@astrale-os/kernel-server 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/routes/routes.js

@@ -1,57 +1,46 @@
 import * as codecs from '@astrale-os/kernel-protocol/codecs';
 import * as errors from '@astrale-os/kernel-protocol/errors';
 import * as protocol from '@astrale-os/kernel-protocol/invocation';
-import { PATH as PUBLICATION_PATH, url as publicationUrl, } from '@astrale-os/kernel-protocol/publication/publication';
-import { reference as publicationReference } from '@astrale-os/kernel-protocol/publication/reference';
+import { bundleUrl, MEDIA_TYPE as RELEASE_MEDIA_TYPE, PATH as RELEASE_PATH, url as releaseUrl, } from '@astrale-os/kernel-protocol/release';
+import { mediaType as publicationMediaType, PATH as PUBLICATION_PATH, reference as publicationReference, url as publicationUrl, } from '@astrale-os/kernel-protocol/release/legacy';
 import * as routes from '@astrale-os/kernel-protocol/routes';
-import { classifyError, RequestBodyInvalidError, RequestBodyTooLargeError, } from '../errors/index.js';
+import { admissionRefusal, classifyError, classifyRequestError, RequestBodyInvalidError, RequestBodyTooLargeError, retryAfterHeaders, } from '../errors/index.js';
 import { invocationContext } from '../invocation/index.js';
-import { handleDelivery } from '../publication/delivery/index.js';
-import { readPreparedPublicationSnapshot, } from '../publication/index.js';
+import { handleDelivery } from '../release/delivery/index.js';
+import { pinned, readServed, servedDocument } from '../release/served.js';
 import { readBoundedBody } from '../transport/body.js';
 import {} from '../transport/router.js';
 import { interruptedStreamError } from '../transport/stream-error.js';
-export function mountRoutes(app, source, deliveryProvider, handler, active, nextInvocation, limits, cors, hostFor, reservations, externalIssuer) {
-    const publicationPath = externalIssuer === undefined
-        ? PUBLICATION_PATH
-        : new URL(publicationUrl(externalIssuer)).pathname;
-    const externalOrigin = externalIssuer === undefined ? undefined : new URL(externalIssuer).origin;
-    if (cors.enabled) {
-        app.options(publicationPath, (context) => cors.preflight(context.req.raw, {
-            methods: ['GET'],
-            headers: ['if-none-match'],
-        }));
-    }
-    app.get(publicationPath, (context) => {
-        const responseCors = cors.response(context.req.raw, ['etag']);
-        if (!active.isAccepting)
-            return response({ error: 'Publication is unavailable while draining.' }, 503, responseCors);
-        const snapshot = servingSnapshot(source, limits, context.req.raw, reservations, externalIssuer);
-        if (snapshot === undefined)
-            return response({ error: 'Publication is not ready.' }, 503, responseCors);
-        const body = snapshot.publicationBytes;
-        if (context.req.raw.headers.get('if-none-match') === quoteEtag(snapshot.publication.etag)) {
-            return new Response(null, {
-                status: 304,
-                headers: {
-                    ...responseCors,
-                    etag: quoteEtag(snapshot.publication.etag),
-                    'cache-control': 'public, max-age=0, must-revalidate, no-transform',
-                },
-            });
-        }
-        return new Response(toBody(body), {
-            status: 200,
-            headers: {
-                ...responseCors,
-                'content-type': 'application/json',
-                etag: quoteEtag(snapshot.publication.etag),
-                'cache-control': 'public, max-age=0, must-revalidate, no-transform',
-            },
+export function mountRoutes(app, source, deliveryProvider, handler, active, nextInvocation, limits, cors, hostFor, reservations, externalIssuer, publicOrigin) {
+    const externalOrigin = publicOrigin ?? (externalIssuer === undefined ? undefined : new URL(externalIssuer).origin);
+    const served = (request) => servingSnapshot(source, limits, request, reservations, externalIssuer, externalOrigin);
+    if (source.kind === 'release') {
+        mountDocument(app, documentPath(RELEASE_PATH, releaseUrl, externalIssuer), 'Release', {
+            cors,
+            active,
+            served,
+            read: (snapshot) => snapshot.kind === 'release'
+                ? {
+                    bytes: snapshot.releaseBytes,
+                    mediaType: RELEASE_MEDIA_TYPE,
+                    etag: snapshot.release.digest,
+                }
+                : undefined,
         });
+    }
+    // At a release-backed destination `domain.json` serves the frozen v3 projection.
+    mountDocument(app, documentPath(PUBLICATION_PATH, publicationUrl, externalIssuer), 'Publication', {
+        cors,
+        active,
+        served,
+        read: (snapshot) => ({
+            bytes: snapshot.publicationBytes,
+            mediaType: publicationMediaType(snapshot.publication),
+            etag: snapshot.publication.etag,
+        }),
     });
     app.all('*', async (context) => {
-        const snapshot = servingSnapshot(source, limits, context.req.raw, reservations, externalIssuer);
+        const snapshot = served(context.req.raw);
         if (snapshot === undefined)
             return context.notFound();
         const request = context.req.raw;
@@ -59,48 +48,80 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
             return publicationPreflight(cors, request, snapshot, externalOrigin);
         }
         const responseCors = cors.response(request);
-        if (sameRoute(request.url, snapshot.publication.schema.bundle.href, externalOrigin)) {
-            if (!active.isAccepting)
-                return response({ error: 'Publication artifact is unavailable while draining.' }, 503, responseCors);
+        const corsFor = (exposed) => cors.response(request, exposed);
+        const document = servedDocument(snapshot);
+        const descriptor = document.schema.bundle;
+        const addressed = bundleUrl(document.identity.issuer, descriptor.ref);
+        const immutable = descriptor.href === addressed;
+        if (sameRoute(request.url, descriptor.href, externalOrigin)) {
+            // A release names its own document; a v3-input destination keeps its recorded bytes.
+            const releaseBacked = snapshot.kind === 'release';
+            if (!active.isAccepting) {
+                return drained(releaseBacked
+                    ? 'Release artifact is unavailable while draining.'
+                    : 'Publication artifact is unavailable while draining.', corsFor);
+            }
             if (request.method !== 'GET')
                 return response({ error: 'Bundle retrieval requires GET.' }, 405, responseCors);
             const body = snapshot.bundle;
-            if (body.byteLength !== snapshot.publication.schema.bundle.ref.size) {
-                return response({ error: 'Bundle differs from its Publication.' }, 500, responseCors);
+            if (body.byteLength !== descriptor.ref.size) {
+                return response({
+                    error: releaseBacked
+                        ? 'Bundle differs from its release.'
+                        : 'Bundle differs from its Publication.',
+                }, 500, responseCors);
             }
-            return new Response(toBody(body), {
-                status: 200,
+            const etag = quoteEtag(descriptor.ref.digest);
+            const unchanged = request.headers.get('if-none-match') === etag;
+            return new Response(unchanged ? null : toBody(body), {
+                status: unchanged ? 304 : 200,
                 headers: {
                     ...responseCors,
-                    'content-type': snapshot.publication.schema.bundle.ref.mediaType,
-                    etag: quoteEtag(snapshot.publication.schema.bundle.ref.digest),
-                    'cache-control': 'public, max-age=31536000, immutable, no-transform',
+                    'content-type': descriptor.ref.mediaType,
+                    etag,
+                    'cache-control': immutable
+                        ? 'public, max-age=31536000, immutable, no-transform'
+                        : 'public, max-age=0, must-revalidate, no-transform',
                 },
             });
         }
-        const deliveryUrl = snapshot.publication.delivery?.href;
+        if (request.method === 'GET' && immutable) {
+            const pathname = new URL(addressed).pathname;
+            const directory = pathname.slice(0, pathname.lastIndexOf('/') + 1);
+            const requested = new URL(request.url);
+            if (requested.pathname.startsWith(directory) &&
+                /^[0-9a-f]{64}\.json$/u.test(requested.pathname.slice(directory.length))) {
+                return new Response(null, {
+                    status: 404,
+                    headers: { ...responseCors, 'cache-control': 'no-store' },
+                });
+            }
+        }
+        const deliveryUrl = document.delivery?.href;
         if (deliveryUrl !== undefined && sameRoute(request.url, deliveryUrl, externalOrigin)) {
-            return handleDelivery(request, snapshot, deliveryProvider, active, limits, cors.response(request));
+            return handleDelivery(request, snapshot, deliveryProvider, active, limits, corsFor);
         }
         let routing;
         try {
-            const ifMatch = request.headers.get(routes.HTTP_ROUTE_PUBLICATION);
-            if (ifMatch !== null &&
-                /^"sha256:[0-9a-f]{64}"$/u.test(ifMatch) &&
-                ifMatch !== quoteEtag(snapshot.publication.etag)) {
-                return new Response(null, {
-                    status: routes.HTTP_ROUTE_STALE_STATUS,
-                    headers: {
-                        ...cors.response(request, [routes.HTTP_ROUTE_STALE]),
-                        ...routes.staleHeaders(snapshot.publication.etag),
-                    },
-                });
+            if (snapshot.kind === 'release') {
+                const decoded = routes.decodeRouting(request, snapshot.references);
+                if (decoded?.kind === 'stale')
+                    return stale(request, decoded.current, cors);
+                routing = decoded;
+            }
+            else {
+                const ifMatch = request.headers.get(routes.HTTP_ROUTE_DIGEST);
+                if (ifMatch !== null &&
+                    /^"sha256:[0-9a-f]{64}"$/u.test(ifMatch) &&
+                    ifMatch !== quoteEtag(snapshot.publication.etag)) {
+                    return stale(request, snapshot.publication.etag, cors);
+                }
+                routing = routes.legacy.decodeRouting(request, publicationReference(snapshot.publication));
             }
-            routing = routes.decodeRouting(request, publicationReference(snapshot.publication));
         }
         catch (cause) {
             if (cause instanceof routes.RouteError) {
-                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route routing is invalid.' }, 400, responseCors);
+                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route routing is invalid.' }, 400, corsFor);
             }
             throw cause;
         }
@@ -110,14 +131,23 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
         const assigned = nextInvocation();
         const operation = active.begin(limits.invocationTimeoutMs, request.signal);
         if (operation === undefined)
-            return nativeError({
-                code: errors.CODES.BACKEND_UNAVAILABLE,
-                message: 'Server is draining.',
-            }, 503, responseCors);
+            return nativeError(admissionRefusal(active.isAccepting), 503, corsFor);
         let handedOff = false;
         try {
             const body = await readBoundedBody(request, limits.maximumRequestBytes, operation.signal);
-            const invocation = routes.decode(route, { url: request.url, method: request.method, headers: request.headers, body }, snapshot.validator, snapshot.table.publication);
+            const native = { url: request.url, method: request.method, headers: request.headers, body };
+            const invocation = snapshot.kind === 'release'
+                ? routes.decode(route, native, snapshot.domain, snapshot.references)
+                : routes.legacy.decode(route, native, snapshot.domain, snapshot.table.publication);
+            if (invocation.credentialIn === 'cookie' &&
+                isStateChanging(request) &&
+                isClearlyCrossSite(request, externalOrigin ?? new URL(request.url).origin)) {
+                const refusal = {
+                    code: errors.CODES.ACCESS_DENIED,
+                    message: 'Cross-site cookie-authenticated request to a native route is refused.',
+                };
+                return nativeError(refusal, errors.httpStatusOf(refusal), corsFor);
+            }
             const idempotencyHeader = request.headers.get(protocol.HTTP_IDEMPOTENCY_KEY);
             const idempotencyKey = idempotencyHeader === null
                 ? undefined
@@ -126,7 +156,7 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
                 call: invocation.call,
                 ...(invocation.credential === undefined ? {} : { credential: invocation.credential }),
                 ...(routing === undefined ? {} : { via: routing }),
-                publication: snapshot.snapshot,
+                ...pinned(snapshot),
                 context: invocationContext(assigned, operation, active, hostFor(request), body, idempotencyKey),
             }));
             if (result.kind === 'value') {
@@ -138,8 +168,17 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
                 });
             }
             if (result.kind === 'binary') {
+                if (isStreamingBinary(result.value)) {
+                    // Hand the operation off only once the streaming response is built. A refused render
+                    // (reserved header or a body-forbidding status) throws before this point, so the
+                    // `finally` below still settles the operation instead of leaking its slot.
+                    const streaming = streamingBinaryResponse(result.value, operation, cors, request);
+                    handedOff = true;
+                    return streaming;
+                }
                 const applicationHeaders = applicationBinaryHeaders(result.value.headers);
                 return new Response(toBody(result.value.body), {
+                    status: result.value.status ?? 200,
                     headers: {
                         ...cors.response(request, [
                             protocol.http.BINARY_HEADERS_FIELD,
@@ -153,7 +192,7 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
             }
             if (result.kind === 'stream') {
                 handedOff = true;
-                return await streamResponse(result.stream, operation, responseCors);
+                return await streamResponse(result.stream, operation, corsFor);
             }
             if (result.kind === 'miss') {
                 return new Response(null, {
@@ -167,29 +206,20 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
             return nativeError({
                 code: errors.CODES.UNSUPPORTED,
                 message: 'Native routes do not forward Runtime redirects.',
-            }, 502, responseCors);
+            }, 502, corsFor);
         }
         catch (cause) {
             if (cause instanceof RequestBodyTooLargeError) {
-                return nativeError({ code: errors.CODES.LIMIT_EXCEEDED, message: 'Request body is too large.' }, 413, responseCors);
+                return nativeError({ code: errors.CODES.LIMIT_EXCEEDED, message: 'Request body is too large.' }, 413, corsFor);
             }
             if (cause instanceof RequestBodyInvalidError) {
-                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Request body is invalid.' }, 400, responseCors);
+                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Request body is invalid.' }, 400, corsFor);
             }
             if (cause instanceof routes.RouteError) {
-                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route request is invalid.' }, 400, responseCors);
-            }
-            if (operation.timedOut) {
-                return nativeError({
-                    code: errors.CODES.DEADLINE_EXCEEDED,
-                    message: 'Invocation deadline exceeded.',
-                }, 504, responseCors);
+                return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route request is invalid.' }, 400, corsFor);
             }
-            if (operation.signal.aborted) {
-                return nativeError({ code: errors.CODES.CANCELLED, message: 'Invocation was cancelled.' }, 408, responseCors);
-            }
-            const payload = classifyError(cause);
-            return nativeError(payload, errors.httpStatusOf(payload), responseCors);
+            const payload = classifyRequestError(cause, operation);
+            return nativeError(payload, errors.httpStatusOf(payload), corsFor);
         }
         finally {
             if (!handedOff)
@@ -197,11 +227,89 @@ export function mountRoutes(app, source, deliveryProvider, handler, active, next
         }
     });
 }
+function streamingBinaryResponse(binary, operation, cors, request) {
+    // Admit the reserved/invalid headers before acquiring the producer, so a refused render never
+    // captures the stream it would then have to abandon.
+    const applicationHeaders = applicationBinaryHeaders(binary.headers);
+    const iterator = binary.body[Symbol.asyncIterator]();
+    let terminal = false;
+    let controller;
+    let stopping;
+    const stop = (reason = 'Binary response was interrupted.') => {
+        if (terminal)
+            return stopping ?? Promise.resolve();
+        terminal = true;
+        controller?.error(new Error(reason));
+        stopping = Promise.resolve().then(async () => {
+            try {
+                await iterator.return?.();
+            }
+            finally {
+                operation.settle();
+            }
+        });
+        return stopping;
+    };
+    const body = new ReadableStream({
+        start(output) {
+            controller = output;
+        },
+        async pull(controller) {
+            if (terminal)
+                return;
+            try {
+                const next = await iterator.next();
+                if (terminal)
+                    return;
+                if (next.done) {
+                    terminal = true;
+                    controller.close();
+                    operation.settle();
+                    return;
+                }
+                controller.enqueue(next.value);
+            }
+            catch (cause) {
+                if (terminal)
+                    return;
+                terminal = true;
+                controller.error(cause);
+                operation.settle();
+            }
+        },
+        async cancel(reason) {
+            const message = typeof reason === 'string' ? reason : 'native binary response cancelled';
+            operation.cancel(message);
+            await stop();
+        },
+    });
+    operation.onCancel(stop);
+    try {
+        return new Response(body, {
+            status: binary.status ?? 200,
+            headers: {
+                ...cors.response(request, Object.keys(applicationHeaders)),
+                ...applicationHeaders,
+                'content-type': binary.mediaType,
+            },
+        });
+    }
+    catch (cause) {
+        // A body-forbidding status (e.g. 204) rejects the Response after the producer was wired:
+        // close it and let the caller settle the operation rather than leaking its slot.
+        void stop('Binary response was refused.');
+        throw cause;
+    }
+}
+function isStreamingBinary(input) {
+    return !(input.body instanceof Uint8Array);
+}
 function publicationPreflight(cors, request, snapshot, externalOrigin) {
-    if (sameRoute(request.url, snapshot.publication.schema.bundle.href, externalOrigin)) {
+    const document = servedDocument(snapshot);
+    if (sameRoute(request.url, document.schema.bundle.href, externalOrigin)) {
         return cors.preflight(request, { methods: ['GET'], headers: ['if-none-match'] });
     }
-    const deliveryUrl = snapshot.publication.delivery?.href;
+    const deliveryUrl = document.delivery?.href;
     if (deliveryUrl !== undefined && sameRoute(request.url, deliveryUrl, externalOrigin)) {
         return cors.preflight(request, {
             methods: ['POST'],
@@ -217,7 +325,7 @@ function publicationPreflight(cors, request, snapshot, externalOrigin) {
 function nativeCorsRoute(entry, requestedMethod) {
     const headers = new Set([
         'accept',
-        routes.HTTP_ROUTE_PUBLICATION,
+        routes.HTTP_ROUTE_DIGEST,
         routes.HTTP_ROUTE_ISSUER,
         protocol.HTTP_IDEMPOTENCY_KEY,
     ]);
@@ -246,23 +354,28 @@ function nativeCorsRoute(entry, requestedMethod) {
         ...(allowAnyHeaders ? { allowAnyHeaders: true } : {}),
     });
 }
-export function currentPublicationSnapshot(source, limits, serving) {
-    const snapshot = source.current();
-    if (snapshot === undefined)
-        return undefined;
-    const prepared = readPreparedPublicationSnapshot(snapshot);
+/**
+ * Read the one snapshot a request pins, withheld while it exceeds a serving limit, names another
+ * serving issuer, or claims a route this Server reserves.
+ */
+export function currentServed(source, limits, serving) {
+    const prepared = readServed(source);
     if (prepared === undefined ||
+        (prepared.kind === 'release' &&
+            prepared.releaseBytes.byteLength > limits.maximumPublicationBytes) ||
         prepared.publicationBytes.byteLength > limits.maximumPublicationBytes ||
         prepared.bundle.byteLength > limits.maximumBundleBytes ||
-        (serving?.issuer !== undefined && prepared.publication.identity.issuer !== serving.issuer) ||
+        (serving?.issuer !== undefined &&
+            servedDocument(prepared).identity.issuer !== serving.issuer) ||
         (serving !== undefined && conflictsWithServingRoutes(prepared, serving))) {
         return undefined;
     }
     return prepared;
 }
-function servingSnapshot(source, limits, request, reservations, externalIssuer) {
-    return currentPublicationSnapshot(source, limits, {
-        origin: externalIssuer === undefined ? new URL(request.url).origin : new URL(externalIssuer).origin,
+function servingSnapshot(source, limits, request, reservations, externalIssuer, publicOrigin) {
+    return currentServed(source, limits, {
+        origin: publicOrigin ??
+            (externalIssuer === undefined ? new URL(request.url).origin : new URL(externalIssuer).origin),
         ...(externalIssuer === undefined ? {} : { issuer: externalIssuer }),
         reservations,
     });
@@ -279,6 +392,58 @@ function conflictsWithServingRoutes(snapshot, serving) {
     }
     return false;
 }
+function documentPath(path, url, externalIssuer) {
+    return externalIssuer === undefined ? path : new URL(url(externalIssuer)).pathname;
+}
+function mountDocument(app, path, name, serving) {
+    const { cors, active } = serving;
+    if (cors.enabled) {
+        app.options(path, (context) => cors.preflight(context.req.raw, {
+            methods: ['GET'],
+            headers: ['if-none-match'],
+        }));
+    }
+    app.get(path, (context) => {
+        const responseCors = cors.response(context.req.raw, ['etag']);
+        if (!active.isAccepting) {
+            return drained(`${name} is unavailable while draining.`, (exposed) => cors.response(context.req.raw, exposed));
+        }
+        const snapshot = serving.served(context.req.raw);
+        const document = snapshot === undefined ? undefined : serving.read(snapshot);
+        if (document === undefined)
+            return response({ error: `${name} is not ready.` }, 503, responseCors);
+        const etag = quoteEtag(document.etag);
+        if (context.req.raw.headers.get('if-none-match') === etag) {
+            return new Response(null, {
+                status: 304,
+                headers: {
+                    ...responseCors,
+                    etag,
+                    'cache-control': 'public, max-age=0, must-revalidate, no-transform',
+                },
+            });
+        }
+        return new Response(toBody(document.bytes), {
+            status: 200,
+            headers: {
+                ...responseCors,
+                'content-type': document.mediaType,
+                etag,
+                'cache-control': 'public, max-age=0, must-revalidate, no-transform',
+            },
+        });
+    });
+}
+/** Reserved native stale control naming the digest the destination serves (`StaleControl.current`). */
+function stale(request, current, cors) {
+    return new Response(null, {
+        status: routes.HTTP_ROUTE_STALE_STATUS,
+        headers: {
+            ...cors.response(request, [routes.HTTP_ROUTE_STALE]),
+            ...routes.staleHeaders(current),
+        },
+    });
+}
 async function streamResponse(stream, operation, cors) {
     const iterator = stream[Symbol.asyncIterator]();
     let rejectSetup;
@@ -304,14 +469,14 @@ async function streamResponse(stream, operation, cors) {
         const cleanup = cancelSetup('native stream setup failed');
         if (!operation.signal.aborted)
             await cleanup;
-        const payload = preStreamError(cause, operation);
+        const payload = classifyRequestError(cause, operation);
         return nativeError(payload, errors.httpStatusOf(payload), cors);
     }
     unregisterSetupCancellation();
     if (operation.signal.aborted) {
         void cancelSetup('native stream setup cancelled');
-        const payload = preStreamError(operation.signal.reason, operation);
-        return response({ error: payload }, errors.httpStatusOf(payload), cors);
+        const payload = classifyRequestError(operation.signal.reason, operation);
+        return response({ error: payload }, errors.httpStatusOf(payload), cors());
     }
     const encoder = new TextEncoder();
     let pending = first;
@@ -389,32 +554,52 @@ async function streamResponse(stream, operation, cors) {
     operation.onCancel((reason) => stop(reason, interruptedStreamError(operation.timedOut)));
     return new Response(body, {
         headers: {
-            ...cors,
+            ...cors(),
             'content-type': routes.STREAM_MEDIA_TYPE,
             'cache-control': 'no-cache',
         },
     });
 }
-function preStreamError(cause, operation) {
-    if (operation.timedOut) {
-        return {
-            code: errors.CODES.DEADLINE_EXCEEDED,
-            message: 'Invocation deadline exceeded before the native stream began.',
-        };
-    }
-    if (operation.signal.aborted) {
-        return {
-            code: errors.CODES.CANCELLED,
-            message: 'Invocation was cancelled before the native stream began.',
-        };
-    }
-    return classifyError(cause);
-}
 function sameRoute(left, right, externalOrigin) {
     const a = new URL(left);
     const b = new URL(right);
     return ((externalOrigin ?? a.origin) === b.origin && a.pathname === b.pathname && a.search === b.search);
 }
+/**
+ * A request that mutates state or navigates to an effectful target. Non-safe HTTP methods always
+ * qualify; a GET or HEAD qualifies only as a top-level browser navigation (`Sec-Fetch-Mode:
+ * navigate`), the one GET shape that carries SameSite=Lax cookies cross-site. Programmatic GETs
+ * (`cors`/`no-cors`) are left untouched so read clients are never broken.
+ */
+function isStateChanging(request) {
+    switch (request.method.toUpperCase()) {
+        case 'POST':
+        case 'PUT':
+        case 'PATCH':
+        case 'DELETE':
+            return true;
+        case 'GET':
+        case 'HEAD':
+            return request.headers.get('sec-fetch-mode') === 'navigate';
+        default:
+            return false;
+    }
+}
+/**
+ * Positive evidence that a request originates from another site. `Sec-Fetch-Site` is set by the
+ * browser and cannot be forged by page script, so when present it is authoritative: only
+ * `cross-site` is refused, and `same-origin`/`same-site`/`none` are trusted (a shared-domain
+ * subdomain deployment keeps working). When it is absent, a differing `Origin` is the next-best
+ * signal. Absence of both is treated as not-cross-site, so same-origin browsers and non-browser
+ * clients that omit these headers are never refused.
+ */
+function isClearlyCrossSite(request, serviceOrigin) {
+    const site = request.headers.get('sec-fetch-site');
+    if (site !== null)
+        return site === 'cross-site';
+    const origin = request.headers.get('origin');
+    return origin !== null && origin !== serviceOrigin;
+}
 function applicationBinaryHeaders(input) {
     const output = {};
     for (const [name, value] of Object.entries(input ?? {})) {
@@ -436,9 +621,16 @@ function response(body, status, cors) {
         headers: { ...cors, 'content-type': 'application/json' },
     });
 }
+/** A served document or artifact refused while draining presents the lifecycle retry delay. */
+function drained(message, cors) {
+    const retry = retryAfterHeaders(admissionRefusal(false));
+    return response({ error: message }, 503, { ...cors(Object.keys(retry)), ...retry });
+}
+/** Every native error, including a capacity refusal raised by dispatch, presents its retry delay. */
 function nativeError(error, status, cors) {
     const admitted = routes.decodeErrorResponse({ error });
-    return response(admitted, status, cors);
+    const retry = retryAfterHeaders(error);
+    return response(admitted, status, { ...cors(Object.keys(retry)), ...retry });
 }
 function encodedBody(input) {
     return typeof input === 'string' ? input : toBody(input);
@@ -446,4 +638,3 @@ function encodedBody(input) {
 function toBody(input) {
     return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
 }
-//# sourceMappingURL=routes.js.map

package/dist/server.d.ts

@@ -2,4 +2,3 @@ import type { Server, ServerConfig, ServerOptions, PreparedServer } from './type
 export declare function createServer(config: ServerConfig): Server;
 /** Validate all static transport configuration before a Host starts Runtime recovery/bootstrap. */
 export declare function prepareServer(options: ServerOptions): PreparedServer;
-//# sourceMappingURL=server.d.ts.map