBody, RouteHeaders } from '../publication/index.js';
+import type { CredentialSource, HttpMethod, RouteBody, RouteHeaders } from '../release/route.js';
 import type { RouteTarget } from './target.js';
 export interface PlanEntry {
     readonly name: string;
@@ -22,4 +22,3 @@ export interface Plan {
     readonly revision: Revision;
     readonly entries: readonly PlanEntry[];
 }
-//# sourceMappingURL=plan.d.ts.map

package/dist/routes/plan.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=plan.js.map

package/dist/routes/request.d.ts

@@ -1,10 +1,12 @@
 import type { Value } from '@astrale-os/kernel-dsl/value';
 import type { Call, Via } from '../invocation/index.js';
-import type { HttpMethod } from '../publication/index.js';
+import type { HttpMethod } from '../release/route.js';
 /** Canonical invocation values presented to or returned from a native route mapping. */
 export interface Invocation {
     readonly call: Call;
     readonly credential?: string;
+    /** The request channel that carried `credential`; `cookie` is ambient (CSRF-exposed). */
+    readonly credentialIn?: 'header' | 'cookie' | 'query';
     readonly routing?: Via;
     readonly method?: Exclude<HttpMethod, '*'>;
 }
@@ -24,4 +26,3 @@ export interface HttpRequest {
 export declare function bodyText(body: HttpRequest['body']): string;
 export declare function parseJsonObject(body: HttpRequest['body']): Record<string, Value>;
 export declare function normalizeHeaders(input: HttpRequest['headers']): Record<string, string>;
-//# sourceMappingURL=request.d.ts.map

package/dist/routes/request.js

@@ -51,4 +51,3 @@ export function normalizeHeaders(input) {
     }
     return output;
 }
-//# sourceMappingURL=request.js.map

package/dist/routes/reservation.d.ts

@@ -1,4 +1,5 @@
-import type { Publication } from '../publication/publication.js';
+import type { DomainRelease } from '../release/release.js';
 import type { Route } from './table.js';
-export declare function rejectReserved(publication: Publication, entries: readonly Route[]): void;
-//# sourceMappingURL=reservation.d.ts.map
+/** The canonical Release fields read by route reservation admission. */
+export type Placed = Pick<DomainRelease, 'origin' | 'identity' | 'schema' | 'bindings' | 'routes' | 'delivery'>;
+export declare function rejectReserved(release: Placed, entries: readonly Route[]): void;

package/dist/routes/reservation.js

@@ -1,21 +1,27 @@
 import * as issuer from '../issuer/index.js';
-import { PATH as PUBLICATION_PATH } from '../publication/publication.js';
+import { bundleUrl } from '../release/bundle.js';
+import { PATH as RELEASE_PATH } from '../release/release.js';
 import { fail } from './error.js';
 import { templateUrl, templatesOverlap } from './template.js';
-const STATIC_RESERVED_PATHS = new Set([PUBLICATION_PATH]);
-export function rejectReserved(publication, entries) {
-    const discovery = issuer.paths(publication.identity.issuer);
+const STATIC_RESERVED_PATHS = new Set([RELEASE_PATH]);
+export function rejectReserved(release, entries) {
+    const discovery = issuer.paths(release.identity.issuer);
     const reservedPaths = new Set([...STATIC_RESERVED_PATHS, discovery.configuration, discovery.keys]);
     const reservedUrls = [
-        publication.schema.bundle.href,
-        ...(publication.delivery === undefined ? [] : [publication.delivery.href]),
-        ...publication.bindings.callables.flatMap(({ endpoint }) => [
+        release.schema.bundle.href,
+        ...(release.delivery === undefined ? [] : [release.delivery.href]),
+        ...release.bindings.callables.flatMap(({ endpoint }) => [
             endpoint.http,
             ...(endpoint.websocket === undefined ? [] : [httpUrlForWebSocket(endpoint.websocket)]),
         ]),
     ];
+    const addressed = bundleUrl(release.identity.issuer, release.schema.bundle.ref);
+    const bundlePattern = release.schema.bundle.href === addressed
+        ? `${addressed.slice(0, addressed.lastIndexOf('/') + 1)}{artifact}`
+        : undefined;
     for (const entry of entries) {
-        const claimed = [...reservedPaths].some((path) => templateClaimsPath(entry.href, path)) ||
+        const claimed = (bundlePattern !== undefined && templatesOverlap(entry.href, bundlePattern)) ||
+            [...reservedPaths].some((path) => templateClaimsPath(entry.href, path)) ||
             reservedUrls.some((reserved) => templatesOverlap(entry.href, routeLocation(reserved)));
         if (claimed) {
             fail('NATIVE_ROUTE_RESERVED', `Route ${entry.name} claims reserved URL ${templateUrl(entry.href).href}.`);
@@ -35,4 +41,3 @@ function templateClaimsPath(template, path) {
     const url = templateUrl(template);
     return templatesOverlap(template, `${url.origin}${path}`);
 }
-//# sourceMappingURL=reservation.js.map

package/dist/routes/routing.d.ts

@@ -1,23 +1,34 @@
 import type * as invocation from '../invocation/index.js';
-import type { Etag, PublicationRef } from '../publication/index.js';
+import type { Sha256Digest } from '../release/digest.js';
+import type { ReleaseRef } from '../release/reference.js';
 import type { HttpRequest } from './request.js';
 export interface StaleControl {
     readonly kind: 'stale';
-    readonly current: Etag;
+    /** Current release digest. */
+    readonly current: Sha256Digest;
 }
 export interface MissControl {
     readonly kind: 'miss';
 }
-export declare const HTTP_ROUTE_PUBLICATION: 'if-match';
+/** The references one release-backed destination answers native routes for. */
+export interface ServedReferences {
+    readonly release: ReleaseRef;
+}
+/** If-Match carries the routed digest of a native route request (`invocation.routedDigest`). */
+export declare const HTTP_ROUTE_DIGEST: 'if-match';
 export declare const HTTP_ROUTE_ISSUER: 'x-astrale-issuer';
 export declare const HTTP_ROUTE_STALE: 'x-astrale-route-stale';
 export declare const HTTP_ROUTE_STALE_STATUS: 412;
 export declare const HTTP_ROUTE_MISS: 'x-astrale-route-miss';
 export declare const HTTP_ROUTE_MISS_STATUS: 421;
-export declare function decodeRouting(input: Pick<HttpRequest, 'headers'>, publication: PublicationRef): invocation.Via | undefined;
-export declare function staleHeaders(current: Etag): Readonly<Record<string, string>>;
+/**
+ * Decode a native route witness against the served release. A different strong digest is stale
+ * before issuer admission; otherwise the digest and issuer must occur together.
+ */
+export declare function decodeRouting(input: Pick<HttpRequest, 'headers'>, served: ServedReferences): invocation.Via | StaleControl | undefined;
+/** Emit the reserved stale header naming `current` (see `StaleControl.current`). */
+export declare function staleHeaders(current: Sha256Digest): Readonly<Record<string, string>>;
 export declare function decodeStale(status: number, headers: HttpRequest['headers']): StaleControl | undefined;
 export declare function missHeaders(): Readonly<Record<string, string>>;
 export declare function decodeMiss(status: number, headers: HttpRequest['headers']): MissControl | undefined;
-export declare function encodeStrongEtag(input: Etag): string;
-//# sourceMappingURL=routing.d.ts.map
+export declare function encodeStrongEtag(input: Sha256Digest): string;

package/dist/routes/routing.js

@@ -1,36 +1,35 @@
-import * as auth from '@astrale-os/kernel-core/auth';
 import { fail } from './error.js';
-export const HTTP_ROUTE_PUBLICATION = 'if-match';
+import { acceptIssuerHeader, reservedHeader, strongDigest } from './header.js';
+/** If-Match carries the routed digest of a native route request (`invocation.routedDigest`). */
+export const HTTP_ROUTE_DIGEST = 'if-match';
 export const HTTP_ROUTE_ISSUER = 'x-astrale-issuer';
 export const HTTP_ROUTE_STALE = 'x-astrale-route-stale';
 export const HTTP_ROUTE_STALE_STATUS = 412;
 export const HTTP_ROUTE_MISS = 'x-astrale-route-miss';
 export const HTTP_ROUTE_MISS_STATUS = 421;
-const STRONG_ETAG = /^"(sha256:[0-9a-f]{64})"$/u;
-export function decodeRouting(input, publication) {
-    const encodedEtag = routingHeader(input.headers, HTTP_ROUTE_PUBLICATION);
-    const encodedIssuer = routingHeader(input.headers, HTTP_ROUTE_ISSUER);
-    if (encodedEtag === undefined && encodedIssuer === undefined)
+/**
+ * Decode a native route witness against the served release. A different strong digest is stale
+ * before issuer admission; otherwise the digest and issuer must occur together.
+ */
+export function decodeRouting(input, served) {
+    const encodedDigest = reservedHeader(input.headers, HTTP_ROUTE_DIGEST);
+    const encodedIssuer = reservedHeader(input.headers, HTTP_ROUTE_ISSUER);
+    if (encodedDigest === undefined && encodedIssuer === undefined)
         return undefined;
-    if (encodedEtag === undefined || encodedIssuer === undefined) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_PUBLICATION} and ${HTTP_ROUTE_ISSUER} must occur together.`);
+    const named = encodedDigest === undefined ? undefined : strongDigest(encodedDigest);
+    if (named !== undefined && named !== served.release.digest) {
+        return Object.freeze({ kind: 'stale', current: served.release.digest });
     }
-    const etag = decodeStrongEtag(encodedEtag, 'If-Match');
-    if (etag !== publication.etag) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match does not name the compiled Publication.');
+    if (encodedDigest === undefined || encodedIssuer === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_DIGEST} and ${HTTP_ROUTE_ISSUER} must occur together.`);
     }
-    let issuer;
-    try {
-        issuer = auth.issuer.accept(encodedIssuer);
+    if (named === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', 'If-Match must contain exactly one strong quoted digest.');
     }
-    catch (cause) {
-        if (cause instanceof auth.AuthValueError) {
-            return fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_ISSUER} is invalid.`, cause);
-        }
-        throw cause;
-    }
-    return Object.freeze({ kind: 'via', publication, issuer });
+    const issuer = acceptIssuerHeader(encodedIssuer, HTTP_ROUTE_ISSUER);
+    return Object.freeze({ kind: 'via', release: served.release, issuer });
 }
+/** Emit the reserved stale header naming `current` (see `StaleControl.current`). */
 export function staleHeaders(current) {
     return Object.freeze({
         [HTTP_ROUTE_STALE]: encodeStrongEtag(current),
@@ -38,22 +37,23 @@ export function staleHeaders(current) {
     });
 }
 export function decodeStale(status, headers) {
-    const encoded = routingHeader(headers, HTTP_ROUTE_STALE);
+    const encoded = reservedHeader(headers, HTTP_ROUTE_STALE);
     if (encoded === undefined)
         return undefined;
     if (status !== HTTP_ROUTE_STALE_STATUS) {
         fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${HTTP_ROUTE_STALE} is reserved for status ${HTTP_ROUTE_STALE_STATUS}.`);
     }
-    return Object.freeze({
-        kind: 'stale',
-        current: decodeStrongEtag(encoded, HTTP_ROUTE_STALE),
-    });
+    const current = strongDigest(encoded);
+    if (current === undefined) {
+        fail('NATIVE_ROUTE_ROUTING_INVALID', `${HTTP_ROUTE_STALE} must contain exactly one strong quoted digest.`);
+    }
+    return Object.freeze({ kind: 'stale', current });
 }
 export function missHeaders() {
     return Object.freeze({ [HTTP_ROUTE_MISS]: '1', 'cache-control': 'no-store' });
 }
 export function decodeMiss(status, headers) {
-    const encoded = routingHeader(headers, HTTP_ROUTE_MISS);
+    const encoded = reservedHeader(headers, HTTP_ROUTE_MISS);
     if (encoded === undefined)
         return undefined;
     if (status !== HTTP_ROUTE_MISS_STATUS || encoded !== '1') {
@@ -64,25 +64,3 @@ export function decodeMiss(status, headers) {
 export function encodeStrongEtag(input) {
     return `"${input}"`;
 }
-function decodeStrongEtag(input, label) {
-    const matched = STRONG_ETAG.exec(input);
-    if (matched === null) {
-        fail('NATIVE_ROUTE_ROUTING_INVALID', `${label} must contain exactly one strong quoted Publication ETag.`);
-    }
-    return matched[1];
-}
-function routingHeader(input, name) {
-    if (input instanceof Headers)
-        return input.get(name) ?? undefined;
-    let found;
-    for (const [candidate, value] of Object.entries(input ?? {})) {
-        if (candidate.toLowerCase() !== name || value === undefined)
-            continue;
-        if (found !== undefined || (Array.isArray(value) && value.length !== 1)) {
-            fail('NATIVE_ROUTE_ROUTING_INVALID', `Header ${name} must occur at most once.`);
-        }
-        found = typeof value === 'string' ? value : value[0];
-    }
-    return found;
-}
-//# sourceMappingURL=routing.js.map

package/dist/routes/scalar.d.ts

@@ -5,4 +5,3 @@ export declare function encodeScalar(entry: Route, name: string, value: unknown,
 export declare function decodeScalar(entry: Route, name: string, encoded: string, domain: Domain): portable.Value;
 export declare function scalar(value: unknown): string;
 export declare function asObject(value: unknown): Record<string, portable.Value>;
-//# sourceMappingURL=scalar.d.ts.map