@astrale-os/kernel-server 0.5.0-beta.7 → 0.5.0-beta.70

package/dist/issuer/exchange.js

@@ -2,6 +2,7 @@ import { inspect as inspectCredential } from '@astrale-os/kernel-core/auth/crede
 import * as errors from '@astrale-os/kernel-protocol/errors';
 import * as exchangeProtocol from '@astrale-os/kernel-protocol/issuer/exchange';
 import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { admissionRefusal, retryAfterHeaders } from '../errors/index.js';
 const PROVIDER_CODES = new Set([
     errors.CODES.AUTH_INVALID,
     errors.CODES.AUTH_EXPIRED,
@@ -24,7 +25,10 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
     }
     app.all(path, async (context) => {
         const request = context.req.raw;
-        const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, extra);
+        const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, {
+            ...retryAfterHeaders(payload.error),
+            ...extra,
+        });
         let admitted;
         try {
             admitted = exchangeProtocol.acceptHttpRequest({
@@ -40,12 +44,9 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
             }
             throw cause;
         }
-        if (!active.isAccepting) {
-            return respond(error('BACKEND_UNAVAILABLE', 'Token exchange is unavailable.'));
-        }
         const operation = active.begin(timeoutMs, request.signal);
         if (operation === undefined) {
-            return respond(error('LIMIT_EXCEEDED', 'Token-exchange limit exceeded.'));
+            return respond(exchangeProtocol.acceptErrorResponse({ error: admissionRefusal(active.isAccepting) }));
         }
         try {
             try {
@@ -60,6 +61,11 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                 }
                 throw cause;
             }
+            if (operation.timedOut) {
+                return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+            }
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
             let output;
             try {
                 output = await provider.exchange(admitted, { signal: operation.signal });
@@ -68,6 +74,8 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                 if (operation.timedOut) {
                     return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
                 }
+                if (operation.signal.aborted)
+                    throw operation.signal.reason;
                 if (cause instanceof errors.ProtocolError && PROVIDER_CODES.has(cause.payload.code)) {
                     return respond(exchangeProtocol.acceptErrorResponse({ error: cause.payload }));
                 }
@@ -76,6 +84,8 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
             if (operation.timedOut) {
                 return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
             }
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
             const response = exchangeProtocol.acceptResponse(output);
             if (inspectCredential(response.token).claims.exp !== response.expiresAt) {
                 throw new TypeError('Token-exchange provider returned inconsistent expiry evidence.');
@@ -125,13 +135,13 @@ function error(code, message) {
     });
 }
 function json(value, status, request, cors, extra) {
+    const additional = new Headers(extra);
     const headers = new Headers(exchangeProtocol.responseHeaders());
-    for (const [name, value] of Object.entries(cors.response(request)))
+    const exposed = additional.has('retry-after') ? ['retry-after'] : [];
+    for (const [name, value] of Object.entries(cors.response(request, exposed))) {
         headers.set(name, value);
-    if (extra !== undefined) {
-        for (const [name, value] of new Headers(extra))
-            headers.set(name, value);
     }
+    for (const [name, value] of additional)
+        headers.set(name, value);
     return new Response(JSON.stringify(value), { status, headers });
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/index.d.ts

@@ -1,4 +1,3 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, type IssuerRouteReservation, } from './routes.js';
 export type * as exchange from './exchange.js';
 export type { Issuer } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -1,2 +1 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, } from './routes.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/routes.d.ts

@@ -11,4 +11,3 @@ export declare function issuerRouteReservations(input: Issuer, tokenExchange?: b
 export declare function mountIssuer(app: ServerRouter, input: Issuer, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number, tokenExchange?: Provider): void;
 /** Admit static discovery configuration before Runtime Boot performs any durable work. */
 export declare function admitIssuer(input: Issuer): Issuer;
-//# sourceMappingURL=routes.d.ts.map

package/dist/issuer/routes.js

@@ -2,7 +2,8 @@ import { configuration } from '@astrale-os/kernel-protocol/issuer/configuration'
 import { hosted } from '@astrale-os/kernel-protocol/issuer/hosted';
 import { keySet } from '@astrale-os/kernel-protocol/issuer/key-set';
 import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
-import { IssuerKeysUnavailableError } from '../errors/index.js';
+import { workflowEngine } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+import { admissionRefusal, IssuerKeysUnavailableError, retryAfterHeaders } from '../errors/index.js';
 import { mount } from './exchange.js';
 export function issuerRouteReservations(input, tokenExchange = false) {
     const paths = issuerPaths(input.issuer);
@@ -13,6 +14,9 @@ export function issuerRouteReservations(input, tokenExchange = false) {
     if (tokenExchange) {
         reservations.push(Object.freeze({ path: paths.tokenExchange, methods: Object.freeze(['POST']) }));
     }
+    if (input.workflowEngineKeys !== undefined) {
+        reservations.push(Object.freeze({ path: paths.workflowEngine, methods: Object.freeze(['GET']) }));
+    }
     if (input.loadIssuerPublicKeys !== undefined) {
         const base = new URL(input.issuer).pathname.replace(/\/+$/u, '');
         reservations.push(Object.freeze({
@@ -32,11 +36,28 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
         ...cors.response(request),
         'cache-control': 'no-cache',
     });
+    // A lifecycle refusal names saturation or drain and presents its retry delay.
+    const refusal = (request) => {
+        const refused = admissionRefusal(active.isAccepting);
+        const retry = retryAfterHeaders(refused);
+        return {
+            body: { error: refused.message },
+            headers: {
+                ...cors.response(request, Object.keys(retry)),
+                'cache-control': 'no-cache',
+                ...retry,
+            },
+        };
+    };
     const algorithm = input.signingAlgorithm ?? 'ES256';
     const discovery = configuration(issuer, [algorithm], {
         tokenExchange: tokenExchange !== undefined,
     });
     app.get(paths.configuration, (context) => context.json(discovery, 200, headers(context.req.raw)));
+    if (input.workflowEngineKeys !== undefined) {
+        const engine = workflowEngine(issuer, input.workflowEngineKeys);
+        app.get(paths.workflowEngine, (context) => context.json(engine, 200, headers(context.req.raw)));
+    }
     if (cors.enabled) {
         app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
@@ -44,7 +65,8 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
     app.get(paths.keys, async (context) => {
         const operation = active.begin(timeoutMs, context.req.raw.signal);
         if (operation === undefined) {
-            return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            const refused = refusal(context.req.raw);
+            return context.json(refused.body, 503, refused.headers);
         }
         try {
             const keys = await input.loadPublicKeys(operation.signal);
@@ -76,7 +98,8 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
                 return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
             const operation = active.begin(timeoutMs, context.req.raw.signal);
             if (operation === undefined) {
-                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+                const refused = refusal(context.req.raw);
+                return context.json(refused.body, 503, refused.headers);
             }
             try {
                 const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
@@ -100,7 +123,8 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
                 return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
             const operation = active.begin(timeoutMs, context.req.raw.signal);
             if (operation === undefined) {
-                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+                const refused = refusal(context.req.raw);
+                return context.json(refused.body, 503, refused.headers);
             }
             try {
                 const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
@@ -136,9 +160,14 @@ export function admitIssuer(input) {
     }
     const loadPublicKeys = input.loadPublicKeys;
     const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    // A Kernel that drives an engine publishes it; invalid keys fail closed at boot.
+    const workflowEngineKeys = input.workflowEngineKeys === undefined
+        ? undefined
+        : workflowEngine(issuer, input.workflowEngineKeys).identity_keys;
     return Object.freeze({
         issuer,
         signingAlgorithm,
+        ...(workflowEngineKeys === undefined ? {} : { workflowEngineKeys }),
         loadPublicKeys: (signal) => loadPublicKeys.call(input, signal),
         ...(loadIssuerPublicKeys === undefined
             ? {}
@@ -147,4 +176,3 @@ export function admitIssuer(input) {
             }),
     });
 }
-//# sourceMappingURL=routes.js.map

package/dist/issuer/types.d.ts

@@ -8,5 +8,9 @@ export interface Issuer {
     loadPublicKeys(signal: AbortSignal): Promise<readonly JsonWebKey[]>;
     /** Optional hosted-key discovery for issuers below `<issuer>/iss/:thumbprint`. */
     readonly loadIssuerPublicKeys?: (issuer: IssuerId, signal: AbortSignal) => Promise<readonly JsonWebKey[]>;
+    /**
+     * Request identity keys of the workflow engine this Kernel drives, published at
+     * `<issuer>/.well-known/astrale/workflow-engine.json` so Domains verify the engine's requests.
+     */
+    readonly workflowEngineKeys?: readonly string[];
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/issuer/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/lifecycle/active.d.ts

@@ -12,6 +12,8 @@ export interface ActiveOperation {
     /** Register cooperative cleanup and return an idempotent unregistration function. */
     onCancel(cancel: CancelWork): () => void;
     cancel(reason: string): void;
+    /** Replace the remaining budget after a trusted transport binding is admitted. */
+    extend(timeoutMs: number): void;
     settle(): void;
     readonly finished: Promise<void>;
 }
@@ -26,6 +28,8 @@ export declare class ActiveOperations {
     private changed;
     constructor(maximumConcurrentOperations: number);
     get isAccepting(): boolean;
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable(): boolean;
     begin(timeoutMs: number, externalSignal?: AbortSignal): ActiveOperation | undefined;
     attachSocket(socket: ActiveSocket): boolean;
     detachSocket(socket: ActiveSocket): void;
@@ -37,4 +41,3 @@ export declare class ActiveOperations {
     private closeSockets;
 }
 export {};
-//# sourceMappingURL=active.d.ts.map

package/dist/lifecycle/active.js

@@ -1,3 +1,6 @@
+// Streaming iterators can need several microtasks to return after cancellation. Keep the
+// cleanup join bounded even when a producer ignores its cancellation signal.
+const CANCELLATION_CLEANUP_GRACE_MS = 250;
 export class ActiveOperations {
     maximumConcurrentOperations;
     accepting = true;
@@ -13,10 +16,13 @@ export class ActiveOperations {
     get isAccepting() {
         return this.accepting;
     }
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable() {
+        return this.accepting && this.operations.size < this.maximumConcurrentOperations;
+    }
     begin(timeoutMs, externalSignal) {
-        if (!this.accepting || this.operations.size >= this.maximumConcurrentOperations) {
+        if (!this.isAvailable)
             return undefined;
-        }
         const operation = new Operation(Date.now() + timeoutMs, () => {
             this.operations.delete(operation);
             this.changed?.();
@@ -63,19 +69,32 @@ export class ActiveOperations {
     }
     close(deadline) {
         this.drain();
-        this.closing ??= this.closeOnce(deadline);
+        if (this.closing === undefined) {
+            const flight = this.closeOnce(deadline);
+            this.closing = flight;
+            void flight.catch(() => {
+                // A failed close leaves admission terminal, but residual work may settle later.
+                // Let the same owner join that cleanup on its next close attempt.
+                if (this.closing === flight)
+                    this.closing = undefined;
+            });
+        }
         return this.closing;
     }
     async closeOnce(deadline) {
         await this.waitUntilIdleOr(deadline);
+        const hasCancellationWork = [...this.operations].some((operation) => operation.hasCancellationWork);
         if (this.operations.size > 0) {
             for (const operation of this.operations)
                 operation.cancel('server closing');
         }
         this.closeSockets();
-        // Give cooperative cancellation and iterator returns one turn to settle. The absolute deadline
-        // has already elapsed; an uncooperative operation must reject close rather than pin Host forever.
-        await Promise.resolve();
+        if (hasCancellationWork) {
+            await this.waitUntilIdleOr(Date.now() + CANCELLATION_CLEANUP_GRACE_MS);
+        }
+        else {
+            await Promise.resolve();
+        }
         if (this.operations.size > 0 || this.backgroundTasks.size > 0) {
             this.closed = true;
             throw new Error(`Server close deadline elapsed with ${this.operations.size} active operation(s) and ${this.backgroundTasks.size} background task(s).`);
@@ -110,11 +129,11 @@ export class ActiveOperations {
     }
 }
 class Operation {
-    deadline;
     onSettled;
     controller = new AbortController();
     cancelWork = new Set();
     timer;
+    deadlineValue;
     external;
     settled = false;
     cancelled = false;
@@ -122,15 +141,31 @@ class Operation {
     resolveFinished;
     finished;
     constructor(deadline, onSettled) {
-        this.deadline = deadline;
         this.onSettled = onSettled;
+        this.deadlineValue = deadline;
         this.finished = new Promise((resolve) => {
             this.resolveFinished = resolve;
         });
-        this.timer = setTimeout(() => {
+        this.timer = this.arm();
+    }
+    get deadline() {
+        return this.deadlineValue;
+    }
+    extend(timeoutMs) {
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647) {
+            throw new TypeError('Active operation timeout is invalid.');
+        }
+        if (this.cancelled || this.settled)
+            return;
+        clearTimeout(this.timer);
+        this.deadlineValue = Date.now() + timeoutMs;
+        this.timer = this.arm();
+    }
+    arm() {
+        return setTimeout(() => {
             this.timeout = true;
             this.cancel('invocation deadline exceeded');
-        }, Math.min(Math.max(0, deadline - Date.now()), 2_147_483_647));
+        }, Math.min(Math.max(0, this.deadlineValue - Date.now()), 2_147_483_647));
     }
     link(signal) {
         if (signal === undefined)
@@ -148,6 +183,9 @@ class Operation {
     get timedOut() {
         return this.timeout;
     }
+    get hasCancellationWork() {
+        return this.cancelWork.size > 0;
+    }
     onCancel(cancel) {
         if (this.cancelled) {
             void settleCancellation(cancel, abortReason(this.controller.signal));
@@ -197,4 +235,3 @@ async function settleCancellation(cancel, reason) {
 function abortReason(signal) {
     return signal.reason instanceof Error ? signal.reason.message : 'operation cancelled';
 }
-//# sourceMappingURL=active.js.map

package/dist/lifecycle/index.d.ts

@@ -1,2 +1 @@
 export { ActiveOperations, type ActiveOperation, type ActiveSocket } from './active.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.js

@@ -1,2 +1 @@
 export { ActiveOperations } from './active.js';
-//# sourceMappingURL=index.js.map

package/dist/release/delivery/handler.d.ts

@@ -0,0 +1,13 @@
+import type { ActiveOperations } from '../../lifecycle/index.js';
+import type { Served } from '../served.js';
+import type { Provider } from './types.js';
+export interface Limits {
+    readonly maximumDeliveryBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/**
+ * Serve one delivery request against the exact snapshot that selected its URL, in the request's
+ * version: Delivery v2 names the served release, Delivery v1 the served Publication (a release's
+ * frozen v3 projection). A v3-input destination keeps its Delivery v1 decoder.
+ */
+export declare function handleDelivery(request: Request, snapshot: Served, provider: Provider | undefined, active: ActiveOperations, limits: Limits, corsFor: (exposedHeaders?: readonly string[]) => Readonly<Record<string, string>>): Promise<Response>;

package/dist/{publication → release}/delivery/handler.js

@@ -1,23 +1,34 @@
-import { codecs, publication as protocolPublication } from '@astrale-os/kernel-protocol';
-import { DeliveryUnavailableError } from '../../errors/index.js';
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as release from '@astrale-os/kernel-protocol/release';
+import { admissionRefusal, DeliveryUnavailableError, retryAfterHeaders, } from '../../errors/index.js';
 import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../../errors/index.js';
 import { readBoundedBody } from '../../transport/index.js';
-const delivery = protocolPublication.delivery;
-/** Serve one delivery request against the exact Publication snapshot that selected its URL. */
-export async function handleDelivery(request, snapshot, provider, active, limits, cors) {
+import { servedDocument } from '../served.js';
+const delivery = release.delivery;
+const publicationDelivery = release.legacy.delivery;
+/**
+ * Serve one delivery request against the exact snapshot that selected its URL, in the request's
+ * version: Delivery v2 names the served release, Delivery v1 the served Publication (a release's
+ * frozen v3 projection). A v3-input destination keeps its Delivery v1 decoder.
+ */
+export async function handleDelivery(request, snapshot, provider, active, limits, corsFor) {
+    const cors = corsFor();
     if (request.method !== 'POST') {
         return response({ error: 'Delivery requires POST.' }, 405, cors);
     }
     if (provider === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 503, cors);
     }
-    const advertised = snapshot.publication.delivery;
+    const advertised = servedDocument(snapshot).delivery;
     if (advertised === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 404, cors);
     }
     const operation = active.begin(limits.invocationTimeoutMs, request.signal);
-    if (operation === undefined)
-        return response({ error: 'Server is draining.' }, 503, cors);
+    if (operation === undefined) {
+        const refusal = admissionRefusal(active.isAccepting);
+        const retry = retryAfterHeaders(refusal);
+        return response({ error: refusal.message }, 503, { ...corsFor(Object.keys(retry)), ...retry });
+    }
     try {
         const authorization = request.headers.get('authorization');
         const token = bearer(authorization);
@@ -55,7 +66,10 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         }
         let input;
         try {
-            input = delivery.acceptRequest(decoded);
+            input =
+                snapshot.kind === 'release'
+                    ? delivery.acceptRequest(decoded)
+                    : publicationDelivery.acceptRequest(decoded);
         }
         catch (cause) {
             if (cause instanceof delivery.Error && cause.code === 'DELIVERY_REQUEST_INVALID') {
@@ -63,8 +77,13 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (input.etag !== snapshot.publication.etag) {
-            return response({ error: 'Publication ETag differs from request.' }, 409, cors);
+        const named = input.version === 2 ? input.release : input.etag;
+        const served = input.version === 2 ? servedRelease(snapshot) : snapshot.publication.etag;
+        if (named !== served) {
+            const error = input.version === 2
+                ? 'Release digest differs from request.'
+                : 'Publication ETag differs from request.';
+            return response({ error }, 409, cors);
         }
         let candidate;
         try {
@@ -81,7 +100,8 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         }
         let created;
         try {
-            created = delivery.accept(candidate);
+            created =
+                input.version === 2 ? delivery.accept(candidate) : publicationDelivery.accept(candidate);
         }
         catch (cause) {
             if (cause instanceof delivery.Error) {
@@ -89,8 +109,12 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (created.publication.etag !== snapshot.publication.etag) {
-            return response({ error: 'Delivery provider returned a different Publication.' }, 500, cors);
+        const delivered = created.version === 2 ? created.release.digest : created.publication.etag;
+        if (delivered !== served) {
+            const error = created.version === 2
+                ? 'Delivery provider returned a different release.'
+                : 'Delivery provider returned a different Publication.';
+            return response({ error }, 500, cors);
         }
         const encoded = codecs.json.encode(created);
         if (encodedSize(encoded) > limits.maximumDeliveryBytes) {
@@ -104,6 +128,10 @@ export async function handleDelivery(request, snapshot, provider, active, limits
         operation.settle();
     }
 }
+/** Digest a Delivery v2 must name: only a release-backed destination serves one. */
+function servedRelease(snapshot) {
+    return snapshot.kind === 'release' ? snapshot.release.digest : undefined;
+}
 function bearer(input) {
     if (input === null)
         return undefined;
@@ -124,4 +152,3 @@ function encodedSize(input) {
 function toBody(input) {
     return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
 }
-//# sourceMappingURL=handler.js.map

package/dist/{publication → release}/delivery/index.d.ts

@@ -1,3 +1,2 @@
 export { handleDelivery, type Limits } from './handler.js';
 export type { Context, Provider } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/{publication → release}/delivery/index.js

@@ -1,2 +1 @@
 export { handleDelivery } from './handler.js';
-//# sourceMappingURL=index.js.map

package/dist/release/delivery/types.d.ts

@@ -0,0 +1,21 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+export interface Context {
+    /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
+    readonly token?: release.delivery.Token;
+    readonly signal: AbortSignal;
+}
+/** Provider-owned retrieval, construction, and attestation signing. */
+export interface Provider {
+    /**
+     * Answer in the request's version: a Delivery v2 carrying the served release for a v2 request,
+     * and a Delivery v1 carrying the served Publication (at a release-backed destination, its frozen
+     * v3 projection) for a deprecated v1 request. A v3-input destination passes only v1 requests.
+     * Throw DeliveryUnavailableError only for an expected dependency outage.
+     *
+     * A release-backed destination (`ServerOptions.release`) passes v2 requests, so its provider
+     * must answer both versions. The deprecated v1-only `publication.delivery.Provider` still
+     * type-checks here, because method parameters are compared bivariantly, but every v2 request
+     * it receives fails with 500 `Delivery provider returned an invalid response.`
+     */
+    create(request: release.delivery.Request | release.legacy.delivery.Request, context: Context): Promise<release.delivery.Delivery | release.legacy.delivery.Delivery>;
+}

package/dist/release/delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/release/index.d.ts

@@ -0,0 +1,3 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export type { ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource } from './types.js';
+export * as delivery from './delivery/index.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export * as delivery from './delivery/index.js';

package/dist/release/legacy/delivery.d.ts

@@ -0,0 +1,18 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Context as DeliveryContext } from '../delivery/types.js';
+/** @deprecated Successor: `release.delivery.Context`, the same retrieval context. */
+export type Context = DeliveryContext;
+/**
+ * The Delivery v1 provider of a v3-input destination, which only ever receives v1 requests. It
+ * remains assignable to `release.delivery.Provider`, so existing providers keep configuring a
+ * Server unchanged. Pass it only with `ServerOptions.publication`: a release-backed destination
+ * also passes Delivery v2 requests, which this provider cannot answer.
+ *
+ * @deprecated Successor: `release.delivery.Provider`, which answers a v2 request over the release
+ * and a v1 request over its frozen v3 projection.
+ */
+export interface Provider {
+    create(request: release.legacy.delivery.Request, context: Context): Promise<release.legacy.delivery.Delivery>;
+}
+/** @deprecated Successor: `release.delivery.handleDelivery`, which serves both snapshots. */
+export { handleDelivery, type Limits } from '../delivery/handler.js';

package/dist/release/legacy/delivery.js

@@ -0,0 +1,2 @@
+/** @deprecated Successor: `release.delivery.handleDelivery`, which serves both snapshots. */
+export { handleDelivery } from '../delivery/handler.js';

package/dist/release/legacy/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The Publication snapshot of a v3-input destination: a Server built from a v2/v3 Publication
+ * serves `domain.json`, its bundle, Delivery v1 and its native routes exactly as before the release
+ * snapshot, and keeps the #508 same-schema and schema-drift continuity
+ * (`server/invocation/legacy/publication-route.ts`). Its answers are pinned byte for byte by the
+ * golden transcript of `server/__tests__/transcripts.test.ts`.
+ *
+ * @deprecated Use `ServerOptions.release` with `prepareReleaseSnapshot`, which serves a
+ * `DomainRelease` at `release.json` beside its frozen v3 projection at `domain.json` and admits
+ * only exact routing.
+ *
+ * Short-term consumers:
+ * - the legacy direct-mode Workers built by an SDK that seals v2/v3 only: the domains platform
+ *   Domains, Shell, the Services `development` environment and `ui:domain`, until they serve
+ *   releases;
+ * - an SDK Worker whose deployment host binds no build digest, which serves today's v3 document;
+ * - the Host's intrinsic Kernel and Host Domain publishers (`host/kernel/publication/`) and the
+ *   FalkorDB qualification remote Domain, until the Host serves its intrinsic release.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one), no supported SDK
+ * builds a v3-input Worker, and the intrinsic Kernel and Host Domains serve a release. Then
+ * delete, in the same PR:
+ * - this folder with its `.spec` (its v1-only Delivery `Provider` included), the `publication`
+ *   namespace, `preparePublicationSnapshot` and the Publication snapshot types of
+ *   `server/index.ts` and `server/.spec/api.d.ts`, and the `./publication/snapshot` subpath
+ *   (source and `dist`) of `server/package.json`;
+ * - `ServerOptions.publication` (`server/types.ts`) and `HandlerRequest.publication`
+ *   (`server/invocation/types.ts`), with the `publication` branch of `Served`
+ *   (`server/release/served.ts`) and every `kind === 'publication'` branch it selects in
+ *   `server/routes/routes.ts`, `server/release/delivery/handler.ts` and `admitVia`;
+ * - `server/invocation/legacy/` (laws SV-PUBLICATION-CONTINUITY, SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the golden transcript that records a v3-input server, keeping the one of a server without a
+ *   source.
+ */
+export { preparePublicationSnapshot, readPreparedPublicationSnapshot, type PreparedPublicationSnapshot, } from './snapshot.js';
+export type { PublicationSnapshot, PublicationSnapshotInput, PublicationSource } from './types.js';
+/** @deprecated The Delivery v1 boundary of a v3-input destination; use `release.delivery`. */
+export * as delivery from './delivery.js';

package/dist/release/legacy/index.js

@@ -0,0 +1,38 @@
+/**
+ * The Publication snapshot of a v3-input destination: a Server built from a v2/v3 Publication
+ * serves `domain.json`, its bundle, Delivery v1 and its native routes exactly as before the release
+ * snapshot, and keeps the #508 same-schema and schema-drift continuity
+ * (`server/invocation/legacy/publication-route.ts`). Its answers are pinned byte for byte by the
+ * golden transcript of `server/__tests__/transcripts.test.ts`.
+ *
+ * @deprecated Use `ServerOptions.release` with `prepareReleaseSnapshot`, which serves a
+ * `DomainRelease` at `release.json` beside its frozen v3 projection at `domain.json` and admits
+ * only exact routing.
+ *
+ * Short-term consumers:
+ * - the legacy direct-mode Workers built by an SDK that seals v2/v3 only: the domains platform
+ *   Domains, Shell, the Services `development` environment and `ui:domain`, until they serve
+ *   releases;
+ * - an SDK Worker whose deployment host binds no build digest, which serves today's v3 document;
+ * - the Host's intrinsic Kernel and Host Domain publishers (`host/kernel/publication/`) and the
+ *   FalkorDB qualification remote Domain, until the Host serves its intrinsic release.
+ *
+ * Removal, in a separate breaking release: the conditions of `protocol/release/legacy/index.ts`
+ * hold (no stable Worker serves a v2/v3 document, no installation pins one), no supported SDK
+ * builds a v3-input Worker, and the intrinsic Kernel and Host Domains serve a release. Then
+ * delete, in the same PR:
+ * - this folder with its `.spec` (its v1-only Delivery `Provider` included), the `publication`
+ *   namespace, `preparePublicationSnapshot` and the Publication snapshot types of
+ *   `server/index.ts` and `server/.spec/api.d.ts`, and the `./publication/snapshot` subpath
+ *   (source and `dist`) of `server/package.json`;
+ * - `ServerOptions.publication` (`server/types.ts`) and `HandlerRequest.publication`
+ *   (`server/invocation/types.ts`), with the `publication` branch of `Served`
+ *   (`server/release/served.ts`) and every `kind === 'publication'` branch it selects in
+ *   `server/routes/routes.ts`, `server/release/delivery/handler.ts` and `admitVia`;
+ * - `server/invocation/legacy/` (laws SV-PUBLICATION-CONTINUITY, SV-PUBLICATION-ADMITS-LEGACY-VIA);
+ * - the golden transcript that records a v3-input server, keeping the one of a server without a
+ *   source.
+ */
+export { preparePublicationSnapshot, readPreparedPublicationSnapshot, } from './snapshot.js';
+/** @deprecated The Delivery v1 boundary of a v3-input destination; use `release.delivery`. */
+export * as delivery from './delivery.js';