@astrale-os/kernel-server 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/capture.d.ts

@@ -1,3 +1,2 @@
 /** Capture one receiver-bound method while preserving the capability's exact method type. */
 export declare function captureMethod<Receiver extends object, Name extends keyof Receiver>(input: Receiver, name: Name, invalidMessage: string): Receiver[Name];
-//# sourceMappingURL=capture.d.ts.map

package/dist/capture.js

@@ -7,4 +7,3 @@ export function captureMethod(input, name, invalidMessage) {
         throw new TypeError(invalidMessage);
     return method.bind(input);
 }
-//# sourceMappingURL=capture.js.map

package/dist/cors/cors.d.ts

@@ -19,4 +19,3 @@ export interface CorsPolicy {
 }
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export declare function prepareCors(input: CorsConfig | false | undefined): CorsPolicy;
-//# sourceMappingURL=cors.d.ts.map

package/dist/cors/cors.js

@@ -1,5 +1,6 @@
 /** Request-aware CORS admission shared by every Server-owned HTTP surface. */
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const PREFLIGHT_MAX_AGE_SECONDS = 24 * 60 * 60;
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export function prepareCors(input) {
     if (input === false)
@@ -61,11 +62,18 @@ export function prepareCors(input) {
                 return new Response(null, { status: 403, headers: response(request) });
             }
             const allowedMethods = [...routeMethods].filter((method) => methods?.has(method) ?? true);
-            const allowedHeaders = requestedHeaders.length > 0 ? requestedHeaders : [...routeHeaders];
+            // Advertise the whole header allowance, not an echo of the request: Chromium and WebKit keep
+            // one preflight result per origin and URL, so an echo would preflight again whenever a later
+            // call adds a permitted header. Requested names, already admitted, add only what a
+            // wildcard-header route cannot enumerate.
+            const allowedHeaders = new Set([...routeHeaders].filter((name) => headers?.has(name) ?? true));
+            for (const name of requestedHeaders)
+                allowedHeaders.add(name);
             const output = new Headers(response(request));
             output.set('access-control-allow-methods', [...allowedMethods, 'OPTIONS'].join(', '));
-            if (allowedHeaders.length > 0) {
-                output.set('access-control-allow-headers', allowedHeaders.join(', '));
+            output.set('access-control-max-age', String(PREFLIGHT_MAX_AGE_SECONDS));
+            if (allowedHeaders.size > 0) {
+                output.set('access-control-allow-headers', [...allowedHeaders].join(', '));
             }
             appendVary(output, 'access-control-request-method');
             appendVary(output, 'access-control-request-headers');
@@ -133,4 +141,3 @@ function appendVary(headers, value) {
     names.add(value);
     headers.set('vary', [...names].join(', '));
 }
-//# sourceMappingURL=cors.js.map

package/dist/cors/index.d.ts

@@ -1,3 +1,2 @@
 export { prepareCors, type CorsPolicy, type CorsRoute } from './cors.js';
 export type { CorsConfig } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/cors/index.js

@@ -1,2 +1 @@
 export { prepareCors } from './cors.js';
-//# sourceMappingURL=index.js.map

package/dist/cors/types.d.ts

@@ -9,4 +9,3 @@ export interface CorsConfig {
     /** Emit Access-Control-Allow-Credentials; requires one explicit origin rather than `*`. */
     readonly credentials?: boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/cors/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/errors/admission.d.ts

@@ -0,0 +1,7 @@
+import * as errors from '@astrale-os/kernel-protocol/errors';
+/** Advisory delay before a request the Server did not admit is sent again. */
+export declare const ADMISSION_RETRY_AFTER_MS = 1000;
+/** Public refusal of an operation the Server did not admit; nothing ran. */
+export declare function admissionRefusal(accepting: boolean): errors.ErrorPayload;
+/** HTTP presentation of a public error's retry delay, when it has one. */
+export declare function retryAfterHeaders(error: errors.ErrorPayload): Readonly<Record<string, string>>;

package/dist/errors/admission.js

@@ -0,0 +1,22 @@
+import * as errors from '@astrale-os/kernel-protocol/errors';
+/** Advisory delay before a request the Server did not admit is sent again. */
+export const ADMISSION_RETRY_AFTER_MS = 1_000;
+/** Public refusal of an operation the Server did not admit; nothing ran. */
+export function admissionRefusal(accepting) {
+    return accepting
+        ? {
+            code: errors.CODES.BACKEND_UNAVAILABLE,
+            message: 'Server is at capacity; retry later.',
+            data: errors.retryReason(errors.RETRY_REASONS.CAPACITY_EXHAUSTED, ADMISSION_RETRY_AFTER_MS),
+        }
+        : {
+            code: errors.CODES.BACKEND_UNAVAILABLE,
+            message: 'Server is draining; retry later.',
+            data: errors.retryReason(errors.RETRY_REASONS.SERVER_DRAINING, ADMISSION_RETRY_AFTER_MS),
+        };
+}
+/** HTTP presentation of a public error's retry delay, when it has one. */
+export function retryAfterHeaders(error) {
+    const retryAfterMs = errors.retryAfterOf(error);
+    return retryAfterMs === undefined ? {} : { 'retry-after': errors.retryAfterField(retryAfterMs) };
+}

package/dist/errors/availability.d.ts

@@ -8,4 +8,3 @@ export declare class IssuerKeysUnavailableError extends Error {
     readonly name = "IssuerKeysUnavailableError";
     constructor(message?: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=availability.d.ts.map

package/dist/errors/availability.js

@@ -12,4 +12,3 @@ export class IssuerKeysUnavailableError extends Error {
         super(message, options);
     }
 }
-//# sourceMappingURL=availability.js.map

package/dist/errors/classify.d.ts

@@ -1,4 +1,11 @@
 import * as errors from '@astrale-os/kernel-protocol/errors';
 /** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
 export declare function classifyError(input: unknown): errors.ErrorPayload;
-//# sourceMappingURL=classify.d.ts.map
+/**
+ * Classify the failure of one request. Its own deadline or cancellation names the failure, except an
+ * outcome already unknown: ending the request proves nothing about an effect.
+ */
+export declare function classifyRequestError(input: unknown, request: {
+    readonly timedOut: boolean;
+    readonly signal: AbortSignal;
+}): errors.ErrorPayload;

package/dist/errors/classify.js

@@ -17,6 +17,21 @@ export function classifyError(input) {
     }
     return internal(input);
 }
+/**
+ * Classify the failure of one request. Its own deadline or cancellation names the failure, except an
+ * outcome already unknown: ending the request proves nothing about an effect.
+ */
+export function classifyRequestError(input, request) {
+    if (input instanceof errors.ProtocolError &&
+        input.payload.code === errors.CODES.OUTCOME_UNKNOWN) {
+        return input.payload;
+    }
+    if (request.timedOut)
+        return publicError('DEADLINE_EXCEEDED', 'Invocation deadline exceeded.');
+    if (request.signal.aborted)
+        return publicError('CANCELLED', 'Invocation was cancelled.');
+    return classifyError(input);
+}
 function publicError(name, message) {
     return { code: errors.CODES[name], message };
 }
@@ -39,4 +54,3 @@ function reportInternal(input) {
         code: stableCode(input),
     });
 }
-//# sourceMappingURL=classify.js.map

package/dist/errors/index.d.ts

@@ -1,5 +1,5 @@
+export { ADMISSION_RETRY_AFTER_MS, admissionRefusal, retryAfterHeaders } from './admission.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
-export { classifyError } from './classify.js';
+export { classifyError, classifyRequestError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.js

@@ -1,5 +1,5 @@
+export { ADMISSION_RETRY_AFTER_MS, admissionRefusal, retryAfterHeaders } from './admission.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
-export { classifyError } from './classify.js';
+export { classifyError, classifyRequestError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.js.map

package/dist/errors/request-body.d.ts

@@ -5,4 +5,3 @@ export declare class RequestBodyTooLargeError extends Error {
 export declare class RequestBodyInvalidError extends Error {
     constructor(message: string);
 }
-//# sourceMappingURL=request-body.d.ts.map

package/dist/errors/request-body.js

@@ -12,4 +12,3 @@ export class RequestBodyInvalidError extends Error {
         this.name = 'RequestBodyInvalidError';
     }
 }
-//# sourceMappingURL=request-body.js.map

package/dist/errors/response-body.d.ts

@@ -2,4 +2,3 @@ export declare class ResponseBodyTooLargeError extends Error {
     readonly maximumBytes: number;
     constructor(maximumBytes: number);
 }
-//# sourceMappingURL=response-body.d.ts.map

package/dist/errors/response-body.js

@@ -6,4 +6,3 @@ export class ResponseBodyTooLargeError extends Error {
         this.name = 'ResponseBodyTooLargeError';
     }
 }
-//# sourceMappingURL=response-body.js.map

package/dist/index.d.ts

@@ -1,6 +1,10 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
-export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
-//# sourceMappingURL=index.d.ts.map
+export { releaseProjectionRouteDecision, releaseRouteDecision, type RouteDecision, } from './invocation/index.js';
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';
+/** @deprecated Successor: `prepareReleaseSnapshot`; serves v3-input destinations only. */
+export { preparePublicationSnapshot } from './release/legacy/index.js';
+/** @deprecated Successor: `release`; the Publication snapshot of a v3-input destination. */
+export * as publication from './release/legacy/index.js';
+export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';

package/dist/index.js

@@ -1,5 +1,9 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
-//# sourceMappingURL=index.js.map
+export { releaseProjectionRouteDecision, releaseRouteDecision, } from './invocation/index.js';
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';
+/** @deprecated Successor: `prepareReleaseSnapshot`; serves v3-input destinations only. */
+export { preparePublicationSnapshot } from './release/legacy/index.js';
+/** @deprecated Successor: `release`; the Publication snapshot of a v3-input destination. */
+export * as publication from './release/legacy/index.js';

package/dist/invocation/context.d.ts

@@ -1,7 +1,7 @@
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { BinaryRequestBody } from '@astrale-os/kernel-core/callable';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
 import type { ApplicationHost, InvocationContext } from './types.js';
-export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey): InvocationContext;
+export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey, binary?: BinaryRequestBody): InvocationContext;
 /** Default non-durable timer used when the application host supplies no timer capability. */
 export declare function defaultSleep(durationMs: number): Promise<void>;
-//# sourceMappingURL=context.d.ts.map

package/dist/invocation/context.js

@@ -1,4 +1,4 @@
-export function invocationContext(assigned, operation, active, host, requestBody, idempotencyKey) {
+export function invocationContext(assigned, operation, active, host, requestBody, idempotencyKey, binary) {
     const body = requestBody?.slice();
     return Object.freeze({
         invocation: assigned,
@@ -9,6 +9,7 @@ export function invocationContext(assigned, operation, active, host, requestBody
         },
         ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
         ...(body === undefined ? {} : { request: Object.freeze({ body: () => body.slice() }) }),
+        ...(binary === undefined ? {} : { binary }),
     });
 }
 /** Default non-durable timer used when the application host supplies no timer capability. */
@@ -58,4 +59,3 @@ function sleepDuration(input) {
     }
     return input;
 }
-//# sourceMappingURL=context.js.map

package/dist/invocation/identity.d.ts

@@ -1,5 +1,5 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 /** Injected source-owned identity allocator captured before Server readiness. */
 export interface InvocationSource {
     readonly source: IssuerId;
@@ -7,4 +7,3 @@ export interface InvocationSource {
 }
 export type NextInvocationId = () => protocol.InvocationId;
 export declare function captureInvocationSource(input: InvocationSource): NextInvocationId;
-//# sourceMappingURL=identity.d.ts.map

package/dist/invocation/identity.js

@@ -1,5 +1,5 @@
 import { issuer } from '@astrale-os/kernel-core/auth';
-import { invocation as protocolInvocation } from '@astrale-os/kernel-protocol';
+import * as protocolInvocation from '@astrale-os/kernel-protocol/invocation';
 import { captureMethod } from '../capture.js';
 export function captureInvocationSource(input) {
     if (input === null || typeof input !== 'object') {
@@ -9,4 +9,3 @@ export function captureInvocationSource(input) {
     const next = captureMethod(input, 'next', 'Server Invocation source is invalid.');
     return () => protocolInvocation.acceptInvocationId({ source, id: next() });
 }
-//# sourceMappingURL=identity.js.map

package/dist/invocation/index.d.ts

@@ -1,5 +1,4 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, type InvocationSource, type NextInvocationId, } from './identity.js';
-export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
+export { admitVia, releaseProjectionRouteDecision, releaseRouteDecision, type RouteDecision, } from './release-route.js';
 export type { ApplicationHost, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, InvocationContext, RequestBackground, RequestEvidence, RequestSleep, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.js

@@ -1,4 +1,3 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, } from './identity.js';
-export { publicationRouteDecision } from './publication-route.js';
-//# sourceMappingURL=index.js.map
+export { admitVia, releaseProjectionRouteDecision, releaseRouteDecision, } from './release-route.js';

package/dist/invocation/legacy/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Routed admission at a v3-input destination: #508 same-schema and schema-drift continuity
+ * (`publicationRouteDecision`) admits a `PublicationVia` whose ETag or Schema differs from the
+ * served Publication while origin and issuer stay equal, so a legacy stable Worker keeps serving
+ * the installations made before the release snapshot with its latest code (Routage [.57929]). It
+ * applies only to a Server built from a v2/v3 Publication, never to a release snapshot.
+ *
+ * @deprecated Use `releaseRouteDecision` and `releaseProjectionRouteDecision`
+ * (`../release-route.ts`), which admit only the exact served release or its exact projection and
+ * answer every other relation with DEPLOYMENT_RETIRED.
+ *
+ * Short-term consumers: the v3-input destinations of `server/release/legacy/` (legacy direct-mode
+ * Workers, SDK Workers without a bound build digest, the Host's intrinsic publishers).
+ *
+ * Removal, in the separate breaking release that deletes `server/release/legacy/`, under its
+ * condition. Then delete this folder, its laws (SV-PUBLICATION-CONTINUITY,
+ * SV-PUBLICATION-ADMITS-LEGACY-VIA) and the `publication` branch of `admitVia`
+ * (`../release-route.ts`).
+ */
+export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';

package/dist/invocation/legacy/index.js

@@ -0,0 +1,20 @@
+/**
+ * Routed admission at a v3-input destination: #508 same-schema and schema-drift continuity
+ * (`publicationRouteDecision`) admits a `PublicationVia` whose ETag or Schema differs from the
+ * served Publication while origin and issuer stay equal, so a legacy stable Worker keeps serving
+ * the installations made before the release snapshot with its latest code (Routage [.57929]). It
+ * applies only to a Server built from a v2/v3 Publication, never to a release snapshot.
+ *
+ * @deprecated Use `releaseRouteDecision` and `releaseProjectionRouteDecision`
+ * (`../release-route.ts`), which admit only the exact served release or its exact projection and
+ * answer every other relation with DEPLOYMENT_RETIRED.
+ *
+ * Short-term consumers: the v3-input destinations of `server/release/legacy/` (legacy direct-mode
+ * Workers, SDK Workers without a bound build digest, the Host's intrinsic publishers).
+ *
+ * Removal, in the separate breaking release that deletes `server/release/legacy/`, under its
+ * condition. Then delete this folder, its laws (SV-PUBLICATION-CONTINUITY,
+ * SV-PUBLICATION-ADMITS-LEGACY-VIA) and the `publication` branch of `admitVia`
+ * (`../release-route.ts`).
+ */
+export { publicationRouteDecision } from './publication-route.js';

package/dist/invocation/{publication-route.d.ts → legacy/publication-route.d.ts}

@@ -1,14 +1,16 @@
 import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
 import type { Publication } from '@astrale-os/kernel-protocol/publication/publication';
 import type { PublicationRef } from '@astrale-os/kernel-protocol/publication/reference';
+/** @deprecated Successor: `RouteDecision`, which also answers a retired deployment. */
 export type PublicationRouteDecision = {
-    readonly kind: 'exact';
-} | {
-    readonly kind: 'same-schema';
+    readonly kind: 'admitted';
 } | {
     readonly kind: 'rejected';
     readonly error: ErrorPayload;
 };
-/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+/**
+ * Accept ETag or Schema changes only while origin and issuer remain equal.
+ *
+ * @deprecated Use `releaseRouteDecision` or `releaseProjectionRouteDecision` for exact release admission.
+ */
 export declare function publicationRouteDecision(current: Publication, installed: PublicationRef): PublicationRouteDecision;
-//# sourceMappingURL=publication-route.d.ts.map

package/dist/invocation/{publication-route.js → legacy/publication-route.js}

@@ -1,22 +1,17 @@
 import { CODES } from '@astrale-os/kernel-protocol/errors';
-import { SCHEMA_UPGRADE_REQUIRED, SERVICE_TRUST_REQUIRED, } from '@astrale-os/kernel-protocol/invocation/service-reason';
+import { SERVICE_TRUST_REQUIRED } from '@astrale-os/kernel-protocol/invocation/service-reason';
 import { compareReference } from '@astrale-os/kernel-protocol/publication/reference';
-/** Compare untrusted installed routing evidence with the one captured serving Publication. */
+/**
+ * Accept ETag or Schema changes only while origin and issuer remain equal.
+ *
+ * @deprecated Use `releaseRouteDecision` or `releaseProjectionRouteDecision` for exact release admission.
+ */
 export function publicationRouteDecision(current, installed) {
     switch (compareReference(current, installed)) {
         case 'exact':
-            return Object.freeze({ kind: 'exact' });
         case 'same-schema':
-            return Object.freeze({ kind: 'same-schema' });
         case 'schema-drift':
-            return rejected('Installed Domain schema requires an explicit upgrade.', Object.freeze({
-                code: SCHEMA_UPGRADE_REQUIRED,
-                details: Object.freeze({
-                    origin: installed.origin,
-                    installedRevision: installed.revision,
-                    candidateRevision: current.schema.revision,
-                }),
-            }));
+            return Object.freeze({ kind: 'admitted' });
         case 'identity-drift':
             return rejected('Installed Domain Service identity requires explicit trust.', Object.freeze({
                 code: SERVICE_TRUST_REQUIRED,
@@ -42,4 +37,3 @@ function rejected(message, data) {
         error: Object.freeze({ code: CODES.CONFLICT, message, data }),
     });
 }
-//# sourceMappingURL=publication-route.js.map

package/dist/invocation/release-route.d.ts

@@ -0,0 +1,26 @@
+import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
+import type { PublicationVia, Via } from '@astrale-os/kernel-protocol/invocation';
+import type { DomainRelease, ReleaseDigest, ReleaseRef } from '@astrale-os/kernel-protocol/release';
+import type { PublicationRef } from '@astrale-os/kernel-protocol/release/legacy';
+import type { Served } from '../release/served.js';
+import type { ReleaseSnapshot } from '../release/types.js';
+export type RouteDecision = {
+    readonly kind: 'admitted';
+} | {
+    readonly kind: 'rejected';
+    readonly error: ErrorPayload;
+}
+/** DEPLOYMENT_RETIRED includes the requested release only when the witness identifies it. */
+ | {
+    readonly kind: 'retired';
+    readonly release?: ReleaseDigest;
+};
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export declare function releaseRouteDecision(current: DomainRelease, installed: ReleaseRef): RouteDecision;
+/** Only the exact v3 projection reference admits, including its ETag, Schema and issuer. */
+export declare function releaseProjectionRouteDecision(current: ReleaseSnapshot, installed: PublicationRef): RouteDecision;
+/** Admit routing before credential resolution; Publication sources accept only legacy witnesses. */
+export declare function admitVia(served: Served | undefined, via: Via | PublicationVia): RouteDecision;

package/dist/invocation/release-route.js

@@ -0,0 +1,55 @@
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { compareReferences, reference } from '@astrale-os/kernel-protocol/release';
+import { compareReference } from '@astrale-os/kernel-protocol/release/legacy';
+import { publicationRouteDecision } from './legacy/index.js';
+const ADMITTED = Object.freeze({ kind: 'admitted' });
+const RETIRED = Object.freeze({ kind: 'retired' });
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export function releaseRouteDecision(current, installed) {
+    switch (compareReferences(reference(current), installed)) {
+        case 'exact':
+            return ADMITTED;
+        case 'release-drift':
+            return installed.digest === current.digest
+                ? RETIRED
+                : Object.freeze({ kind: 'retired', release: installed.digest });
+        case 'origin-drift':
+            return invalid('Routed release origin differs from the served Domain.');
+    }
+}
+/** Only the exact v3 projection reference admits, including its ETag, Schema and issuer. */
+export function releaseProjectionRouteDecision(current, installed) {
+    switch (compareReference(current.publication, installed)) {
+        case 'exact':
+            return ADMITTED;
+        case 'same-schema':
+        case 'schema-drift':
+        case 'identity-drift':
+            return RETIRED;
+        case 'origin-drift':
+            return invalid('Routed Publication origin differs from the served Domain.');
+    }
+}
+/** Admit routing before credential resolution; Publication sources accept only legacy witnesses. */
+export function admitVia(served, via) {
+    if ('release' in via) {
+        return served?.kind === 'release'
+            ? releaseRouteDecision(served.release, via.release)
+            : invalid('Release routing requires a release-backed destination.');
+    }
+    if (served === undefined) {
+        return invalid('Publication routing requires a Publication-backed destination.');
+    }
+    return served.kind === 'release'
+        ? releaseProjectionRouteDecision(served.snapshot, via.publication)
+        : publicationRouteDecision(served.publication, via.publication);
+}
+function invalid(message) {
+    return Object.freeze({
+        kind: 'rejected',
+        error: Object.freeze({ code: CODES.INVALID_REQUEST, message }),
+    });
+}

package/dist/invocation/types.d.ts

@@ -1,8 +1,9 @@
 import type { CredentialInput } from '@astrale-os/kernel-core/auth';
-import type { CallableResult } from '@astrale-os/kernel-core/domain';
+import type { BinaryRequestBody, CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
-import type { PublicationSnapshot } from '../publication/index.js';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
+import type { ReleaseSnapshot } from '../release/index.js';
+import type { PublicationSnapshot } from '../release/legacy/index.js';
 /** Optional platform retention and timer adaptation for one Fetch invocation. */
 export interface ApplicationHost {
     waitUntil(promise: Promise<unknown>): void;
@@ -27,6 +28,8 @@ export interface InvocationContext {
     readonly execution: ExecutionControl;
     readonly idempotencyKey?: protocol.IdempotencyKey;
     readonly request?: RequestEvidence;
+    /** Root-only binary HTTP ingress; ordinary envelopes and WebSocket carry none. */
+    readonly binary?: BinaryRequestBody;
     readonly background: RequestBackground;
     /** Rejects promptly when execution is cancelled or reaches its deadline. */
     readonly sleep: RequestSleep;
@@ -49,15 +52,25 @@ export interface HandlerRequest {
     readonly credential?: CredentialInput;
     /** Source-only effective delegation forwarded unchanged to Runtime. */
     readonly delegate?: protocol.Delegate;
-    /** Destination routing witness forwarded after exact or same-schema Server admission. */
-    readonly via?: protocol.Via;
+    /**
+     * Destination routing witness forwarded after Server admission: at a release-backed destination
+     * a `Via` naming its exact release or a `PublicationVia` naming its exact v3 projection; at a
+     * v3-input destination only a `PublicationVia`.
+     */
+    readonly via?: protocol.Via | protocol.PublicationVia;
     /** Source-only local-target or remote-revision Schema Registration precondition. */
     readonly schema?: protocol.SchemaTarget;
-    /** Exact Server-pinned serving generation for a Publication-backed request. */
+    /** Exact Server-pinned release for a request at a release-backed destination. */
+    readonly release?: ReleaseSnapshot;
+    /**
+     * Exact Server-pinned Publication snapshot for a request at a v3-input destination.
+     *
+     * @deprecated Successor: `release`. Present only on a Server built from a v2/v3 Publication;
+     * deleted with `server/release/legacy/`.
+     */
     readonly publication?: PublicationSnapshot;
     readonly context: InvocationContext;
 }
 export interface Handler {
     dispatch(request: HandlerRequest): Promise<HandlerResult>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/invocation/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/issuer/exchange.d.ts

@@ -10,4 +10,3 @@ export interface Provider {
 }
 export declare function capture(input: Provider): Provider;
 export declare function mount(app: ServerRouter, issuer: string, provider: Provider, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;
-//# sourceMappingURL=exchange.d.ts.map