@astrale-os/kernel-server 0.4.17 → 0.5.0-beta.10

package/dist/capture.d.ts

@@ -0,0 +1,2 @@
+/** Capture one receiver-bound method while preserving the capability's exact method type. */
+export declare function captureMethod<Receiver extends object, Name extends keyof Receiver>(input: Receiver, name: Name, invalidMessage: string): Receiver[Name];

package/dist/capture.js

@@ -0,0 +1,9 @@
+/** Capture one receiver-bound method while preserving the capability's exact method type. */
+export function captureMethod(input, name, invalidMessage) {
+    if (input === null || typeof input !== 'object')
+        throw new TypeError(invalidMessage);
+    const method = input[name];
+    if (typeof method !== 'function')
+        throw new TypeError(invalidMessage);
+    return method.bind(input);
+}

package/dist/cors/cors.d.ts

@@ -0,0 +1,21 @@
+/** Request-aware CORS admission shared by every Server-owned HTTP surface. */
+import type { CorsConfig } from './types.js';
+export interface CorsRoute {
+    /** Methods that can actually select this route; OPTIONS is added by the policy. */
+    readonly methods: readonly string[];
+    /** Request headers owned by this route, in addition to the CORS safelist. */
+    readonly headers?: readonly string[];
+    /** A declared wildcard-header mapping may receive other caller-selected headers. */
+    readonly allowAnyHeaders?: boolean;
+}
+export interface CorsPolicy {
+    readonly enabled: boolean;
+    /** Apply the configured browser-origin rule without treating WebSocket as CORS. */
+    allowsBrowserOrigin(request: Request): boolean;
+    /** Headers for one ordinary response. Exposed names are additive and canonicalized. */
+    response(request: Request, exposedHeaders?: readonly string[]): Readonly<Record<string, string>>;
+    /** Validate and answer one route-aware browser preflight without semantic dispatch. */
+    preflight(request: Request, route: CorsRoute | undefined): Response;
+}
+/** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
+export declare function prepareCors(input: CorsConfig | false | undefined): CorsPolicy;

package/dist/cors/cors.js

@@ -0,0 +1,135 @@
+/** Request-aware CORS admission shared by every Server-owned HTTP surface. */
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+/** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
+export function prepareCors(input) {
+    if (input === false)
+        return DISABLED;
+    const config = input ?? { origin: '*' };
+    const origin = admitHeaderValue(config.origin, 'CORS origin');
+    const methods = config.methods === undefined ? undefined : methodSet(config.methods, 'CORS method');
+    const headers = config.headers === undefined ? undefined : tokenSet(config.headers, 'CORS header');
+    const exposedHeaders = tokenSet(config.exposedHeaders ?? [], 'CORS exposed header');
+    const credentials = config.credentials === true;
+    if (credentials && origin === '*') {
+        throw new TypeError('Credentialed CORS requires one explicit origin.');
+    }
+    const response = (request, dynamicExposed = []) => {
+        const requestOrigin = request.headers.get('origin');
+        if (requestOrigin !== null && origin !== '*' && requestOrigin !== origin)
+            return Object.freeze({});
+        const output = {
+            'access-control-allow-origin': origin,
+        };
+        if (credentials)
+            output['access-control-allow-credentials'] = 'true';
+        const exposed = new Set(exposedHeaders);
+        for (const name of dynamicExposed)
+            exposed.add(admitToken(name, 'CORS exposed header').toLowerCase());
+        if (exposed.size > 0)
+            output['access-control-expose-headers'] = [...exposed].join(', ');
+        if (origin !== '*')
+            output.vary = 'origin';
+        return Object.freeze(output);
+    };
+    return Object.freeze({
+        enabled: true,
+        allowsBrowserOrigin(request) {
+            const requestOrigin = request.headers.get('origin');
+            return requestOrigin === null || origin === '*' || requestOrigin === origin;
+        },
+        response,
+        preflight(request, route) {
+            const requestOrigin = request.headers.get('origin');
+            const requestedMethod = request.headers.get('access-control-request-method')?.toUpperCase();
+            if (requestOrigin === null || requestedMethod === undefined) {
+                return new Response(null, { status: 400, headers: response(request) });
+            }
+            if (origin !== '*' && requestOrigin !== origin)
+                return new Response(null, { status: 403 });
+            if (route === undefined) {
+                return new Response(null, { status: 404, headers: response(request) });
+            }
+            const routeMethods = methodSet(route.methods, 'CORS route method');
+            const methodAllowed = routeMethods.has(requestedMethod) && (methods?.has(requestedMethod) ?? true);
+            if (!methodAllowed) {
+                return new Response(null, { status: 405, headers: response(request) });
+            }
+            const requestedHeaders = parseRequestedHeaders(request.headers.get('access-control-request-headers'));
+            const routeHeaders = tokenSet(route.headers ?? [], 'CORS route header');
+            const headerAllowed = (name) => (route.allowAnyHeaders === true || routeHeaders.has(name)) && (headers?.has(name) ?? true);
+            if (requestedHeaders.some((name) => !headerAllowed(name))) {
+                return new Response(null, { status: 403, headers: response(request) });
+            }
+            const allowedMethods = [...routeMethods].filter((method) => methods?.has(method) ?? true);
+            const allowedHeaders = requestedHeaders.length > 0 ? requestedHeaders : [...routeHeaders];
+            const output = new Headers(response(request));
+            output.set('access-control-allow-methods', [...allowedMethods, 'OPTIONS'].join(', '));
+            if (allowedHeaders.length > 0) {
+                output.set('access-control-allow-headers', allowedHeaders.join(', '));
+            }
+            appendVary(output, 'access-control-request-method');
+            appendVary(output, 'access-control-request-headers');
+            return new Response(null, { status: 204, headers: output });
+        },
+    });
+}
+const DISABLED = Object.freeze({
+    enabled: false,
+    allowsBrowserOrigin: () => true,
+    response: () => Object.freeze({}),
+    preflight: () => new Response(null, { status: 405 }),
+});
+function parseRequestedHeaders(input) {
+    if (input === null || input.trim() === '')
+        return [];
+    const output = [];
+    const seen = new Set();
+    for (const raw of input.split(',')) {
+        const name = admitToken(raw.trim(), 'CORS requested header').toLowerCase();
+        if (!seen.has(name)) {
+            seen.add(name);
+            output.push(name);
+        }
+    }
+    return output;
+}
+function tokenSet(input, label) {
+    const output = new Set();
+    for (const value of input)
+        output.add(admitToken(value, label).toLowerCase());
+    return output;
+}
+function methodSet(input, label) {
+    const output = new Set();
+    for (const value of input)
+        output.add(admitToken(value, label).toUpperCase());
+    return output;
+}
+function admitHeaderValue(input, label) {
+    if (typeof input !== 'string' || input.length === 0 || hasControlCharacter(input)) {
+        throw new TypeError(`${label} must be a non-empty control-free string.`);
+    }
+    return input;
+}
+function hasControlCharacter(input) {
+    for (let index = 0; index < input.length; index += 1) {
+        const code = input.charCodeAt(index);
+        if (code <= 0x1f || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function admitToken(input, label) {
+    if (typeof input !== 'string' || !TOKEN.test(input))
+        throw new TypeError(`${label} must be an HTTP token.`);
+    return input;
+}
+function appendVary(headers, value) {
+    const current = headers.get('vary');
+    const names = new Set(current
+        ?.split(',')
+        .map((name) => name.trim().toLowerCase())
+        .filter(Boolean) ?? []);
+    names.add(value);
+    headers.set('vary', [...names].join(', '));
+}

package/dist/cors/index.d.ts

@@ -0,0 +1,2 @@
+export { prepareCors, type CorsPolicy, type CorsRoute } from './cors.js';
+export type { CorsConfig } from './types.js';

package/dist/cors/index.js

@@ -0,0 +1 @@
+export { prepareCors } from './cors.js';

package/dist/cors/types.d.ts

@@ -0,0 +1,11 @@
+export interface CorsConfig {
+    readonly origin: string;
+    /** Optional global preflight ceiling; actual responses are narrowed to the matched route. */
+    readonly methods?: readonly string[];
+    /** Optional global preflight ceiling; route-owned request headers are still matched exactly. */
+    readonly headers?: readonly string[];
+    /** Additional response headers that browser JavaScript may observe. */
+    readonly exposedHeaders?: readonly string[];
+    /** Emit Access-Control-Allow-Credentials; requires one explicit origin rather than `*`. */
+    readonly credentials?: boolean;
+}

package/dist/cors/types.js

@@ -0,0 +1 @@
+export {};

package/dist/errors/availability.d.ts

@@ -0,0 +1,10 @@
+/** Expected loss of the external capability used to create a Delivery. */
+export declare class DeliveryUnavailableError extends Error {
+    readonly name = "DeliveryUnavailableError";
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** Expected loss of the external capability used to load public issuer keys. */
+export declare class IssuerKeysUnavailableError extends Error {
+    readonly name = "IssuerKeysUnavailableError";
+    constructor(message?: string, options?: ErrorOptions);
+}

package/dist/errors/availability.js

@@ -0,0 +1,14 @@
+/** Expected loss of the external capability used to create a Delivery. */
+export class DeliveryUnavailableError extends Error {
+    name = 'DeliveryUnavailableError';
+    constructor(message = 'Delivery is unavailable.', options) {
+        super(message, options);
+    }
+}
+/** Expected loss of the external capability used to load public issuer keys. */
+export class IssuerKeysUnavailableError extends Error {
+    name = 'IssuerKeysUnavailableError';
+    constructor(message = 'Issuer keys are unavailable.', options) {
+        super(message, options);
+    }
+}

package/dist/errors/classify.d.ts

@@ -0,0 +1,3 @@
+import * as errors from '@astrale-os/kernel-protocol/errors';
+/** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
+export declare function classifyError(input: unknown): errors.ErrorPayload;

package/dist/errors/classify.js

@@ -0,0 +1,41 @@
+import { PathError } from '@astrale-os/kernel-core/path';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import { RequestBodyTooLargeError } from './request-body.js';
+import { ResponseBodyTooLargeError } from './response-body.js';
+/** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
+export function classifyError(input) {
+    if (input instanceof errors.ProtocolError)
+        return input.payload;
+    if (input instanceof RequestBodyTooLargeError) {
+        return publicError('LIMIT_EXCEEDED', 'Request body exceeds the configured limit.');
+    }
+    if (input instanceof ResponseBodyTooLargeError) {
+        return publicError('LIMIT_EXCEEDED', 'Response body exceeds the configured limit.');
+    }
+    if (input instanceof PathError) {
+        return publicError('VALIDATION_ERROR', 'Target Path is invalid.');
+    }
+    return internal(input);
+}
+function publicError(name, message) {
+    return { code: errors.CODES[name], message };
+}
+function internal(input) {
+    reportInternal(input);
+    return publicError('INTERNAL_ERROR', 'Internal application error.');
+}
+function stableCode(input) {
+    if (input !== null && typeof input === 'object' && 'code' in input) {
+        return typeof input.code === 'string' ? input.code : undefined;
+    }
+    return undefined;
+}
+function reportInternal(input) {
+    const error = input instanceof Error ? input : undefined;
+    // Never print the message, cause, input, credentials, query, or backend command.
+    // oxlint-disable-next-line no-console
+    console.error('[server] Internal dispatch failure', {
+        type: error?.constructor.name ?? typeof input,
+        code: stableCode(input),
+    });
+}

package/dist/errors/index.d.ts

@@ -0,0 +1,4 @@
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
+export { classifyError } from './classify.js';
+export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
+export { ResponseBodyTooLargeError } from './response-body.js';

package/dist/errors/index.js

@@ -0,0 +1,4 @@
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
+export { classifyError } from './classify.js';
+export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
+export { ResponseBodyTooLargeError } from './response-body.js';

package/dist/errors/request-body.d.ts

@@ -0,0 +1,7 @@
+export declare class RequestBodyTooLargeError extends Error {
+    readonly maximumBytes: number;
+    constructor(maximumBytes: number);
+}
+export declare class RequestBodyInvalidError extends Error {
+    constructor(message: string);
+}

package/dist/errors/request-body.js

@@ -0,0 +1,14 @@
+export class RequestBodyTooLargeError extends Error {
+    maximumBytes;
+    constructor(maximumBytes) {
+        super(`Request body exceeds ${maximumBytes} bytes.`);
+        this.maximumBytes = maximumBytes;
+        this.name = 'RequestBodyTooLargeError';
+    }
+}
+export class RequestBodyInvalidError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RequestBodyInvalidError';
+    }
+}

package/dist/errors/response-body.d.ts

@@ -0,0 +1,4 @@
+export declare class ResponseBodyTooLargeError extends Error {
+    readonly maximumBytes: number;
+    constructor(maximumBytes: number);
+}

package/dist/errors/response-body.js

@@ -0,0 +1,8 @@
+export class ResponseBodyTooLargeError extends Error {
+    maximumBytes;
+    constructor(maximumBytes) {
+        super(`Server response exceeds maximumResponseBytes (${maximumBytes}).`);
+        this.maximumBytes = maximumBytes;
+        this.name = 'ResponseBodyTooLargeError';
+    }
+}

package/dist/index.d.ts

@@ -1,12 +1,5 @@
-export { createKernelApp, type KernelAppConfig, type WsAdapter } from './app/create.js';
-export { createMultiplexedKernelApp, type MultiplexedKernelAppConfig, type DispatcherResolver, } from './app/multiplexed.js';
-export { walkDomain, type ServerHost, type MountedFunction, type MountedRoute, type MountPlan, } from './plan/index.js';
-export { buildCorsHeaders, type CorsConfig } from './cors.js';
-export { createKernelDispatcher, type KernelDispatcherOptions } from './envelope/http.js';
-export { KernelWsConnection, type WebSocketLike } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, type CapabilityHost, type CapabilityLifecycle, type Defer, type DeferredTask, type Capabilities, type Sleep, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, type Invocation, type InvocationPath, type InvocationReply, type InvocationResponse, type Dispatcher, } from './invocation/index.js';
-export { createRouteHandler, type RouteHandlerConfig } from './routed/index.js';
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, type JwksKeys, type MultiplexedJwks, type JwksConfig, type InstanceJwksConfig, type IssuerRegistryConfig, type InstanceIssuerRegistryConfig, } from './jwks/index.js';
-export { classifyError } from '@astrale-os/kernel-api';
-//# sourceMappingURL=index.d.ts.map
+export { createServer, prepareServer } from './server.js';
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
+export * as publication from './publication/index.js';
+export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';

package/dist/index.js

@@ -1,19 +1,4 @@
-// ─── App entry points ─────────────────────────────────────────────────────────
-export { createKernelApp } from './app/create.js';
-export { createMultiplexedKernelApp, } from './app/multiplexed.js';
-// ─── Plan ────────────────────────────────────────────────────────────────────
-export { walkDomain, } from './plan/index.js';
-// ─── Cross-cutting ───────────────────────────────────────────────────────────
-export { buildCorsHeaders } from './cors.js';
-// ─── Kernel envelope dispatcher ──────────────────────────────────────────────
-export { createKernelDispatcher } from './envelope/http.js';
-export { KernelWsConnection } from './envelope/ws.js';
-export { createCapabilityLifecycle, honoCapabilityHost, } from './capabilities/index.js';
-export { dispatchInvocation, executeInvocation, kernelDispatcher, } from './invocation/index.js';
-// ─── Routed HTTP handler (per-route) ─────────────────────────────────────────
-export { createRouteHandler } from './routed/index.js';
-// ─── JWKS (OIDC Discovery + JSON Web Key Set) ───────────────────────────────
-export { mountJwks, mountInstanceJwks, mountIssuerRegistry, mountInstanceIssuerRegistry, } from './jwks/index.js';
-// ─── Dispatch (for custom integrations) ──────────────────────────────────────
-export { classifyError } from '@astrale-os/kernel-api';
-//# sourceMappingURL=index.js.map
+export { createServer, prepareServer } from './server.js';
+export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
+export { preparePublicationSnapshot } from './publication/index.js';
+export * as publication from './publication/index.js';

package/dist/invocation/context.d.ts

@@ -0,0 +1,6 @@
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
+import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
+import type { ApplicationHost, InvocationContext } from './types.js';
+export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey): InvocationContext;
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export declare function defaultSleep(durationMs: number): Promise<void>;

package/dist/invocation/context.js

@@ -0,0 +1,60 @@
+export function invocationContext(assigned, operation, active, host, requestBody, idempotencyKey) {
+    const body = requestBody?.slice();
+    return Object.freeze({
+        invocation: assigned,
+        execution: Object.freeze({ deadline: operation.deadline, signal: operation.signal }),
+        background: (task) => active.background(task, host?.waitUntil),
+        sleep: async (durationMs) => {
+            await interruptibleSleep(sleepDuration(durationMs), operation.signal, host?.sleep);
+        },
+        ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
+        ...(body === undefined ? {} : { request: Object.freeze({ body: () => body.slice() }) }),
+    });
+}
+/** Default non-durable timer used when the application host supplies no timer capability. */
+export async function defaultSleep(durationMs) {
+    await new Promise((resolve) => setTimeout(resolve, sleepDuration(durationMs)));
+}
+async function interruptibleSleep(durationMs, signal, sleep) {
+    if (signal.aborted)
+        throw abortCause(signal);
+    if (sleep === undefined) {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => finish(resolve), durationMs);
+            const abort = () => {
+                clearTimeout(timer);
+                finish(() => reject(abortCause(signal)));
+            };
+            const finish = (settle) => {
+                signal.removeEventListener('abort', abort);
+                settle();
+            };
+            signal.addEventListener('abort', abort, { once: true });
+        });
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (settle) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', abort);
+            settle();
+        };
+        const abort = () => finish(() => reject(abortCause(signal)));
+        signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve()
+            .then(() => sleep(durationMs))
+            .then(() => finish(resolve), (cause) => finish(() => reject(cause)));
+    });
+}
+function abortCause(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error('Invocation was cancelled.');
+}
+function sleepDuration(input) {
+    if (!Number.isFinite(input) || input < 0 || input > 2_147_483_647) {
+        throw new RangeError('Sleep duration must be finite, non-negative, and within timer range.');
+    }
+    return input;
+}

package/dist/invocation/identity.d.ts

@@ -0,0 +1,9 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
+/** Injected source-owned identity allocator captured before Server readiness. */
+export interface InvocationSource {
+    readonly source: IssuerId;
+    next(): string;
+}
+export type NextInvocationId = () => protocol.InvocationId;
+export declare function captureInvocationSource(input: InvocationSource): NextInvocationId;

package/dist/invocation/identity.js

@@ -0,0 +1,11 @@
+import { issuer } from '@astrale-os/kernel-core/auth';
+import * as protocolInvocation from '@astrale-os/kernel-protocol/invocation';
+import { captureMethod } from '../capture.js';
+export function captureInvocationSource(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new TypeError('Server Invocation source is invalid.');
+    }
+    const source = issuer.accept(input.source);
+    const next = captureMethod(input, 'next', 'Server Invocation source is invalid.');
+    return () => protocolInvocation.acceptInvocationId({ source, id: next() });
+}

package/dist/invocation/index.d.ts

@@ -1,3 +1,4 @@
-export { dispatchInvocation, executeInvocation, type InvocationReply, type InvocationResponse, } from './dispatch.js';
-export { kernelDispatcher, type Invocation, type InvocationPath, type Dispatcher, } from './dispatcher.js';
-//# sourceMappingURL=index.d.ts.map
+export { defaultSleep, invocationContext } from './context.js';
+export { captureInvocationSource, type InvocationSource, type NextInvocationId, } from './identity.js';
+export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
+export type { ApplicationHost, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, InvocationContext, RequestBackground, RequestEvidence, RequestSleep, } from './types.js';

package/dist/invocation/index.js

@@ -1,3 +1,3 @@
-export { dispatchInvocation, executeInvocation, } from './dispatch.js';
-export { kernelDispatcher, } from './dispatcher.js';
-//# sourceMappingURL=index.js.map
+export { defaultSleep, invocationContext } from './context.js';
+export { captureInvocationSource, } from './identity.js';
+export { publicationRouteDecision } from './publication-route.js';

package/dist/invocation/publication-route.d.ts

@@ -0,0 +1,13 @@
+import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
+import type { Publication } from '@astrale-os/kernel-protocol/publication/publication';
+import type { PublicationRef } from '@astrale-os/kernel-protocol/publication/reference';
+export type PublicationRouteDecision = {
+    readonly kind: 'exact';
+} | {
+    readonly kind: 'same-schema';
+} | {
+    readonly kind: 'rejected';
+    readonly error: ErrorPayload;
+};
+/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+export declare function publicationRouteDecision(current: Publication, installed: PublicationRef): PublicationRouteDecision;

package/dist/invocation/publication-route.js

@@ -0,0 +1,44 @@
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { SCHEMA_UPGRADE_REQUIRED, SERVICE_TRUST_REQUIRED, } from '@astrale-os/kernel-protocol/invocation/service-reason';
+import { compareReference } from '@astrale-os/kernel-protocol/publication/reference';
+/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+export function publicationRouteDecision(current, installed) {
+    switch (compareReference(current, installed)) {
+        case 'exact':
+            return Object.freeze({ kind: 'exact' });
+        case 'same-schema':
+            return Object.freeze({ kind: 'same-schema' });
+        case 'schema-drift':
+            return rejected('Installed Domain schema requires an explicit upgrade.', Object.freeze({
+                code: SCHEMA_UPGRADE_REQUIRED,
+                details: Object.freeze({
+                    origin: installed.origin,
+                    installedRevision: installed.revision,
+                    candidateRevision: current.schema.revision,
+                }),
+            }));
+        case 'identity-drift':
+            return rejected('Installed Domain Service identity requires explicit trust.', Object.freeze({
+                code: SERVICE_TRUST_REQUIRED,
+                details: Object.freeze({
+                    origin: installed.origin,
+                    installedIssuer: installed.identity.issuer,
+                    candidateIssuer: current.identity.issuer,
+                }),
+            }));
+        case 'origin-drift':
+            return Object.freeze({
+                kind: 'rejected',
+                error: Object.freeze({
+                    code: CODES.INVALID_REQUEST,
+                    message: 'Routed Publication origin differs from the served Domain.',
+                }),
+            });
+    }
+}
+function rejected(message, data) {
+    return Object.freeze({
+        kind: 'rejected',
+        error: Object.freeze({ code: CODES.CONFLICT, message, data }),
+    });
+}

package/dist/invocation/types.d.ts

@@ -0,0 +1,62 @@
+import type { CredentialInput } from '@astrale-os/kernel-core/auth';
+import type { CallableResult } from '@astrale-os/kernel-core/callable';
+import type { Value } from '@astrale-os/kernel-dsl/value';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
+import type { PublicationSnapshot } from '../publication/index.js';
+/** Optional platform retention and timer adaptation for one Fetch invocation. */
+export interface ApplicationHost {
+    waitUntil(promise: Promise<unknown>): void;
+    readonly sleep?: (durationMs: number) => Promise<void>;
+}
+/** Ephemeral execution lifetime for one admitted request. */
+export interface ExecutionControl {
+    readonly deadline: number;
+    readonly signal: AbortSignal;
+}
+/** Register non-durable work with the request owner. */
+export type RequestBackground = (task: () => void | PromiseLike<unknown>) => void;
+/** Request-owner timer bounded by the same cancellation and deadline. */
+export type RequestSleep = (durationMs: number) => Promise<void>;
+/** Exact bounded ingress evidence retained outside portable Function input. */
+export interface RequestEvidence {
+    body(): Uint8Array;
+}
+/** Immutable lifetime and execution conveniences for one admitted dispatch. */
+export interface InvocationContext {
+    readonly invocation: protocol.InvocationId;
+    readonly execution: ExecutionControl;
+    readonly idempotencyKey?: protocol.IdempotencyKey;
+    readonly request?: RequestEvidence;
+    readonly background: RequestBackground;
+    /** Rejects promptly when execution is cancelled or reaches its deadline. */
+    readonly sleep: RequestSleep;
+}
+export interface HandlerStream extends AsyncIterable<Value> {
+    cancel(reason?: string): Promise<void>;
+}
+/** Complete semantic result accepted from one ready application Handler. */
+export type HandlerResult = CallableResult<Value, HandlerStream> | {
+    readonly kind: 'redirect';
+    readonly redirect: protocol.Redirection;
+} | {
+    readonly kind: 'miss';
+};
+/** Ready semantic capability invoked by canonical and advertised transport routes. */
+export interface HandlerRequest {
+    readonly call: protocol.Call;
+    /** Admitted transport correlation syntax, separate from semantic execution options. */
+    readonly trace?: protocol.Trace;
+    readonly credential?: CredentialInput;
+    /** Source-only effective delegation forwarded unchanged to Runtime. */
+    readonly delegate?: protocol.Delegate;
+    /** Destination routing witness forwarded after exact or same-schema Server admission. */
+    readonly via?: protocol.Via;
+    /** Source-only local-target or remote-revision Schema Registration precondition. */
+    readonly schema?: protocol.SchemaTarget;
+    /** Exact Server-pinned serving generation for a Publication-backed request. */
+    readonly publication?: PublicationSnapshot;
+    readonly context: InvocationContext;
+}
+export interface Handler {
+    dispatch(request: HandlerRequest): Promise<HandlerResult>;
+}

package/dist/invocation/types.js

@@ -0,0 +1 @@
+export {};

package/dist/issuer/exchange.d.ts

@@ -0,0 +1,12 @@
+import * as exchangeProtocol from '@astrale-os/kernel-protocol/issuer/exchange';
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { ServerRouter } from '../transport/index.js';
+export interface Context {
+    readonly signal: AbortSignal;
+}
+export interface Provider {
+    exchange(request: exchangeProtocol.Request, context: Context): Promise<exchangeProtocol.Response>;
+}
+export declare function capture(input: Provider): Provider;
+export declare function mount(app: ServerRouter, issuer: string, provider: Provider, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;