@astrale-os/kernel-server 0.5.0-beta.8 → 1.0.0-beta.1

package/dist/capture.d.ts

@@ -1,3 +1,2 @@
 /** Capture one receiver-bound method while preserving the capability's exact method type. */
 export declare function captureMethod<Receiver extends object, Name extends keyof Receiver>(input: Receiver, name: Name, invalidMessage: string): Receiver[Name];
-//# sourceMappingURL=capture.d.ts.map

package/dist/capture.js

@@ -7,4 +7,3 @@ export function captureMethod(input, name, invalidMessage) {
         throw new TypeError(invalidMessage);
     return method.bind(input);
 }
-//# sourceMappingURL=capture.js.map

package/dist/cors/cors.d.ts

@@ -19,4 +19,3 @@ export interface CorsPolicy {
 }
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export declare function prepareCors(input: CorsConfig | false | undefined): CorsPolicy;
-//# sourceMappingURL=cors.d.ts.map

package/dist/cors/cors.js

@@ -1,5 +1,6 @@
 /** Request-aware CORS admission shared by every Server-owned HTTP surface. */
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const PREFLIGHT_MAX_AGE_SECONDS = 24 * 60 * 60;
 /** Admit one immutable policy. `false` delegates the complete concern to an outer application. */
 export function prepareCors(input) {
     if (input === false)
@@ -61,11 +62,18 @@ export function prepareCors(input) {
                 return new Response(null, { status: 403, headers: response(request) });
             }
             const allowedMethods = [...routeMethods].filter((method) => methods?.has(method) ?? true);
-            const allowedHeaders = requestedHeaders.length > 0 ? requestedHeaders : [...routeHeaders];
+            // Advertise the whole header allowance, not an echo of the request: Chromium and WebKit keep
+            // one preflight result per origin and URL, so an echo would preflight again whenever a later
+            // call adds a permitted header. Requested names, already admitted, add only what a
+            // wildcard-header route cannot enumerate.
+            const allowedHeaders = new Set([...routeHeaders].filter((name) => headers?.has(name) ?? true));
+            for (const name of requestedHeaders)
+                allowedHeaders.add(name);
             const output = new Headers(response(request));
             output.set('access-control-allow-methods', [...allowedMethods, 'OPTIONS'].join(', '));
-            if (allowedHeaders.length > 0) {
-                output.set('access-control-allow-headers', allowedHeaders.join(', '));
+            output.set('access-control-max-age', String(PREFLIGHT_MAX_AGE_SECONDS));
+            if (allowedHeaders.size > 0) {
+                output.set('access-control-allow-headers', [...allowedHeaders].join(', '));
             }
             appendVary(output, 'access-control-request-method');
             appendVary(output, 'access-control-request-headers');
@@ -133,4 +141,3 @@ function appendVary(headers, value) {
     names.add(value);
     headers.set('vary', [...names].join(', '));
 }
-//# sourceMappingURL=cors.js.map

package/dist/cors/index.d.ts

@@ -1,3 +1,2 @@
 export { prepareCors, type CorsPolicy, type CorsRoute } from './cors.js';
 export type { CorsConfig } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/cors/index.js

@@ -1,2 +1 @@
 export { prepareCors } from './cors.js';
-//# sourceMappingURL=index.js.map

package/dist/cors/types.d.ts

@@ -9,4 +9,3 @@ export interface CorsConfig {
     /** Emit Access-Control-Allow-Credentials; requires one explicit origin rather than `*`. */
     readonly credentials?: boolean;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/cors/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/errors/admission.d.ts

@@ -0,0 +1,7 @@
+import * as errors from '@astrale-os/kernel-protocol/errors';
+/** Advisory delay before a request the Server did not admit is sent again. */
+export declare const ADMISSION_RETRY_AFTER_MS = 1000;
+/** Public refusal of an operation the Server did not admit; nothing ran. */
+export declare function admissionRefusal(accepting: boolean): errors.ErrorPayload;
+/** HTTP presentation of a public error's retry delay, when it has one. */
+export declare function retryAfterHeaders(error: errors.ErrorPayload): Readonly<Record<string, string>>;

package/dist/errors/admission.js

@@ -0,0 +1,22 @@
+import * as errors from '@astrale-os/kernel-protocol/errors';
+/** Advisory delay before a request the Server did not admit is sent again. */
+export const ADMISSION_RETRY_AFTER_MS = 1_000;
+/** Public refusal of an operation the Server did not admit; nothing ran. */
+export function admissionRefusal(accepting) {
+    return accepting
+        ? {
+            code: errors.CODES.BACKEND_UNAVAILABLE,
+            message: 'Server is at capacity; retry later.',
+            data: errors.retryReason(errors.RETRY_REASONS.CAPACITY_EXHAUSTED, ADMISSION_RETRY_AFTER_MS),
+        }
+        : {
+            code: errors.CODES.BACKEND_UNAVAILABLE,
+            message: 'Server is draining; retry later.',
+            data: errors.retryReason(errors.RETRY_REASONS.SERVER_DRAINING, ADMISSION_RETRY_AFTER_MS),
+        };
+}
+/** HTTP presentation of a public error's retry delay, when it has one. */
+export function retryAfterHeaders(error) {
+    const retryAfterMs = errors.retryAfterOf(error);
+    return retryAfterMs === undefined ? {} : { 'retry-after': errors.retryAfterField(retryAfterMs) };
+}

package/dist/errors/availability.d.ts

@@ -8,4 +8,3 @@ export declare class IssuerKeysUnavailableError extends Error {
     readonly name = "IssuerKeysUnavailableError";
     constructor(message?: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=availability.d.ts.map

package/dist/errors/availability.js

@@ -12,4 +12,3 @@ export class IssuerKeysUnavailableError extends Error {
         super(message, options);
     }
 }
-//# sourceMappingURL=availability.js.map

package/dist/errors/classify.d.ts

@@ -1,4 +1,11 @@
 import * as errors from '@astrale-os/kernel-protocol/errors';
 /** Convert only errors owned by an admitted Server or Protocol boundary into safe public data. */
 export declare function classifyError(input: unknown): errors.ErrorPayload;
-//# sourceMappingURL=classify.d.ts.map
+/**
+ * Classify the failure of one request. Its own deadline or cancellation names the failure, except an
+ * outcome already unknown: ending the request proves nothing about an effect.
+ */
+export declare function classifyRequestError(input: unknown, request: {
+    readonly timedOut: boolean;
+    readonly signal: AbortSignal;
+}): errors.ErrorPayload;

package/dist/errors/classify.js

@@ -17,6 +17,21 @@ export function classifyError(input) {
     }
     return internal(input);
 }
+/**
+ * Classify the failure of one request. Its own deadline or cancellation names the failure, except an
+ * outcome already unknown: ending the request proves nothing about an effect.
+ */
+export function classifyRequestError(input, request) {
+    if (input instanceof errors.ProtocolError &&
+        input.payload.code === errors.CODES.OUTCOME_UNKNOWN) {
+        return input.payload;
+    }
+    if (request.timedOut)
+        return publicError('DEADLINE_EXCEEDED', 'Invocation deadline exceeded.');
+    if (request.signal.aborted)
+        return publicError('CANCELLED', 'Invocation was cancelled.');
+    return classifyError(input);
+}
 function publicError(name, message) {
     return { code: errors.CODES[name], message };
 }
@@ -39,4 +54,3 @@ function reportInternal(input) {
         code: stableCode(input),
     });
 }
-//# sourceMappingURL=classify.js.map

package/dist/errors/index.d.ts

@@ -1,5 +1,5 @@
+export { ADMISSION_RETRY_AFTER_MS, admissionRefusal, retryAfterHeaders } from './admission.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
-export { classifyError } from './classify.js';
+export { classifyError, classifyRequestError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.js

@@ -1,5 +1,5 @@
+export { ADMISSION_RETRY_AFTER_MS, admissionRefusal, retryAfterHeaders } from './admission.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './availability.js';
-export { classifyError } from './classify.js';
+export { classifyError, classifyRequestError } from './classify.js';
 export { RequestBodyInvalidError, RequestBodyTooLargeError } from './request-body.js';
 export { ResponseBodyTooLargeError } from './response-body.js';
-//# sourceMappingURL=index.js.map

package/dist/errors/request-body.d.ts

@@ -5,4 +5,3 @@ export declare class RequestBodyTooLargeError extends Error {
 export declare class RequestBodyInvalidError extends Error {
     constructor(message: string);
 }
-//# sourceMappingURL=request-body.d.ts.map

package/dist/errors/request-body.js

@@ -12,4 +12,3 @@ export class RequestBodyInvalidError extends Error {
         this.name = 'RequestBodyInvalidError';
     }
 }
-//# sourceMappingURL=request-body.js.map

package/dist/errors/response-body.d.ts

@@ -2,4 +2,3 @@ export declare class ResponseBodyTooLargeError extends Error {
     readonly maximumBytes: number;
     constructor(maximumBytes: number);
 }
-//# sourceMappingURL=response-body.d.ts.map

package/dist/errors/response-body.js

@@ -6,4 +6,3 @@ export class ResponseBodyTooLargeError extends Error {
         this.name = 'ResponseBodyTooLargeError';
     }
 }
-//# sourceMappingURL=response-body.js.map

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
-export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, PublicationSnapshot, PublicationSnapshotInput, PublicationSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';
-//# sourceMappingURL=index.d.ts.map
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';
+export type { Application, ApplicationHost, CorsConfig, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, HealthProbe, InvocationContext, InvocationSource, RequestBackground, RequestEvidence, RequestSleep, Issuer, exchange, PreparedServer, ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource, Server, ServerCloseOptions, ServerConfig, ServerLimits, ServerOptions, WebSocketAdapter, WebSocketHandlers, WebSocketLike, WebSocketUpgradeOptions, } from './types.js';

package/dist/index.js

@@ -1,5 +1,4 @@
 export { createServer, prepareServer } from './server.js';
 export { DeliveryUnavailableError, IssuerKeysUnavailableError } from './errors/index.js';
-export { preparePublicationSnapshot } from './publication/index.js';
-export * as publication from './publication/index.js';
-//# sourceMappingURL=index.js.map
+export { prepareReleaseSnapshot } from './release/index.js';
+export * as release from './release/index.js';

package/dist/invocation/context.d.ts

@@ -1,7 +1,7 @@
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type { BinaryRequestBody } from '@astrale-os/kernel-core/callable';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 import type { ActiveOperation, ActiveOperations } from '../lifecycle/index.js';
 import type { ApplicationHost, InvocationContext } from './types.js';
-export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey): InvocationContext;
+export declare function invocationContext(assigned: protocol.InvocationId, operation: ActiveOperation, active: ActiveOperations, host?: ApplicationHost, requestBody?: Uint8Array, idempotencyKey?: protocol.IdempotencyKey, binary?: BinaryRequestBody): InvocationContext;
 /** Default non-durable timer used when the application host supplies no timer capability. */
 export declare function defaultSleep(durationMs: number): Promise<void>;
-//# sourceMappingURL=context.d.ts.map

package/dist/invocation/context.js

@@ -1,4 +1,4 @@
-export function invocationContext(assigned, operation, active, host, requestBody, idempotencyKey) {
+export function invocationContext(assigned, operation, active, host, requestBody, idempotencyKey, binary) {
     const body = requestBody?.slice();
     return Object.freeze({
         invocation: assigned,
@@ -9,6 +9,7 @@ export function invocationContext(assigned, operation, active, host, requestBody
         },
         ...(idempotencyKey === undefined ? {} : { idempotencyKey }),
         ...(body === undefined ? {} : { request: Object.freeze({ body: () => body.slice() }) }),
+        ...(binary === undefined ? {} : { binary }),
     });
 }
 /** Default non-durable timer used when the application host supplies no timer capability. */
@@ -58,4 +59,3 @@ function sleepDuration(input) {
     }
     return input;
 }
-//# sourceMappingURL=context.js.map

package/dist/invocation/identity.d.ts

@@ -1,5 +1,5 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
 /** Injected source-owned identity allocator captured before Server readiness. */
 export interface InvocationSource {
     readonly source: IssuerId;
@@ -7,4 +7,3 @@ export interface InvocationSource {
 }
 export type NextInvocationId = () => protocol.InvocationId;
 export declare function captureInvocationSource(input: InvocationSource): NextInvocationId;
-//# sourceMappingURL=identity.d.ts.map

package/dist/invocation/identity.js

@@ -1,5 +1,5 @@
 import { issuer } from '@astrale-os/kernel-core/auth';
-import { invocation as protocolInvocation } from '@astrale-os/kernel-protocol';
+import * as protocolInvocation from '@astrale-os/kernel-protocol/invocation';
 import { captureMethod } from '../capture.js';
 export function captureInvocationSource(input) {
     if (input === null || typeof input !== 'object') {
@@ -9,4 +9,3 @@ export function captureInvocationSource(input) {
     const next = captureMethod(input, 'next', 'Server Invocation source is invalid.');
     return () => protocolInvocation.acceptInvocationId({ source, id: next() });
 }
-//# sourceMappingURL=identity.js.map

package/dist/invocation/index.d.ts

@@ -1,5 +1,4 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, type InvocationSource, type NextInvocationId, } from './identity.js';
-export { publicationRouteDecision, type PublicationRouteDecision } from './publication-route.js';
+export { admitVia, releaseRouteDecision, type RouteDecision } from './release-route.js';
 export type { ApplicationHost, ExecutionControl, Handler, HandlerRequest, HandlerResult, HandlerStream, InvocationContext, RequestBackground, RequestEvidence, RequestSleep, } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/index.js

@@ -1,4 +1,3 @@
 export { defaultSleep, invocationContext } from './context.js';
 export { captureInvocationSource, } from './identity.js';
-export { publicationRouteDecision } from './publication-route.js';
-//# sourceMappingURL=index.js.map
+export { admitVia, releaseRouteDecision } from './release-route.js';

package/dist/invocation/release-route.d.ts

@@ -0,0 +1,22 @@
+import type { ErrorPayload } from '@astrale-os/kernel-protocol/errors';
+import type { Via } from '@astrale-os/kernel-protocol/invocation';
+import type { DomainRelease, ReleaseDigest, ReleaseRef } from '@astrale-os/kernel-protocol/release';
+import type { Served } from '../release/served.js';
+export type RouteDecision = {
+    readonly kind: 'admitted';
+} | {
+    readonly kind: 'rejected';
+    readonly error: ErrorPayload;
+}
+/** DEPLOYMENT_RETIRED includes the requested release only when the witness identifies it. */
+ | {
+    readonly kind: 'retired';
+    readonly release?: ReleaseDigest;
+};
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export declare function releaseRouteDecision(current: DomainRelease, installed: ReleaseRef): RouteDecision;
+/** Admit routing against the exact release before credential resolution. */
+export declare function admitVia(served: Served | undefined, via: Via): RouteDecision;

package/dist/invocation/release-route.js

@@ -0,0 +1,32 @@
+import { CODES } from '@astrale-os/kernel-protocol/errors';
+import { compareReferences, reference } from '@astrale-os/kernel-protocol/release';
+const ADMITTED = Object.freeze({ kind: 'admitted' });
+const RETIRED = Object.freeze({ kind: 'retired' });
+/**
+ * Only the exact served release admits. Never report the served digest as retired when
+ * the witness pairs it with a different revision or issuer.
+ */
+export function releaseRouteDecision(current, installed) {
+    switch (compareReferences(reference(current), installed)) {
+        case 'exact':
+            return ADMITTED;
+        case 'release-drift':
+            return installed.digest === current.digest
+                ? RETIRED
+                : Object.freeze({ kind: 'retired', release: installed.digest });
+        case 'origin-drift':
+            return invalid('Routed release origin differs from the served Domain.');
+    }
+}
+/** Admit routing against the exact release before credential resolution. */
+export function admitVia(served, via) {
+    return served === undefined
+        ? invalid('Release routing requires a release-backed destination.')
+        : releaseRouteDecision(served.release, via.release);
+}
+function invalid(message) {
+    return Object.freeze({
+        kind: 'rejected',
+        error: Object.freeze({ code: CODES.INVALID_REQUEST, message }),
+    });
+}

package/dist/invocation/types.d.ts

@@ -1,8 +1,8 @@
 import type { CredentialInput } from '@astrale-os/kernel-core/auth';
-import type { CallableResult } from '@astrale-os/kernel-core/domain';
+import type { BinaryRequestBody, CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
-import type { invocation as protocol } from '@astrale-os/kernel-protocol';
-import type { PublicationSnapshot } from '../publication/index.js';
+import type * as protocol from '@astrale-os/kernel-protocol/invocation';
+import type { ReleaseSnapshot } from '../release/index.js';
 /** Optional platform retention and timer adaptation for one Fetch invocation. */
 export interface ApplicationHost {
     waitUntil(promise: Promise<unknown>): void;
@@ -27,6 +27,8 @@ export interface InvocationContext {
     readonly execution: ExecutionControl;
     readonly idempotencyKey?: protocol.IdempotencyKey;
     readonly request?: RequestEvidence;
+    /** Root-only binary HTTP ingress; ordinary envelopes and WebSocket carry none. */
+    readonly binary?: BinaryRequestBody;
     readonly background: RequestBackground;
     /** Rejects promptly when execution is cancelled or reaches its deadline. */
     readonly sleep: RequestSleep;
@@ -49,15 +51,14 @@ export interface HandlerRequest {
     readonly credential?: CredentialInput;
     /** Source-only effective delegation forwarded unchanged to Runtime. */
     readonly delegate?: protocol.Delegate;
-    /** Destination routing witness forwarded after exact or same-schema Server admission. */
+    /** Destination witness admitted against the exact served release. */
     readonly via?: protocol.Via;
     /** Source-only local-target or remote-revision Schema Registration precondition. */
     readonly schema?: protocol.SchemaTarget;
-    /** Exact Server-pinned serving generation for a Publication-backed request. */
-    readonly publication?: PublicationSnapshot;
+    /** Exact Server-pinned release for a request at a release-backed destination. */
+    readonly release?: ReleaseSnapshot;
     readonly context: InvocationContext;
 }
 export interface Handler {
     dispatch(request: HandlerRequest): Promise<HandlerResult>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/invocation/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/issuer/exchange.d.ts

@@ -10,4 +10,3 @@ export interface Provider {
 }
 export declare function capture(input: Provider): Provider;
 export declare function mount(app: ServerRouter, issuer: string, provider: Provider, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number): void;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -2,6 +2,7 @@ import { inspect as inspectCredential } from '@astrale-os/kernel-core/auth/crede
 import * as errors from '@astrale-os/kernel-protocol/errors';
 import * as exchangeProtocol from '@astrale-os/kernel-protocol/issuer/exchange';
 import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
+import { admissionRefusal, retryAfterHeaders } from '../errors/index.js';
 const PROVIDER_CODES = new Set([
     errors.CODES.AUTH_INVALID,
     errors.CODES.AUTH_EXPIRED,
@@ -24,7 +25,10 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
     }
     app.all(path, async (context) => {
         const request = context.req.raw;
-        const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, extra);
+        const respond = (payload, extra) => json(payload, errors.httpStatusOf(payload.error), request, cors, {
+            ...retryAfterHeaders(payload.error),
+            ...extra,
+        });
         let admitted;
         try {
             admitted = exchangeProtocol.acceptHttpRequest({
@@ -40,12 +44,9 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
             }
             throw cause;
         }
-        if (!active.isAccepting) {
-            return respond(error('BACKEND_UNAVAILABLE', 'Token exchange is unavailable.'));
-        }
         const operation = active.begin(timeoutMs, request.signal);
         if (operation === undefined) {
-            return respond(error('LIMIT_EXCEEDED', 'Token-exchange limit exceeded.'));
+            return respond(exchangeProtocol.acceptErrorResponse({ error: admissionRefusal(active.isAccepting) }));
         }
         try {
             try {
@@ -60,6 +61,11 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                 }
                 throw cause;
             }
+            if (operation.timedOut) {
+                return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
+            }
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
             let output;
             try {
                 output = await provider.exchange(admitted, { signal: operation.signal });
@@ -68,6 +74,8 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
                 if (operation.timedOut) {
                     return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
                 }
+                if (operation.signal.aborted)
+                    throw operation.signal.reason;
                 if (cause instanceof errors.ProtocolError && PROVIDER_CODES.has(cause.payload.code)) {
                     return respond(exchangeProtocol.acceptErrorResponse({ error: cause.payload }));
                 }
@@ -76,6 +84,8 @@ export function mount(app, issuer, provider, cors, active, timeoutMs) {
             if (operation.timedOut) {
                 return respond(error('DEADLINE_EXCEEDED', 'Token-exchange deadline elapsed.'));
             }
+            if (operation.signal.aborted)
+                throw operation.signal.reason;
             const response = exchangeProtocol.acceptResponse(output);
             if (inspectCredential(response.token).claims.exp !== response.expiresAt) {
                 throw new TypeError('Token-exchange provider returned inconsistent expiry evidence.');
@@ -125,13 +135,13 @@ function error(code, message) {
     });
 }
 function json(value, status, request, cors, extra) {
+    const additional = new Headers(extra);
     const headers = new Headers(exchangeProtocol.responseHeaders());
-    for (const [name, value] of Object.entries(cors.response(request)))
+    const exposed = additional.has('retry-after') ? ['retry-after'] : [];
+    for (const [name, value] of Object.entries(cors.response(request, exposed))) {
         headers.set(name, value);
-    if (extra !== undefined) {
-        for (const [name, value] of new Headers(extra))
-            headers.set(name, value);
     }
+    for (const [name, value] of additional)
+        headers.set(name, value);
     return new Response(JSON.stringify(value), { status, headers });
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/index.d.ts

@@ -1,4 +1,3 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, type IssuerRouteReservation, } from './routes.js';
 export type * as exchange from './exchange.js';
 export type { Issuer } from './types.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -1,2 +1 @@
 export { admitIssuer, issuerRouteReservations, mountIssuer, } from './routes.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/routes.d.ts

@@ -11,4 +11,3 @@ export declare function issuerRouteReservations(input: Issuer, tokenExchange?: b
 export declare function mountIssuer(app: ServerRouter, input: Issuer, cors: CorsPolicy, active: ActiveOperations, timeoutMs: number, tokenExchange?: Provider): void;
 /** Admit static discovery configuration before Runtime Boot performs any durable work. */
 export declare function admitIssuer(input: Issuer): Issuer;
-//# sourceMappingURL=routes.d.ts.map