@astrale-os/sdk 0.6.0-beta.22 → 0.6.0-beta.24

package/dist/deployment/worker/response.js

@@ -0,0 +1,207 @@
+import { parseDeploymentLabel } from '../address/label.js';
+import { serviceName } from './address.js';
+import { decodeWorkerRecord } from './record.js';
+export const WORKER_DEPLOYMENT_REJECTIONS = Object.freeze([
+    'invalid-deployment',
+    'address-mismatch',
+    'build-mismatch',
+    'service-owned-elsewhere',
+    'deployment-conflict',
+    'deployment-retired',
+    'hosting-unavailable',
+    'service-unavailable',
+]);
+const STATES = Object.freeze([
+    'deploying',
+    'active',
+    'retiring',
+    'retired',
+    'failed',
+]);
+/** Which secret states each deployment state reports. */
+const SECRETS_BY_STATE = Object.freeze({
+    created: Object.freeze(['bound']),
+    reused: Object.freeze(['updated', 'unchanged']),
+});
+/** Admit the answer of a host's `hosting`: exactly its routing domain. */
+export function decodeWorkerHosting(input) {
+    const value = exact(input, ['routingDomain'], [], 'hosting');
+    if (typeof value.routingDomain !== 'string' || !isDnsName(value.routingDomain)) {
+        invalid('hosting', 'routingDomain');
+    }
+    return Object.freeze({ routingDomain: value.routingDomain });
+}
+/**
+ * Admit the answer of a deploy exactly: a deployment whose state reports the secret state it
+ * pairs with, or a refusal a host can give.
+ */
+export function decodeWorkerDeploymentResponse(input) {
+    const value = exact(input, ['kind'], ['state', 'secrets', 'deployment', 'reason', 'message', 'retryAfter'], 'deploy');
+    if (value.kind === 'rejected') {
+        exact(value, ['kind', 'reason', 'message'], ['retryAfter'], 'refusal');
+        if (!WORKER_DEPLOYMENT_REJECTIONS.includes(value.reason)) {
+            invalid('refusal', 'reason');
+        }
+        if (typeof value.message !== 'string' ||
+            value.message.length < 1 ||
+            value.message.length > 500) {
+            invalid('refusal', 'message');
+        }
+        if (value.retryAfter !== undefined && !isInstant(value.retryAfter)) {
+            invalid('refusal', 'retryAfter');
+        }
+        return Object.freeze({
+            kind: 'rejected',
+            reason: value.reason,
+            message: value.message,
+            ...(value.retryAfter === undefined ? {} : { retryAfter: value.retryAfter }),
+        });
+    }
+    exact(value, ['kind', 'state', 'secrets', 'deployment'], [], 'deploy');
+    if (value.kind !== 'deployed')
+        invalid('deploy', 'kind');
+    if (value.state !== 'created' && value.state !== 'reused')
+        invalid('deploy', 'state');
+    const secrets = exact(value.secrets, ['state'], [], 'secrets');
+    const allowed = SECRETS_BY_STATE[value.state];
+    if (typeof secrets.state !== 'string' || !allowed.includes(secrets.state)) {
+        invalid('deploy', 'secrets.state');
+    }
+    return Object.freeze({
+        kind: 'deployed',
+        state: value.state,
+        secrets: Object.freeze({ state: secrets.state }),
+        deployment: decodeWorkerDeploymentSummary(value.deployment),
+    });
+}
+/** Admit the answer of a host's `list`: the summaries of the caller's deployments, in its order. */
+export function decodeWorkerDeploymentList(input) {
+    const value = exact(input, ['deployments'], [], 'list');
+    if (!Array.isArray(value.deployments))
+        invalid('list', 'deployments');
+    return Object.freeze(value.deployments.map((deployment) => decodeWorkerDeploymentSummary(deployment)));
+}
+/**
+ * Admit one summary exactly: node ids and names a person can read, a label whose first part is
+ * the Service's name, the URL of that label, a known state, instants, digests, and a record that
+ * decodes.
+ */
+export function decodeWorkerDeploymentSummary(input) {
+    const value = exact(input, [
+        'id',
+        'url',
+        'label',
+        'serviceId',
+        'service',
+        'project',
+        'environment',
+        'owner',
+        'state',
+        'current',
+        'createdAt',
+        'buildDigest',
+        'configuration',
+    ], ['retiredAt', 'signingKeyId', 'record'], 'deployment');
+    for (const key of [
+        'id',
+        'url',
+        'label',
+        'serviceId',
+        'service',
+        'project',
+        'environment',
+        'owner',
+    ]) {
+        if (typeof value[key] !== 'string' || !isPrintable(value[key]))
+            invalid('deployment', key);
+    }
+    if (value.signingKeyId !== undefined) {
+        if (typeof value.signingKeyId !== 'string' || !isPrintable(value.signingKeyId)) {
+            invalid('deployment', 'signingKeyId');
+        }
+    }
+    let line;
+    try {
+        line = parseDeploymentLabel(value.label).line;
+    }
+    catch {
+        invalid('deployment', 'label');
+    }
+    if (value.service !== line)
+        invalid('deployment', 'service');
+    let named;
+    try {
+        named = serviceName(value.project, value.environment);
+    }
+    catch {
+        invalid('deployment', 'project');
+    }
+    if (named !== line)
+        invalid('deployment', 'service');
+    if (!isDeploymentUrl(value.url, value.label))
+        invalid('deployment', 'url');
+    if (!STATES.includes(value.state))
+        invalid('deployment', 'state');
+    if (typeof value.current !== 'boolean')
+        invalid('deployment', 'current');
+    if (!isInstant(value.createdAt))
+        invalid('deployment', 'createdAt');
+    if (value.retiredAt !== undefined && !isInstant(value.retiredAt))
+        invalid('deployment', 'retiredAt');
+    for (const key of ['buildDigest', 'configuration']) {
+        if (typeof value[key] !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(value[key])) {
+            invalid('deployment', key);
+        }
+    }
+    let record;
+    if (value.record !== undefined) {
+        try {
+            record = decodeWorkerRecord(value.record);
+        }
+        catch {
+            invalid('deployment', 'record');
+        }
+    }
+    const summary = { ...value };
+    delete summary.record;
+    return Object.freeze({
+        ...summary,
+        ...(record === undefined ? {} : { record }),
+    });
+}
+/** `https://<label>.<routing domain>`, nothing more. */
+function isDeploymentUrl(url, label) {
+    const prefix = `https://${label}.`;
+    return url.startsWith(prefix) && isDnsName(url.slice(prefix.length));
+}
+/** Text a person can read in a listing: at most 512 characters, none of them a control character. */
+function isPrintable(value) {
+    return value.length > 0 && value.length <= 512 && !/[\p{Cc}]/u.test(value);
+}
+function isInstant(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= 64 &&
+        !Number.isNaN(Date.parse(value)));
+}
+function isDnsName(value) {
+    return (value.length <= 253 &&
+        value.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(label)));
+}
+function exact(input, required, optional, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid(label);
+    const value = input;
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== 'string' || (!required.includes(key) && !optional.includes(key))) {
+            invalid(label, String(key));
+        }
+    }
+    for (const key of required)
+        if (!Object.hasOwn(value, key))
+            invalid(label, key);
+    return value;
+}
+function invalid(label, member) {
+    throw new TypeError(`The Worker host returned an invalid ${label} answer${member === undefined ? '' : ` (${member})`}.`);
+}

package/dist/execution/identity/delivery.d.ts

@@ -2,12 +2,7 @@ import type { release as serverRelease } from '@astrale-os/kernel-server';
 import * as release from '@astrale-os/kernel-protocol/release';
 import type { IssuerId } from '../../platform/auth/index.js';
 import type { SigningMaterial } from './signing.js';
-type Served = release.DomainRelease | release.legacy.Publication;
 /**
- * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
- * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
- * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
- * deprecated v1 request. A stable target's Publication answers v1 only.
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
  */
-export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: Served): serverRelease.delivery.Provider;
-export {};
+export declare function releaseDelivery(signing: SigningMaterial, issuer: IssuerId, subject: string, deployed: release.DomainRelease): serverRelease.delivery.Provider;

package/dist/execution/identity/delivery.js

@@ -2,34 +2,12 @@ import * as release from '@astrale-os/kernel-protocol/release';
 import { SignJWT } from 'jose';
 const ATTESTATION_TTL_SECONDS = 60;
 /**
- * Create one stateless, nonce-bound public Delivery provider for the exact document a deployment
- * serves. It answers in the request's version: a Delivery v2 carrying the release for a v2
- * request, and a Delivery v1 carrying the Publication (a release's frozen v3 projection) for the
- * deprecated v1 request. A stable target's Publication answers v1 only.
+ * Create one stateless, nonce-bound public Delivery v2 provider for the exact deployment release.
  */
 export function releaseDelivery(signing, issuer, subject, deployed) {
-    const projection = deployed.version === 4 ? release.legacy.publication(deployed) : deployed;
     return Object.freeze({
         async create(request, context) {
             context.signal.throwIfAborted();
-            if (request.version === 1) {
-                const attestation = await attest(signing, issuer, subject, request.kernel, {
-                    purpose: release.legacy.delivery.PURPOSE,
-                    nonce: request.nonce,
-                    etag: projection.etag,
-                    schemaRevision: projection.schema.revision,
-                });
-                context.signal.throwIfAborted();
-                return release.legacy.delivery.accept({
-                    format: 'astrale.domain.delivery',
-                    version: 1,
-                    publication: projection,
-                    attestation,
-                });
-            }
-            if (deployed.version !== 4) {
-                throw new TypeError('A Publication-backed deployment answers Delivery v1 only.');
-            }
             const attestation = await attest(signing, issuer, subject, request.kernel, {
                 purpose: release.delivery.PURPOSE,
                 nonce: request.nonce,

package/dist/execution/identity/identity.d.ts

@@ -12,10 +12,9 @@ export interface Identity extends Issuer, InvocationAuthority {
     readonly subject: string;
     readonly tokenExchange?: exchange.Provider;
     /**
-     * Delivery for the exact document this deployment serves: Delivery v2 over its release and v1
-     * over its frozen v3 projection, or v1 over a stable target's Publication.
+     * Delivery v2 for the exact release this deployment serves.
      */
-    delivery(served: releaseProtocol.DomainRelease | releaseProtocol.legacy.Publication): release.delivery.Provider;
+    delivery(served: releaseProtocol.DomainRelease): release.delivery.Provider;
     /**
      * The Domain's own authority toward one Kernel for a step of the durable Execution `executionId`
      * (`ctx.execution.id`), which no caller credential carries; its credentials name `executionId` in

package/dist/execution/index.d.ts

@@ -1,7 +1,5 @@
 export { serve } from './serve.js';
 export type { ExecutionContext, ServedDomain, ServeInput } from './serve.js';
 export { createIdentity, maximumExchangeTtl, type ExchangeOptions, type Identity, type IdentityInput, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
-export type { InvocationErrorCode } from './invocation/index.js';
 export type { DurableEngine, DurableServing, DurableServingProvider } from './workflows/index.js';
-export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/index.js

@@ -1,4 +1,3 @@
 export { serve } from './serve.js';
 export { createIdentity, maximumExchangeTtl, } from './identity/index.js';
-export { InvocationError } from './invocation/index.js';
-export { isCanonicalDurableRequest, isLegacyDurableRequest } from './workflows/route.js';
+export { isCanonicalDurableRequest } from './workflows/route.js';

package/dist/execution/invocation/admission/authority.d.ts

@@ -6,13 +6,13 @@ import type { Domain } from '../../../platform/schema/index.js';
 export interface InvocationAdmissionInput {
     readonly call: invocation.Call;
     readonly credential?: string;
-    readonly via: invocation.Via | invocation.PublicationVia;
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
 export interface InvocationAuthenticationInput {
     readonly credential: string;
-    readonly via: invocation.Via | invocation.PublicationVia;
+    readonly via: invocation.Via;
     readonly domain: Domain;
     readonly context: InvocationContext;
 }
@@ -35,7 +35,6 @@ export interface InvocationAuthority {
 export declare function authority(input: InvocationAuthority): InvocationAuthority;
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served
- * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
- * (a release's exact projection, or a stable target's Publication).
+ * snapshot: the exact ReleaseRef of this immutable deployment.
  */
-export declare function requireVia(request: HandlerRequest): invocation.Via | invocation.PublicationVia;
+export declare function requireVia(request: HandlerRequest): invocation.Via;

package/dist/execution/invocation/admission/authority.js

@@ -14,8 +14,7 @@ export function authority(input) {
 }
 /**
  * The routed witness of a remote call, already admitted by the Kernel Server against the served
- * snapshot: the exact `ReleaseRef` of an immutable deployment, or the `PublicationRef` of a v3 pin
- * (a release's exact projection, or a stable target's Publication).
+ * snapshot: the exact ReleaseRef of this immutable deployment.
  */
 export function requireVia(request) {
     if (request.via === undefined) {

package/dist/execution/invocation/index.d.ts

@@ -1,5 +1,5 @@
 export { createHandler, type HandlerInput } from './handler.js';
 export { invoke, type InvocationInput } from './invocation.js';
 export type * from './admission/index.js';
-export { InvocationDefect, InvocationError } from './result/index.js';
-export type { InvocationDefectCode, InvocationErrorCode } from './result/index.js';
+export { InvocationDefect } from './result/index.js';
+export type { InvocationDefectCode } from './result/index.js';

package/dist/execution/invocation/index.js

@@ -1,3 +1,3 @@
 export { createHandler } from './handler.js';
 export { invoke } from './invocation.js';
-export { InvocationDefect, InvocationError } from './result/index.js';
+export { InvocationDefect } from './result/index.js';

package/dist/execution/invocation/invocation.js

@@ -70,19 +70,10 @@ function refusedAsMiss(cause) {
     return (cause instanceof errors.ProtocolError &&
         errors.reasonOf(cause.payload.data)?.code === FUNCTION_MISS);
 }
-/**
- * The Kernel Server pins every request to the one snapshot it serves: the release of an immutable
- * deployment, or a stable target's Publication. Execution answers only for that exact document.
- */
+/** Execution answers only for the exact release pinned by the Kernel Server snapshot. */
 function pinsRunningRelease(request, running) {
-    if (running.kind === 'release') {
-        return (request.publication === undefined &&
-            request.release !== undefined &&
-            release.matchesReference(request.release.release, release.reference(running.document)));
-    }
-    return (request.release === undefined &&
-        request.publication !== undefined &&
-        release.legacy.matchesReference(request.publication.publication, release.legacy.reference(running.publication)));
+    return (request.release !== undefined &&
+        release.matchesReference(request.release.release, release.reference(running.document)));
 }
 function once(operation) {
     let called = false;

package/dist/execution/invocation/result/errors.d.ts

@@ -2,16 +2,6 @@ import * as errors from '@astrale-os/kernel-protocol/errors';
 import type { ResolvedCallable } from '../../../application/action/index.js';
 import type { Key } from '../../../platform/schema/index.js';
 import type { Value } from '../../../platform/value/index.js';
-export type InvocationErrorCode = Extract<keyof typeof errors.CODES, 'VALIDATION_ERROR' | 'ACCESS_DENIED' | 'NOT_FOUND' | 'CONFLICT' | 'UNSUPPORTED' | 'LIMIT_EXCEEDED' | 'BACKEND_UNAVAILABLE'>;
-/** @deprecated Declare expected failures on defineAction or defineWorkflow instead. */
-export declare class InvocationError extends Error {
-    readonly code: InvocationErrorCode;
-    readonly name = "InvocationError";
-    readonly reason?: errors.ErrorReason;
-    constructor(code: InvocationErrorCode, message: string, options?: ErrorOptions & {
-        readonly reason?: errors.ErrorReason;
-    });
-}
 export type InvocationDefectCode = 'INVOCATION_TARGET_INVALID' | 'INVOCATION_HANDLER_INVALID' | 'INVOCATION_OUTPUT_INVALID' | 'INVOCATION_RESULT_CONTRACT_VIOLATION';
 export declare class InvocationDefect extends Error {
     readonly code: InvocationDefectCode;

package/dist/execution/invocation/result/errors.js

@@ -5,20 +5,6 @@ const PUBLIC_ERROR_CODES = new Set(Object.values(errors.CODES));
 const PUBLIC_ERROR_NAMES = new Map(Object.entries(errors.CODES).map(([name, code]) => [code, name]));
 const MAXIMUM_DIAGNOSTICS = 32;
 const admittedProtocolErrors = new WeakSet();
-/** @deprecated Declare expected failures on defineAction or defineWorkflow instead. */
-export class InvocationError extends Error {
-    code;
-    name = 'InvocationError';
-    reason;
-    constructor(code, message, options = {}) {
-        super(message, options);
-        this.code = code;
-        this.reason =
-            options.reason === undefined
-                ? undefined
-                : errors.acceptReason(options.reason, 'InvocationError reason');
-    }
-}
 export class InvocationDefect extends Error {
     code;
     name = 'InvocationDefect';
@@ -62,9 +48,6 @@ export function projectError(input) {
             ? input
             : protocolError('INTERNAL_ERROR', 'Internal application error.');
     }
-    if (input instanceof InvocationError) {
-        return protocolError('INTERNAL_ERROR', 'Internal application error.');
-    }
     if (input instanceof ResponseError) {
         if (!PUBLIC_ERROR_CODES.has(input.code)) {
             return protocolError('BACKEND_UNAVAILABLE', 'Dependency Kernel returned invalid error evidence.');

package/dist/execution/invocation/result/index.d.ts

@@ -1,4 +1,4 @@
-export { inputError, InvocationDefect, InvocationError, projectError, protocolError, } from './errors.js';
-export type { InvocationDefectCode, InvocationErrorCode } from './errors.js';
+export { inputError, InvocationDefect, projectError, protocolError } from './errors.js';
+export type { InvocationDefectCode } from './errors.js';
 export { project } from './project.js';
 export { validateInput, validateOutput } from './validate.js';

package/dist/execution/invocation/result/index.js

@@ -1,3 +1,3 @@
-export { inputError, InvocationDefect, InvocationError, projectError, protocolError, } from './errors.js';
+export { inputError, InvocationDefect, projectError, protocolError } from './errors.js';
 export { project } from './project.js';
 export { validateInput, validateOutput } from './validate.js';

package/dist/execution/runtime/release.d.ts

@@ -1,22 +1,17 @@
 import type * as release from '@astrale-os/kernel-protocol/release';
 import type { Build } from '../../deployment/build/build.js';
-import type * as legacy from '../../deployment/release/legacy/index.js';
 import type { Release } from '../../deployment/release/release.js';
 import type { IssuerId } from '../../platform/auth/index.js';
-/**
- * What one Service serves: the `DomainRelease` v4 Release of an immutable deployment, or the
- * deprecated v3 Release of a stable target (`legacy`, its consumers and removal in
- * `deployment/release/legacy/index.ts`, D10).
- */
-export type ServedRelease<BuildValue extends Build = Build> = Release<BuildValue> | legacy.Release<BuildValue>;
+/** The DomainRelease v4 served by one immutable deployment. */
+export type ServedRelease<BuildValue extends Build = Build> = Release<BuildValue>;
 /** Where and as whom one served Release answers, and the document it serves. */
 export interface Serving {
-    /** Domain identity issuer: a deployment's URL, or a stable target's configured issuer. */
+    /** Domain identity issuer: this deployment's URL. */
     readonly issuer: IssuerId;
-    /** Public origin the Server answers at: a deployment's URL, or a stable target's route. */
+    /** Public origin the Server answers at: this deployment's URL. */
     readonly publicUrl: IssuerId;
-    /** The document served at `release.json`, or a stable target's v3 Publication at `domain.json`. */
-    readonly document: release.DomainRelease | release.legacy.Publication;
+    /** The document served at release.json. */
+    readonly document: release.DomainRelease;
 }
 export declare function isServedRelease(input: unknown): input is ServedRelease;
 export declare function serving(served: ServedRelease): Serving;

package/dist/execution/runtime/release.js

@@ -1,14 +1,7 @@
 import { isRelease } from '../../deployment/release/admission.js';
-import { isRelease as isLegacyRelease } from '../../deployment/release/legacy/admission.js';
 export function isServedRelease(input) {
-    return isRelease(input) || isLegacyRelease(input);
+    return isRelease(input);
 }
 export function serving(served) {
-    return served.kind === 'release'
-        ? Object.freeze({ issuer: served.url, publicUrl: served.url, document: served.document })
-        : Object.freeze({
-            issuer: served.addressing.issuer,
-            publicUrl: served.addressing.publicUrl,
-            document: served.publication,
-        });
+    return Object.freeze({ issuer: served.url, publicUrl: served.url, document: served.document });
 }

package/dist/execution/service/create.js

@@ -4,7 +4,7 @@ import { invocationPath } from '../../deployment/release/invocation.js';
 import { identity as captureIdentity } from '../identity/index.js';
 import { createHandler } from '../invocation/index.js';
 import { initialize, load, serving as servedRelease } from '../runtime/index.js';
-import { createDurableReceiver, durableServing, isDurableRequest, } from '../workflows/index.js';
+import { createDurableReceiver, durableServing, isCanonicalDurableRequest, isDurableRequest, } from '../workflows/index.js';
 import { initialization } from './initialization.js';
 import { lifecycle } from './lifecycle.js';
 import { loadRelease } from './release.js';
@@ -83,6 +83,8 @@ export function createService(input) {
                 return unavailable();
             // Without engine configuration only durable calls fail: the engine's discovery is refused.
             if (isDurableRequest(request)) {
+                if (!isCanonicalDurableRequest(request))
+                    return notServed();
                 const selected = await receiver.get(request);
                 if (!state.accepting)
                     return unavailable();

package/dist/execution/service/service.d.ts

@@ -6,7 +6,7 @@ import type { Identity } from '../identity/index.js';
 import type { ServedRelease } from '../runtime/index.js';
 import type { DurableServing, DurableServingProvider } from '../workflows/index.js';
 import type { ReleaseLoader } from './release.js';
-export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'release' | 'publication' | 'delivery'>;
+export type ServiceServerOptions = Omit<ServerOptions, 'path' | 'invocation' | 'issuer' | 'publicOrigin' | 'tokenExchange' | 'release' | 'delivery'>;
 export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtime> {
     readonly runtime: RuntimeValue;
     readonly environment: Environment;
@@ -14,8 +14,7 @@ export interface ServiceInput<Environment, RuntimeValue extends Runtime = Runtim
     readonly identity: Identity;
     readonly server: ServiceServerOptions;
     /**
-     * Answers Delivery in the request's version: v2 over an immutable deployment's release, v1 over
-     * the Publication (a release's frozen v3 projection). Defaults to the Identity's own.
+     * Answers Delivery v2 over an immutable deployment's Release. Defaults to the Identity's own.
      */
     readonly delivery?: release.delivery.Provider;
     readonly workflows?: WorkflowRunner;

package/dist/execution/service/serving/delivery.d.ts

@@ -1,6 +1,5 @@
 import type { release } from '@astrale-os/kernel-server';
 /**
- * Capture an explicit Delivery Provider. It answers in the request's version: v2 over an immutable
- * deployment's release, v1 over the Publication (a release's frozen v3 projection).
+ * Capture an explicit Delivery v2 Provider over an immutable deployment's Release.
  */
 export declare function delivery(input: release.delivery.Provider | undefined): release.delivery.Provider | undefined;

package/dist/execution/service/serving/delivery.js

@@ -1,6 +1,5 @@
 /**
- * Capture an explicit Delivery Provider. It answers in the request's version: v2 over an immutable
- * deployment's release, v1 over the Publication (a release's frozen v3 projection).
+ * Capture an explicit Delivery v2 Provider over an immutable deployment's Release.
  */
 export function delivery(input) {
     if (input === undefined)

package/dist/execution/service/serving/source.d.ts

@@ -1,18 +1,11 @@
-import type { PublicationSource, ReleaseSource } from '@astrale-os/kernel-server';
+import type { ReleaseSource } from '@astrale-os/kernel-server';
 import type { LoadedRuntime } from '../../runtime/index.js';
 /** The one source a Kernel Server serves, as `ServerOptions` takes it. */
-export type ServingSource = 
-/** The release of an immutable deployment: `release.json` and its v3 projection. */
-{
+export type ServingSource = {
     readonly release: ReleaseSource;
-}
-/** @deprecated A stable target's v3 Publication; see `legacy/index.ts`. */
- | {
-    readonly publication: PublicationSource;
 };
 /**
  * Prepare, once, the exact snapshot the loaded Release serves: an immutable deployment serves its
- * `DomainRelease` through `prepareReleaseSnapshot`, which admits only routing naming that exact
- * release or its exact v3 projection; a stable target keeps serving its v3 Publication.
+ * DomainRelease through prepareReleaseSnapshot, which admits routing naming that exact release.
  */
 export declare function source(runtime: LoadedRuntime): ServingSource;

package/dist/execution/service/serving/source.js

@@ -1,14 +1,10 @@
 import { prepareReleaseSnapshot } from '@astrale-os/kernel-server';
-import { publicationSource } from './legacy/index.js';
 /**
  * Prepare, once, the exact snapshot the loaded Release serves: an immutable deployment serves its
- * `DomainRelease` through `prepareReleaseSnapshot`, which admits only routing naming that exact
- * release or its exact v3 projection; a stable target keeps serving its v3 Publication.
+ * DomainRelease through prepareReleaseSnapshot, which admits routing naming that exact release.
  */
 export function source(runtime) {
     const served = runtime.release;
-    if (served.kind !== 'release')
-        return publicationSource(runtime, served);
     const snapshot = prepareReleaseSnapshot({
         release: served.document,
         bundle: served.build.schema.bundle.bytes(),

package/dist/execution/workflows/index.d.ts

@@ -1,4 +1,4 @@
 export type { DurableEngine, EngineRetryPolicy, EngineSharedContext, EngineWorkflowContext, EngineWorkflowDefinition, } from './engine.js';
 export { durableServing, type AdmittedDurableServing, type DurableServing, type DurableServingProvider, } from './options.js';
 export { createDurableReceiver, type DurableReceiver } from './receiver.js';
-export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';
+export { isDurableRequest, isCanonicalDurableRequest } from './route.js';

package/dist/execution/workflows/index.js

@@ -1,3 +1,3 @@
 export { durableServing, } from './options.js';
 export { createDurableReceiver } from './receiver.js';
-export { isDurableRequest, isCanonicalDurableRequest, isLegacyDurableRequest } from './route.js';
+export { isDurableRequest, isCanonicalDurableRequest } from './route.js';

package/dist/execution/workflows/options.d.ts

@@ -4,11 +4,6 @@ import type { DurableEngine, EngineRetryPolicy } from './engine.js';
 export interface DurableServing {
     /** The Restate SDK Fetch build of this platform. */
     readonly engine: DurableEngine;
-    /**
-     * @deprecated Explicit signing authority for retained callbacks registered before issuer-prefixed
-     * paths. Canonical requests discover their authority from the named Kernel and ignore these keys.
-     */
-    readonly identityKeys?: readonly string[];
     /** Fetch capability used for HTTPS discovery of a canonical request's Kernel engine. */
     readonly fetch?: Fetch;
     /**
@@ -30,7 +25,6 @@ export interface DurableServing {
 export type DurableServingProvider = (request: Request) => DurableServing | undefined | Promise<DurableServing | undefined>;
 export interface AdmittedDurableServing {
     readonly engine: DurableEngine;
-    readonly identityKeys: readonly string[];
     readonly fetch: Fetch;
     readonly retentionMs: number;
     readonly retryPolicy: EngineRetryPolicy;