@astrale-os/kernel-core 0.9.0-beta.61 → 0.9.0-beta.63

package/dist/callable/invocation/call.d.ts

@@ -1,15 +1,13 @@
-import type { Key, Revision } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Value } from '@astrale-os/kernel-dsl/value';
 import { type NodePath } from '@astrale-os/kernel-core/path';
 /**
  * One declaration, optionally bound to an instance and to the caller's expectation of it: the
- * declaring Domain revision, or the fingerprint of the callable meaning it compiled against.
+ * fingerprint of the callable meaning it compiled against.
  */
 export type Target = {
     readonly callable: Key.Callable;
     readonly instance?: NodePath;
-    /** @deprecated Pin the callable meaning with `fingerprint`; revision pinning will be removed. */
-    readonly revision?: Revision;
     readonly fingerprint?: `sha256:${string}`;
 };
 /** Capture a structured invocation target at a representation boundary. */

package/dist/callable/invocation/call.js

@@ -1,21 +1,16 @@
 import { Path } from '@astrale-os/kernel-core/path';
-import { callableAddress, patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { callableAddress } from '@astrale-os/kernel-dsl/v1/addressing';
 const FINGERPRINT_PATTERN = /^sha256:[0-9a-f]{64}$/u;
 /** Capture a structured invocation target at a representation boundary. */
 export function Target(input) {
     if (input === null ||
         typeof input !== 'object' ||
         Array.isArray(input) ||
-        Reflect.ownKeys(input).some((field) => !['callable', 'instance', 'revision', 'fingerprint'].includes(String(field)))) {
-        throw new TypeError('Invocation Target must contain only callable, instance, revision and fingerprint.');
+        Reflect.ownKeys(input).some((field) => !['callable', 'instance', 'fingerprint'].includes(String(field)))) {
+        throw new TypeError('Invocation Target must contain only callable, instance and fingerprint.');
     }
     const callable = input.callable;
     const coordinate = callableAddress(callable);
-    const revision = input.revision;
-    if (revision !== undefined &&
-        (typeof revision !== 'string' || !patterns.revision.test(revision))) {
-        throw new TypeError('Invocation Target revision is invalid.');
-    }
     const fingerprint = input.fingerprint;
     if (fingerprint !== undefined &&
         (typeof fingerprint !== 'string' || !FINGERPRINT_PATTERN.test(fingerprint))) {
@@ -30,7 +25,6 @@ export function Target(input) {
     return Object.freeze({
         callable,
         ...(instance === undefined ? {} : { instance: instance.raw }),
-        ...(revision === undefined ? {} : { revision }),
         ...(fingerprint === undefined ? {} : { fingerprint }),
     });
 }

package/dist/schema/callables/function.d.ts

@@ -2529,7 +2529,6 @@ export declare const Function: builder.NodeClass<{
                 target: string | {
                     callable: string;
                     instance?: string | undefined;
-                    revision?: string | undefined;
                     fingerprint?: string | undefined;
                 };
                 input: unknown;
@@ -3489,7 +3488,6 @@ export declare const Function: builder.NodeClass<{
             target: string | {
                 callable: string;
                 instance?: string | undefined;
-                revision?: string | undefined;
                 fingerprint?: string | undefined;
             };
             input: unknown;

package/dist/schema/introspection/language.d.ts

@@ -9,4 +9,6 @@ export type Introspection = {
 } | {
     readonly kind: 'dependencies';
     readonly origin: Key.Origin;
+} | {
+    readonly kind: 'installed';
 };

package/dist/schema/kernel/schema.d.ts

@@ -6684,7 +6684,6 @@ declare const KernelDefinitions: {
                         target: string | {
                             callable: string;
                             instance?: string | undefined;
-                            revision?: string | undefined;
                             fingerprint?: string | undefined;
                         };
                         input: unknown;
@@ -7644,7 +7643,6 @@ declare const KernelDefinitions: {
                     target: string | {
                         callable: string;
                         instance?: string | undefined;
-                        revision?: string | undefined;
                         fingerprint?: string | undefined;
                     };
                     input: unknown;
@@ -8571,6 +8569,21 @@ declare const KernelDefinitions: {
                     size: number;
                 };
                 currentRevision?: string | null | undefined;
+            } | {
+                release: {
+                    url: string;
+                    token?: string | undefined;
+                    digest?: string | undefined;
+                };
+                consent?: {
+                    issuer: {
+                        from: string;
+                        to: string;
+                    };
+                    previous?: "drain" | "revoke" | undefined;
+                } | undefined;
+                revision?: string | undefined;
+                currentRevision?: string | null | undefined;
             } | {
                 publication: {
                     url: string;
@@ -8586,6 +8599,8 @@ declare const KernelDefinitions: {
         introspect: builder.Function<builder.CallableProjection<{
             kind: "bundle" | "dependencies" | "inspect";
             origin: string;
+        } | {
+            kind: "installed";
         }, {
             readonly mode: 'binary';
         }, "authenticated", false, false, undefined>>;
@@ -8614,6 +8629,13 @@ declare const KernelDefinitions: {
                             revision: string;
                             generation: string;
                         } | null;
+                        consent?: {
+                            issuer: {
+                                from: string;
+                                to: string;
+                            };
+                            previous: "drain" | "revoke";
+                        } | undefined;
                     };
                     phase: "converge" | "cutover";
                     state: "committed";
@@ -8964,6 +8986,21 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
             size: number;
         };
         currentRevision?: string | null | undefined;
+    } | {
+        release: {
+            url: string;
+            token?: string | undefined;
+            digest?: string | undefined;
+        };
+        consent?: {
+            issuer: {
+                from: string;
+                to: string;
+            };
+            previous?: "drain" | "revoke" | undefined;
+        } | undefined;
+        revision?: string | undefined;
+        currentRevision?: string | null | undefined;
     } | {
         publication: {
             url: string;
@@ -9472,25 +9509,6 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
     readonly key: "kernel.astrale.ai:function.query";
     readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<import("@astrale-os/kernel-dsl/v1").BinaryInputProjection<{
-    mediaType: string;
-}>, {
-    readonly mode: 'value';
-    readonly value: {
-        receipt: string;
-        ref: {
-            digest: string;
-            mediaType: string;
-            size: number;
-        };
-        expiresAt: string;
-    };
-}, "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
-    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"upload"> & {
-        readonly origin: "kernel.astrale.ai";
-    };
-    readonly key: "kernel.astrale.ai:function.upload";
-    readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<{
     idempotencyKey: string;
     identities: ({
@@ -9543,6 +9561,13 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
                     revision: string;
                     generation: string;
                 } | null;
+                consent?: {
+                    issuer: {
+                        from: string;
+                        to: string;
+                    };
+                    previous: "drain" | "revoke";
+                } | undefined;
             };
             phase: "converge" | "cutover";
             state: "committed";
@@ -9564,17 +9589,24 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
     readonly key: "kernel.astrale.ai:function.uninstall";
     readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
-    audience?: string | undefined;
-    ttlSeconds: number;
-    grant?: unknown;
-    identity: string;
-}, {
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedFunction<import("@astrale-os/kernel-dsl/v1").BinaryInputProjection<{
+    mediaType: string;
+}>, {
     readonly mode: 'value';
-    readonly value: string;
-}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
-    readonly name: "impersonate";
-    readonly executable: true;
+    readonly value: {
+        receipt: string;
+        ref: {
+            digest: string;
+            mediaType: string;
+            size: number;
+        };
+        expiresAt: string;
+    };
+}, "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>> & {
+    readonly ref: import("@astrale-os/kernel-dsl/v1").FunctionRef<"upload"> & {
+        readonly origin: "kernel.astrale.ai";
+    };
+    readonly key: "kernel.astrale.ai:function.upload";
     readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     iss: string;
@@ -9603,6 +9635,18 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     readonly name: "whois";
     readonly executable: true;
     readonly execution: undefined;
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
+    audience?: string | undefined;
+    ttlSeconds: number;
+    grant?: unknown;
+    identity: string;
+}, {
+    readonly mode: 'value';
+    readonly value: string;
+}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").PolicyCheckExpression<import("@astrale-os/kernel-dsl/v1").PolicyRef, import("@astrale-os/kernel-dsl/v1/language").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
+    readonly name: "impersonate";
+    readonly executable: true;
+    readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     target: string;
 }, {

package/dist/schema/kernel/syscalls/contracts/admit.d.ts

@@ -3,7 +3,6 @@ export declare const admitInput: import("zod").ZodObject<{
         target: import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodObject<{
             callable: import("zod").ZodString;
             instance: import("zod").ZodOptional<import("zod").ZodString>;
-            revision: import("zod").ZodOptional<import("zod").ZodString>;
             fingerprint: import("zod").ZodOptional<import("zod").ZodString>;
         }, import("zod/v4/core").$strict>]>;
         input: import("zod").ZodUnknown;

package/dist/schema/kernel/syscalls/contracts/admit.js

@@ -6,8 +6,6 @@ export const admitInput = strictObject({
             strictObject({
                 callable: string().min(1),
                 instance: string().min(1).optional(),
-                // Deprecated revision pin, retained until every client pins by fingerprint.
-                revision: string().min(1).optional(),
                 fingerprint: string().min(1).optional(),
             }),
         ]),

package/dist/schema/kernel/syscalls/contracts/install.d.ts

@@ -1,4 +1,5 @@
 import type { OperationId } from '../../../installation/operation-id.js';
+import type { PublicationRequest } from './legacy/install.js';
 export declare const domainRequest: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
     artifact: import("zod").ZodObject<{
         digest: import("zod").ZodString;
@@ -6,6 +7,24 @@ export declare const domainRequest: import("zod").ZodUnion<readonly [import("zod
         size: import("zod").ZodNumber;
     }, import("zod/v4/core").$strict>;
     currentRevision: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    release: import("zod").ZodObject<{
+        url: import("zod").ZodString;
+        token: import("zod").ZodOptional<import("zod").ZodString>;
+        digest: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>;
+    consent: import("zod").ZodOptional<import("zod").ZodObject<{
+        issuer: import("zod").ZodObject<{
+            from: import("zod").ZodString;
+            to: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+        previous: import("zod").ZodOptional<import("zod").ZodEnum<{
+            drain: "drain";
+            revoke: "revoke";
+        }>>;
+    }, import("zod/v4/core").$strict>>;
+    revision: import("zod").ZodOptional<import("zod").ZodString>;
+    currentRevision: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
 }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
     publication: import("zod").ZodObject<{
         url: import("zod").ZodString;
@@ -24,6 +43,24 @@ export declare const installInput: import("zod").ZodObject<{
             size: import("zod").ZodNumber;
         }, import("zod/v4/core").$strict>;
         currentRevision: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+    }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+        release: import("zod").ZodObject<{
+            url: import("zod").ZodString;
+            token: import("zod").ZodOptional<import("zod").ZodString>;
+            digest: import("zod").ZodOptional<import("zod").ZodString>;
+        }, import("zod/v4/core").$strict>;
+        consent: import("zod").ZodOptional<import("zod").ZodObject<{
+            issuer: import("zod").ZodObject<{
+                from: import("zod").ZodString;
+                to: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>;
+            previous: import("zod").ZodOptional<import("zod").ZodEnum<{
+                drain: "drain";
+                revoke: "revoke";
+            }>>;
+        }, import("zod/v4/core").$strict>>;
+        revision: import("zod").ZodOptional<import("zod").ZodString>;
+        currentRevision: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
     }, import("zod/v4/core").$strict>, import("zod").ZodObject<{
         publication: import("zod").ZodObject<{
             url: import("zod").ZodString;
@@ -51,6 +88,16 @@ export declare const installReceipt: import("zod").ZodObject<{
                 revision: import("zod").ZodString;
                 generation: import("zod").ZodString;
             }, import("zod/v4/core").$strict>>;
+            consent: import("zod").ZodOptional<import("zod").ZodObject<{
+                issuer: import("zod").ZodObject<{
+                    from: import("zod").ZodString;
+                    to: import("zod").ZodString;
+                }, import("zod/v4/core").$strict>;
+                previous: import("zod").ZodEnum<{
+                    drain: "drain";
+                    revoke: "revoke";
+                }>;
+            }, import("zod/v4/core").$strict>>;
         }, import("zod/v4/core").$strict>;
         phase: import("zod").ZodEnum<{
             converge: "converge";
@@ -71,6 +118,7 @@ export declare const installReceipt: import("zod").ZodObject<{
 }, import("zod/v4/core").$strict>;
 type NonEmpty<Value> = readonly [Value, ...Value[]];
 export type InstallationDigest = `sha256:${string}`;
+export type ReleaseDigest = InstallationDigest;
 export interface ArtifactRef {
     readonly digest: InstallationDigest;
     readonly mediaType: string;
@@ -87,12 +135,35 @@ export interface DomainGeneration {
     readonly revision: string;
     readonly generation: InstallationDigest;
 }
+/**
+ * The operator's consent to replace the issuer an installation runs under (D7): a compare-and-swap
+ * of the exact installed issuer `from` for the exact issuer `to` the source serves.
+ */
+export interface IssuerConsent {
+    readonly issuer: {
+        readonly from: string;
+        readonly to: string;
+    };
+    /**
+     * What the replaced issuer keeps: `drain` (default) accepts it for a bounded time after the
+     * activation, then only for the steps of its durable runs; `revoke` cuts it at the activation.
+     */
+    readonly previous?: 'drain' | 'revoke';
+}
 export interface TransitionIntent {
     readonly transition: string;
     readonly operation: OperationId;
     readonly origin: string;
     readonly previous: DomainGeneration | null;
     readonly generation: DomainGeneration | null;
+    /** Present only on a replacement that changed its issuer under consent. */
+    readonly consent?: {
+        readonly issuer: {
+            readonly from: string;
+            readonly to: string;
+        };
+        readonly previous: 'drain' | 'revoke';
+    };
 }
 export interface ReadinessReceipt {
     readonly generation: InstallationDigest;
@@ -105,18 +176,26 @@ export interface TransitionReceipt {
     readonly state: 'committed';
     readonly readiness?: ReadinessReceipt;
 }
-export type DomainRequest = {
-    readonly artifact: ArtifactRef;
-    readonly currentRevision?: string | null;
-} | {
-    readonly publication: {
+/** Installs the document served by the URL, preferring release.json over domain.json. */
+export interface ReleaseRequest {
+    readonly release: {
         readonly url: string;
         readonly token?: string;
-        readonly etag?: InstallationDigest;
+        /** Requires an exact release digest. Omit to accept any served document, including a legacy Publication. */
+        readonly digest?: ReleaseDigest;
     };
+    /**
+     * Required when the source serves another issuer than the installed one, refused otherwise:
+     * `from` must be the installed issuer and `to` the served one, neither the Kernel issuer.
+     */
+    readonly consent?: IssuerConsent;
     readonly revision?: string;
     readonly currentRevision?: string | null;
-};
+}
+export type DomainRequest = {
+    readonly artifact: ArtifactRef;
+    readonly currentRevision?: string | null;
+} | ReleaseRequest | PublicationRequest;
 export interface InstallInput {
     readonly operation: OperationId;
     readonly domains: NonEmpty<DomainRequest>;

package/dist/schema/kernel/syscalls/contracts/install.js

@@ -1,19 +1,22 @@
 import { array, strictObject, union } from 'zod';
-import { artifactRef, installationText, operationIdSchema, transitionReceipt, } from './installation.js';
+import { artifactRef, installationDigest, installationText, issuerConsent, operationIdSchema, transitionReceipt, } from './installation.js';
+import { publicationRequest } from './legacy/install.js';
 export const domainRequest = union([
     strictObject({
         artifact: artifactRef,
         currentRevision: installationText.nullable().optional(),
     }),
     strictObject({
-        publication: strictObject({
+        release: strictObject({
             url: installationText,
             token: installationText.optional(),
-            etag: installationText.optional(),
+            digest: installationDigest.optional(),
         }),
+        consent: issuerConsent.optional(),
         revision: installationText.optional(),
         currentRevision: installationText.nullable().optional(),
     }),
+    publicationRequest,
 ]);
 export const installInput = strictObject({
     operation: operationIdSchema,

package/dist/schema/kernel/syscalls/contracts/installation.d.ts

@@ -18,6 +18,16 @@ export declare const domainGeneration: import("zod").ZodObject<{
     revision: import("zod").ZodString;
     generation: import("zod").ZodString;
 }, import("zod/v4/core").$strict>;
+export declare const issuerConsent: import("zod").ZodObject<{
+    issuer: import("zod").ZodObject<{
+        from: import("zod").ZodString;
+        to: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>;
+    previous: import("zod").ZodOptional<import("zod").ZodEnum<{
+        drain: "drain";
+        revoke: "revoke";
+    }>>;
+}, import("zod/v4/core").$strict>;
 export declare const transitionIntent: import("zod").ZodObject<{
     transition: import("zod").ZodString;
     operation: import("zod").ZodString;
@@ -32,6 +42,16 @@ export declare const transitionIntent: import("zod").ZodObject<{
         revision: import("zod").ZodString;
         generation: import("zod").ZodString;
     }, import("zod/v4/core").$strict>>;
+    consent: import("zod").ZodOptional<import("zod").ZodObject<{
+        issuer: import("zod").ZodObject<{
+            from: import("zod").ZodString;
+            to: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+        previous: import("zod").ZodEnum<{
+            drain: "drain";
+            revoke: "revoke";
+        }>;
+    }, import("zod/v4/core").$strict>>;
 }, import("zod/v4/core").$strict>;
 export declare const readinessReceipt: import("zod").ZodObject<{
     generation: import("zod").ZodString;
@@ -58,6 +78,16 @@ export declare const transitionReceipt: import("zod").ZodObject<{
             revision: import("zod").ZodString;
             generation: import("zod").ZodString;
         }, import("zod/v4/core").$strict>>;
+        consent: import("zod").ZodOptional<import("zod").ZodObject<{
+            issuer: import("zod").ZodObject<{
+                from: import("zod").ZodString;
+                to: import("zod").ZodString;
+            }, import("zod/v4/core").$strict>;
+            previous: import("zod").ZodEnum<{
+                drain: "drain";
+                revoke: "revoke";
+            }>;
+        }, import("zod/v4/core").$strict>>;
     }, import("zod/v4/core").$strict>;
     phase: import("zod").ZodEnum<{
         converge: "converge";

package/dist/schema/kernel/syscalls/contracts/installation.js

@@ -20,12 +20,21 @@ export const domainGeneration = strictObject({
     revision: installationText,
     generation: installationDigest,
 });
+const consentIssuers = strictObject({ from: installationText, to: installationText });
+export const issuerConsent = strictObject({
+    issuer: consentIssuers,
+    previous: enumeration(['drain', 'revoke']).optional(),
+});
 export const transitionIntent = strictObject({
     transition: installationText,
     operation: operationIdSchema,
     origin: installationText,
     previous: domainGeneration.nullable(),
     generation: domainGeneration.nullable(),
+    consent: strictObject({
+        issuer: consentIssuers,
+        previous: enumeration(['drain', 'revoke']),
+    }).optional(),
 });
 export const readinessReceipt = strictObject({
     generation: installationDigest,

package/dist/schema/kernel/syscalls/contracts/introspect.d.ts

@@ -1,8 +1,11 @@
-export declare const introspectInput: import("zod").ZodObject<{
+/** One ready Domain by origin, or the installed listing, which names no origin. */
+export declare const introspectInput: import("zod").ZodUnion<readonly [import("zod").ZodObject<{
     kind: import("zod").ZodEnum<{
         bundle: "bundle";
         dependencies: "dependencies";
         inspect: "inspect";
     }>;
     origin: import("zod").ZodString;
-}, import("zod/v4/core").$strict>;
+}, import("zod/v4/core").$strict>, import("zod").ZodObject<{
+    kind: import("zod").ZodLiteral<"installed">;
+}, import("zod/v4/core").$strict>]>;

package/dist/schema/kernel/syscalls/contracts/introspect.js

@@ -1,5 +1,9 @@
-import { enum as enumeration, strictObject, string } from 'zod';
-export const introspectInput = strictObject({
-    kind: enumeration(['inspect', 'bundle', 'dependencies']),
-    origin: string().min(1),
-});
+import { enum as enumeration, literal, strictObject, string, union } from 'zod';
+/** One ready Domain by origin, or the installed listing, which names no origin. */
+export const introspectInput = union([
+    strictObject({
+        kind: enumeration(['inspect', 'bundle', 'dependencies']),
+        origin: string().min(1),
+    }),
+    strictObject({ kind: literal('installed') }),
+]);

package/dist/schema/kernel/syscalls/contracts/legacy/install.d.ts

@@ -0,0 +1,22 @@
+import type { InstallationDigest } from '../install.js';
+/** @deprecated Successor: the `release` request of `../install.ts`. */
+export declare const publicationRequest: import("zod").ZodObject<{
+    publication: import("zod").ZodObject<{
+        url: import("zod").ZodString;
+        token: import("zod").ZodOptional<import("zod").ZodString>;
+        etag: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>;
+    revision: import("zod").ZodOptional<import("zod").ZodString>;
+    currentRevision: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+}, import("zod/v4/core").$strict>;
+/** @deprecated Use `ReleaseRequest` to guard the release digest. */
+export interface PublicationRequest {
+    readonly publication: {
+        readonly url: string;
+        readonly token?: string;
+        /** ETag of the v3 document the source serves: its own, or the projection of a v4 release. */
+        readonly etag?: InstallationDigest;
+    };
+    readonly revision?: string;
+    readonly currentRevision?: string | null;
+}

package/dist/schema/kernel/syscalls/contracts/legacy/install.js

@@ -0,0 +1,31 @@
+/**
+ * The `publication` Domain request of `schema.install` keeps its v3 meaning: `etag` guards the
+ * ETag of the v3 document the source serves, including the frozen projection of a v4 release.
+ *
+ * @deprecated Use the `release` request of `../install.ts`, whose `digest` is the release digest.
+ *
+ * Short-term consumers: the Admin instance gateway and the CLI until they send `release`, the SDK
+ * e2e controller, and this repository's own callers (`__e2e__`, `host/e2e`,
+ * `host/qualification/falkor`) and tests. The 1Pact Host runs its own Kernel .117 and does not
+ * depend on this module.
+ *
+ * Removal, in a separate breaking release, once the Admin gateway and the CLI send `release` to
+ * every Kernel that accepts it and the SDK e2e controller has moved: move this repository's callers
+ * and tests first, then delete this folder, the `publication` branch of `domainRequest`, Runtime
+ * `PublicationDomainInput` with the `publication` branch of `installDomain`,
+ * `DesiredInstallation.targetEtag`, `InstallRoot.targetEtag` and
+ * `CUTOVER_PUBLICATION_ETAG_CONFLICT`. The legacy fingerprint keys stay frozen: retained operations
+ * store their digests.
+ */
+import { strictObject } from 'zod';
+import { installationText } from '../installation.js';
+/** @deprecated Successor: the `release` request of `../install.ts`. */
+export const publicationRequest = strictObject({
+    publication: strictObject({
+        url: installationText,
+        token: installationText.optional(),
+        etag: installationText.optional(),
+    }),
+    revision: installationText.optional(),
+    currentRevision: installationText.nullable().optional(),
+});

package/dist/schema/kernel/syscalls/contracts/uninstall.d.ts

@@ -24,6 +24,16 @@ export declare const uninstallOutput: import("zod").ZodObject<{
                 revision: import("zod").ZodString;
                 generation: import("zod").ZodString;
             }, import("zod/v4/core").$strict>>;
+            consent: import("zod").ZodOptional<import("zod").ZodObject<{
+                issuer: import("zod").ZodObject<{
+                    from: import("zod").ZodString;
+                    to: import("zod").ZodString;
+                }, import("zod/v4/core").$strict>;
+                previous: import("zod").ZodEnum<{
+                    drain: "drain";
+                    revoke: "revoke";
+                }>;
+            }, import("zod/v4/core").$strict>>;
         }, import("zod/v4/core").$strict>;
         phase: import("zod").ZodEnum<{
             converge: "converge";

package/dist/schema/kernel/syscalls/declarations/admit.d.ts

@@ -4,7 +4,6 @@ export declare const Admit: builder.Method<builder.CallableProjection<{
         target: string | {
             callable: string;
             instance?: string | undefined;
-            revision?: string | undefined;
             fingerprint?: string | undefined;
         };
         input: unknown;

package/dist/schema/kernel/syscalls/declarations/index.d.ts

@@ -499,6 +499,21 @@ export declare const Functions: Readonly<{
                 size: number;
             };
             currentRevision?: string | null | undefined;
+        } | {
+            release: {
+                url: string;
+                token?: string | undefined;
+                digest?: string | undefined;
+            };
+            consent?: {
+                issuer: {
+                    from: string;
+                    to: string;
+                };
+                previous?: "drain" | "revoke" | undefined;
+            } | undefined;
+            revision?: string | undefined;
+            currentRevision?: string | null | undefined;
         } | {
             publication: {
                 url: string;
@@ -514,6 +529,8 @@ export declare const Functions: Readonly<{
     introspect: builder.Function<builder.CallableProjection<{
         kind: "bundle" | "dependencies" | "inspect";
         origin: string;
+    } | {
+        kind: "installed";
     }, {
         readonly mode: 'binary';
     }, "authenticated", false, false, undefined>>;
@@ -542,6 +559,13 @@ export declare const Functions: Readonly<{
                         revision: string;
                         generation: string;
                     } | null;
+                    consent?: {
+                        issuer: {
+                            from: string;
+                            to: string;
+                        };
+                        previous: "drain" | "revoke";
+                    } | undefined;
                 };
                 phase: "converge" | "cutover";
                 state: "committed";
@@ -684,7 +708,6 @@ export declare const FunctionMethods: Readonly<{
             target: string | {
                 callable: string;
                 instance?: string | undefined;
-                revision?: string | undefined;
                 fingerprint?: string | undefined;
             };
             input: unknown;

package/dist/schema/kernel/syscalls/declarations/install.d.ts

@@ -8,6 +8,21 @@ export declare const Install: builder.Function<builder.CallableProjection<{
             size: number;
         };
         currentRevision?: string | null | undefined;
+    } | {
+        release: {
+            url: string;
+            token?: string | undefined;
+            digest?: string | undefined;
+        };
+        consent?: {
+            issuer: {
+                from: string;
+                to: string;
+            };
+            previous?: "drain" | "revoke" | undefined;
+        } | undefined;
+        revision?: string | undefined;
+        currentRevision?: string | null | undefined;
     } | {
         publication: {
             url: string;

package/dist/schema/kernel/syscalls/declarations/introspect.d.ts

@@ -2,6 +2,8 @@ import { type builder } from '@astrale-os/kernel-dsl/v1';
 export declare const Introspect: builder.Function<builder.CallableProjection<{
     kind: "bundle" | "dependencies" | "inspect";
     origin: string;
+} | {
+    kind: "installed";
 }, {
     readonly mode: 'binary';
 }, "authenticated", false, false, undefined>>;

package/dist/schema/kernel/syscalls/declarations/uninstall.d.ts

@@ -24,6 +24,13 @@ export declare const Uninstall: builder.Function<builder.CallableProjection<{
                     revision: string;
                     generation: string;
                 } | null;
+                consent?: {
+                    issuer: {
+                        from: string;
+                        to: string;
+                    };
+                    previous: "drain" | "revoke";
+                } | undefined;
             };
             phase: "converge" | "cutover";
             state: "committed";

package/dist/schema/kernel/syscalls/descriptors/function.d.ts

@@ -5,7 +5,6 @@ declare const Admit: import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
         target: string | {
             callable: string;
             instance?: string | undefined;
-            revision?: string | undefined;
             fingerprint?: string | undefined;
         };
         input: unknown;

package/dist/schema/kernel/syscalls/descriptors/results/view-resolution.d.ts

@@ -11,6 +11,13 @@ export interface ResolvedView {
     readonly iframe?: IframeRequirements;
     readonly host?: ViewHostRequirements;
     readonly issuer: IssuerId;
+    /**
+     * ETag of the v3 Publication that pins the View's Domain: its own for a legacy pin, the
+     * frozen projection's for a `DomainRelease` v4 pin.
+     *
+     * @deprecated Successor: `ResolvedView.release`, emitted by the breaking release (AM-1) as
+     * the release digest.
+     */
     readonly etag: `sha256:${string}`;
     readonly revision: Revision;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "0.9.0-beta.61",
+  "version": "0.9.0-beta.63",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "0.2.0-beta.43",
+    "@astrale-os/kernel-dsl": "0.2.0-beta.45",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"