@astrale-os/kernel-server 0.5.0-beta.8 → 1.0.0-beta.1

package/dist/routes/binary.js

@@ -0,0 +1,110 @@
+import * as protocol from '@astrale-os/kernel-protocol/invocation';
+import * as routes from '@astrale-os/kernel-protocol/routes';
+import { toBody } from './response.js';
+/** Retain the native operation until its byte producer ends or is closed. */
+export function streamingBinaryResponse(binary, operation, cors, request) {
+    // Admit the reserved/invalid headers before acquiring the producer, so a refused render never
+    // captures the stream it would then have to abandon.
+    const applicationHeaders = applicationBinaryHeaders(binary.headers);
+    const iterator = binary.body[Symbol.asyncIterator]();
+    let terminal = false;
+    let controller;
+    let stopping;
+    const stop = (reason = 'Binary response was interrupted.') => {
+        if (terminal)
+            return stopping ?? Promise.resolve();
+        terminal = true;
+        controller?.error(new Error(reason));
+        stopping = Promise.resolve().then(async () => {
+            try {
+                await iterator.return?.();
+            }
+            finally {
+                operation.settle();
+            }
+        });
+        return stopping;
+    };
+    const body = new ReadableStream({
+        start(output) {
+            controller = output;
+        },
+        async pull(controller) {
+            if (terminal)
+                return;
+            try {
+                const next = await iterator.next();
+                if (terminal)
+                    return;
+                if (next.done) {
+                    terminal = true;
+                    controller.close();
+                    operation.settle();
+                    return;
+                }
+                controller.enqueue(next.value);
+            }
+            catch (cause) {
+                if (terminal)
+                    return;
+                terminal = true;
+                controller.error(cause);
+                operation.settle();
+            }
+        },
+        async cancel(reason) {
+            const message = typeof reason === 'string' ? reason : 'native binary response cancelled';
+            operation.cancel(message);
+            await stop();
+        },
+    });
+    operation.onCancel(stop);
+    try {
+        return new Response(body, {
+            status: binary.status ?? 200,
+            headers: {
+                ...cors.response(request, Object.keys(applicationHeaders)),
+                ...applicationHeaders,
+                'content-type': binary.mediaType,
+            },
+        });
+    }
+    catch (cause) {
+        // A body-forbidding status (e.g. 204) rejects the Response after the producer was wired:
+        // close it and let the caller settle the operation rather than leaking its slot.
+        void stop('Binary response was refused.');
+        throw cause;
+    }
+}
+/** Identify a producer-backed binary result before handing off operation ownership. */
+export function isStreamingBinary(input) {
+    return !(input.body instanceof Uint8Array);
+}
+function applicationBinaryHeaders(input) {
+    const output = {};
+    for (const [name, value] of Object.entries(input ?? {})) {
+        if (name.toLowerCase() === routes.HTTP_ROUTE_STALE ||
+            name.toLowerCase() === routes.HTTP_ROUTE_MISS) {
+            throw new TypeError(`${name.toLowerCase()} is reserved for native routing control.`);
+        }
+        if (protocol.http.isApplicationBinaryHeader(name))
+            output[name] = value;
+    }
+    return output;
+}
+/** Render buffered application bytes with the native binary header manifest. */
+export function binaryResponse(binary, cors, request) {
+    const applicationHeaders = applicationBinaryHeaders(binary.headers);
+    return new Response(toBody(binary.body), {
+        status: binary.status ?? 200,
+        headers: {
+            ...cors.response(request, [
+                protocol.http.BINARY_HEADERS_FIELD,
+                ...Object.keys(applicationHeaders),
+            ]),
+            ...applicationHeaders,
+            'content-type': binary.mediaType,
+            [protocol.http.BINARY_HEADERS_FIELD]: protocol.http.encodeBinaryHeaderNames(applicationHeaders),
+        },
+    });
+}

package/dist/routes/bundle.d.ts

@@ -0,0 +1,5 @@
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { Served } from '../release/served.js';
+import type { CorsHeaders } from './model.js';
+/** Serve exact bundle bytes or an uncached miss inside its immutable artifact directory. */
+export declare function bundleResponse(request: Request, snapshot: Served, active: ActiveOperations, responseCors: Readonly<Record<string, string>>, corsFor: CorsHeaders, externalOrigin?: string): Response | undefined;

package/dist/routes/bundle.js

@@ -0,0 +1,50 @@
+import { bundleUrl } from '@astrale-os/kernel-protocol/release';
+import { servedDocument } from '../release/served.js';
+import { sameRoute } from './address.js';
+import { drained, quoteEtag, response, toBody } from './response.js';
+/** Serve exact bundle bytes or an uncached miss inside its immutable artifact directory. */
+export function bundleResponse(request, snapshot, active, responseCors, corsFor, externalOrigin) {
+    const document = servedDocument(snapshot);
+    const descriptor = document.schema.bundle;
+    const addressed = bundleUrl(document.identity.issuer, descriptor.ref);
+    const immutable = descriptor.href === addressed;
+    if (sameRoute(request.url, descriptor.href, externalOrigin)) {
+        if (!active.isAccepting) {
+            return drained('Release artifact is unavailable while draining.', corsFor);
+        }
+        if (request.method !== 'GET')
+            return response({ error: 'Bundle retrieval requires GET.' }, 405, responseCors);
+        const body = snapshot.bundle;
+        if (body.byteLength !== descriptor.ref.size) {
+            return response({
+                error: 'Bundle differs from its release.',
+            }, 500, responseCors);
+        }
+        const etag = quoteEtag(descriptor.ref.digest);
+        const unchanged = request.headers.get('if-none-match') === etag;
+        return new Response(unchanged ? null : toBody(body), {
+            status: unchanged ? 304 : 200,
+            headers: {
+                ...responseCors,
+                'content-type': descriptor.ref.mediaType,
+                etag,
+                'cache-control': immutable
+                    ? 'public, max-age=31536000, immutable, no-transform'
+                    : 'public, max-age=0, must-revalidate, no-transform',
+            },
+        });
+    }
+    if (request.method === 'GET' && immutable) {
+        const pathname = new URL(addressed).pathname;
+        const directory = pathname.slice(0, pathname.lastIndexOf('/') + 1);
+        const requested = new URL(request.url);
+        if (requested.pathname.startsWith(directory) &&
+            /^[0-9a-f]{64}\.json$/u.test(requested.pathname.slice(directory.length))) {
+            return new Response(null, {
+                status: 404,
+                headers: { ...responseCors, 'cache-control': 'no-store' },
+            });
+        }
+    }
+    return undefined;
+}

package/dist/routes/csrf.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A request that mutates state or navigates to an effectful target. Non-safe HTTP methods always
+ * qualify; a GET or HEAD qualifies only as a top-level browser navigation (`Sec-Fetch-Mode:
+ * navigate`), the one GET shape that carries SameSite=Lax cookies cross-site. Programmatic GETs
+ * (`cors`/`no-cors`) are left untouched so read clients are never broken.
+ */
+export declare function isStateChanging(request: Request): boolean;
+/**
+ * Positive evidence that a request originates from another site. `Sec-Fetch-Site` is set by the
+ * browser and cannot be forged by page script, so when present it is authoritative: only
+ * `cross-site` is refused, and `same-origin`/`same-site`/`none` are trusted (a shared-domain
+ * subdomain deployment keeps working). When it is absent, a differing `Origin` is the next-best
+ * signal. Absence of both is treated as not-cross-site, so same-origin browsers and non-browser
+ * clients that omit these headers are never refused.
+ */
+export declare function isClearlyCrossSite(request: Request, serviceOrigin: string): boolean;

package/dist/routes/csrf.js

@@ -0,0 +1,35 @@
+/**
+ * A request that mutates state or navigates to an effectful target. Non-safe HTTP methods always
+ * qualify; a GET or HEAD qualifies only as a top-level browser navigation (`Sec-Fetch-Mode:
+ * navigate`), the one GET shape that carries SameSite=Lax cookies cross-site. Programmatic GETs
+ * (`cors`/`no-cors`) are left untouched so read clients are never broken.
+ */
+export function isStateChanging(request) {
+    switch (request.method.toUpperCase()) {
+        case 'POST':
+        case 'PUT':
+        case 'PATCH':
+        case 'DELETE':
+            return true;
+        case 'GET':
+        case 'HEAD':
+            return request.headers.get('sec-fetch-mode') === 'navigate';
+        default:
+            return false;
+    }
+}
+/**
+ * Positive evidence that a request originates from another site. `Sec-Fetch-Site` is set by the
+ * browser and cannot be forged by page script, so when present it is authoritative: only
+ * `cross-site` is refused, and `same-origin`/`same-site`/`none` are trusted (a shared-domain
+ * subdomain deployment keeps working). When it is absent, a differing `Origin` is the next-best
+ * signal. Absence of both is treated as not-cross-site, so same-origin browsers and non-browser
+ * clients that omit these headers are never refused.
+ */
+export function isClearlyCrossSite(request, serviceOrigin) {
+    const site = request.headers.get('sec-fetch-site');
+    if (site !== null)
+        return site === 'cross-site';
+    const origin = request.headers.get('origin');
+    return origin !== null && origin !== serviceOrigin;
+}

package/dist/routes/document.d.ts

@@ -0,0 +1,6 @@
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { Served } from '../release/served.js';
+import type { ServerRouter } from '../transport/router.js';
+/** Mount the Release document at its issuer path. */
+export declare function mountDocuments(app: ServerRouter, cors: CorsPolicy, active: ActiveOperations, served: (request: Request) => Served | undefined, externalIssuer?: string): void;

package/dist/routes/document.js

@@ -0,0 +1,57 @@
+import { MEDIA_TYPE as RELEASE_MEDIA_TYPE, PATH as RELEASE_PATH, url as releaseUrl, } from '@astrale-os/kernel-protocol/release';
+import { drained, quoteEtag, response, toBody } from './response.js';
+/** Mount the Release document at its issuer path. */
+export function mountDocuments(app, cors, active, served, externalIssuer) {
+    mountDocument(app, documentPath(RELEASE_PATH, releaseUrl, externalIssuer), 'Release', {
+        cors,
+        active,
+        served,
+        read: (snapshot) => ({
+            bytes: snapshot.releaseBytes,
+            mediaType: RELEASE_MEDIA_TYPE,
+            etag: snapshot.release.digest,
+        }),
+    });
+}
+function documentPath(path, url, externalIssuer) {
+    return externalIssuer === undefined ? path : new URL(url(externalIssuer)).pathname;
+}
+function mountDocument(app, path, name, serving) {
+    const { cors, active } = serving;
+    if (cors.enabled) {
+        app.options(path, (context) => cors.preflight(context.req.raw, {
+            methods: ['GET'],
+            headers: ['if-none-match'],
+        }));
+    }
+    app.get(path, (context) => {
+        const responseCors = cors.response(context.req.raw, ['etag']);
+        if (!active.isAccepting) {
+            return drained(`${name} is unavailable while draining.`, (exposed) => cors.response(context.req.raw, exposed));
+        }
+        const snapshot = serving.served(context.req.raw);
+        const document = snapshot === undefined ? undefined : serving.read(snapshot);
+        if (document === undefined)
+            return response({ error: `${name} is not ready.` }, 503, responseCors);
+        const etag = quoteEtag(document.etag);
+        if (context.req.raw.headers.get('if-none-match') === etag) {
+            return new Response(null, {
+                status: 304,
+                headers: {
+                    ...responseCors,
+                    etag,
+                    'cache-control': 'public, max-age=0, must-revalidate, no-transform',
+                },
+            });
+        }
+        return new Response(toBody(document.bytes), {
+            status: 200,
+            headers: {
+                ...responseCors,
+                'content-type': document.mediaType,
+                etag,
+                'cache-control': 'public, max-age=0, must-revalidate, no-transform',
+            },
+        });
+    });
+}

package/dist/routes/index.d.ts

@@ -1,2 +1,3 @@
-export { currentPublicationSnapshot, mountRoutes, type RouteLimits, type RouteReservation, } from './routes.js';
-//# sourceMappingURL=index.d.ts.map
+export { mountRoutes } from './routes.js';
+export { currentServed } from './snapshot.js';
+export type { RouteLimits, RouteReservation } from './model.js';

package/dist/routes/index.js

@@ -1,2 +1,2 @@
-export { currentPublicationSnapshot, mountRoutes, } from './routes.js';
-//# sourceMappingURL=index.js.map
+export { mountRoutes } from './routes.js';
+export { currentServed } from './snapshot.js';

package/dist/routes/model.d.ts

@@ -0,0 +1,15 @@
+/** Budgets applied to advertised resources and native invocations. */
+export interface RouteLimits {
+    readonly maximumRequestBytes: number;
+    readonly maximumReleaseBytes: number;
+    readonly maximumBundleBytes: number;
+    readonly maximumDeliveryBytes: number;
+    readonly invocationTimeoutMs: number;
+}
+/** Derive response headers with route-owned exposed names. */
+export type CorsHeaders = (exposedHeaders?: readonly string[]) => Readonly<Record<string, string>>;
+/** Server-owned method and path space unavailable to advertised native routes. */
+export interface RouteReservation {
+    readonly path: string;
+    readonly methods: readonly string[];
+}

package/dist/routes/model.js

@@ -0,0 +1 @@
+export {};

package/dist/routes/native.d.ts

@@ -0,0 +1,17 @@
+import type { CorsPolicy } from '../cors/index.js';
+import type { ActiveOperations } from '../lifecycle/index.js';
+import type { Served } from '../release/served.js';
+import type { RouteLimits } from './model.js';
+import { type ApplicationHost, type Handler, type NextInvocationId } from '../invocation/index.js';
+interface NativeOptions {
+    readonly handler: Handler;
+    readonly active: ActiveOperations;
+    readonly nextInvocation: NextInvocationId;
+    readonly limits: RouteLimits;
+    readonly cors: CorsPolicy;
+    readonly hostFor: (request: Request) => ApplicationHost | undefined;
+    readonly externalOrigin: string | undefined;
+}
+/** Gate the pinned native route before body admission and dispatch with one operation lifetime. */
+export declare function nativeResponse(request: Request, snapshot: Served, options: NativeOptions, responseCors: Readonly<Record<string, string>>): Promise<Response | undefined>;
+export {};

package/dist/routes/native.js

@@ -0,0 +1,126 @@
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as protocol from '@astrale-os/kernel-protocol/invocation';
+import * as routes from '@astrale-os/kernel-protocol/routes';
+import { admissionRefusal, classifyRequestError, RequestBodyInvalidError, RequestBodyTooLargeError, } from '../errors/index.js';
+import { invocationContext, } from '../invocation/index.js';
+import { pinned } from '../release/served.js';
+import { readBoundedBody } from '../transport/body.js';
+import { binaryResponse, isStreamingBinary, streamingBinaryResponse } from './binary.js';
+import { isClearlyCrossSite, isStateChanging } from './csrf.js';
+import { encodedBody, nativeError } from './response.js';
+import { streamResponse } from './stream.js';
+/** Gate the pinned native route before body admission and dispatch with one operation lifetime. */
+export async function nativeResponse(request, snapshot, options, responseCors) {
+    const { handler, active, nextInvocation, limits, cors, hostFor, externalOrigin } = options;
+    const corsFor = (exposed) => cors.response(request, exposed);
+    let routing;
+    try {
+        const decoded = routes.decodeRouting(request, snapshot.references);
+        if (decoded?.kind === 'stale')
+            return stale(request, decoded.current, cors);
+        routing = decoded;
+    }
+    catch (cause) {
+        if (cause instanceof routes.RouteError) {
+            return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route routing is invalid.' }, 400, corsFor);
+        }
+        throw cause;
+    }
+    const route = routes.match(snapshot.table, request);
+    if (route === undefined)
+        return undefined;
+    const assigned = nextInvocation();
+    const operation = active.begin(limits.invocationTimeoutMs, request.signal);
+    if (operation === undefined)
+        return nativeError(admissionRefusal(active.isAccepting), 503, corsFor);
+    let handedOff = false;
+    try {
+        const body = await readBoundedBody(request, limits.maximumRequestBytes, operation.signal);
+        const native = { url: request.url, method: request.method, headers: request.headers, body };
+        const invocation = routes.decode(route, native, snapshot.domain, snapshot.references);
+        if (invocation.credentialIn === 'cookie' &&
+            isStateChanging(request) &&
+            isClearlyCrossSite(request, externalOrigin ?? new URL(request.url).origin)) {
+            const refusal = {
+                code: errors.CODES.ACCESS_DENIED,
+                message: 'Cross-site cookie-authenticated request to a native route is refused.',
+            };
+            return nativeError(refusal, errors.httpStatusOf(refusal), corsFor);
+        }
+        const idempotencyHeader = request.headers.get(protocol.HTTP_IDEMPOTENCY_KEY);
+        const idempotencyKey = idempotencyHeader === null
+            ? undefined
+            : protocol.acceptIdempotencyKey(idempotencyHeader, protocol.HTTP_IDEMPOTENCY_KEY);
+        const result = await handler.dispatch(Object.freeze({
+            call: invocation.call,
+            ...(invocation.credential === undefined ? {} : { credential: invocation.credential }),
+            ...(routing === undefined ? {} : { via: routing }),
+            ...pinned(snapshot),
+            context: invocationContext(assigned, operation, active, hostFor(request), body, idempotencyKey),
+        }));
+        if (result.kind === 'value') {
+            return new Response(encodedBody(codecs.json.encode(result.value)), {
+                headers: {
+                    ...responseCors,
+                    'content-type': 'application/json',
+                },
+            });
+        }
+        if (result.kind === 'binary') {
+            if (isStreamingBinary(result.value)) {
+                // Hand the operation off only once the streaming response is built. A refused render
+                // (reserved header or a body-forbidding status) throws before this point, so the
+                // `finally` below still settles the operation instead of leaking its slot.
+                const streaming = streamingBinaryResponse(result.value, operation, cors, request);
+                handedOff = true;
+                return streaming;
+            }
+            return binaryResponse(result.value, cors, request);
+        }
+        if (result.kind === 'stream') {
+            handedOff = true;
+            return await streamResponse(result.stream, operation, corsFor);
+        }
+        if (result.kind === 'miss') {
+            return new Response(null, {
+                status: routes.HTTP_ROUTE_MISS_STATUS,
+                headers: {
+                    ...cors.response(request, [routes.HTTP_ROUTE_MISS]),
+                    ...routes.missHeaders(),
+                },
+            });
+        }
+        return nativeError({
+            code: errors.CODES.UNSUPPORTED,
+            message: 'Native routes do not forward Runtime redirects.',
+        }, 502, corsFor);
+    }
+    catch (cause) {
+        if (cause instanceof RequestBodyTooLargeError) {
+            return nativeError({ code: errors.CODES.LIMIT_EXCEEDED, message: 'Request body is too large.' }, 413, corsFor);
+        }
+        if (cause instanceof RequestBodyInvalidError) {
+            return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Request body is invalid.' }, 400, corsFor);
+        }
+        if (cause instanceof routes.RouteError) {
+            return nativeError({ code: errors.CODES.INVALID_REQUEST, message: 'Native route request is invalid.' }, 400, corsFor);
+        }
+        const payload = classifyRequestError(cause, operation);
+        return nativeError(payload, errors.httpStatusOf(payload), corsFor);
+    }
+    finally {
+        if (!handedOff)
+            operation.settle();
+    }
+}
+/** Reserved native stale control naming the digest the destination serves (`StaleControl.current`). */
+function stale(request, current, cors) {
+    return new Response(null, {
+        status: routes.HTTP_ROUTE_STALE_STATUS,
+        headers: {
+            ...cors.response(request, [routes.HTTP_ROUTE_STALE]),
+            ...routes.staleHeaders(current),
+        },
+    });
+}

package/dist/routes/preflight.d.ts

@@ -0,0 +1,4 @@
+import type { CorsPolicy } from '../cors/index.js';
+import type { Served } from '../release/served.js';
+/** Answer resource or native-route preflight from the pinned serving snapshot. */
+export declare function releasePreflight(cors: CorsPolicy, request: Request, snapshot: Served, externalOrigin?: string): Response;

package/dist/routes/preflight.js

@@ -0,0 +1,55 @@
+import * as protocol from '@astrale-os/kernel-protocol/invocation';
+import * as routes from '@astrale-os/kernel-protocol/routes';
+import { servedDocument } from '../release/served.js';
+import { sameRoute } from './address.js';
+/** Answer resource or native-route preflight from the pinned serving snapshot. */
+export function releasePreflight(cors, request, snapshot, externalOrigin) {
+    const document = servedDocument(snapshot);
+    if (sameRoute(request.url, document.schema.bundle.href, externalOrigin)) {
+        return cors.preflight(request, { methods: ['GET'], headers: ['if-none-match'] });
+    }
+    const deliveryUrl = document.delivery?.href;
+    if (deliveryUrl !== undefined && sameRoute(request.url, deliveryUrl, externalOrigin)) {
+        return cors.preflight(request, {
+            methods: ['POST'],
+            headers: ['authorization', 'content-type'],
+        });
+    }
+    const requestedMethod = request.headers.get('access-control-request-method');
+    const route = requestedMethod === null
+        ? undefined
+        : routes.match(snapshot.table, { url: request.url, method: requestedMethod });
+    return cors.preflight(request, route === undefined ? undefined : nativeCorsRoute(route, requestedMethod));
+}
+function nativeCorsRoute(entry, requestedMethod) {
+    const headers = new Set([
+        'accept',
+        routes.HTTP_ROUTE_DIGEST,
+        routes.HTTP_ROUTE_ISSUER,
+        protocol.HTTP_IDEMPOTENCY_KEY,
+    ]);
+    if (entry.body !== undefined)
+        headers.add('content-type');
+    let allowAnyHeaders = false;
+    for (const pick of Object.values(entry.headers ?? {})) {
+        if (pick === '*')
+            allowAnyHeaders = true;
+        else
+            headers.add(pick.toLowerCase());
+    }
+    const credential = entry.credential;
+    const sources = credential === undefined
+        ? [{ in: 'header' }]
+        : Array.isArray(credential)
+            ? credential
+            : [credential];
+    for (const source of sources) {
+        if (source.in === 'header')
+            headers.add((source.name ?? 'authorization').toLowerCase());
+    }
+    return Object.freeze({
+        methods: Object.freeze([entry.method === '*' ? requestedMethod.toUpperCase() : entry.method]),
+        headers: Object.freeze([...headers]),
+        ...(allowAnyHeaders ? { allowAnyHeaders: true } : {}),
+    });
+}

package/dist/routes/response.d.ts

@@ -0,0 +1,14 @@
+import type * as errors from '@astrale-os/kernel-protocol/errors';
+import type { CorsHeaders } from './model.js';
+/** Quote an exact digest as a strong HTTP validator. */
+export declare function quoteEtag(digest: string): string;
+/** Encode a JSON response with the admitted CORS headers. */
+export declare function response(body: unknown, status: number, cors: Readonly<Record<string, string>>): Response;
+/** A served document or artifact refused while draining presents the lifecycle retry delay. */
+export declare function drained(message: string, cors: CorsHeaders): Response;
+/** Every native error, including a capacity refusal raised by dispatch, presents its retry delay. */
+export declare function nativeError(error: errors.ErrorPayload, status: number, cors: CorsHeaders): Response;
+/** Preserve encoded JSON as text or exact detached bytes for Fetch. */
+export declare function encodedBody(input: string | Uint8Array): string | ArrayBuffer;
+/** Expose only the selected byte range as a Fetch response body. */
+export declare function toBody(input: Uint8Array): ArrayBuffer;

package/dist/routes/response.js

@@ -0,0 +1,33 @@
+import * as codecs from '@astrale-os/kernel-protocol/codecs';
+import * as routes from '@astrale-os/kernel-protocol/routes';
+import { admissionRefusal, retryAfterHeaders } from '../errors/index.js';
+/** Quote an exact digest as a strong HTTP validator. */
+export function quoteEtag(digest) {
+    return `"${digest}"`;
+}
+/** Encode a JSON response with the admitted CORS headers. */
+export function response(body, status, cors) {
+    return new Response(encodedBody(codecs.json.encode(body)), {
+        status,
+        headers: { ...cors, 'content-type': 'application/json' },
+    });
+}
+/** A served document or artifact refused while draining presents the lifecycle retry delay. */
+export function drained(message, cors) {
+    const retry = retryAfterHeaders(admissionRefusal(false));
+    return response({ error: message }, 503, { ...cors(Object.keys(retry)), ...retry });
+}
+/** Every native error, including a capacity refusal raised by dispatch, presents its retry delay. */
+export function nativeError(error, status, cors) {
+    const admitted = routes.decodeErrorResponse({ error });
+    const retry = retryAfterHeaders(error);
+    return response(admitted, status, { ...cors(Object.keys(retry)), ...retry });
+}
+/** Preserve encoded JSON as text or exact detached bytes for Fetch. */
+export function encodedBody(input) {
+    return typeof input === 'string' ? input : toBody(input);
+}
+/** Expose only the selected byte range as a Fetch response body. */
+export function toBody(input) {
+    return input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength);
+}

package/dist/routes/routes.d.ts

@@ -1,26 +1,9 @@
 import type { CorsPolicy } from '../cors/index.js';
-import type { NextInvocationId } from '../invocation/index.js';
+import type { ApplicationHost, Handler, NextInvocationId } from '../invocation/index.js';
 import type { ActiveOperations } from '../lifecycle/index.js';
-import type { Provider as DeliveryProvider } from '../publication/delivery/index.js';
-import type { PublicationSource } from '../publication/index.js';
-import { type ApplicationHost, type Handler } from '../invocation/index.js';
-import { type PreparedPublicationSnapshot } from '../publication/index.js';
-import { type ServerRouter } from '../transport/router.js';
-export interface RouteLimits {
-    readonly maximumRequestBytes: number;
-    readonly maximumPublicationBytes: number;
-    readonly maximumBundleBytes: number;
-    readonly maximumDeliveryBytes: number;
-    readonly invocationTimeoutMs: number;
-}
-export interface RouteReservation {
-    readonly path: string;
-    readonly methods: readonly string[];
-}
-export declare function mountRoutes(app: ServerRouter, source: PublicationSource, deliveryProvider: DeliveryProvider | undefined, handler: Handler, active: ActiveOperations, nextInvocation: NextInvocationId, limits: RouteLimits, cors: CorsPolicy, hostFor: (request: Request) => ApplicationHost | undefined, reservations: readonly RouteReservation[], externalIssuer?: string): void;
-export declare function currentPublicationSnapshot(source: PublicationSource, limits: Pick<RouteLimits, 'maximumPublicationBytes' | 'maximumBundleBytes'>, serving?: {
-    readonly origin: string;
-    readonly issuer?: string;
-    readonly reservations: readonly RouteReservation[];
-}): PreparedPublicationSnapshot | undefined;
-//# sourceMappingURL=routes.d.ts.map
+import type { Provider as DeliveryProvider } from '../release/delivery/index.js';
+import type { ServerRouter } from '../transport/router.js';
+import type { RouteLimits, RouteReservation } from './model.js';
+import { type ServingSource } from '../release/served.js';
+/** Mount the advertised HTTP resources and native routes from one pinned serving snapshot. */
+export declare function mountRoutes(app: ServerRouter, source: ServingSource, deliveryProvider: DeliveryProvider | undefined, handler: Handler, active: ActiveOperations, nextInvocation: NextInvocationId, limits: RouteLimits, cors: CorsPolicy, hostFor: (request: Request) => ApplicationHost | undefined, reservations: readonly RouteReservation[], externalIssuer?: string, publicOrigin?: string): void;