@astrale-os/sdk 0.6.0-beta.13 → 0.6.0-beta.14

package/dist/deployment/verify/readiness/index.js

@@ -1,10 +1,21 @@
 import { verifyIdentity } from './identity.js';
-import { verifyPublication } from './publication.js';
+import { verifyPublication } from './legacy/index.js';
+import { verifyRelease } from './release.js';
 export { verifyDeployment } from './deployment.js';
 export { verifyIdentity } from './identity.js';
-export { verifyPublication } from './publication.js';
-/** Read-only verification of one exact live Release and serving identity. */
+export { verifyPublication } from './legacy/index.js';
+export { verifyRelease } from './release.js';
+/**
+ * Read-only verification of one exact live Release and its serving identity: an immutable
+ * deployment's `release.json` (release digest and build digest), or a stable target's
+ * `domain.json` (deprecated, `legacy/`).
+ */
 export async function readiness(release, options = {}) {
+    if (release.kind === 'release') {
+        await verifyRelease(release, options);
+        await verifyIdentity(release.url, options);
+        return;
+    }
     await verifyPublication(release, options);
-    await verifyIdentity(release.addressing, options);
+    await verifyIdentity(release.addressing.issuer, options);
 }

package/dist/deployment/verify/readiness/legacy/index.d.ts

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/index.js

@@ -0,0 +1,2 @@
+/** @deprecated Stable-target readiness at `domain.json`; see `publication.ts` (removal D10). */
+export { verifyPublication } from './publication.js';

package/dist/deployment/verify/readiness/legacy/publication.d.ts

@@ -0,0 +1,12 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type * as legacy from '../../../release/legacy/index.js';
+import type { ReadinessOptions } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare and adapter-astrale (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export declare function verifyPublication(release: legacy.Release, options?: ReadinessOptions): Promise<publication.Publication>;

package/dist/deployment/verify/readiness/legacy/publication.js

@@ -0,0 +1,23 @@
+import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from '../fetch.js';
+/**
+ * Fetch and verify the exact live Publication and Bundle a stable target serves at `domain.json`.
+ *
+ * @deprecated Replacement: `verifyRelease`, the readiness of an immutable deployment at
+ * `release.json` (release digest and build digest). Consumer: the direct-mode deploy path of
+ * adapter-cloudflare and adapter-astrale (the consumers of `deployment/release/legacy/index.ts`).
+ * Removal: D10, with that path.
+ */
+export async function verifyPublication(release, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const publicationUrl = publication.url(release.addressing.publicUrl);
+    const response = await fetchRequired(fetcher, publicationUrl, options.signal);
+    const deployed = publication.accept(JSON.parse(await text(response, publicationUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!publication.matchesReference(deployed, publication.reference(release.publication))) {
+        throw new Error('Live Publication differs from the expected Release.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    publication.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/deployment/verify/readiness/release.d.ts

@@ -0,0 +1,8 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import type { Release } from '../../release/index.js';
+import type { ReadinessOptions } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export declare function verifyRelease(expected: Release, options?: ReadinessOptions): Promise<release.DomainRelease>;

package/dist/deployment/verify/readiness/release.js

@@ -0,0 +1,22 @@
+import * as release from '@astrale-os/kernel-protocol/release';
+import { bounded, fetchRequired, MAXIMUM_BUNDLE_BYTES, MAXIMUM_DOCUMENT_BYTES, text, } from './fetch.js';
+/**
+ * Fetch and verify the exact live release of one immutable deployment at its `release.json`: its
+ * release digest and the build digest of its code, then its Bundle.
+ */
+export async function verifyRelease(expected, options = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const releaseUrl = release.url(expected.url);
+    const response = await fetchRequired(fetcher, releaseUrl, options.signal);
+    const deployed = release.accept(JSON.parse(await text(response, releaseUrl, MAXIMUM_DOCUMENT_BYTES)));
+    if (!release.matchesReference(deployed, release.reference(expected.document))) {
+        throw new Error('Live release differs from the expected Release.');
+    }
+    if (deployed.build.digest !== expected.buildDigest) {
+        throw new Error('Live release build digest differs from the expected build.');
+    }
+    const bundleResponse = await fetchRequired(fetcher, deployed.schema.bundle.href, options.signal);
+    const bytes = new Uint8Array(await bounded(bundleResponse, deployed.schema.bundle.href, MAXIMUM_BUNDLE_BYTES));
+    release.decodeBundle(deployed, bytes);
+    return deployed;
+}

package/dist/execution/identity/authentication.d.ts

@@ -5,6 +5,13 @@ import type { InvocationAdmissionInput } from '../invocation/index.js';
 import type { IdentityNetworkPolicy, VerificationBasis, VerificationBasisResolver } from './jwks.js';
 import type { SigningMaterial } from './signing.js';
 import { ClientSession } from '../../platform/client/session/index.js';
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export declare const DEFAULT_ROUTE_AGE_MS = 60000;
 export declare function admit(request: InvocationAdmissionInput, configuration: AuthenticationConfiguration): Promise<unknown>;
 export interface AuthenticationConfiguration {
     readonly issuer: IssuerId;

package/dist/execution/identity/authentication.js

@@ -10,7 +10,13 @@ import { projectError, protocolError } from '../invocation/result/index.js';
 import { callbackIdentities, createCallbackCredentialResolver, maximumCallbackDelegationTtlSeconds, selfIdentity, signDomainCallback, } from './callback.js';
 import { CredentialRejected, IssuerUnavailable, boundedFetch, callbackTtl, httpIssuer, invocationUrl, admitEndpoint, requireLive, } from './errors.js';
 import { verifyCredential, verifyCredentialAgainst } from './jwks.js';
-const DEFAULT_ROUTE_AGE_MS = 60_000;
+/**
+ * How long a callback Session reuses a learned route. It stays at most the Kernel's in-flight
+ * issuer window (`KERNEL_INFLIGHT_ISSUER_MS`, Host default 300 s; CT11): a route learned to a
+ * deployment replaced by a consented install ages out while that deployment is still accepted and
+ * answers the reserved miss, never after its own credential is refused (AM-85).
+ */
+export const DEFAULT_ROUTE_AGE_MS = 60_000;
 export async function admit(request, configuration) {
     const execution = request.context.execution;
     requireLive(execution);

package/dist/execution/identity/delivery.d.ts

@@ -1,6 +1,13 @@
-import type { publication as serverPublication } from '@astrale-os/kernel-server';
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import type { release as serverRelease } from '@astrale-os/kernel-server';
+import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export declare function publicationDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: publication.Publication): serverPublication.delivery.Provider;
+type Served = release.DomainRelease | release.legacy.Publication;
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
+export {};

package/dist/execution/identity/delivery.js

@@ -1,34 +1,61 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
-/** Create one stateless, nonce-bound public Delivery provider for an exact Publication. */
-export function publicationDelivery(signing, issuer, subject, deployed) {
+/**
+ * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
+ * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
+ * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
+ * deprecated v1 request. A stable target's Publication answers v1 only.
+ */
+export function releaseDelivery(signing, issuer, subject, deployed) {
+    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            const now = Math.floor(Date.now() / 1_000);
-            const attestation = await new SignJWT({
-                purpose: publication.delivery.PURPOSE,
+            if (request.version === 1) {
+                const attestation = await attest(signing, issuer, subject, request.kernel, {
+                    purpose: release.legacy.delivery.PURPOSE,
+                    nonce: request.nonce,
+                    etag: projection.etag,
+                    schemaRevision: projection.schema.revision,
+                });
+                context.signal.throwIfAborted();
+                return release.legacy.delivery.accept({
+                    format: 'astrale.domain.delivery',
+                    version: 1,
+                    publication: projection,
+                    attestation,
+                });
+            }
+            if (deployed.version !== 4) {
+                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
+            }
+            const attestation = await attest(signing, issuer, subject, request.kernel, {
+                purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,
-                etag: deployed.etag,
+                release: deployed.digest,
                 schemaRevision: deployed.schema.revision,
-            })
-                .setProtectedHeader({
-                alg: signing.algorithm,
-                ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
-            })
-                .setIssuer(issuer)
-                .setSubject(subject)
-                .setAudience(request.kernel)
-                .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
-                .sign(await signing.privateKey);
+            });
             context.signal.throwIfAborted();
-            return publication.delivery.accept({
+            return release.delivery.accept({
                 format: 'astrale.domain.delivery',
-                version: 1,
-                publication: deployed,
+                version: 2,
+                release: deployed,
                 attestation,
             });
         },
     });
 }
+async function attest(signing, issuer, subject, kernel, claims) {
+    const now = Math.floor(Date.now() / 1_000);
+    return new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signing.algorithm,
+        ...(signing.keyId === undefined ? {} : { kid: signing.keyId }),
+    })
+        .setIssuer(issuer)
+        .setSubject(subject)
+        .setAudience(kernel)
+        .setExpirationTime(now + ATTESTATION_TTL_SECONDS)
+        .sign(await signing.privateKey);
+}

package/dist/execution/identity/identity.d.ts

@@ -1,6 +1,6 @@
 import type { Fetch } from '@astrale-os/kernel-client';
-import type * as publicationProtocol from '@astrale-os/kernel-protocol/release/legacy';
-import type { Issuer, exchange, publication } from '@astrale-os/kernel-server';
+import type * as releaseProtocol from '@astrale-os/kernel-protocol/release';
+import type { Issuer, exchange, release } from '@astrale-os/kernel-server';
 import type { IssuerId, JsonWebKey } from '../../platform/auth/index.js';
 import type { ClientSession } from '../../platform/client/session/index.js';
 import type { InvocationAuthority } from '../invocation/index.js';
@@ -10,7 +10,11 @@ import type { IdentityNetworkPolicy } from './jwks.js';
 export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
-    delivery(publication: publicationProtocol.Publication): publication.delivery.Provider;
+    /**
+     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
+     * over its frozen v3 projection, or v1 over a stable target's Publication.
+     */
+    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
     /**
      * The Domain's own authority toward one Kernel for work no caller credential carries, such as a
      * durable run. Required to serve durable Workflows; the caller closes the Session.

package/dist/execution/identity/identity.js

@@ -1,5 +1,5 @@
 import { admit, authenticate, executorSession } from './authentication.js';
-import { publicationDelivery } from './delivery.js';
+import { releaseDelivery } from './delivery.js';
 import { httpIssuer } from './errors.js';
 import { maximumExchangeTtl, tokenExchange } from './exchange.js';
 import { createVerificationBasisResolver } from './jwks.js';
@@ -49,7 +49,7 @@ export function createIdentity(input) {
             ? {}
             : { loadIssuerPublicKeys: input.loadIssuerPublicKeys }),
         ...(exchangeProvider === undefined ? {} : { tokenExchange: exchangeProvider }),
-        delivery: (publication) => publicationDelivery(material, issuer, input.subject, publication),
+        delivery: (served) => releaseDelivery(material, issuer, input.subject, served),
         admit: (request) => admit(request, configuration),
         executor: (kernel, execution) => executorSession(kernel, execution, configuration),
         authenticate: (request) => authenticate(request.credential, request.via.issuer, request.context.execution, configuration),

package/dist/execution/invocation/admission/authentication.d.ts

@@ -1,6 +1,5 @@
 import type { HandlerRequest } from '@astrale-os/kernel-server';
 import type { AnonymousCaller, ResolvedCallable } from '../../../application/action/index.js';
-import type { Release } from '../../../deployment/release/legacy/index.js';
 import type { Domain } from '../../../platform/schema/index.js';
 import type { AuthenticatedInvocation, InvocationAuthority } from './authority.js';
 export interface AnonymousInvocation {
@@ -10,4 +9,4 @@ export interface AnonymousInvocation {
     close(): void;
 }
 export type InvocationAuthentication = AnonymousInvocation | AuthenticatedInvocation;
-export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, release: Release, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;
+export declare function authentication(callable: ResolvedCallable, request: HandlerRequest, domain: Domain, authority: InvocationAuthority): Promise<InvocationAuthentication>;

package/dist/execution/invocation/admission/authentication.js

@@ -9,7 +9,7 @@ const ANONYMOUS = Object.freeze({
     graph: null,
     close() { },
 });
-export async function authentication(callable, request, release, domain, authority) {
+export async function authentication(callable, request, domain, authority) {
     const credential = request.credential;
     if (callable.auth === 'anonymous' && credential === undefined)
         return ANONYMOUS;
@@ -21,7 +21,6 @@ export async function authentication(callable, request, release, domain, authori
     const authenticated = await authority.authenticate({
         credential,
         via: requireVia(request),
-        publication: release.publication,
         domain,
         context: request.context,
     });

package/dist/execution/invocation/admission/authority.d.ts

@@ -1,5 +1,4 @@
 import type * as invocation from '@astrale-os/kernel-protocol/invocation';
-import type * as publication from '@astrale-os/kernel-protocol/release/legacy';
 import type { HandlerRequest, InvocationContext } from '@astrale-os/kernel-server';
 import type { AuthenticatedCaller } from '../../../application/action/index.js';
 import type { BoundClientSession } from '../../../platform/client/session/index.js';
@@ -8,14 +7,12 @@ export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
     readonly via: invocation.Via | invocation.PublicationVia;
-    readonly publication: publication.Publication;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
@@ -26,10 +23,19 @@ export interface AuthenticatedInvocation {
     close(): void;
 }
 export interface InvocationAuthority {
+    /**
+     * The source Kernel's `Function.admit` of a remote call: resolves to the admitted target, or
+     * rejects with the public refusal. A refusal whose reason is `FUNCTION_MISS` (the Kernel no longer
+     * places the call on this deployment) is answered as the reserved miss, never as an error.
+     */
     admit(input: InvocationAdmissionInput): Promise<unknown>;
     authenticate(input: InvocationAuthenticationInput): Promise<AuthenticatedInvocation>;
 }
 /** Capture the execution Identity capability and receiver-bind both privileged operations. */
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;

package/dist/execution/invocation/admission/authority.js

@@ -12,7 +12,11 @@ export function authority(input) {
         authenticate: receiver.authenticate.bind(receiver),
     });
 }
-/** The routed witness of a remote call: a `ReleaseRef`, or the `PublicationRef` of a v3 pin. */
+/**
+ * The routed witness of a remote call, already admitted by the Kernel Server against the served
+ * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
+ * (a release's exact projection, or a stable target's Publication).
+ */
 export function requireVia(request) {
     if (request.via === undefined) {
         throw protocolError('VALIDATION_ERROR', 'Remote invocation requires Via.');

package/dist/execution/invocation/invocation.js

@@ -1,38 +1,39 @@
-import * as publication from '@astrale-os/kernel-protocol/release/legacy';
+import * as errors from '@astrale-os/kernel-protocol/errors';
+import * as release from '@astrale-os/kernel-protocol/release';
 import { authentication, input, requireVia, target } from './admission/index.js';
 import { action, context, select, workflow } from './dispatch/index.js';
 import { active, settle } from './lifecycle/index.js';
 import { project, protocolError } from './result/index.js';
+/** The reserved answer of a deployment that does not serve the call: its caller re-routes. */
+const MISS = Object.freeze({ kind: 'miss' });
+const FUNCTION_MISS = 'FUNCTION_MISS';
 export async function invoke(request, inputConfig) {
     active(request.context);
-    const release = inputConfig.runtime.loaded.release;
-    const snapshot = request.publication;
-    if (snapshot === undefined ||
-        !publication.matchesReference(snapshot.publication, publication.reference(release.publication))) {
-        throw protocolError('CONFLICT', 'Invocation Publication differs from the running Release.');
+    if (!pinsRunningRelease(request, inputConfig.runtime.loaded.release)) {
+        throw protocolError('CONFLICT', 'Invocation release differs from the running Release.');
     }
     if (request.credential !== undefined && typeof request.credential !== 'string') {
         throw protocolError('AUTH_INVALID', 'Credential is invalid.');
     }
-    const via = requireVia(request);
-    const selectedTarget = target(await inputConfig.authority.admit({
+    const admitted = await admit(inputConfig.authority, {
         call: request.call,
         ...(request.credential === undefined ? {} : { credential: request.credential }),
-        via,
-        publication: release.publication,
+        via: requireVia(request),
         domain: inputConfig.runtime.loaded.domain,
         context: request.context,
-    }));
-    const selected = select(inputConfig.runtime.loaded.registry, selectedTarget);
+    });
+    if (admitted === undefined)
+        return MISS;
+    const selected = select(inputConfig.runtime.loaded.registry, admitted);
     if (selected === undefined)
-        return Object.freeze({ kind: 'miss' });
+        return MISS;
     if (selected.implementation.kind === 'workflow' && selected.implementation.durable) {
         // The Kernel records a durable call as an Execution and runs it on the engine; running it
         // inline here would silently drop durability.
         throw protocolError('UNSUPPORTED', 'A durable Workflow runs only as a Kernel Execution.');
     }
     input(selected.implementation.callable, request.call.input, request.context.binary);
-    const admittedAuthentication = await authentication(selected.implementation.callable, request, release, inputConfig.runtime.loaded.domain, inputConfig.authority);
+    const admittedAuthentication = await authentication(selected.implementation.callable, request, inputConfig.runtime.loaded.domain, inputConfig.authority);
     const close = once(admittedAuthentication.close);
     try {
         active(request.context);
@@ -47,6 +48,42 @@ export async function invoke(request, inputConfig) {
         throw cause;
     }
 }
+/**
+ * The source Kernel's `Function.admit` refuses `FUNCTION_MISS` when it no longer places the call on
+ * this deployment, as for a client whose learned route still names a deployment replaced by a
+ * consented install. That refusal is answered as the reserved miss, never as a public error, so
+ * the client re-routes through its source Kernel (AM-85). Every other refusal is unchanged.
+ */
+async function admit(authority, admission) {
+    let admitted;
+    try {
+        admitted = await authority.admit(admission);
+    }
+    catch (cause) {
+        if (refusedAsMiss(cause))
+            return undefined;
+        throw cause;
+    }
+    return target(admitted);
+}
+function refusedAsMiss(cause) {
+    return (cause instanceof errors.ProtocolError &&
+        errors.reasonOf(cause.payload.data)?.code === FUNCTION_MISS);
+}
+/**
+ * The Kernel Server pins every request to the one snapshot it serves: the release of an immutable
+ * deployment, or a stable target's Publication. Execution answers only for that exact document.
+ */
+function pinsRunningRelease(request, running) {
+    if (running.kind === 'release') {
+        return (request.publication === undefined &&
+            request.release !== undefined &&
+            release.matchesReference(request.release.release, release.reference(running.document)));
+    }
+    return (request.release === undefined &&
+        request.publication !== undefined &&
+        release.legacy.matchesReference(request.publication.publication, release.legacy.reference(running.publication)));
+}
 function once(operation) {
     let called = false;
     return () => {

package/dist/execution/runtime/index.d.ts

@@ -3,3 +3,4 @@ export { initialize, type InitializedRuntime } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load, type LoadedRuntime } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving, type ServedRelease, type Serving } from './release.js';

package/dist/execution/runtime/index.js

@@ -3,3 +3,4 @@ export { initialize } from './initialize.js';
 export { integrations } from './integrations.js';
 export { load } from './load.js';
 export { providers } from './providers.js';
+export { isServedRelease, serving } from './release.js';

package/dist/execution/runtime/load.d.ts

@@ -2,13 +2,13 @@ import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
 import type { DomainSchema, DomainOf } from '@astrale-os/kernel-dsl/v1/schema';
 import type { RuntimeRegistry } from '../../application/runtime/index.js';
 import type { Build } from '../../deployment/build/build.js';
-import type { Release } from '../../deployment/release/legacy/release.js';
+import type { ServedRelease } from './release.js';
 type DomainOfBuild<BuildValue extends Build> = BuildValue extends Build<infer Schema extends DomainSchema, object> ? Extract<DomainOf<Schema>, Domain> : Domain;
 export interface LoadedRuntime<BuildValue extends Build = Build> {
-    readonly release: Release<BuildValue>;
+    readonly release: ServedRelease<BuildValue>;
     readonly domain: DomainOfBuild<BuildValue>;
     readonly registry: RuntimeRegistry;
 }
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
-export declare function load<const BuildValue extends Build>(release: Release<BuildValue>): LoadedRuntime<BuildValue>;
+export declare function load<const BuildValue extends Build>(release: ServedRelease<BuildValue>): LoadedRuntime<BuildValue>;
 export {};

package/dist/execution/runtime/load.js

@@ -1,10 +1,11 @@
 import { evidenceOf } from '../../deployment/build/admission.js';
-import { isRelease } from '../../deployment/release/legacy/admission.js';
 import { capture } from './admission.js';
+import { isServedRelease } from './release.js';
 /** Load one execution Runtime from the exact evidence retained by its admitted Build. */
 export function load(release) {
-    if (!isRelease(release))
+    if (!isServedRelease(release)) {
         throw new TypeError('Runtime loading requires an admitted Release.');
+    }
     const evidence = evidenceOf(release.build);
     const domain = evidence.domain;
     const { registry } = evidence;

package/dist/execution/runtime/release.d.ts

@@ -0,0 +1,22 @@
+import type * as release from '@astrale-os/kernel-protocol/release';
+import type { Build } from '../../deployment/build/build.js';
+import type * as legacy from '../../deployment/release/legacy/index.js';
+import type { Release } from '../../deployment/release/release.js';
+import type { IssuerId } from '../../platform/auth/index.js';
+/**
+ * What one Service serves: the `DomainRelease` v4 Release of an immutable deployment, or the
+ * deprecated v3 Release of a stable target (`legacy`, its consumers and removal in
+ * `deployment/release/legacy/index.ts`, D10).
+ */
+export type ServedRelease<BuildValue extends Build = Build> = Release<BuildValue> | legacy.Release<BuildValue>;
+/** Where and as whom one served Release answers, and the document it serves. */
+export interface Serving {
+    /** Domain identity issuer: a deployment's URL, or a stable target's configured issuer. */
+    readonly issuer: IssuerId;
+    /** Public origin the Server answers at: a deployment's URL, or a stable target's route. */
+    readonly publicUrl: IssuerId;
+    /** The document served at `release.json`, or a stable target's v3 Publication at `domain.json`. */
+    readonly document: release.DomainRelease | release.legacy.Publication;
+}
+export declare function isServedRelease(input: unknown): input is ServedRelease;
+export declare function serving(served: ServedRelease): Serving;

package/dist/execution/runtime/release.js

@@ -0,0 +1,14 @@
+import { isRelease } from '../../deployment/release/admission.js';
+import { isRelease as isLegacyRelease } from '../../deployment/release/legacy/admission.js';
+export function isServedRelease(input) {
+    return isRelease(input) || isLegacyRelease(input);
+}
+export function serving(served) {
+    return served.kind === 'release'
+        ? Object.freeze({ issuer: served.url, publicUrl: served.url, document: served.document })
+        : Object.freeze({
+            issuer: served.addressing.issuer,
+            publicUrl: served.addressing.publicUrl,
+            document: served.publication,
+        });
+}

package/dist/execution/serve.d.ts

@@ -1,5 +1,5 @@
 import type { ServerCloseOptions } from '@astrale-os/kernel-server';
-import type { publication } from '@astrale-os/kernel-server';
+import type { release } from '@astrale-os/kernel-server';
 import type { Runtime } from '../application/runtime/index.js';
 import type { WorkflowRunner } from '../application/workflow/runner/index.js';
 import type { Identity } from './identity/index.js';
@@ -16,7 +16,7 @@ export interface ServeInput<Environment, RuntimeValue extends Runtime, RuntimeEn
     identity(environment: Environment): Identity;
     readonly initialize?: (environment: Environment) => RuntimeEnvironment;
     readonly server: ServiceServerOptions;
-    readonly delivery?: (environment: Environment) => publication.delivery.Provider | undefined;
+    readonly delivery?: (environment: Environment) => release.delivery.Provider | undefined;
     readonly workflows?: WorkflowRunner;
     /**
      * Serve durable Workflows to the workflow engine; required when the Release declares any.

package/dist/execution/service/create.js

@@ -3,12 +3,12 @@ import { isRuntime } from '../../application/runtime/index.js';
 import { invocationPath } from '../../deployment/release/invocation.js';
 import { identity as captureIdentity } from '../identity/index.js';
 import { createHandler } from '../invocation/index.js';
-import { initialize, load } from '../runtime/index.js';
+import { initialize, load, serving as servedRelease } from '../runtime/index.js';
 import { createDurableReceiver, durableServing, isDurableRequest, } from '../workflows/index.js';
 import { initialization } from './initialization.js';
 import { lifecycle } from './lifecycle.js';
-import { delivery, installation, source } from './publication/index.js';
 import { loadRelease } from './release.js';
+import { delivery, installation, source } from './serving/index.js';
 /** Create one lazy running Service around the exact current Release. */
 export function createService(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input))
@@ -24,20 +24,21 @@ export function createService(input) {
     const state = lifecycle(() => running?.server.drain());
     const realized = initialization(async () => {
         const release = await loadRelease(input.load, input.environment, input.runtime);
-        if (release.addressing.issuer !== selectedIdentity.issuer) {
+        const served = servedRelease(release);
+        if (served.issuer !== selectedIdentity.issuer) {
             throw new TypeError('Service Identity differs from Release Addressing.');
         }
         if (selectedIdentity.subject !== release.build.schema.compiled.root.origin) {
             throw new TypeError('Service Identity subject differs from the Release Domain origin.');
         }
-        const selectedDelivery = providedDelivery ?? selectedIdentity.delivery(release.publication);
-        installation(release, selectedDelivery);
+        const selectedDelivery = providedDelivery ?? selectedIdentity.delivery(served.document);
+        installation(served.document, selectedDelivery);
         const loaded = load(release);
         const runtime = await initialize(loaded, input.environment);
         const prepared = prepareServer({
             ...serverOptions(input.server),
             path: invocationPath(),
-            publicOrigin: release.addressing.publicUrl,
+            publicOrigin: served.publicUrl,
             invocation: {
                 source: selectedIdentity.issuer,
                 next: () => crypto.randomUUID(),
@@ -46,7 +47,7 @@ export function createService(input) {
             ...(selectedIdentity.tokenExchange === undefined
                 ? {}
                 : { tokenExchange: selectedIdentity.tokenExchange }),
-            publication: source(loaded),
+            ...source(loaded),
             ...(selectedDelivery === undefined ? {} : { delivery: selectedDelivery }),
         });
         const server = prepared.create(createHandler({
@@ -119,6 +120,7 @@ function serverOptions(input) {
         'issuer',
         'publicOrigin',
         'tokenExchange',
+        'release',
         'publication',
         'delivery',
         'handler',