@astrale-os/kernel-protocol 0.5.0-beta.10

package/dist/issuer/configuration.js

@@ -0,0 +1,86 @@
+import { fail } from './error.js';
+import { acceptIssuer } from './url.js';
+const ALGORITHM = /^[A-Za-z0-9_-]{1,64}$/u;
+export function configuration(issuer, algorithms, options = {}) {
+    const admitted = acceptIssuer(issuer);
+    const acceptedAlgorithms = acceptAlgorithms(algorithms);
+    const tokenExchange = acceptConfigurationOptions(options).tokenExchange === true;
+    return deepFreeze({
+        issuer: admitted,
+        jwks_uri: `${admitted}/.well-known/jwks.json`,
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: acceptedAlgorithms,
+        ...(tokenExchange ? { token_exchange_endpoint: `${admitted}/.well-known/astrale/token` } : {}),
+    });
+}
+export function acceptConfiguration(input, expectedIssuer) {
+    const value = record(input);
+    exact(value, ['issuer', 'jwks_uri', 'subject_types_supported', 'id_token_signing_alg_values_supported'], ['token_exchange_endpoint']);
+    const admitted = acceptIssuer(value.issuer);
+    if (expectedIssuer !== undefined && admitted !== acceptIssuer(expectedIssuer)) {
+        fail('ISSUER_DISCOVERY_MISMATCH', 'Issuer discovery does not match the requested issuer.');
+    }
+    if (value.jwks_uri !== `${admitted}/.well-known/jwks.json`) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer discovery key URL is not canonical.');
+    }
+    if (!Array.isArray(value.subject_types_supported) ||
+        value.subject_types_supported.length !== 1 ||
+        value.subject_types_supported[0] !== 'public') {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer discovery subject types are invalid.');
+    }
+    const endpoint = value.token_exchange_endpoint;
+    if (endpoint !== undefined && endpoint !== `${admitted}/.well-known/astrale/token`) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer token-exchange URL is not canonical.');
+    }
+    return configuration(admitted, acceptAlgorithms(value.id_token_signing_alg_values_supported), {
+        tokenExchange: endpoint !== undefined,
+    });
+}
+function acceptConfigurationOptions(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer configuration options are invalid.');
+    }
+    const keys = Reflect.ownKeys(input);
+    if (keys.some((key) => key !== 'tokenExchange')) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer configuration options contain unexpected fields.');
+    }
+    if (input.tokenExchange !== undefined && typeof input.tokenExchange !== 'boolean') {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer token-exchange option is invalid.');
+    }
+    return input;
+}
+export function acceptAlgorithms(input) {
+    if (!Array.isArray(input) || input.length === 0) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer algorithms must be a non-empty array.');
+    }
+    const algorithms = input.map((algorithm) => {
+        if (typeof algorithm !== 'string' || !ALGORITHM.test(algorithm)) {
+            fail('ISSUER_DISCOVERY_INVALID', 'Issuer algorithm is invalid.');
+        }
+        return algorithm;
+    });
+    if (new Set(algorithms).size !== algorithms.length) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer algorithms must be unique.');
+    }
+    return Object.freeze(algorithms);
+}
+function record(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer discovery is invalid.');
+    }
+    return input;
+}
+function exact(input, required, optional = []) {
+    const keys = Reflect.ownKeys(input);
+    if (required.some((field) => !Object.hasOwn(input, field)) ||
+        keys.some((key) => typeof key !== 'string' || (!required.includes(key) && !optional.includes(key)))) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer discovery document contains unexpected fields.');
+    }
+}
+function deepFreeze(input) {
+    if (input === null || typeof input !== 'object' || Object.isFrozen(input))
+        return input;
+    for (const value of Object.values(input))
+        deepFreeze(value);
+    return Object.freeze(input);
+}

package/dist/issuer/error.d.ts

@@ -0,0 +1,7 @@
+export type DiscoveryErrorCode = 'ISSUER_DISCOVERY_INVALID' | 'ISSUER_DISCOVERY_MISMATCH' | 'ISSUER_KEY_SET_INVALID';
+export declare class DiscoveryError extends Error {
+    readonly code: DiscoveryErrorCode;
+    readonly name = "DiscoveryError";
+    constructor(code: DiscoveryErrorCode, message: string, options?: ErrorOptions);
+}
+export declare function fail(code: DiscoveryErrorCode, message: string, cause?: unknown): never;

package/dist/issuer/error.js

@@ -0,0 +1,11 @@
+export class DiscoveryError extends Error {
+    code;
+    name = 'DiscoveryError';
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+    }
+}
+export function fail(code, message, cause) {
+    throw new DiscoveryError(code, message, cause === undefined ? undefined : { cause });
+}

package/dist/issuer/exchange.d.ts

@@ -0,0 +1,25 @@
+import type { ErrorPayload } from '../errors/index.js';
+export declare const MEDIA_TYPE: 'application/vnd.astrale+json';
+export interface Request {
+    readonly token: string;
+}
+export interface Response {
+    readonly token: string;
+    readonly expiresAt: number;
+}
+export interface ErrorResponse {
+    readonly error: ErrorPayload;
+}
+export interface HttpRequest {
+    readonly method: string;
+    readonly url: string;
+    readonly authorization: string | null;
+    readonly accept: string | null;
+}
+export declare function request(token: string): Request;
+export declare function acceptRequest(input: unknown): Request;
+export declare function response(token: string, expiresAt: number): Response;
+export declare function acceptResponse(input: unknown): Response;
+export declare function acceptErrorResponse(input: unknown): ErrorResponse;
+export declare function acceptHttpRequest(input: HttpRequest): Request;
+export declare function responseHeaders(): Readonly<Record<string, string>>;

package/dist/issuer/exchange.js

@@ -0,0 +1,129 @@
+import { acceptPayload, CODES, ProtocolError } from '../errors/index.js';
+export const MEDIA_TYPE = 'application/vnd.astrale+json';
+export function request(token) {
+    return acceptRequest({ token });
+}
+export function acceptRequest(input) {
+    const value = exactObject(input, ['token'], 'token-exchange request');
+    return Object.freeze({ token: nonEmptyText(value.token, 'token-exchange request.token') });
+}
+export function response(token, expiresAt) {
+    return acceptResponse({ token, expiresAt });
+}
+export function acceptResponse(input) {
+    const value = exactObject(input, ['token', 'expiresAt'], 'token-exchange response');
+    if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt <= 0) {
+        throw new TypeError('token-exchange response.expiresAt must be a positive safe integer.');
+    }
+    return Object.freeze({
+        token: nonEmptyText(value.token, 'token-exchange response.token'),
+        expiresAt: value.expiresAt,
+    });
+}
+export function acceptErrorResponse(input) {
+    const value = exactObject(input, ['error'], 'token-exchange error response');
+    return Object.freeze({ error: acceptPayload(value.error, 'token-exchange error response.error') });
+}
+export function acceptHttpRequest(input) {
+    const value = exactObject(input, ['method', 'url', 'authorization', 'accept'], 'token-exchange HTTP request');
+    if (value.method !== 'POST') {
+        fail(CODES.METHOD_NOT_ALLOWED, 'Token exchange supports POST only.');
+    }
+    if (typeof value.url !== 'string')
+        invalid('Token-exchange URL is invalid.');
+    let url;
+    try {
+        url = new URL(value.url);
+    }
+    catch {
+        invalid('Token-exchange URL is invalid.');
+    }
+    if (url.search !== '' || url.hash !== '') {
+        invalid('Token-exchange URL must not contain a query or fragment.');
+    }
+    if (value.authorization === null) {
+        fail(CODES.AUTH_MISSING, 'Authentication is required.');
+    }
+    if (typeof value.authorization !== 'string') {
+        fail(CODES.AUTH_INVALID, 'Token is invalid.');
+    }
+    const authorization = /^Bearer ([^\s,]+)$/iu.exec(value.authorization);
+    if (authorization === null)
+        fail(CODES.AUTH_INVALID, 'Token is invalid.');
+    if (value.accept !== null) {
+        if (typeof value.accept !== 'string' || !acceptsJson(value.accept)) {
+            invalid('Token-exchange response representation is not accepted.');
+        }
+    }
+    return request(authorization[1]);
+}
+export function responseHeaders() {
+    return Object.freeze({
+        'content-type': MEDIA_TYPE,
+        'cache-control': 'no-store',
+        pragma: 'no-cache',
+        'x-content-type-options': 'nosniff',
+    });
+}
+function acceptsJson(input) {
+    for (const member of input.split(',')) {
+        const parts = member.split(';');
+        const media = parts.shift()?.trim().toLowerCase();
+        if (media === undefined)
+            continue;
+        let quality = 1;
+        let valid = media === MEDIA_TYPE || media === 'application/json' || media === '*/*';
+        for (const parameter of parts) {
+            const [rawName, rawValue, ...extra] = parameter.split('=');
+            if (extra.length > 0 || rawName?.trim().toLowerCase() !== 'q') {
+                valid = false;
+                break;
+            }
+            const value = rawValue?.trim();
+            if (value === undefined || !/^(?:0(?:\.\d{0,3})?|1(?:\.0{0,3})?)$/u.test(value)) {
+                valid = false;
+                break;
+            }
+            quality = Number(value);
+        }
+        if (valid && quality > 0)
+            return true;
+    }
+    return false;
+}
+function invalid(message) {
+    fail(CODES.INVALID_REQUEST, message);
+}
+function fail(code, message) {
+    throw new ProtocolError({ code, message });
+}
+function exactObject(input, expected, label) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        throw new TypeError(`${label} must be an object.`);
+    }
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new TypeError(`${label} must be a plain object.`);
+    }
+    const output = {};
+    const keys = Reflect.ownKeys(input);
+    if (keys.length !== expected.length)
+        throw new TypeError(`${label} must be exact.`);
+    for (const key of keys) {
+        if (typeof key !== 'string' || !expected.includes(key)) {
+            throw new TypeError(`${label} contains an unexpected field.`);
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(input, key);
+        if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor)) {
+            throw new TypeError(`${label}.${key} must be an enumerable data field.`);
+        }
+        output[key] = descriptor.value;
+    }
+    return output;
+}
+function nonEmptyText(input, label) {
+    if (typeof input !== 'string' || input.length === 0) {
+        throw new TypeError(`${label} must be non-empty text.`);
+    }
+    return input;
+}

package/dist/issuer/hosted.d.ts

@@ -0,0 +1,2 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+export declare function hosted(base: string, thumbprint: string): IssuerId | undefined;

package/dist/issuer/hosted.js

@@ -0,0 +1,7 @@
+import { acceptIssuer } from './url.js';
+const THUMBPRINT = /^[A-Za-z0-9_-]{43}$/u;
+export function hosted(base, thumbprint) {
+    if (typeof thumbprint !== 'string' || !THUMBPRINT.test(thumbprint))
+        return undefined;
+    return acceptIssuer(`${acceptIssuer(base)}/iss/${thumbprint}`);
+}

package/dist/issuer/index.d.ts

@@ -0,0 +1,6 @@
+export { acceptConfiguration, configuration, type Configuration, type ConfigurationOptions, } from './configuration.js';
+export { DiscoveryError, type DiscoveryErrorCode } from './error.js';
+export { hosted } from './hosted.js';
+export { acceptKeySet, keySet, type KeySet } from './key-set.js';
+export { paths, type Paths } from './paths.js';
+export * as exchange from './exchange.js';

package/dist/issuer/index.js

@@ -0,0 +1,6 @@
+export { acceptConfiguration, configuration, } from './configuration.js';
+export { DiscoveryError } from './error.js';
+export { hosted } from './hosted.js';
+export { acceptKeySet, keySet } from './key-set.js';
+export { paths } from './paths.js';
+export * as exchange from './exchange.js';

package/dist/issuer/key-set.d.ts

@@ -0,0 +1,6 @@
+import { type JsonWebKey } from '@astrale-os/kernel-core/auth/jwk';
+export interface KeySet {
+    readonly keys: readonly JsonWebKey[];
+}
+export declare function keySet(keys: readonly JsonWebKey[], algorithms: readonly [string, ...string[]]): KeySet;
+export declare function acceptKeySet(input: unknown, algorithms: readonly [string, ...string[]]): KeySet;

package/dist/issuer/key-set.js

@@ -0,0 +1,48 @@
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { acceptPublic } from '@astrale-os/kernel-core/auth/jwk';
+import { acceptAlgorithms } from './configuration.js';
+import { fail } from './error.js';
+export function keySet(keys, algorithms) {
+    if (!Array.isArray(keys))
+        fail('ISSUER_KEY_SET_INVALID', 'Issuer keys must be an array.');
+    const acceptedAlgorithms = new Set(acceptAlgorithms(algorithms));
+    const admittedKeys = keys.map((key) => admitKey(key, acceptedAlgorithms));
+    return deepFreeze({ keys: admittedKeys });
+}
+export function acceptKeySet(input, algorithms) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_KEY_SET_INVALID', 'Issuer key set is invalid.');
+    }
+    const value = input;
+    const fields = Reflect.ownKeys(value);
+    if (fields.length !== 1 || fields[0] !== 'keys' || !Array.isArray(value.keys)) {
+        fail('ISSUER_KEY_SET_INVALID', 'Issuer key set is invalid.');
+    }
+    return keySet(value.keys, algorithms);
+}
+function admitKey(input, algorithms) {
+    let accepted;
+    try {
+        accepted = acceptPublic(input);
+    }
+    catch (cause) {
+        if (cause instanceof AuthValueError) {
+            return fail('ISSUER_KEY_SET_INVALID', 'Issuer public key is invalid.', cause);
+        }
+        throw cause;
+    }
+    if (accepted.alg !== undefined && !algorithms.has(accepted.alg)) {
+        fail('ISSUER_KEY_SET_INVALID', 'Issuer key algorithm is not advertised.');
+    }
+    if (accepted.use !== undefined && accepted.use !== 'sig') {
+        fail('ISSUER_KEY_SET_INVALID', 'Issuer key is not admitted for signature verification.');
+    }
+    return Object.freeze({ ...accepted });
+}
+function deepFreeze(input) {
+    if (input === null || typeof input !== 'object' || Object.isFrozen(input))
+        return input;
+    for (const value of Object.values(input))
+        deepFreeze(value);
+    return Object.freeze(input);
+}

package/dist/issuer/paths.d.ts

@@ -0,0 +1,6 @@
+export interface Paths {
+    readonly configuration: string;
+    readonly keys: string;
+    readonly tokenExchange: string;
+}
+export declare function paths(issuer: string): Paths;

package/dist/issuer/paths.js

@@ -0,0 +1,10 @@
+import { acceptIssuer } from './url.js';
+export function paths(issuer) {
+    const admitted = acceptIssuer(issuer);
+    const pathname = new URL(admitted).pathname.replace(/\/+$/u, '');
+    return Object.freeze({
+        configuration: `${pathname}/.well-known/openid-configuration`,
+        keys: `${pathname}/.well-known/jwks.json`,
+        tokenExchange: `${pathname}/.well-known/astrale/token`,
+    });
+}

package/dist/issuer/url.d.ts

@@ -0,0 +1,2 @@
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+export declare function acceptIssuer(input: unknown): IssuerId;

package/dist/issuer/url.js

@@ -0,0 +1,34 @@
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import { fail } from './error.js';
+export function acceptIssuer(input) {
+    if (typeof input !== 'string') {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer must be an absolute HTTP(S) URL.');
+    }
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError) {
+            return fail('ISSUER_DISCOVERY_INVALID', 'Issuer must be an absolute HTTP(S) URL.', cause);
+        }
+        throw cause;
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        url.username !== '' ||
+        url.password !== '' ||
+        url.hash !== '' ||
+        url.search !== '') {
+        fail('ISSUER_DISCOVERY_INVALID', 'Issuer must be HTTP(S) without credentials, query, or fragment.');
+    }
+    try {
+        return acceptIssuerId(input.replace(/\/+$/u, ''));
+    }
+    catch (cause) {
+        if (cause instanceof AuthValueError) {
+            return fail('ISSUER_DISCOVERY_INVALID', 'Issuer is invalid.', cause);
+        }
+        throw cause;
+    }
+}

package/dist/publication/bindings/callable.d.ts

@@ -0,0 +1,8 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { InvocationEndpoints } from './invocation.js';
+export interface CallableBinding {
+    readonly callable: Key.Callable;
+    readonly endpoint: InvocationEndpoints;
+}
+export declare function admitCallableBinding(input: unknown, origin: string): CallableBinding;
+export declare function admitCallableKey(input: unknown, origin: string): Key.Callable;

package/dist/publication/bindings/callable.js

@@ -0,0 +1,34 @@
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { exact, record } from '../content.js';
+import { fail } from '../error.js';
+import { acceptInvocationEndpoints } from './invocation.js';
+export function admitCallableBinding(input, origin) {
+    const value = record(input, 'PUBLICATION_BINDING_INVALID', 'Callable binding is invalid.');
+    exact(value, ['callable', 'endpoint'], 'PUBLICATION_BINDING_INVALID');
+    return Object.freeze({
+        callable: admitCallableKey(value.callable, origin),
+        endpoint: acceptInvocationEndpoints(value.endpoint),
+    });
+}
+export function admitCallableKey(input, origin) {
+    let callable;
+    try {
+        callable = Key(String(input));
+    }
+    catch (cause) {
+        if (cause instanceof TypeError) {
+            return fail('PUBLICATION_BINDING_INVALID', 'Callable key is invalid.', cause);
+        }
+        throw cause;
+    }
+    if (Key.origin(callable) !== origin) {
+        fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
+    }
+    try {
+        callableAddress(callable);
+    }
+    catch (cause) {
+        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+    }
+    return callable;
+}

package/dist/publication/bindings/index.d.ts

@@ -0,0 +1,3 @@
+export { admitCallableBinding, admitCallableKey, type CallableBinding } from './callable.js';
+export { acceptInvocationEndpoints, type InvocationEndpoints } from './invocation.js';
+export { admitViewBinding, type ViewBinding } from './view.js';

package/dist/publication/bindings/index.js

@@ -0,0 +1,3 @@
+export { admitCallableBinding, admitCallableKey } from './callable.js';
+export { acceptInvocationEndpoints } from './invocation.js';
+export { admitViewBinding } from './view.js';

package/dist/publication/bindings/invocation.d.ts

@@ -0,0 +1,5 @@
+export interface InvocationEndpoints {
+    readonly http: string;
+    readonly websocket?: string;
+}
+export declare function acceptInvocationEndpoints(input: unknown): InvocationEndpoints;

package/dist/publication/bindings/invocation.js

@@ -0,0 +1,13 @@
+import { absoluteHttpUrl, absoluteUrl, exact, record } from '../content.js';
+export function acceptInvocationEndpoints(input) {
+    const value = record(input, 'PUBLICATION_BINDING_INVALID', 'Invocation endpoints are invalid.');
+    exact(value, ['http', 'websocket'], 'PUBLICATION_BINDING_INVALID');
+    const http = absoluteHttpUrl(value.http, true, 'PUBLICATION_BINDING_INVALID');
+    const websocket = value.websocket === undefined
+        ? undefined
+        : absoluteUrl(value.websocket, ['ws:', 'wss:'], true, 'PUBLICATION_BINDING_INVALID');
+    return Object.freeze({
+        http,
+        ...(websocket === undefined ? {} : { websocket }),
+    });
+}

package/dist/publication/bindings/view.d.ts

@@ -0,0 +1,7 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+export interface ViewBinding {
+    readonly view: Key.View;
+    readonly href: string;
+    readonly handshake: 'shell' | 'none';
+}
+export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;

package/dist/publication/bindings/view.js

@@ -0,0 +1,28 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { absoluteHttpUrl, exact, record } from '../content.js';
+import { fail } from '../error.js';
+export function admitViewBinding(input, origin) {
+    const value = record(input, 'PUBLICATION_VIEW_INVALID', 'Published View binding is invalid.');
+    exact(value, ['view', 'href', 'handshake'], 'PUBLICATION_VIEW_INVALID');
+    let view;
+    try {
+        view = Key(String(value.view));
+    }
+    catch (cause) {
+        if (cause instanceof TypeError) {
+            return fail('PUBLICATION_VIEW_INVALID', 'View key is invalid.', cause);
+        }
+        throw cause;
+    }
+    if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
+        fail('PUBLICATION_VIEW_INVALID', 'View binding must name a root View.');
+    }
+    if (value.handshake !== 'shell' && value.handshake !== 'none') {
+        fail('PUBLICATION_VIEW_INVALID', 'View handshake is invalid.');
+    }
+    return Object.freeze({
+        view,
+        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_VIEW_INVALID'),
+        handshake: value.handshake,
+    });
+}

package/dist/publication/bundle-admission.d.ts

@@ -0,0 +1,4 @@
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import type { Publication } from './publication.js';
+export declare function acceptBundle(input: Publication, artifact: unknown): dslBundle.Bundle;
+export declare function decodeBundle(input: Publication, bytes: Uint8Array): dslBundle.Bundle;

package/dist/publication/bundle-admission.js

@@ -0,0 +1,65 @@
+import { Key, MethodKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
+import { acceptBundleValue, decodeBundleValue, verifyBundleBytes } from './bundle.js';
+import { fail } from './error.js';
+import { validateRequirements } from './requirements.js';
+export function acceptBundle(input, artifact) {
+    const accepted = acceptBundleValue(artifact);
+    verifyBundleBytes(input, dslBundle.encode(accepted));
+    validateInventory(input, accepted);
+    return accepted;
+}
+export function decodeBundle(input, bytes) {
+    const decoded = decodeBundleValue(input, bytes);
+    validateInventory(input, decoded);
+    return decoded;
+}
+function validateInventory(publication, bundle) {
+    const root = bundle.root;
+    if (root.origin !== publication.origin || revision(root) !== publication.schema.revision) {
+        fail('PUBLICATION_INVALID', 'Bundle root does not match the Publication schema.');
+    }
+    validateRequirements(root, bundle.closure, publication.requirements);
+    const callables = concreteCallables(root);
+    const publishedCallables = new Set(publication.bindings.callables.map(({ callable }) => callable));
+    if (publishedCallables.size !== callables.size ||
+        [...callables].some((key) => !publishedCallables.has(key))) {
+        fail('PUBLICATION_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
+    }
+    const views = new Set(Object.keys(root.views).map((name) => Key.of({ origin: root.origin, kind: 'view', name })));
+    const publishedViews = new Set(publication.bindings.views.map(({ view }) => view));
+    if (publishedViews.size !== views.size || [...views].some((key) => !publishedViews.has(key))) {
+        fail('PUBLICATION_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
+    }
+    if (publication.manifest?.entrypoint !== undefined &&
+        (publication.manifest.entrypoint.origin !== root.origin ||
+            publication.manifest.entrypoint.kind !== 'view' ||
+            root.views[publication.manifest.entrypoint.name] === undefined)) {
+        fail('PUBLICATION_INVALID', 'Manifest entrypoint does not exist in the root schema.');
+    }
+    for (const route of publication.routes) {
+        if (!callables.has(route.callable)) {
+            fail('PUBLICATION_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
+        }
+    }
+}
+function concreteCallables(root) {
+    const result = new Set();
+    for (const name of Object.keys(root.functions)) {
+        result.add(Key.of({ origin: root.origin, kind: 'function', name }));
+    }
+    addClassMethods(result, root.origin, root.classes);
+    return result;
+}
+function addClassMethods(result, origin, definitions) {
+    for (const [owner, declaration] of Object.entries(definitions)) {
+        if (declaration.kind !== 'node')
+            continue;
+        for (const [name, method] of Object.entries(declaration.methods)) {
+            if (method.inheritance === 'abstract')
+                continue;
+            result.add(MethodKey.of({ origin, kind: 'class', name: owner }, name));
+        }
+    }
+}

package/dist/publication/bundle-descriptor.d.ts

@@ -0,0 +1,9 @@
+import * as artifact from '../artifact/index.js';
+export declare const BUNDLE_MEDIA_TYPE: 'application/vnd.astrale.domain-bundle+json;v=1';
+export interface BundleDescriptor {
+    readonly href: string;
+    readonly ref: artifact.Ref & {
+        readonly mediaType: typeof BUNDLE_MEDIA_TYPE;
+    };
+}
+export declare function admitBundleDescriptor(input: unknown): BundleDescriptor;

package/dist/publication/bundle-descriptor.js

@@ -0,0 +1,19 @@
+import * as artifact from '../artifact/index.js';
+import { absoluteHttpUrl, exact, record } from './content.js';
+import { fail } from './error.js';
+export const BUNDLE_MEDIA_TYPE = 'application/vnd.astrale.domain-bundle+json;v=1';
+export function admitBundleDescriptor(input) {
+    const value = record(input, 'PUBLICATION_INVALID', 'Bundle descriptor is invalid.');
+    exact(value, ['href', 'ref'], 'PUBLICATION_INVALID');
+    const ref = artifact.accept(value.ref);
+    if (ref.mediaType !== BUNDLE_MEDIA_TYPE) {
+        fail('PUBLICATION_INVALID', 'Bundle media type is unsupported.');
+    }
+    if (ref.size < 1) {
+        fail('PUBLICATION_INVALID', 'Bundle size is invalid.');
+    }
+    return Object.freeze({
+        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_INVALID'),
+        ref: Object.freeze({ ...ref, mediaType: BUNDLE_MEDIA_TYPE }),
+    });
+}

package/dist/publication/bundle-evidence.d.ts

@@ -0,0 +1,3 @@
+import type { Publication } from './publication.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export declare function verifyBundleBytes(publication: Publication, bytes: Uint8Array): void;

package/dist/publication/bundle-evidence.js

@@ -0,0 +1,13 @@
+import { fail } from './error.js';
+import { sha256Hex } from './etag.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export function verifyBundleBytes(publication, bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+        fail('PUBLICATION_INVALID', 'Bundle artifact bytes are invalid.');
+    }
+    const descriptor = publication.schema.bundle;
+    if (bytes.byteLength !== descriptor.ref.size ||
+        `sha256:${sha256Hex(bytes)}` !== descriptor.ref.digest) {
+        fail('PUBLICATION_INVALID', 'Bundle artifact does not match its descriptor.');
+    }
+}