@astrale-os/kernel-server 0.5.0-beta.8 → 1.0.0-beta.1

package/dist/issuer/routes.js

@@ -2,7 +2,8 @@ import { configuration } from '@astrale-os/kernel-protocol/issuer/configuration'
 import { hosted } from '@astrale-os/kernel-protocol/issuer/hosted';
 import { keySet } from '@astrale-os/kernel-protocol/issuer/key-set';
 import { paths as issuerPaths } from '@astrale-os/kernel-protocol/issuer/paths';
-import { IssuerKeysUnavailableError } from '../errors/index.js';
+import { workflowEngine } from '@astrale-os/kernel-protocol/issuer/workflow-engine';
+import { admissionRefusal, IssuerKeysUnavailableError, retryAfterHeaders } from '../errors/index.js';
 import { mount } from './exchange.js';
 export function issuerRouteReservations(input, tokenExchange = false) {
     const paths = issuerPaths(input.issuer);
@@ -13,6 +14,9 @@ export function issuerRouteReservations(input, tokenExchange = false) {
     if (tokenExchange) {
         reservations.push(Object.freeze({ path: paths.tokenExchange, methods: Object.freeze(['POST']) }));
     }
+    if (input.workflowEngineKeys !== undefined) {
+        reservations.push(Object.freeze({ path: paths.workflowEngine, methods: Object.freeze(['GET']) }));
+    }
     if (input.loadIssuerPublicKeys !== undefined) {
         const base = new URL(input.issuer).pathname.replace(/\/+$/u, '');
         reservations.push(Object.freeze({
@@ -32,11 +36,28 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
         ...cors.response(request),
         'cache-control': 'no-cache',
     });
+    // A lifecycle refusal names saturation or drain and presents its retry delay.
+    const refusal = (request) => {
+        const refused = admissionRefusal(active.isAccepting);
+        const retry = retryAfterHeaders(refused);
+        return {
+            body: { error: refused.message },
+            headers: {
+                ...cors.response(request, Object.keys(retry)),
+                'cache-control': 'no-cache',
+                ...retry,
+            },
+        };
+    };
     const algorithm = input.signingAlgorithm ?? 'ES256';
     const discovery = configuration(issuer, [algorithm], {
         tokenExchange: tokenExchange !== undefined,
     });
     app.get(paths.configuration, (context) => context.json(discovery, 200, headers(context.req.raw)));
+    if (input.workflowEngineKeys !== undefined) {
+        const engine = workflowEngine(issuer, input.workflowEngineKeys);
+        app.get(paths.workflowEngine, (context) => context.json(engine, 200, headers(context.req.raw)));
+    }
     if (cors.enabled) {
         app.options(paths.configuration, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         app.options(paths.keys, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
@@ -44,7 +65,8 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
     app.get(paths.keys, async (context) => {
         const operation = active.begin(timeoutMs, context.req.raw.signal);
         if (operation === undefined) {
-            return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
+            const refused = refusal(context.req.raw);
+            return context.json(refused.body, 503, refused.headers);
         }
         try {
             const keys = await input.loadPublicKeys(operation.signal);
@@ -70,54 +92,37 @@ export function mountIssuer(app, input, cors, active, timeoutMs, tokenExchange)
             app.options(`${base}/iss/:thumbprint/.well-known/openid-configuration`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
             app.options(`${base}/iss/:thumbprint/.well-known/jwks.json`, (context) => cors.preflight(context.req.raw, { methods: ['GET'] }));
         }
-        app.get(`${base}/iss/:thumbprint/.well-known/openid-configuration`, async (context) => {
-            const hostedIssuer = hosted(issuer, context.req.param('thumbprint'));
-            if (hostedIssuer === undefined)
-                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
-            const operation = active.begin(timeoutMs, context.req.raw.signal);
-            if (operation === undefined) {
-                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
-            }
-            try {
-                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
-                if (keys.length === 0)
+        const mountHostedDiscovery = (path, document) => {
+            app.get(path, async (context) => {
+                const hostedIssuer = hosted(issuer, context.req.param('thumbprint'));
+                if (hostedIssuer === undefined)
                     return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
-                return context.json(configuration(hostedIssuer, [algorithm]), 200, headers(context.req.raw));
-            }
-            catch (cause) {
-                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
-                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                const operation = active.begin(timeoutMs, context.req.raw.signal);
+                if (operation === undefined) {
+                    const refused = refusal(context.req.raw);
+                    return context.json(refused.body, 503, refused.headers);
                 }
-                throw cause;
-            }
-            finally {
-                operation.settle();
-            }
-        });
-        app.get(`${base}/iss/:thumbprint/.well-known/jwks.json`, async (context) => {
-            const hostedIssuer = hosted(issuer, context.req.param('thumbprint'));
-            if (hostedIssuer === undefined)
-                return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
-            const operation = active.begin(timeoutMs, context.req.raw.signal);
-            if (operation === undefined) {
-                return context.json({ error: 'Issuer is unavailable while draining.' }, 503, headers(context.req.raw));
-            }
-            try {
-                const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
-                if (keys.length === 0)
-                    return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
-                return context.json({ keys }, 200, headers(context.req.raw));
-            }
-            catch (cause) {
-                if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
-                    return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                try {
+                    const keys = await hostedKeys(loadIssuerPublicKeys, hostedIssuer, operation.signal, algorithm);
+                    if (keys.length === 0)
+                        return context.json({ error: 'Issuer not found.' }, 404, headers(context.req.raw));
+                    return context.json(document(hostedIssuer, keys), 200, headers(context.req.raw));
                 }
-                throw cause;
-            }
-            finally {
-                operation.settle();
-            }
-        });
+                catch (cause) {
+                    if (operation.signal.aborted || cause instanceof IssuerKeysUnavailableError) {
+                        return context.json({ error: 'Issuer keys are unavailable.' }, 503, headers(context.req.raw));
+                    }
+                    throw cause;
+                }
+                finally {
+                    operation.settle();
+                }
+            });
+        };
+        mountHostedDiscovery(`${base}/iss/:thumbprint/.well-known/openid-configuration`, (issuer) => configuration(issuer, [algorithm]));
+        mountHostedDiscovery(`${base}/iss/:thumbprint/.well-known/jwks.json`, (_issuer, keys) => ({
+            keys,
+        }));
     }
 }
 async function hostedKeys(load, issuer, signal, algorithm) {
@@ -136,9 +141,14 @@ export function admitIssuer(input) {
     }
     const loadPublicKeys = input.loadPublicKeys;
     const loadIssuerPublicKeys = input.loadIssuerPublicKeys;
+    // A Kernel that drives an engine publishes it; invalid keys fail closed at boot.
+    const workflowEngineKeys = input.workflowEngineKeys === undefined
+        ? undefined
+        : workflowEngine(issuer, input.workflowEngineKeys).identity_keys;
     return Object.freeze({
         issuer,
         signingAlgorithm,
+        ...(workflowEngineKeys === undefined ? {} : { workflowEngineKeys }),
         loadPublicKeys: (signal) => loadPublicKeys.call(input, signal),
         ...(loadIssuerPublicKeys === undefined
             ? {}
@@ -147,4 +157,3 @@ export function admitIssuer(input) {
             }),
     });
 }
-//# sourceMappingURL=routes.js.map

package/dist/issuer/types.d.ts

@@ -8,5 +8,9 @@ export interface Issuer {
     loadPublicKeys(signal: AbortSignal): Promise<readonly JsonWebKey[]>;
     /** Optional hosted-key discovery for issuers below `<issuer>/iss/:thumbprint`. */
     readonly loadIssuerPublicKeys?: (issuer: IssuerId, signal: AbortSignal) => Promise<readonly JsonWebKey[]>;
+    /**
+     * Request identity keys of the workflow engine this Kernel drives, published at
+     * `<issuer>/.well-known/astrale/workflow-engine.json` so Domains verify the engine's requests.
+     */
+    readonly workflowEngineKeys?: readonly string[];
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/issuer/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/lifecycle/active.d.ts

@@ -12,6 +12,8 @@ export interface ActiveOperation {
     /** Register cooperative cleanup and return an idempotent unregistration function. */
     onCancel(cancel: CancelWork): () => void;
     cancel(reason: string): void;
+    /** Replace the remaining budget after a trusted transport binding is admitted. */
+    extend(timeoutMs: number): void;
     settle(): void;
     readonly finished: Promise<void>;
 }
@@ -26,6 +28,8 @@ export declare class ActiveOperations {
     private changed;
     constructor(maximumConcurrentOperations: number);
     get isAccepting(): boolean;
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable(): boolean;
     begin(timeoutMs: number, externalSignal?: AbortSignal): ActiveOperation | undefined;
     attachSocket(socket: ActiveSocket): boolean;
     detachSocket(socket: ActiveSocket): void;
@@ -37,4 +41,3 @@ export declare class ActiveOperations {
     private closeSockets;
 }
 export {};
-//# sourceMappingURL=active.d.ts.map

package/dist/lifecycle/active.js

@@ -1,3 +1,6 @@
+// Streaming iterators can need several microtasks to return after cancellation. Keep the
+// cleanup join bounded even when a producer ignores its cancellation signal.
+const CANCELLATION_CLEANUP_GRACE_MS = 250;
 export class ActiveOperations {
     maximumConcurrentOperations;
     accepting = true;
@@ -13,10 +16,13 @@ export class ActiveOperations {
     get isAccepting() {
         return this.accepting;
     }
+    /** Whether a newly arriving operation can be admitted without semantic dispatch. */
+    get isAvailable() {
+        return this.accepting && this.operations.size < this.maximumConcurrentOperations;
+    }
     begin(timeoutMs, externalSignal) {
-        if (!this.accepting || this.operations.size >= this.maximumConcurrentOperations) {
+        if (!this.isAvailable)
             return undefined;
-        }
         const operation = new Operation(Date.now() + timeoutMs, () => {
             this.operations.delete(operation);
             this.changed?.();
@@ -63,19 +69,32 @@ export class ActiveOperations {
     }
     close(deadline) {
         this.drain();
-        this.closing ??= this.closeOnce(deadline);
+        if (this.closing === undefined) {
+            const flight = this.closeOnce(deadline);
+            this.closing = flight;
+            void flight.catch(() => {
+                // A failed close leaves admission terminal, but residual work may settle later.
+                // Let the same owner join that cleanup on its next close attempt.
+                if (this.closing === flight)
+                    this.closing = undefined;
+            });
+        }
         return this.closing;
     }
     async closeOnce(deadline) {
         await this.waitUntilIdleOr(deadline);
+        const hasCancellationWork = [...this.operations].some((operation) => operation.hasCancellationWork);
         if (this.operations.size > 0) {
             for (const operation of this.operations)
                 operation.cancel('server closing');
         }
         this.closeSockets();
-        // Give cooperative cancellation and iterator returns one turn to settle. The absolute deadline
-        // has already elapsed; an uncooperative operation must reject close rather than pin Host forever.
-        await Promise.resolve();
+        if (hasCancellationWork) {
+            await this.waitUntilIdleOr(Date.now() + CANCELLATION_CLEANUP_GRACE_MS);
+        }
+        else {
+            await Promise.resolve();
+        }
         if (this.operations.size > 0 || this.backgroundTasks.size > 0) {
             this.closed = true;
             throw new Error(`Server close deadline elapsed with ${this.operations.size} active operation(s) and ${this.backgroundTasks.size} background task(s).`);
@@ -110,11 +129,11 @@ export class ActiveOperations {
     }
 }
 class Operation {
-    deadline;
     onSettled;
     controller = new AbortController();
     cancelWork = new Set();
     timer;
+    deadlineValue;
     external;
     settled = false;
     cancelled = false;
@@ -122,15 +141,31 @@ class Operation {
     resolveFinished;
     finished;
     constructor(deadline, onSettled) {
-        this.deadline = deadline;
         this.onSettled = onSettled;
+        this.deadlineValue = deadline;
         this.finished = new Promise((resolve) => {
             this.resolveFinished = resolve;
         });
-        this.timer = setTimeout(() => {
+        this.timer = this.arm();
+    }
+    get deadline() {
+        return this.deadlineValue;
+    }
+    extend(timeoutMs) {
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647) {
+            throw new TypeError('Active operation timeout is invalid.');
+        }
+        if (this.cancelled || this.settled)
+            return;
+        clearTimeout(this.timer);
+        this.deadlineValue = Date.now() + timeoutMs;
+        this.timer = this.arm();
+    }
+    arm() {
+        return setTimeout(() => {
             this.timeout = true;
             this.cancel('invocation deadline exceeded');
-        }, Math.min(Math.max(0, deadline - Date.now()), 2_147_483_647));
+        }, Math.min(Math.max(0, this.deadlineValue - Date.now()), 2_147_483_647));
     }
     link(signal) {
         if (signal === undefined)
@@ -148,6 +183,9 @@ class Operation {
     get timedOut() {
         return this.timeout;
     }
+    get hasCancellationWork() {
+        return this.cancelWork.size > 0;
+    }
     onCancel(cancel) {
         if (this.cancelled) {
             void settleCancellation(cancel, abortReason(this.controller.signal));
@@ -197,4 +235,3 @@ async function settleCancellation(cancel, reason) {
 function abortReason(signal) {
     return signal.reason instanceof Error ? signal.reason.message : 'operation cancelled';
 }
-//# sourceMappingURL=active.js.map

package/dist/lifecycle/index.d.ts

@@ -1,2 +1 @@
 export { ActiveOperations, type ActiveOperation, type ActiveSocket } from './active.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.js

@@ -1,2 +1 @@
 export { ActiveOperations } from './active.js';
-//# sourceMappingURL=index.js.map

package/dist/release/delivery/handler.d.ts

@@ -0,0 +1,9 @@
+import type { ActiveOperations } from '../../lifecycle/index.js';
+import type { Served } from '../served.js';
+import type { Provider } from './types.js';
+export interface Limits {
+    readonly maximumDeliveryBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/** Serve one version-two Delivery against the exact snapshot that selected its URL. */
+export declare function handleDelivery(request: Request, snapshot: Served, provider: Provider | undefined, active: ActiveOperations, limits: Limits, corsFor: (exposedHeaders?: readonly string[]) => Readonly<Record<string, string>>): Promise<Response>;

package/dist/{publication → release}/delivery/handler.js

@@ -1,23 +1,29 @@
-import { codecs, publication as protocolPublication } from '@astrale-os/kernel-protocol';
-import { DeliveryUnavailableError } from '../../errors/index.js';
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as release from '@astrale-os/kernel-protocol/release';
+import { admissionRefusal, DeliveryUnavailableError, retryAfterHeaders, } from '../../errors/index.js';
 import { RequestBodyInvalidError, RequestBodyTooLargeError } from '../../errors/index.js';
 import { readBoundedBody } from '../../transport/index.js';
-const delivery = protocolPublication.delivery;
-/** Serve one delivery request against the exact Publication snapshot that selected its URL. */
-export async function handleDelivery(request, snapshot, provider, active, limits, cors) {
+import { servedDocument } from '../served.js';
+const delivery = release.delivery;
+/** Serve one version-two Delivery against the exact snapshot that selected its URL. */
+export async function handleDelivery(request, snapshot, provider, active, limits, corsFor) {
+    const cors = corsFor();
     if (request.method !== 'POST') {
         return response({ error: 'Delivery requires POST.' }, 405, cors);
     }
     if (provider === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 503, cors);
     }
-    const advertised = snapshot.publication.delivery;
+    const advertised = servedDocument(snapshot).delivery;
     if (advertised === undefined) {
         return response({ error: 'Delivery is unavailable.' }, 404, cors);
     }
     const operation = active.begin(limits.invocationTimeoutMs, request.signal);
-    if (operation === undefined)
-        return response({ error: 'Server is draining.' }, 503, cors);
+    if (operation === undefined) {
+        const refusal = admissionRefusal(active.isAccepting);
+        const retry = retryAfterHeaders(refusal);
+        return response({ error: refusal.message }, 503, { ...corsFor(Object.keys(retry)), ...retry });
+    }
     try {
         const authorization = request.headers.get('authorization');
         const token = bearer(authorization);
@@ -63,8 +69,9 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (input.etag !== snapshot.publication.etag) {
-            return response({ error: 'Publication ETag differs from request.' }, 409, cors);
+        const served = snapshot.release.digest;
+        if (input.release !== served) {
+            return response({ error: 'Release digest differs from request.' }, 409, cors);
         }
         let candidate;
         try {
@@ -89,8 +96,8 @@ export async function handleDelivery(request, snapshot, provider, active, limits
             }
             throw cause;
         }
-        if (created.publication.etag !== snapshot.publication.etag) {
-            return response({ error: 'Delivery provider returned a different Publication.' }, 500, cors);
+        if (created.release.digest !== served) {
+            return response({ error: 'Delivery provider returned a different release.' }, 500, cors);
         }
         const encoded = codecs.json.encode(created);
         if (encodedSize(encoded) > limits.maximumDeliveryBytes) {
@@ -124,4 +131,3 @@ function encodedSize(input) {
 function toBody(input) {
     return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
 }
-//# sourceMappingURL=handler.js.map

package/dist/release/delivery/index.d.ts

@@ -0,0 +1 @@
+export type { Context, Provider } from './types.js';

package/dist/release/delivery/index.js

@@ -0,0 +1 @@
+export {};

package/dist/{publication → release}/delivery/types.d.ts

@@ -1,12 +1,11 @@
-import type { publication } from '@astrale-os/kernel-protocol';
+import type * as release from '@astrale-os/kernel-protocol/release';
 export interface Context {
     /** Omitted for a public endpoint; otherwise the exact admitted retrieval credential. */
-    readonly token?: publication.delivery.Token;
+    readonly token?: release.delivery.Token;
     readonly signal: AbortSignal;
 }
-/** Provider-owned retrieval, construction, and attestation signing. */
+/** Provider-owned retrieval, construction, and attestation signing for the served release. */
 export interface Provider {
     /** Throw DeliveryUnavailableError only for an expected dependency outage. */
-    create(request: publication.delivery.Request, context: Context): Promise<publication.delivery.Delivery>;
+    create(request: release.delivery.Request, context: Context): Promise<release.delivery.Delivery>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/release/delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/release/index.d.ts

@@ -0,0 +1,3 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export type { ReleaseSnapshot, ReleaseSnapshotInput, ReleaseSource } from './types.js';
+export * as delivery from './delivery/index.js';

package/dist/release/index.js

@@ -0,0 +1,2 @@
+export { prepareReleaseSnapshot } from './snapshot.js';
+export * as delivery from './delivery/index.js';

package/dist/release/served.d.ts

@@ -0,0 +1,21 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { DomainRelease } from '@astrale-os/kernel-protocol/release';
+import type { PreparedReleaseSnapshot } from './snapshot.js';
+import type { ReleaseSnapshot, ReleaseSource } from './types.js';
+export interface ServingSource {
+    readonly kind: 'release';
+    readonly source: ReleaseSource;
+}
+export type Served = PreparedReleaseSnapshot;
+export interface RequestServing {
+    readonly kind: 'release';
+    /** The snapshot the request pins; undefined while none is ready or it is withheld. */
+    current(): Served | undefined;
+    /** The public serving origin named by a DEPLOYMENT_RETIRED answer. */
+    deployment(): IssuerId;
+}
+export declare function readServed(serving: ServingSource): Served | undefined;
+export declare function servedDocument(served: Served): DomainRelease;
+export declare function pinned(served: Served): {
+    readonly release: ReleaseSnapshot;
+};

package/dist/release/served.js

@@ -0,0 +1,10 @@
+import { readPreparedReleaseSnapshot } from './snapshot.js';
+export function readServed(serving) {
+    return readPreparedReleaseSnapshot(serving.source.current());
+}
+export function servedDocument(served) {
+    return served.release;
+}
+export function pinned(served) {
+    return { release: served.snapshot };
+}

package/dist/release/snapshot.d.ts

@@ -0,0 +1,22 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { ServedReferences, Table } from '@astrale-os/kernel-protocol/routes';
+import { type DomainRelease } from '@astrale-os/kernel-protocol/release';
+import type { ReleaseSnapshot, ReleaseSnapshotInput } from './types.js';
+export interface PreparedReleaseSnapshot {
+    readonly kind: 'release';
+    readonly snapshot: ReleaseSnapshot;
+    readonly release: DomainRelease;
+    readonly releaseBytes: Uint8Array;
+    /** The exact release reference native-route If-Match names. */
+    readonly references: ServedReferences;
+    readonly bundle: Uint8Array;
+    readonly table: Table;
+    readonly domain: Domain;
+}
+/**
+ * Admit and detach one deployment's serving snapshot before it is served: the release, its exact
+ * bundle bytes, its resolved Domain and route Table.
+ */
+export declare function prepareReleaseSnapshot(input: ReleaseSnapshotInput): ReleaseSnapshot;
+/** Internal proof that a ReleaseSource returned a Server-prepared snapshot without cloning it. */
+export declare function readPreparedReleaseSnapshot(input: unknown): PreparedReleaseSnapshot | undefined;

package/dist/release/snapshot.js

@@ -0,0 +1,49 @@
+import { accept as acceptRelease, bundleUrl, encode as encodeRelease, verifyBundleBytes, } from '@astrale-os/kernel-protocol/release';
+import { admitTable } from './table.js';
+const snapshots = new WeakMap();
+/**
+ * Admit and detach one deployment's serving snapshot before it is served: the release, its exact
+ * bundle bytes, its resolved Domain and route Table.
+ */
+export function prepareReleaseSnapshot(input) {
+    if (input === null || typeof input !== 'object' || !(input.bundle instanceof Uint8Array)) {
+        throw new TypeError('Release snapshot input is invalid.');
+    }
+    const release = acceptRelease(input.release);
+    const bundleBytes = new Uint8Array(input.bundle);
+    verifyBundleBytes(release, bundleBytes);
+    const domain = input.domain;
+    if (domain.origin !== release.origin || domain.revision !== release.schema.revision) {
+        throw new TypeError('Release snapshot Domain identity differs from its release.');
+    }
+    const table = admitTable(release, input.table, domain);
+    const addressed = new URL(bundleUrl(release.identity.issuer, release.schema.bundle.ref));
+    const addressedDirectory = addressed.pathname.slice(0, addressed.pathname.lastIndexOf('/') + 1);
+    const servingBundle = new URL(release.schema.bundle.href);
+    if (servingBundle.origin === addressed.origin &&
+        servingBundle.pathname.startsWith(addressedDirectory) &&
+        servingBundle.href !== addressed.href) {
+        throw new TypeError('Release bundle URL differs from its artifact digest.');
+    }
+    const snapshot = Object.freeze({ release });
+    const prepared = Object.freeze({
+        kind: 'release',
+        snapshot,
+        release,
+        releaseBytes: encodeRelease(release),
+        references: Object.freeze({
+            release: table.release,
+        }),
+        bundle: bundleBytes,
+        table,
+        domain,
+    });
+    snapshots.set(snapshot, prepared);
+    return snapshot;
+}
+/** Internal proof that a ReleaseSource returned a Server-prepared snapshot without cloning it. */
+export function readPreparedReleaseSnapshot(input) {
+    if (input === null || typeof input !== 'object')
+        return undefined;
+    return snapshots.get(input);
+}

package/dist/release/table.d.ts

@@ -0,0 +1,4 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type { DomainRelease } from '@astrale-os/kernel-protocol/release';
+import { type Table } from '@astrale-os/kernel-protocol/routes';
+export declare function admitTable(deployed: DomainRelease, input: Table | undefined, domain: Domain): Table;

package/dist/release/table.js

@@ -0,0 +1,11 @@
+import { reference } from '@astrale-os/kernel-protocol/release';
+import { acceptTable, verifyTable } from '@astrale-os/kernel-protocol/routes';
+export function admitTable(deployed, input, domain) {
+    if (input === undefined) {
+        if (deployed.routes.length !== 0) {
+            throw new TypeError('A release with native routes requires a Route Table.');
+        }
+        return verifyTable(Object.freeze({ release: reference(deployed), entries: Object.freeze([]) }), deployed, domain);
+    }
+    return verifyTable(acceptTable(input), deployed, domain);
+}

package/dist/release/types.d.ts

@@ -0,0 +1,23 @@
+import type { Domain } from '@astrale-os/kernel-dsl/v1';
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Table } from '@astrale-os/kernel-protocol/routes';
+declare const RELEASE_SNAPSHOT: unique symbol;
+export interface ReleaseSnapshotInput {
+    readonly release: release.DomainRelease;
+    /** Exact artifact served at DomainRelease.schema.bundle.href. */
+    readonly bundle: Uint8Array;
+    /** Route Table bound to this release; required when it declares native routes. */
+    readonly table?: Table;
+    readonly domain: Domain;
+}
+/** Immutable admitted serving identity; bundle and compiled routes remain Server-private. */
+export interface ReleaseSnapshot {
+    readonly release: release.DomainRelease;
+    readonly [RELEASE_SNAPSHOT]: true;
+}
+/** Atomically readable source swapped only after a complete snapshot is prepared. */
+export interface ReleaseSource {
+    /** Undefined until the first snapshot is ready. */
+    current(): ReleaseSnapshot | undefined;
+}
+export {};

package/dist/release/types.js

@@ -0,0 +1 @@
+export {};

package/dist/routes/address.d.ts

@@ -0,0 +1,2 @@
+/** Match a resource path and query against its trusted serving origin. */
+export declare function sameRoute(left: string, right: string, externalOrigin?: string): boolean;

package/dist/routes/address.js

@@ -0,0 +1,6 @@
+/** Match a resource path and query against its trusted serving origin. */
+export function sameRoute(left, right, externalOrigin) {
+    const a = new URL(left);
+    const b = new URL(right);
+    return ((externalOrigin ?? a.origin) === b.origin && a.pathname === b.pathname && a.search === b.search);
+}

package/dist/routes/binary.d.ts

@@ -0,0 +1,9 @@
+import type { BinaryOutput, StreamingBinaryResult } from '@astrale-os/kernel-core/callable';
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperation } from '../lifecycle/index.js';
+/** Retain the native operation until its byte producer ends or is closed. */
+export declare function streamingBinaryResponse(binary: StreamingBinaryResult, operation: ActiveOperation, cors: CorsPolicy, request: Request): Response;
+/** Identify a producer-backed binary result before handing off operation ownership. */
+export declare function isStreamingBinary(input: BinaryOutput): input is StreamingBinaryResult;
+/** Render buffered application bytes with the native binary header manifest. */
+export declare function binaryResponse(binary: Exclude<BinaryOutput, StreamingBinaryResult>, cors: CorsPolicy, request: Request): Response;