@astrale-os/kernel-server 0.5.0-beta.69 → 0.5.0-beta.70

package/dist/cors/cors.js

@@ -62,12 +62,18 @@ export function prepareCors(input) {
                 return new Response(null, { status: 403, headers: response(request) });
             }
             const allowedMethods = [...routeMethods].filter((method) => methods?.has(method) ?? true);
-            const allowedHeaders = requestedHeaders.length > 0 ? requestedHeaders : [...routeHeaders];
+            // Advertise the whole header allowance, not an echo of the request: Chromium and WebKit keep
+            // one preflight result per origin and URL, so an echo would preflight again whenever a later
+            // call adds a permitted header. Requested names, already admitted, add only what a
+            // wildcard-header route cannot enumerate.
+            const allowedHeaders = new Set([...routeHeaders].filter((name) => headers?.has(name) ?? true));
+            for (const name of requestedHeaders)
+                allowedHeaders.add(name);
             const output = new Headers(response(request));
             output.set('access-control-allow-methods', [...allowedMethods, 'OPTIONS'].join(', '));
             output.set('access-control-max-age', String(PREFLIGHT_MAX_AGE_SECONDS));
-            if (allowedHeaders.length > 0) {
-                output.set('access-control-allow-headers', allowedHeaders.join(', '));
+            if (allowedHeaders.size > 0) {
+                output.set('access-control-allow-headers', [...allowedHeaders].join(', '));
             }
             appendVary(output, 'access-control-request-method');
             appendVary(output, 'access-control-request-headers');

package/dist/index.d.ts

@@ -1,5 +1,10 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
-export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
+export { releaseProjectionRouteDecision, releaseRouteDecision, type RouteDecision, } from './invocation/index.js';
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';
+/** @deprecated Successor: `prepareReleaseSnapshot`; serves v3-input destinations only. */
+export { preparePublicationSnapshot } from './release/legacy/index.js';
+/** @deprecated Successor: `release`; the Publication snapshot of a v3-input destination. */
+export * as publication from './release/legacy/index.js';
+export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';

package/dist/index.js

@@ -1,4 +1,9 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
+export { releaseProjectionRouteDecision, releaseRouteDecision, } from './invocation/index.js';
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';
+/** @deprecated Successor: `prepareReleaseSnapshot`; serves v3-input destinations only. */
+export { preparePublicationSnapshot } from './release/legacy/index.js';
+/** @deprecated Successor: `release`; the Publication snapshot of a v3-input destination. */
+export * as publication from './release/legacy/index.js';

package/dist/invocation/index.d.ts

@@ -1,4 +1,4 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, type InvocationSource, type NextInvocationId, } from './identity.js';
-export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
+export { admitVia, releaseProjectionRouteDecision, releaseRouteDecision, type RouteDecision, } from './release-route.js';
 export type { ApplicationHost, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, InvocationContext, RequestBackground, RequestEvidence, RequestSleep, } from './types.js';

package/dist/invocation/index.js

@@ -1,3 +1,3 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, } from './identity.js';
-export { publicationRouteDecision } from './publication-route.js';
+export { admitVia, releaseProjectionRouteDecision, releaseRouteDecision, } from './release-route.js';

package/dist/invocation/legacy/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Routed admission at a v3-input destination: #508 same-schema and schema-drift continuity
+ * (`publicationRouteDecision`) admits a `PublicationVia` whose ETag or Schema differs from the
+ * served Publication while origin and issuer stay equal, so a legacy stable Worker keeps serving
+ * the installations made before the release snapshot with its latest code (Routage [.57929]). It
+ * applies only to a Server built from a v2/v3 Publication, never to a release snapshot.
+ *
+ * @deprecated Use `releaseRouteDecision` and `releaseProjectionRouteDecision`
+ * (`../release-route.ts`), which admit only the exact served release or its exact projection and
+ * answer every other relation with DEPLOYMENT_RETIRED.
+ *
+ * Short-term consumers: the v3-input destinations of `server/release/legacy/` (legacy direct-mode
+ * Workers, SDK Workers without a bound build digest, the Host's intrinsic publishers).
+ *
+ * Removal, in the separate breaking release that deletes `server/release/legacy/`, under its
+ * condition. Then delete this folder, its laws (SV-PUBLICATION-CONTINUITY,
+ * SV-PUBLICATION-ADMITS-LEGACY-VIA) and the `publication` branch of `admitVia`
+ * (`../release-route.ts`).
+ */
+export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';

package/dist/invocation/legacy/index.js

@@ -0,0 +1,20 @@
+/**
+ * Routed admission at a v3-input destination: #508 same-schema and schema-drift continuity
+ * (`publicationRouteDecision`) admits a `PublicationVia` whose ETag or Schema differs from the
+ * served Publication while origin and issuer stay equal, so a legacy stable Worker keeps serving
+ * the installations made before the release snapshot with its latest code (Routage [.57929]). It
+ * applies only to a Server built from a v2/v3 Publication, never to a release snapshot.
+ *
+ * @deprecated Use `releaseRouteDecision` and `releaseProjectionRouteDecision`
+ * (`../release-route.ts`), which admit only the exact served release or its exact projection and
+ * answer every other relation with DEPLOYMENT_RETIRED.
+ *
+ * Short-term consumers: the v3-input destinations of `server/release/legacy/` (legacy direct-mode
+ * Workers, SDK Workers without a bound build digest, the Host's intrinsic publishers).
+ *
+ * Removal, in the separate breaking release that deletes `server/release/legacy/`, under its
+ * condition. Then delete this folder, its laws (SV-PUBLICATION-CONTINUITY,
+ * SV-PUBLICATION-ADMITS-LEGACY-VIA) and the `publication` branch of `admitVia`
+ * (`../release-route.ts`).
+ */
+export { publicationRouteDecision } from './publication-route.js';

package/dist/invocation/{publication-route.d.ts → legacy/publication-route.d.ts}

@@ -1,11 +1,16 @@
 import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
 import type { Publication } from '@astrale-os/kernel-protocol/publication/publication';
 import type { PublicationRef } from '@astrale-os/kernel-protocol/publication/reference';
+/** @deprecated Successor: `RouteDecision`, which also answers a retired deployment. */
 export type PublicationRouteDecision = {
     readonly kind: 'admitted';
 } | {
     readonly kind: 'rejected';
     readonly error: ErrorPayload;
 };
-/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+/**
+ * Accept ETag or Schema changes only while origin and issuer remain equal.
+ *
+ * @deprecated Use `releaseRouteDecision` or `releaseProjectionRouteDecision` for exact release admission.
+ */
 export declare function publicationRouteDecision(current: Publication, installed: PublicationRef): PublicationRouteDecision;

package/dist/invocation/{publication-route.js → legacy/publication-route.js}

@@ -1,7 +1,11 @@
 import { CODES } from '@astrale-os/kernel-protocol/errors';
 import { SERVICE_TRUST_REQUIRED } from '@astrale-os/kernel-protocol/invocation/service-reason';
 import { compareReference } from '@astrale-os/kernel-protocol/publication/reference';
-/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+/**
+ * Accept ETag or Schema changes only while origin and issuer remain equal.
+ *
+ * @deprecated Use `releaseRouteDecision` or `releaseProjectionRouteDecision` for exact release admission.
+ */
 export function publicationRouteDecision(current, installed) {
     switch (compareReference(current, installed)) {
         case 'exact':

package/dist/invocation/release-route.d.ts

@@ -0,0 +1,26 @@
+import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
+import type { PublicationVia, Via } from '@astrale-os/kernel-protocol/invocation';
+import type { DomainRelease, ReleaseDigest, ReleaseRef } from '@astrale-os/kernel-protocol/release';
+import type { PublicationRef } from '@astrale-os/kernel-protocol/release/legacy';
+import type { Served } from '../release/served.js';
+import type { ReleaseSnapshot } from '../release/types.js';
+export type RouteDecision = {
+    readonly kind: 'admitted';
+} | {
+    readonly kind: 'rejected';
+    readonly error: ErrorPayload;
+}
+/** DEPLOYMENT_RETIRED includes the requested release only when the witness identifies it. */
+ | {
+    readonly kind: 'retired';
+    readonly release?: ReleaseDigest;
+};
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export declare function releaseRouteDecision(current: DomainRelease, installed: ReleaseRef): RouteDecision;
+/** Only the exact v3 projection reference admits, including its ETag, Schema and issuer. */
+export declare function releaseProjectionRouteDecision(current: ReleaseSnapshot, installed: PublicationRef): RouteDecision;
+/** Admit routing before credential resolution; Publication sources accept only legacy witnesses. */
+export declare function admitVia(served: Served | undefined, via: Via | PublicationVia): RouteDecision;

package/dist/invocation/release-route.js

@@ -0,0 +1,55 @@
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { compareReferences, reference } from '@astrale-os/kernel-protocol/release';
+import { compareReference } from '@astrale-os/kernel-protocol/release/legacy';
+import { publicationRouteDecision } from './legacy/index.js';
+const ADMITTED = Object.freeze({ kind: 'admitted' });
+const RETIRED = Object.freeze({ kind: 'retired' });
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export function releaseRouteDecision(current, installed) {
+    switch (compareReferences(reference(current), installed)) {
+        case 'exact':
+            return ADMITTED;
+        case 'release-drift':
+            return installed.digest === current.digest
+                ? RETIRED
+                : Object.freeze({ kind: 'retired', release: installed.digest });
+        case 'origin-drift':
+            return invalid('Routed release origin differs from the served Domain.');
+    }
+}
+/** Only the exact v3 projection reference admits, including its ETag, Schema and issuer. */
+export function releaseProjectionRouteDecision(current, installed) {
+    switch (compareReference(current.publication, installed)) {
+        case 'exact':
+            return ADMITTED;
+        case 'same-schema':
+        case 'schema-drift':
+        case 'identity-drift':
+            return RETIRED;
+        case 'origin-drift':
+            return invalid('Routed Publication origin differs from the served Domain.');
+    }
+}
+/** Admit routing before credential resolution; Publication sources accept only legacy witnesses. */
+export function admitVia(served, via) {
+    if ('release' in via) {
+        return served?.kind === 'release'
+            ? releaseRouteDecision(served.release, via.release)
+            : invalid('Release routing requires a release-backed destination.');
+    }
+    if (served === undefined) {
+        return invalid('Publication routing requires a Publication-backed destination.');
+    }
+    return served.kind === 'release'
+        ? releaseProjectionRouteDecision(served.snapshot, via.publication)
+        : publicationRouteDecision(served.publication, via.publication);
+}
+function invalid(message) {
+    return Object.freeze({
+        kind: 'rejected',
+        error: Object.freeze({ code: CODES.INVALID_REQUEST, message }),
+    });
+}

package/dist/invocation/types.d.ts

@@ -2,7 +2,8 @@ import type { CredentialInput } from '@astrale-os/kernel-core/auth';
 import type { BinaryRequestBody, CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
 import type * as protocol from '@astrale-os/kernel-protocol/invocation';
-import type { PublicationSnapshot } from '../publication/index.js';
+import type { ReleaseSnapshot } from '../release/index.js';
+import type { PublicationSnapshot } from '../release/legacy/index.js';
 /** Optional platform retention and timer adaptation for one Fetch invocation. */
 export interface ApplicationHost {
     waitUntil(promise: Promise<unknown>): void;
@@ -51,11 +52,22 @@ export interface HandlerRequest {
     readonly credential?: CredentialInput;
     /** Source-only effective delegation forwarded unchanged to Runtime. */
     readonly delegate?: protocol.Delegate;
-    /** Destination routing witness forwarded after same-origin, same-identity Server admission. */
-    readonly via?: protocol.Via;
+    /**
+     * Destination routing witness forwarded after Server admission: at a release-backed destination
+     * a `Via` naming its exact release or a `PublicationVia` naming its exact v3 projection; at a
+     * v3-input destination only a `PublicationVia`.
+     */
+    readonly via?: protocol.Via | protocol.PublicationVia;
     /** Source-only local-target or remote-revision Schema Registration precondition. */
     readonly schema?: protocol.SchemaTarget;
-    /** Exact Server-pinned serving generation for a Publication-backed request. */
+    /** Exact Server-pinned release for a request at a release-backed destination. */
+    readonly release?: ReleaseSnapshot;
+    /**
+     * Exact Server-pinned Publication snapshot for a request at a v3-input destination.
+     *
+     * @deprecated Successor: `release`. Present only on a Server built from a v2/v3 Publication;
+     * deleted with `server/release/legacy/`.
+     */
     readonly publication?: PublicationSnapshot;
     readonly context: InvocationContext;
 }

package/dist/issuer/routes.js

@@ -2,6 +2,7 @@ import { configuration } from '@astrale-os/kernel-protocol/issuer/configuration'
 import { hosted } from '@astrale-os/kernel-protocol/issuer/hosted';
 import { keySet } from '@astrale-os/kernel-protocol/issuer/key-set';
 import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { workflowEngine } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
 import { admissionRefusal, IssuerKeysUnavailableError, retryAfterHeaders } from '../errors/index.js';
 import { mount } from './exchange.js';
 export function issuerRouteReservations(input, tokenExchange = false) {
@@ -13,6 +14,9 @@ export function issuerRouteReservations(input, tokenExchange = false) {
     if (tokenExchange) {
         reservations.push(Object.freeze({ path: paths.tokenExchange, methods: Object.freeze(['POST']) }));
     }
+    if (input.workflowEngineKeys !== undefined) {
+        reservations.push(Object.freeze({ path: paths.workflowEngine, methods: Object.freeze(['GET']) }));
+    }
     if (input.loadIssuerPublicKeys !== undefined) {
         const base = new URL(input.issuer).pathname.replace(/\/+$/u, '');
         reservations.push(Object.freeze({
@@ -50,6 +54,10 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
         tokenExchange: tokenExchange !== undefined,
     });
     app.get(paths.configuration, (context) => context.json(discovery, 200, headers(context.req.raw)));
+    if (input.workflowEngineKeys !== undefined) {
+        const engine = workflowEngine(issuer, input.workflowEngineKeys);
+        app.get(paths.workflowEngine, (context) => context.json(engine, 200, headers(context.req.raw)));
+    }
     if (cors.enabled) {
         app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
@@ -152,9 +160,14 @@ export function admitIssuer(input) {
     }
     const loadPublicKeys = input.loadPublicKeys;
     const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    // A Kernel that drives an engine publishes it; invalid keys fail closed at boot.
+    const workflowEngineKeys = input.workflowEngineKeys === undefined
+        ? undefined
+        : workflowEngine(issuer, input.workflowEngineKeys).identity_keys;
     return Object.freeze({
         issuer,
         signingAlgorithm,
+        ...(workflowEngineKeys === undefined ? {} : { workflowEngineKeys }),
         loadPublicKeys: (signal) => loadPublicKeys.call(input, signal),
         ...(loadIssuerPublicKeys === undefined
             ? {}

package/dist/issuer/types.d.ts

@@ -8,4 +8,9 @@ export interface Issuer {
     loadPublicKeys(signal: AbortSignal): Promise<readonly JsonWebKey[]>;
     /** Optional hosted-key discovery for issuers below `<issuer>/iss/:thumbprint`. */
     readonly loadIssuerPublicKeys?: (issuer: IssuerId, signal: AbortSignal) => Promise<readonly JsonWebKey[]>;
+    /**
+     * Request identity keys of the workflow engine this Kernel drives, published at
+     * `<issuer>/.well-known/astrale/workflow-engine.json` so Domains verify the engine's requests.
+     */
+    readonly workflowEngineKeys?: readonly string[];
 }

package/dist/release/delivery/handler.d.ts

@@ -0,0 +1,13 @@
+import type { ActiveOperations } from '../../lifecycle/index.js';
+import type { Served } from '../served.js';
+import type { Provider } from './types.js';
+export interface Limits {
+    readonly maximumDeliveryBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/**
+ * Serve one delivery request against the exact snapshot that selected its URL, in the request's
+ * version: Delivery v2 names the served release, Delivery v1 the served Publication (a release's
+ * frozen v3 projection). A v3-input destination keeps its Delivery v1 decoder.
+ */
+export declare function handleDelivery(request: Request, snapshot: Served, provider: Provider | undefined, active: ActiveOperations, limits: Limits, corsFor: (exposedHeaders?: readonly string[]) => Readonly<Record<string, string>>): Promise<Response>;

package/dist/{publication → release}/delivery/handler.js

@@ -1,10 +1,16 @@
 import * as codecs from '@astrale-os/kernel-protocol/codecs';
-import * as protocolPublication from '@astrale-os/kernel-protocol/publication';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { admissionRefusal, DeliveryUnavailableError, retryAfterHeaders, } from '../../errors/index.js';
 import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../../errors/index.js';
 import { readBoundedBody } from '../../transport/index.js';
-const delivery = protocolPublication.delivery;
-/** Serve one delivery request against the exact Publication snapshot that selected its URL. */
+import { servedDocument } from '../served.js';
+const delivery = release.delivery;
+const publicationDelivery = release.legacy.delivery;
+/**
+ * Serve one delivery request against the exact snapshot that selected its URL, in the request's
+ * version: Delivery v2 names the served release, Delivery v1 the served Publication (a release's
+ * frozen v3 projection). A v3-input destination keeps its Delivery v1 decoder.
+ */
 export async function handleDelivery(request, snapshot, provider, active, limits, corsFor) {
     const cors = corsFor();
     if (request.method !== 'POST') {
@@ -13,7 +19,7 @@ export async function handleDelivery(request, snapshot, provider, active, limits
     if (provider === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 503, cors);
     }
-    const advertised = snapshot.publication.delivery;
+    const advertised = servedDocument(snapshot).delivery;
     if (advertised === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 404, cors);
     }
@@ -60,7 +66,10 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         }
         let input;
         try {
-            input = delivery.acceptRequest(decoded);
+            input =
+                snapshot.kind === 'release'
+                    ? delivery.acceptRequest(decoded)
+                    : publicationDelivery.acceptRequest(decoded);
         }
         catch (cause) {
             if (cause instanceof delivery.Error && cause.code === 'DELIVERY_REQUEST_INVALID') {
@@ -68,8 +77,13 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (input.etag !== snapshot.publication.etag) {
-            return response({ error: 'Publication ETag differs from request.' }, 409, cors);
+        const named = input.version === 2 ? input.release : input.etag;
+        const served = input.version === 2 ? servedRelease(snapshot) : snapshot.publication.etag;
+        if (named !== served) {
+            const error = input.version === 2
+                ? 'Release digest differs from request.'
+                : 'Publication ETag differs from request.';
+            return response({ error }, 409, cors);
         }
         let candidate;
         try {
@@ -86,7 +100,8 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         }
         let created;
         try {
-            created = delivery.accept(candidate);
+            created =
+                input.version === 2 ? delivery.accept(candidate) : publicationDelivery.accept(candidate);
         }
         catch (cause) {
             if (cause instanceof delivery.Error) {
@@ -94,8 +109,12 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (created.publication.etag !== snapshot.publication.etag) {
-            return response({ error: 'Delivery provider returned a different Publication.' }, 500, cors);
+        const delivered = created.version === 2 ? created.release.digest : created.publication.etag;
+        if (delivered !== served) {
+            const error = created.version === 2
+                ? 'Delivery provider returned a different release.'
+                : 'Delivery provider returned a different Publication.';
+            return response({ error }, 500, cors);
         }
         const encoded = codecs.json.encode(created);
         if (encodedSize(encoded) > limits.maximumDeliveryBytes) {
@@ -109,6 +128,10 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         operation.settle();
     }
 }
+/** Digest a Delivery v2 must name: only a release-backed destination serves one. */
+function servedRelease(snapshot) {
+    return snapshot.kind === 'release' ? snapshot.release.digest : undefined;
+}
 function bearer(input) {
     if (input === null)
         return undefined;

package/dist/release/delivery/types.d.ts

@@ -0,0 +1,21 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+export interface Context {
+    /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
+    readonly token?: release.delivery.Token;
+    readonly signal: AbortSignal;
+}
+/** Provider-owned retrieval, construction, and attestation signing. */
+export interface Provider {
+    /**
+     * Answer in the request's version: a Delivery v2 carrying the served release for a v2 request,
+     * and a Delivery v1 carrying the served Publication (at a release-backed destination, its frozen
+     * v3 projection) for a deprecated v1 request. A v3-input destination passes only v1 requests.
+     * Throw DeliveryUnavailableError only for an expected dependency outage.
+     *
+     * A release-backed destination (`ServerOptions.release`) passes v2 requests, so its provider
+     * must answer both versions. The deprecated v1-only `publication.delivery.Provider` still
+     * type-checks here, because method parameters are compared bivariantly, but every v2 request
+     * it receives fails with 500 `Delivery provider returned an invalid response.`
+     */
+    create(request: release.delivery.Request | release.legacy.delivery.Request, context: Context): Promise<release.delivery.Delivery | release.legacy.delivery.Delivery>;
+}

package/dist/release/index.d.ts

@@ -0,0 +1,3 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export type { ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource } from './types.js';
+export * as delivery from './delivery/index.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export * as delivery from './delivery/index.js';

package/dist/release/legacy/delivery.d.ts

@@ -0,0 +1,18 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Context as DeliveryContext } from '../delivery/types.js';
+/** @deprecated Successor: `release.delivery.Context`, the same retrieval context. */
+export type Context = DeliveryContext;
+/**
+ * The Delivery v1 provider of a v3-input destination, which only ever receives v1 requests. It
+ * remains assignable to `release.delivery.Provider`, so existing providers keep configuring a
+ * Server unchanged. Pass it only with `ServerOptions.publication`: a release-backed destination
+ * also passes Delivery v2 requests, which this provider cannot answer.
+ *
+ * @deprecated Successor: `release.delivery.Provider`, which answers a v2 request over the release
+ * and a v1 request over its frozen v3 projection.
+ */
+export interface Provider {
+    create(request: release.legacy.delivery.Request, context: Context): Promise<release.legacy.delivery.Delivery>;
+}
+/** @deprecated Successor: `release.delivery.handleDelivery`, which serves both snapshots. */
+export { handleDelivery, type Limits } from '../delivery/handler.js';

package/dist/release/legacy/delivery.js

@@ -0,0 +1,2 @@
+/** @deprecated Successor: `release.delivery.handleDelivery`, which serves both snapshots. */
+export { handleDelivery } from '../delivery/handler.js';

package/dist/release/legacy/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The Publication snapshot of a v3-input destination: a Server built from a v2/v3 Publication
+ * serves `domain.json`, its bundle, Delivery v1 and its native routes exactly as before the release
+ * snapshot, and keeps the #508 same-schema and schema-drift continuity
+ * (`server/invocation/legacy/publication-route.ts`). Its answers are pinned byte for byte by the
+ * golden transcript of `server/__tests__/transcripts.test.ts`.
+ *
+ * @deprecated Use `ServerOptions.release` with `prepareReleaseSnapshot`, which serves a
+ * `DomainRelease` at `release.json` beside its frozen v3 projection at `domain.json` and admits
+ * only exact routing.
+ *
+ * Short-term consumers:
+ * - the legacy direct-mode Workers built by an SDK that seals v2/v3 only: the domains platform
+ *   Domains, Shell, the Services `development` environment and `ui:domain`, until they serve
+ *   releases;
+ * - an SDK Worker whose deployment host binds no build digest, which serves today's v3 document;
+ * - the Host's intrinsic Kernel and Host Domain publishers (`host/kernel/publication/`) and the
+ *   FalkorDB qualification remote Domain, until the Host serves its intrinsic release.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one), no supported SDK
+ * builds a v3-input Worker, and the intrinsic Kernel and Host Domains serve a release. Then
+ * delete, in the same PR:
+ * - this folder with its `.spec` (its v1-only Delivery `Provider` included), the `publication`
+ *   namespace, `preparePublicationSnapshot` and the Publication snapshot types of
+ *   `server/index.ts` and `server/.spec/api.d.ts`, and the `./publication/snapshot` subpath
+ *   (source and `dist`) of `server/package.json`;
+ * - `ServerOptions.publication` (`server/types.ts`) and `HandlerRequest.publication`
+ *   (`server/invocation/types.ts`), with the `publication` branch of `Served`
+ *   (`server/release/served.ts`) and every `kind === 'publication'` branch it selects in
+ *   `server/routes/routes.ts`, `server/release/delivery/handler.ts` and `admitVia`;
+ * - `server/invocation/legacy/` (laws SV-PUBLICATION-CONTINUITY, SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the golden transcript that records a v3-input server, keeping the one of a server without a
+ *   source.
+ */
+export { preparePublicationSnapshot, readPreparedPublicationSnapshot, type PreparedPublicationSnapshot, } from './snapshot.js';
+export type { PublicationSnapshot, PublicationSnapshotInput, PublicationSource } from './types.js';
+/** @deprecated The Delivery v1 boundary of a v3-input destination; use `release.delivery`. */
+export * as delivery from './delivery.js';

package/dist/release/legacy/index.js

@@ -0,0 +1,38 @@
+/**
+ * The Publication snapshot of a v3-input destination: a Server built from a v2/v3 Publication
+ * serves `domain.json`, its bundle, Delivery v1 and its native routes exactly as before the release
+ * snapshot, and keeps the #508 same-schema and schema-drift continuity
+ * (`server/invocation/legacy/publication-route.ts`). Its answers are pinned byte for byte by the
+ * golden transcript of `server/__tests__/transcripts.test.ts`.
+ *
+ * @deprecated Use `ServerOptions.release` with `prepareReleaseSnapshot`, which serves a
+ * `DomainRelease` at `release.json` beside its frozen v3 projection at `domain.json` and admits
+ * only exact routing.
+ *
+ * Short-term consumers:
+ * - the legacy direct-mode Workers built by an SDK that seals v2/v3 only: the domains platform
+ *   Domains, Shell, the Services `development` environment and `ui:domain`, until they serve
+ *   releases;
+ * - an SDK Worker whose deployment host binds no build digest, which serves today's v3 document;
+ * - the Host's intrinsic Kernel and Host Domain publishers (`host/kernel/publication/`) and the
+ *   FalkorDB qualification remote Domain, until the Host serves its intrinsic release.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one), no supported SDK
+ * builds a v3-input Worker, and the intrinsic Kernel and Host Domains serve a release. Then
+ * delete, in the same PR:
+ * - this folder with its `.spec` (its v1-only Delivery `Provider` included), the `publication`
+ *   namespace, `preparePublicationSnapshot` and the Publication snapshot types of
+ *   `server/index.ts` and `server/.spec/api.d.ts`, and the `./publication/snapshot` subpath
+ *   (source and `dist`) of `server/package.json`;
+ * - `ServerOptions.publication` (`server/types.ts`) and `HandlerRequest.publication`
+ *   (`server/invocation/types.ts`), with the `publication` branch of `Served`
+ *   (`server/release/served.ts`) and every `kind === 'publication'` branch it selects in
+ *   `server/routes/routes.ts`, `server/release/delivery/handler.ts` and `admitVia`;
+ * - `server/invocation/legacy/` (laws SV-PUBLICATION-CONTINUITY, SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the golden transcript that records a v3-input server, keeping the one of a server without a
+ *   source.
+ */
+export { preparePublicationSnapshot, readPreparedPublicationSnapshot, } from './snapshot.js';
+/** @deprecated The Delivery v1 boundary of a v3-input destination; use `release.delivery`. */
+export * as delivery from './delivery.js';

package/dist/{publication → release/legacy}/snapshot.d.ts

@@ -1,16 +1,26 @@
 import type { Domain } from '@astrale-os/kernel-dsl/v1';
 import type * as publication from '@astrale-os/kernel-protocol/publication';
-import type * as routes from '@astrale-os/kernel-protocol/routes';
+import type { Table } from '@astrale-os/kernel-protocol/routes/legacy';
 import type { PublicationSnapshot, PublicationSnapshotInput } from './types.js';
+/** @deprecated Successor: `PreparedReleaseSnapshot`. */
 export interface PreparedPublicationSnapshot {
+    readonly kind: 'publication';
     readonly snapshot: PublicationSnapshot;
     readonly publication: publication.Publication;
     readonly publicationBytes: Uint8Array;
     readonly bundle: Uint8Array;
-    readonly table: routes.Table;
+    readonly table: Table;
     readonly domain: Domain;
 }
-/** Admit and detach one revision-coherent serving snapshot before publication. */
+/**
+ * Admit and detach one revision-coherent serving snapshot.
+ *
+ * @deprecated Use `prepareReleaseSnapshot` to serve a release and its v3 projection.
+ */
 export declare function preparePublicationSnapshot(input: PublicationSnapshotInput): PublicationSnapshot;
-/** Internal proof that a PublicationSource returned a Server-prepared snapshot without cloning it. */
+/**
+ * Internal proof that a PublicationSource returned a Server-prepared snapshot without cloning it.
+ *
+ * @deprecated Successor: `readPreparedReleaseSnapshot`.
+ */
 export declare function readPreparedPublicationSnapshot(input: unknown): PreparedPublicationSnapshot | undefined;

package/dist/{publication → release/legacy}/snapshot.js

@@ -3,7 +3,11 @@ import { verifyBundleBytes } from '@astrale-os/kernel-protocol/publication/bundl
 import { accept as acceptPublication, encode as encodePublication, } from '@astrale-os/kernel-protocol/publication/publication';
 import { admitTable } from './table.js';
 const snapshots = new WeakMap();
-/** Admit and detach one revision-coherent serving snapshot before publication. */
+/**
+ * Admit and detach one revision-coherent serving snapshot.
+ *
+ * @deprecated Use `prepareReleaseSnapshot` to serve a release and its v3 projection.
+ */
 export function preparePublicationSnapshot(input) {
     if (input === null || typeof input !== 'object' || !(input.bundle instanceof Uint8Array)) {
         throw new TypeError('Publication snapshot input is invalid.');
@@ -28,6 +32,7 @@ export function preparePublicationSnapshot(input) {
     const publicationBytes = encodePublication(admittedPublication);
     const snapshot = Object.freeze({ publication: admittedPublication });
     const prepared = Object.freeze({
+        kind: 'publication',
         snapshot,
         publication: admittedPublication,
         publicationBytes,
@@ -38,7 +43,11 @@ export function preparePublicationSnapshot(input) {
     snapshots.set(snapshot, prepared);
     return snapshot;
 }
-/** Internal proof that a PublicationSource returned a Server-prepared snapshot without cloning it. */
+/**
+ * Internal proof that a PublicationSource returned a Server-prepared snapshot without cloning it.
+ *
+ * @deprecated Successor: `readPreparedReleaseSnapshot`.
+ */
 export function readPreparedPublicationSnapshot(input) {
     if (input === null || typeof input !== 'object')
         return undefined;