@astrale-os/kernel-protocol 0.5.0-beta.2 → 0.5.0-beta.21

package/dist/issuer/configuration.d.ts

@@ -1,4 +1,4 @@
-import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export interface Configuration {
     readonly issuer: IssuerId;
     readonly jwks_uri: string;
@@ -12,4 +12,3 @@ export interface ConfigurationOptions {
 export declare function configuration(issuer: string, algorithms: readonly [string, ...string[]], options?: ConfigurationOptions): Configuration;
 export declare function acceptConfiguration(input: unknown, expectedIssuer?: string): Configuration;
 export declare function acceptAlgorithms(input: unknown): readonly [string, ...string[]];
-//# sourceMappingURL=configuration.d.ts.map

package/dist/issuer/configuration.js

@@ -84,4 +84,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=configuration.js.map

package/dist/issuer/error.d.ts

@@ -5,4 +5,3 @@ export declare class DiscoveryError extends Error {
     constructor(code: DiscoveryErrorCode, message: string, options?: ErrorOptions);
 }
 export declare function fail(code: DiscoveryErrorCode, message: string, cause?: unknown): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/issuer/error.js

@@ -9,4 +9,3 @@ export class DiscoveryError extends Error {
 export function fail(code, message, cause) {
     throw new DiscoveryError(code, message, cause === undefined ? undefined : { cause });
 }
-//# sourceMappingURL=error.js.map

package/dist/issuer/exchange.d.ts

@@ -23,4 +23,3 @@ export declare function acceptResponse(input: unknown): Response;
 export declare function acceptErrorResponse(input: unknown): ErrorResponse;
 export declare function acceptHttpRequest(input: HttpRequest): Request;
 export declare function responseHeaders(): Readonly<Record<string, string>>;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -127,4 +127,3 @@ function nonEmptyText(input, label) {
     }
     return input;
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/hosted.d.ts

@@ -1,3 +1,2 @@
-import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function hosted(base: string, thumbprint: string): IssuerId | undefined;
-//# sourceMappingURL=hosted.d.ts.map

package/dist/issuer/hosted.js

@@ -5,4 +5,3 @@ export function hosted(base, thumbprint) {
         return undefined;
     return acceptIssuer(`${acceptIssuer(base)}/iss/${thumbprint}`);
 }
-//# sourceMappingURL=hosted.js.map

package/dist/issuer/index.d.ts

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/key-set.d.ts

@@ -1,7 +1,6 @@
-import { type JsonWebKey } from '@astrale-os/kernel-core/auth';
+import { type JsonWebKey } from '@astrale-os/kernel-core/auth/jwk';
 export interface KeySet {
     readonly keys: readonly JsonWebKey[];
 }
 export declare function keySet(keys: readonly JsonWebKey[], algorithms: readonly [string, ...string[]]): KeySet;
 export declare function acceptKeySet(input: unknown, algorithms: readonly [string, ...string[]]): KeySet;
-//# sourceMappingURL=key-set.d.ts.map

package/dist/issuer/key-set.js

@@ -1,4 +1,5 @@
-import { AuthValueError, jwk } from '@astrale-os/kernel-core/auth';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { acceptPublic } from '@astrale-os/kernel-core/auth/jwk';
 import { acceptAlgorithms } from './configuration.js';
 import { fail } from './error.js';
 export function keySet(keys, algorithms) {
@@ -22,7 +23,7 @@ export function acceptKeySet(input, algorithms) {
 function admitKey(input, algorithms) {
     let accepted;
     try {
-        accepted = jwk.acceptPublic(input);
+        accepted = acceptPublic(input);
     }
     catch (cause) {
         if (cause instanceof AuthValueError) {
@@ -45,4 +46,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=key-set.js.map

package/dist/issuer/paths.d.ts

@@ -4,4 +4,3 @@ export interface Paths {
     readonly tokenExchange: string;
 }
 export declare function paths(issuer: string): Paths;
-//# sourceMappingURL=paths.d.ts.map

package/dist/issuer/paths.js

@@ -8,4 +8,3 @@ export function paths(issuer) {
         tokenExchange: `${pathname}/.well-known/astrale/token`,
     });
 }
-//# sourceMappingURL=paths.js.map

package/dist/issuer/url.d.ts

@@ -1,3 +1,2 @@
-import { type IssuerId } from '@astrale-os/kernel-core/auth';
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function acceptIssuer(input: unknown): IssuerId;
-//# sourceMappingURL=url.d.ts.map

package/dist/issuer/url.js

@@ -1,4 +1,5 @@
-import { AuthValueError, issuer } from '@astrale-os/kernel-core/auth';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import { fail } from './error.js';
 export function acceptIssuer(input) {
     if (typeof input !== 'string') {
@@ -22,7 +23,7 @@ export function acceptIssuer(input) {
         fail('ISSUER_DISCOVERY_INVALID', 'Issuer must be HTTP(S) without credentials, query, or fragment.');
     }
     try {
-        return issuer.accept(input.replace(/\/+$/u, ''));
+        return acceptIssuerId(input.replace(/\/+$/u, ''));
     }
     catch (cause) {
         if (cause instanceof AuthValueError) {
@@ -31,4 +32,3 @@ export function acceptIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=url.js.map

package/dist/publication/bindings/callable.d.ts

@@ -1,4 +1,4 @@
-import { Key } from '@astrale-os/kernel-dsl/v1';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { InvocationEndpoints } from './invocation.js';
 export interface CallableBinding {
     readonly callable: Key.Callable;
@@ -6,4 +6,3 @@ export interface CallableBinding {
 }
 export declare function admitCallableBinding(input: unknown, origin: string): CallableBinding;
 export declare function admitCallableKey(input: unknown, origin: string): Key.Callable;
-//# sourceMappingURL=callable.d.ts.map

package/dist/publication/bindings/callable.js

@@ -1,4 +1,4 @@
-import { Key, Ref } from '@astrale-os/kernel-dsl/v1';
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { exact, record } from '../content.js';
 import { fail } from '../error.js';
 import { acceptInvocationEndpoints } from './invocation.js';
@@ -21,12 +21,14 @@ export function admitCallableKey(input, origin) {
         }
         throw cause;
     }
-    const reference = Key.ref(callable);
-    if (Key.origin(callable) !== origin ||
-        (!Ref.isDefinition(reference) && !Ref.isMethod(reference)) ||
-        (!reference.startsWith('function.') && !Ref.isMethod(reference))) {
+    if (Key.origin(callable) !== origin) {
         fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
+    try {
+        callableAddress(callable);
+    }
+    catch (cause) {
+        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+    }
     return callable;
 }
-//# sourceMappingURL=callable.js.map

package/dist/publication/bindings/index.d.ts

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey, type CallableBinding } from './callable.js';
 export { acceptInvocationEndpoints, type InvocationEndpoints } from './invocation.js';
 export { admitViewBinding, type ViewBinding } from './view.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/publication/bindings/index.js

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey } from './callable.js';
 export { acceptInvocationEndpoints } from './invocation.js';
 export { admitViewBinding } from './view.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/bindings/invocation.d.ts

@@ -3,4 +3,3 @@ export interface InvocationEndpoints {
     readonly websocket?: string;
 }
 export declare function acceptInvocationEndpoints(input: unknown): InvocationEndpoints;
-//# sourceMappingURL=invocation.d.ts.map

package/dist/publication/bindings/invocation.js

@@ -11,4 +11,3 @@ export function acceptInvocationEndpoints(input) {
         ...(websocket === undefined ? {} : { websocket }),
     });
 }
-//# sourceMappingURL=invocation.js.map

package/dist/publication/bindings/view.d.ts

@@ -1,8 +1,7 @@
-import { Key } from '@astrale-os/kernel-dsl/v1';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 export interface ViewBinding {
     readonly view: Key.View;
     readonly href: string;
     readonly handshake: 'shell' | 'none';
 }
 export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
-//# sourceMappingURL=view.d.ts.map

package/dist/publication/bindings/view.js

@@ -1,4 +1,4 @@
-import { Key } from '@astrale-os/kernel-dsl/v1';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { absoluteHttpUrl, exact, record } from '../content.js';
 import { fail } from '../error.js';
 export function admitViewBinding(input, origin) {
@@ -14,7 +14,7 @@ export function admitViewBinding(input, origin) {
         }
         throw cause;
     }
-    if (Key.origin(view) !== origin || !Key.ref(view).startsWith('view.')) {
+    if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
         fail('PUBLICATION_VIEW_INVALID', 'View binding must name a root View.');
     }
     if (value.handshake !== 'shell' && value.handshake !== 'none') {
@@ -26,4 +26,3 @@ export function admitViewBinding(input, origin) {
         handshake: value.handshake,
     });
 }
-//# sourceMappingURL=view.js.map

package/dist/publication/bundle-admission.d.ts

@@ -0,0 +1,4 @@
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import type { Publication } from './publication.js';
+export declare function acceptBundle(input: Publication, artifact: unknown): dslBundle.Bundle;
+export declare function decodeBundle(input: Publication, bytes: Uint8Array): dslBundle.Bundle;

package/dist/publication/bundle-admission.js

@@ -0,0 +1,65 @@
+import { Key, MethodKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
+import { acceptBundleValue, decodeBundleValue, verifyBundleBytes } from './bundle.js';
+import { fail } from './error.js';
+import { validateRequirements } from './requirements.js';
+export function acceptBundle(input, artifact) {
+    const accepted = acceptBundleValue(artifact);
+    verifyBundleBytes(input, dslBundle.encode(accepted));
+    validateInventory(input, accepted);
+    return accepted;
+}
+export function decodeBundle(input, bytes) {
+    const decoded = decodeBundleValue(input, bytes);
+    validateInventory(input, decoded);
+    return decoded;
+}
+function validateInventory(publication, bundle) {
+    const root = bundle.root;
+    if (root.origin !== publication.origin || revision(root) !== publication.schema.revision) {
+        fail('PUBLICATION_INVALID', 'Bundle root does not match the Publication schema.');
+    }
+    validateRequirements(root, bundle.closure, publication.requirements);
+    const callables = concreteCallables(root);
+    const publishedCallables = new Set(publication.bindings.callables.map(({ callable }) => callable));
+    if (publishedCallables.size !== callables.size ||
+        [...callables].some((key) => !publishedCallables.has(key))) {
+        fail('PUBLICATION_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
+    }
+    const views = new Set(Object.keys(root.views).map((name) => Key.of({ origin: root.origin, kind: 'view', name })));
+    const publishedViews = new Set(publication.bindings.views.map(({ view }) => view));
+    if (publishedViews.size !== views.size || [...views].some((key) => !publishedViews.has(key))) {
+        fail('PUBLICATION_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
+    }
+    if (publication.manifest?.entrypoint !== undefined &&
+        (publication.manifest.entrypoint.origin !== root.origin ||
+            publication.manifest.entrypoint.kind !== 'view' ||
+            root.views[publication.manifest.entrypoint.name] === undefined)) {
+        fail('PUBLICATION_INVALID', 'Manifest entrypoint does not exist in the root schema.');
+    }
+    for (const route of publication.routes) {
+        if (!callables.has(route.callable)) {
+            fail('PUBLICATION_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
+        }
+    }
+}
+function concreteCallables(root) {
+    const result = new Set();
+    for (const name of Object.keys(root.functions)) {
+        result.add(Key.of({ origin: root.origin, kind: 'function', name }));
+    }
+    addClassMethods(result, root.origin, root.classes);
+    return result;
+}
+function addClassMethods(result, origin, definitions) {
+    for (const [owner, declaration] of Object.entries(definitions)) {
+        if (declaration.kind !== 'node')
+            continue;
+        for (const [name, method] of Object.entries(declaration.methods)) {
+            if (method.inheritance === 'abstract')
+                continue;
+            result.add(MethodKey.of({ origin, kind: 'class', name: owner }, name));
+        }
+    }
+}

package/dist/publication/bundle-descriptor.d.ts

@@ -0,0 +1,9 @@
+import * as artifact from '../artifact/index.js';
+export declare const BUNDLE_MEDIA_TYPE: 'application/vnd.astrale.domain-bundle+json;v=1';
+export interface BundleDescriptor {
+    readonly href: string;
+    readonly ref: artifact.Ref & {
+        readonly mediaType: typeof BUNDLE_MEDIA_TYPE;
+    };
+}
+export declare function admitBundleDescriptor(input: unknown): BundleDescriptor;

package/dist/publication/bundle-descriptor.js

@@ -0,0 +1,19 @@
+import * as artifact from '../artifact/index.js';
+import { absoluteHttpUrl, exact, record } from './content.js';
+import { fail } from './error.js';
+export const BUNDLE_MEDIA_TYPE = 'application/vnd.astrale.domain-bundle+json;v=1';
+export function admitBundleDescriptor(input) {
+    const value = record(input, 'PUBLICATION_INVALID', 'Bundle descriptor is invalid.');
+    exact(value, ['href', 'ref'], 'PUBLICATION_INVALID');
+    const ref = artifact.accept(value.ref);
+    if (ref.mediaType !== BUNDLE_MEDIA_TYPE) {
+        fail('PUBLICATION_INVALID', 'Bundle media type is unsupported.');
+    }
+    if (ref.size < 1) {
+        fail('PUBLICATION_INVALID', 'Bundle size is invalid.');
+    }
+    return Object.freeze({
+        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_INVALID'),
+        ref: Object.freeze({ ...ref, mediaType: BUNDLE_MEDIA_TYPE }),
+    });
+}

package/dist/publication/bundle-evidence.d.ts

@@ -0,0 +1,3 @@
+import type { Publication } from './publication.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export declare function verifyBundleBytes(publication: Publication, bytes: Uint8Array): void;

package/dist/publication/bundle-evidence.js

@@ -0,0 +1,13 @@
+import { fail } from './error.js';
+import { sha256Hex } from './etag.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export function verifyBundleBytes(publication, bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+        fail('PUBLICATION_INVALID', 'Bundle artifact bytes are invalid.');
+    }
+    const descriptor = publication.schema.bundle;
+    if (bytes.byteLength !== descriptor.ref.size ||
+        `sha256:${sha256Hex(bytes)}` !== descriptor.ref.digest) {
+        fail('PUBLICATION_INVALID', 'Bundle artifact does not match its descriptor.');
+    }
+}

package/dist/publication/bundle.d.ts

@@ -1,16 +1,9 @@
-import { bundle } from '@astrale-os/kernel-dsl/v1';
+import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
+import type { BundleDescriptor } from './bundle-descriptor.js';
 import type { Publication } from './publication.js';
-import * as artifact from '../artifact/index.js';
-export declare const BUNDLE_MEDIA_TYPE: 'application/vnd.astrale.domain-bundle+json;v=1';
-export interface BundleDescriptor {
-    readonly href: string;
-    readonly ref: artifact.Ref & {
-        readonly mediaType: typeof BUNDLE_MEDIA_TYPE;
-    };
-}
-export declare function admitBundleDescriptor(input: unknown): BundleDescriptor;
+import { verifyBundleBytes } from './bundle-evidence.js';
 export declare function describeBundle(input: bundle.Bundle, href: string): BundleDescriptor;
 export declare function acceptBundleValue(input: unknown): bundle.Bundle;
-export declare function verifyBundleBytes(publication: Publication, bytes: Uint8Array): void;
 export declare function decodeBundleValue(publication: Publication, bytes: Uint8Array): bundle.Bundle;
-//# sourceMappingURL=bundle.d.ts.map
+export { verifyBundleBytes };
+export { admitBundleDescriptor, BUNDLE_MEDIA_TYPE, type BundleDescriptor, } from './bundle-descriptor.js';

package/dist/publication/bundle.js

@@ -1,24 +1,9 @@
-import { bundle, schema } from '@astrale-os/kernel-dsl/v1';
+import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
 import * as artifact from '../artifact/index.js';
-import { absoluteHttpUrl, exact, record } from './content.js';
+import { BUNDLE_MEDIA_TYPE } from './bundle-descriptor.js';
+import { verifyBundleBytes } from './bundle-evidence.js';
+import { absoluteHttpUrl } from './content.js';
 import { fail } from './error.js';
-import { sha256Hex } from './etag.js';
-export const BUNDLE_MEDIA_TYPE = 'application/vnd.astrale.domain-bundle+json;v=1';
-export function admitBundleDescriptor(input) {
-    const value = record(input, 'PUBLICATION_INVALID', 'Bundle descriptor is invalid.');
-    exact(value, ['href', 'ref'], 'PUBLICATION_INVALID');
-    const ref = artifact.accept(value.ref);
-    if (ref.mediaType !== BUNDLE_MEDIA_TYPE) {
-        fail('PUBLICATION_INVALID', 'Bundle media type is unsupported.');
-    }
-    if (ref.size < 1) {
-        fail('PUBLICATION_INVALID', 'Bundle size is invalid.');
-    }
-    return Object.freeze({
-        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_INVALID'),
-        ref: Object.freeze({ ...ref, mediaType: BUNDLE_MEDIA_TYPE }),
-    });
-}
 export function describeBundle(input, href) {
     const bytes = bundle.encode(input);
     return Object.freeze({
@@ -34,19 +19,12 @@ export function acceptBundleValue(input) {
         return bundle.accept(input);
     }
     catch (cause) {
-        if (cause instanceof schema.Error) {
+        if (cause instanceof bundle.Error) {
             return fail('PUBLICATION_INVALID', 'Publication bundle is invalid.', cause);
         }
         throw cause;
     }
 }
-export function verifyBundleBytes(publication, bytes) {
-    const descriptor = publication.schema.bundle;
-    if (bytes.byteLength !== descriptor.ref.size ||
-        `sha256:${sha256Hex(bytes)}` !== descriptor.ref.digest) {
-        fail('PUBLICATION_INVALID', 'Bundle artifact does not match its descriptor.');
-    }
-}
 export function decodeBundleValue(publication, bytes) {
     if (!(bytes instanceof Uint8Array)) {
         fail('PUBLICATION_INVALID', 'Bundle artifact bytes are invalid.');
@@ -56,10 +34,11 @@ export function decodeBundleValue(publication, bytes) {
         return bundle.decode(bytes);
     }
     catch (cause) {
-        if (cause instanceof schema.Error) {
+        if (cause instanceof bundle.Error) {
             return fail('PUBLICATION_INVALID', 'Bundle artifact cannot be decoded.', cause);
         }
         throw cause;
     }
 }
-//# sourceMappingURL=bundle.js.map
+export { verifyBundleBytes };
+export { admitBundleDescriptor, BUNDLE_MEDIA_TYPE, } from './bundle-descriptor.js';

package/dist/publication/content.d.ts

@@ -8,4 +8,3 @@ export declare function unique(values: readonly string[], code: PublicationError
 export declare function deepFreeze<T>(value: T): T;
 export declare function absoluteHttpUrl(input: unknown, allowSearch: boolean, code: PublicationErrorCode, allowTemplate?: boolean): string;
 export declare function absoluteUrl(input: unknown, protocols: readonly string[], allowSearch: boolean, code: PublicationErrorCode, allowTemplate?: boolean): string;
-//# sourceMappingURL=content.d.ts.map

package/dist/publication/content.js

@@ -53,4 +53,3 @@ export function absoluteUrl(input, protocols, allowSearch, code, allowTemplate =
     }
     return input;
 }
-//# sourceMappingURL=content.js.map

package/dist/publication/declaration.d.ts

@@ -0,0 +1,11 @@
+import type { Authentication as DeliveryAuthentication } from './delivery-endpoint.js';
+import type { HttpRouteDeclaration } from './route.js';
+export interface DeliveryDeclaration {
+    readonly path: string;
+    readonly authentication: DeliveryAuthentication;
+}
+/** Provider-neutral deployment input selected independently from Domain and Adapter. */
+export interface Declaration {
+    readonly routes: readonly HttpRouteDeclaration[];
+    readonly delivery?: DeliveryDeclaration;
+}

package/dist/publication/declaration.js

@@ -0,0 +1 @@
+export {};

package/dist/publication/delivery/attestation.d.ts

@@ -4,4 +4,3 @@ export type Attestation = string & {
 };
 export declare function acceptAttestation(input: unknown): Attestation;
 export {};
-//# sourceMappingURL=attestation.d.ts.map

package/dist/publication/delivery/attestation.js

@@ -8,4 +8,3 @@ export function acceptAttestation(input) {
     }
     return input;
 }
-//# sourceMappingURL=attestation.js.map

package/dist/publication/delivery/claims.d.ts

@@ -1,16 +1,16 @@
-import * as auth from '@astrale-os/kernel-core/auth';
-import { type schema } from '@astrale-os/kernel-dsl/v1';
-import type { Etag } from '../index.js';
+import type { Subject } from '@astrale-os/kernel-core/auth/identity';
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Etag } from '../etag.js';
 import { PURPOSE } from './limits.js';
 export interface Claims {
     readonly purpose: typeof PURPOSE;
-    readonly iss: auth.IssuerId;
-    readonly sub: auth.IdentitySubject;
-    readonly aud: auth.IssuerId;
+    readonly iss: IssuerId;
+    readonly sub: Subject;
+    readonly aud: IssuerId;
     readonly nonce: string;
     readonly etag: Etag;
-    readonly schemaRevision: schema.Revision;
+    readonly schemaRevision: Revision;
     readonly exp: number;
 }
 export declare function acceptClaims(input: unknown): Claims;
-//# sourceMappingURL=claims.d.ts.map

package/dist/publication/delivery/claims.js

@@ -1,5 +1,6 @@
-import * as auth from '@astrale-os/kernel-core/auth';
-import { schema as dslSchema } from '@astrale-os/kernel-dsl/v1';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { fail } from './error.js';
 import { NONCE_MAX_LENGTH, NONCE_MIN_LENGTH, PURPOSE } from './limits.js';
 export function acceptClaims(input) {
@@ -26,8 +27,7 @@ export function acceptClaims(input) {
     if (typeof value.etag !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(value.etag)) {
         fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims ETag is invalid.');
     }
-    if (typeof value.schemaRevision !== 'string' ||
-        !dslSchema.patterns.revision.test(value.schemaRevision)) {
+    if (typeof value.schemaRevision !== 'string' || !patterns.revision.test(value.schemaRevision)) {
         fail('DELIVERY_CLAIMS_INVALID', 'Schema revision is invalid.');
     }
     return deepFreeze({
@@ -43,10 +43,10 @@ export function acceptClaims(input) {
 }
 function acceptIssuer(input) {
     try {
-        return auth.issuer.accept(String(input));
+        return acceptIssuerId(String(input));
     }
     catch (cause) {
-        if (cause instanceof auth.AuthValueError) {
+        if (cause instanceof AuthValueError) {
             return fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims issuer is invalid.', cause);
         }
         throw cause;
@@ -59,4 +59,3 @@ function deepFreeze(value) {
         deepFreeze(nested);
     return Object.freeze(value);
 }
-//# sourceMappingURL=claims.js.map

package/dist/publication/delivery/delivery.d.ts

@@ -1,4 +1,4 @@
-import type { Publication } from '../index.js';
+import type { Publication } from '../publication.js';
 import type { Attestation } from './attestation.js';
 export interface Delivery {
     readonly format: 'astrale.domain.delivery';
@@ -7,4 +7,3 @@ export interface Delivery {
     readonly attestation: Attestation;
 }
 export declare function accept(input: unknown): Delivery;
-//# sourceMappingURL=delivery.d.ts.map

package/dist/publication/delivery/delivery.js

@@ -1,4 +1,4 @@
-import { accept as acceptPublication } from '../index.js';
+import { accept as acceptPublication } from '../publication.js';
 import { acceptAttestation } from './attestation.js';
 import { fail } from './error.js';
 export function accept(input) {
@@ -27,4 +27,3 @@ function deepFreeze(value) {
         deepFreeze(nested);
     return Object.freeze(value);
 }
-//# sourceMappingURL=delivery.js.map

package/dist/publication/delivery/error.d.ts

@@ -5,4 +5,3 @@ export declare class DeliveryError extends Error {
     constructor(code: DeliveryErrorCode, message: string, options?: ErrorOptions);
 }
 export declare function fail(code: DeliveryErrorCode, message: string, cause?: unknown): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/publication/delivery/error.js

@@ -9,4 +9,3 @@ export class DeliveryError extends Error {
 export function fail(code, message, cause) {
     throw new DeliveryError(code, message, cause === undefined ? undefined : { cause });
 }
-//# sourceMappingURL=error.js.map

package/dist/publication/delivery/index.d.ts

@@ -4,4 +4,3 @@ export { DeliveryError as Error, type DeliveryErrorCode as ErrorCode } from './e
 export { accept, type Delivery } from './delivery.js';
 export { ATTESTATION_MAX_BYTES, NONCE_MAX_LENGTH, NONCE_MIN_LENGTH, PURPOSE } from './limits.js';
 export { acceptRequest, type Token, type Request } from './request.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/publication/delivery/index.js

@@ -4,4 +4,3 @@ export { DeliveryError as Error } from './error.js';
 export { accept } from './delivery.js';
 export { ATTESTATION_MAX_BYTES, NONCE_MAX_LENGTH, NONCE_MIN_LENGTH, PURPOSE } from './limits.js';
 export { acceptRequest } from './request.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/delivery/limits.d.ts

@@ -2,4 +2,3 @@ export declare const PURPOSE: 'astrale.domain.delivery.v1';
 export declare const NONCE_MIN_LENGTH = 16;
 export declare const NONCE_MAX_LENGTH = 256;
 export declare const ATTESTATION_MAX_BYTES = 16384;
-//# sourceMappingURL=limits.d.ts.map

package/dist/publication/delivery/limits.js

@@ -2,4 +2,3 @@ export const PURPOSE = 'astrale.domain.delivery.v1';
 export const NONCE_MIN_LENGTH = 16;
 export const NONCE_MAX_LENGTH = 256;
 export const ATTESTATION_MAX_BYTES = 16_384;
-//# sourceMappingURL=limits.js.map

package/dist/publication/delivery/request.d.ts

@@ -1,8 +1,8 @@
-import * as auth from '@astrale-os/kernel-core/auth';
-import type { Etag } from '../index.js';
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Etag } from '../etag.js';
 export interface Request {
     readonly version: 1;
-    readonly kernel: auth.IssuerId;
+    readonly kernel: IssuerId;
     readonly nonce: string;
     readonly etag: Etag;
 }
@@ -13,4 +13,3 @@ export interface Token {
 }
 /** Admit the exact request representation accepted by a Delivery transport boundary. */
 export declare function acceptRequest(input: unknown): Request;
-//# sourceMappingURL=request.d.ts.map