@astrale-os/kernel-protocol 0.5.0-beta.3 → 0.5.0-beta.30

package/dist/invocation/routing.d.ts

@@ -1,5 +1,6 @@
-import type { IssuerId } from '@astrale-os/kernel-core/auth';
-import type { Etag, PublicationRef } from '../publication/index.js';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Etag } from '../publication/etag.js';
+import type { PublicationRef } from '../publication/reference.js';
 export interface Via {
     readonly kind: 'via';
     readonly publication: PublicationRef;
@@ -11,4 +12,3 @@ export interface Refresh {
 }
 export type Routing = Via | Refresh;
 export declare function acceptRouting(input: unknown): Routing;
-//# sourceMappingURL=routing.d.ts.map

package/dist/invocation/routing.js

@@ -1,4 +1,5 @@
-import * as publication from '../publication/index.js';
+import { PublicationError } from '../publication/error.js';
+import { acceptReference } from '../publication/reference.js';
 import { digest, exactFields, invalid, issuerId, portableObject, required } from './admission.js';
 const VIA_FIELDS = new Set(['kind', 'publication', 'issuer']);
 const REFRESH_FIELDS = new Set(['kind', 'stale']);
@@ -10,12 +11,12 @@ export function acceptRouting(input) {
         try {
             return Object.freeze({
                 kind: 'via',
-                publication: publication.acceptReference(object.publication),
+                publication: acceptReference(object.publication),
                 issuer: issuerId(object.issuer, 'via routing.issuer'),
             });
         }
         catch (cause) {
-            if (cause instanceof publication.PublicationError) {
+            if (cause instanceof PublicationError) {
                 return invalid(`via routing.publication is invalid: ${cause.message}`);
             }
             throw cause;
@@ -31,4 +32,3 @@ export function acceptRouting(input) {
     }
     return invalid('routing.kind must be "via" or "refresh"');
 }
-//# sourceMappingURL=routing.js.map

package/dist/invocation/schema.d.ts

@@ -1,10 +1,9 @@
-import { type schema } from '@astrale-os/kernel-dsl/v1';
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Sha256Digest } from '../publication/index.js';
 /** Source-Kernel precondition for the active Schema Registration selected by one invocation. */
 export type SchemaTarget = {
     readonly target: Sha256Digest;
 } | {
-    readonly revision: schema.Revision;
+    readonly revision: Revision;
 };
 export declare function acceptSchemaTarget(input: unknown): SchemaTarget;
-//# sourceMappingURL=schema.d.ts.map

package/dist/invocation/schema.js

@@ -1,4 +1,4 @@
-import { schema as dslSchema } from '@astrale-os/kernel-dsl/v1';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { digest, exactFields, invalid, portableObject } from './admission.js';
 const FIELDS = new Set(['target', 'revision']);
 export function acceptSchemaTarget(input) {
@@ -12,9 +12,8 @@ export function acceptSchemaTarget(input) {
     if (hasTarget) {
         return Object.freeze({ target: digest(object.target, 'schema target.target') });
     }
-    if (typeof object.revision !== 'string' || !dslSchema.patterns.revision.test(object.revision)) {
+    if (typeof object.revision !== 'string' || !patterns.revision.test(object.revision)) {
         invalid('schema target.revision must be a Schema revision');
     }
     return Object.freeze({ revision: object.revision });
 }
-//# sourceMappingURL=schema.js.map

package/dist/invocation/service-reason.d.ts

@@ -1,41 +1,41 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Object as ValueObject } from '@astrale-os/kernel-dsl/value';
-import * as auth from '@astrale-os/kernel-core/auth';
-import { schema as dslSchema, type Key } from '@astrale-os/kernel-dsl/v1';
+import { type Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { ErrorPayload, ErrorReason } from '../errors/index.js';
 import { CODES } from '../errors/index.js';
-export declare const SCHEMA_UPGRADE_REQUIRED: 'SCHEMA_UPGRADE_REQUIRED';
+export declare const SCHEMA_REVISION_MISMATCH: 'SCHEMA_REVISION_MISMATCH';
 export declare const SERVICE_TRUST_REQUIRED: 'SERVICE_TRUST_REQUIRED';
 export declare const SERVICE_UNAVAILABLE: 'SERVICE_UNAVAILABLE';
 export declare const SERVICE_CANDIDATE_INVALID: 'SERVICE_CANDIDATE_INVALID';
-export type SchemaUpgradeRequiredDetails = ValueObject & {
+export type SchemaRevisionMismatchDetails = ValueObject & {
     readonly origin: Key.Origin;
-    readonly installedRevision: dslSchema.Revision;
-    readonly candidateRevision: dslSchema.Revision;
+    readonly expectedRevision: Revision;
+    readonly installedRevision: Revision;
 };
 export type ServiceTrustRequiredDetails = ValueObject & {
     readonly origin: Key.Origin;
-    readonly installedIssuer: auth.IssuerId;
-    readonly candidateIssuer: auth.IssuerId;
+    readonly installedIssuer: IssuerId;
+    readonly candidateIssuer: IssuerId;
 };
 export type ServiceUnavailableDetails = ValueObject & {
     readonly origin: Key.Origin;
-    readonly revision: dslSchema.Revision;
+    readonly revision: Revision;
 };
 export type ServiceCandidateInvalidDetails = ValueObject & {
     readonly origin: Key.Origin;
 };
-export type SchemaUpgradeRequiredReason = ErrorReason<typeof SCHEMA_UPGRADE_REQUIRED, SchemaUpgradeRequiredDetails>;
+export type SchemaRevisionMismatchReason = ErrorReason<typeof SCHEMA_REVISION_MISMATCH, SchemaRevisionMismatchDetails>;
 export type ServiceTrustRequiredReason = ErrorReason<typeof SERVICE_TRUST_REQUIRED, ServiceTrustRequiredDetails>;
 export type ServiceUnavailableReason = ErrorReason<typeof SERVICE_UNAVAILABLE, ServiceUnavailableDetails>;
 export type ServiceCandidateInvalidReason = ErrorReason<typeof SERVICE_CANDIDATE_INVALID, ServiceCandidateInvalidDetails>;
-export type ServiceReason = SchemaUpgradeRequiredReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason;
+export type ServiceReason = SchemaRevisionMismatchReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason;
 export type ServiceErrorPayload = (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.CONFLICT;
-    readonly data: SchemaUpgradeRequiredReason | ServiceTrustRequiredReason;
+    readonly data: SchemaRevisionMismatchReason | ServiceTrustRequiredReason;
 }) | (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.BACKEND_UNAVAILABLE;
     readonly data: ServiceUnavailableReason | ServiceCandidateInvalidReason;
 });
 /** Recognize only exact outer-code, reason-code, and detail-shape combinations. */
 export declare function serviceErrorOf(input: ErrorPayload): ServiceErrorPayload | undefined;
-//# sourceMappingURL=service-reason.d.ts.map

package/dist/invocation/service-reason.js

@@ -1,7 +1,8 @@
-import * as auth from '@astrale-os/kernel-core/auth';
-import { schema as dslSchema } from '@astrale-os/kernel-dsl/v1';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuer } from '@astrale-os/kernel-core/auth/issuer';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { CODES, reasonOf } from '../errors/index.js';
-export const SCHEMA_UPGRADE_REQUIRED = 'SCHEMA_UPGRADE_REQUIRED';
+export const SCHEMA_REVISION_MISMATCH = 'SCHEMA_REVISION_MISMATCH';
 export const SERVICE_TRUST_REQUIRED = 'SERVICE_TRUST_REQUIRED';
 export const SERVICE_UNAVAILABLE = 'SERVICE_UNAVAILABLE';
 export const SERVICE_CANDIDATE_INVALID = 'SERVICE_CANDIDATE_INVALID';
@@ -11,8 +12,8 @@ export function serviceErrorOf(input) {
     if (reason === undefined)
         return undefined;
     switch (reason.code) {
-        case SCHEMA_UPGRADE_REQUIRED:
-            return input.code === CODES.CONFLICT && schemaUpgradeDetails(reason.details)
+        case SCHEMA_REVISION_MISMATCH:
+            return input.code === CODES.CONFLICT && schemaRevisionMismatchDetails(reason.details)
                 ? input
                 : undefined;
         case SERVICE_TRUST_REQUIRED:
@@ -31,11 +32,11 @@ export function serviceErrorOf(input) {
             return undefined;
     }
 }
-function schemaUpgradeDetails(input) {
-    return (exact(input, ['origin', 'installedRevision', 'candidateRevision']) &&
+function schemaRevisionMismatchDetails(input) {
+    return (exact(input, ['origin', 'expectedRevision', 'installedRevision']) &&
         isOrigin(input.origin) &&
-        isRevision(input.installedRevision) &&
-        isRevision(input.candidateRevision));
+        isRevision(input.expectedRevision) &&
+        isRevision(input.installedRevision));
 }
 function serviceTrustDetails(input) {
     return (exact(input, ['origin', 'installedIssuer', 'candidateIssuer']) &&
@@ -54,21 +55,20 @@ function exact(input, fields) {
         fields.every((field) => Object.hasOwn(input, field)));
 }
 function isOrigin(input) {
-    return typeof input === 'string' && dslSchema.patterns.origin.test(input);
+    return typeof input === 'string' && patterns.origin.test(input);
 }
 function isRevision(input) {
-    return typeof input === 'string' && dslSchema.patterns.revision.test(input);
+    return typeof input === 'string' && patterns.revision.test(input);
 }
 function isIssuer(input) {
     if (typeof input !== 'string')
         return false;
     try {
-        return auth.issuer.accept(input) === input;
+        return acceptIssuer(input) === input;
     }
     catch (cause) {
-        if (cause instanceof auth.AuthValueError)
+        if (cause instanceof AuthValueError)
             return false;
         throw cause;
     }
 }
-//# sourceMappingURL=service-reason.js.map

package/dist/invocation/stale-route.d.ts

@@ -10,4 +10,3 @@ export interface Stale {
 }
 export declare function decodeStale(input: unknown): Stale;
 export declare function stale(requestId: RequestId, assigned: InvocationId, current: Etag): Stale;
-//# sourceMappingURL=stale-route.d.ts.map

package/dist/invocation/stale-route.js

@@ -17,4 +17,3 @@ export function decodeStale(input) {
 export function stale(requestId, assigned, current) {
     return decodeStale({ kind: 'stale', requestId, invocation: assigned, current });
 }
-//# sourceMappingURL=stale-route.js.map

package/dist/invocation/stream.d.ts

@@ -25,4 +25,3 @@ export interface StreamErrorFrame {
 }
 export type StreamFrame = StreamStartFrame | StreamItemFrame | StreamEndFrame | StreamErrorFrame;
 export declare function decodeStreamFrame(input: unknown): StreamFrame;
-//# sourceMappingURL=stream.d.ts.map

package/dist/invocation/stream.js

@@ -42,4 +42,3 @@ export function decodeStreamFrame(input) {
             return invalid(`unsupported stream frame kind ${JSON.stringify(kind)}`);
     }
 }
-//# sourceMappingURL=stream.js.map

package/dist/invocation/target.d.ts

@@ -1,4 +1,3 @@
-import type { Call } from '@astrale-os/kernel-core/domain';
-export type { Call } from '@astrale-os/kernel-core/domain';
+import type { Call } from '@astrale-os/kernel-core/callable';
+export type { Call } from '@astrale-os/kernel-core/callable';
 export declare function acceptCall(input: unknown): Call;
-//# sourceMappingURL=target.d.ts.map

package/dist/invocation/target.js

@@ -9,4 +9,3 @@ export function acceptCall(input) {
         input: object.input,
     });
 }
-//# sourceMappingURL=target.js.map

package/dist/invocation/trace.d.ts

@@ -7,4 +7,3 @@ export interface Trace {
 }
 /** Admit portable correlation syntax without making it an invocation validity condition. */
 export declare function admitTrace(input: unknown): Trace | undefined;
-//# sourceMappingURL=trace.d.ts.map

package/dist/invocation/trace.js

@@ -84,4 +84,3 @@ function validStateKey(input) {
         return false;
     return TENANT_ID.test(input.slice(0, separator)) && SYSTEM_ID.test(input.slice(separator + 1));
 }
-//# sourceMappingURL=trace.js.map

package/dist/invocation/version.d.ts

@@ -1,3 +1,2 @@
 export declare const VERSION: 2;
 export type Version = typeof VERSION;
-//# sourceMappingURL=version.d.ts.map

package/dist/invocation/version.js

@@ -1,2 +1 @@
 export const VERSION = 2;
-//# sourceMappingURL=version.js.map

package/dist/invocation/websocket/binary.d.ts

@@ -1,4 +1,3 @@
 import type { BinaryResponse } from '../binary.js';
 export declare function encodeBinary(response: BinaryResponse): Uint8Array;
 export declare function decodeBinary(input: Uint8Array): BinaryResponse | undefined;
-//# sourceMappingURL=binary.d.ts.map

package/dist/invocation/websocket/binary.js

@@ -4,7 +4,7 @@ const MAGIC = new Uint8Array([0x41, 0x53, 0x54, 0x42, 0x01]);
 const LENGTH_BYTES = 4;
 const MAXIMUM_METADATA_BYTES = 65_536;
 const encoder = new TextEncoder();
-const decoder = new TextDecoder('utf-8', { fatal: true });
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false });
 export function encodeBinary(response) {
     const headers = response.headers === undefined
         ? undefined
@@ -14,6 +14,7 @@ export function encodeBinary(response) {
         requestId: response.requestId,
         invocation: response.invocation,
         mediaType: response.mediaType,
+        status: response.status,
         ...(headers === undefined ? {} : { headers }),
     }));
     if (metadata.byteLength > MAXIMUM_METADATA_BYTES)
@@ -69,4 +70,3 @@ function invalid() {
         message: 'WebSocket binary response is invalid.',
     });
 }
-//# sourceMappingURL=binary.js.map

package/dist/invocation/websocket/index.d.ts

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
 export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/websocket/index.js

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
 export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';
-//# sourceMappingURL=index.js.map

package/dist/invocation/websocket/subprotocol.d.ts

@@ -8,4 +8,3 @@ export interface SubprotocolSelection {
 }
 export declare function subprotocolFor(codec: Codec): Subprotocol;
 export declare function selectSubprotocol(offered: string | null, supported: readonly Codec[]): SubprotocolSelection | undefined;
-//# sourceMappingURL=subprotocol.d.ts.map

package/dist/invocation/websocket/subprotocol.js

@@ -27,4 +27,3 @@ export function selectSubprotocol(offered, supported) {
     }
     return undefined;
 }
-//# sourceMappingURL=subprotocol.js.map

package/dist/issuer/configuration.d.ts

@@ -1,4 +1,4 @@
-import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export interface Configuration {
     readonly issuer: IssuerId;
     readonly jwks_uri: string;
@@ -12,4 +12,3 @@ export interface ConfigurationOptions {
 export declare function configuration(issuer: string, algorithms: readonly [string, ...string[]], options?: ConfigurationOptions): Configuration;
 export declare function acceptConfiguration(input: unknown, expectedIssuer?: string): Configuration;
 export declare function acceptAlgorithms(input: unknown): readonly [string, ...string[]];
-//# sourceMappingURL=configuration.d.ts.map

package/dist/issuer/configuration.js

@@ -84,4 +84,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=configuration.js.map

package/dist/issuer/error.d.ts

@@ -5,4 +5,3 @@ export declare class DiscoveryError extends Error {
     constructor(code: DiscoveryErrorCode, message: string, options?: ErrorOptions);
 }
 export declare function fail(code: DiscoveryErrorCode, message: string, cause?: unknown): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/issuer/error.js

@@ -9,4 +9,3 @@ export class DiscoveryError extends Error {
 export function fail(code, message, cause) {
     throw new DiscoveryError(code, message, cause === undefined ? undefined : { cause });
 }
-//# sourceMappingURL=error.js.map

package/dist/issuer/exchange.d.ts

@@ -23,4 +23,3 @@ export declare function acceptResponse(input: unknown): Response;
 export declare function acceptErrorResponse(input: unknown): ErrorResponse;
 export declare function acceptHttpRequest(input: HttpRequest): Request;
 export declare function responseHeaders(): Readonly<Record<string, string>>;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -127,4 +127,3 @@ function nonEmptyText(input, label) {
     }
     return input;
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/hosted.d.ts

@@ -1,3 +1,2 @@
-import type { IssuerId } from '@astrale-os/kernel-core/auth';
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function hosted(base: string, thumbprint: string): IssuerId | undefined;
-//# sourceMappingURL=hosted.d.ts.map

package/dist/issuer/hosted.js

@@ -5,4 +5,3 @@ export function hosted(base, thumbprint) {
         return undefined;
     return acceptIssuer(`${acceptIssuer(base)}/iss/${thumbprint}`);
 }
-//# sourceMappingURL=hosted.js.map

package/dist/issuer/index.d.ts

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/key-set.d.ts

@@ -1,7 +1,6 @@
-import { type JsonWebKey } from '@astrale-os/kernel-core/auth';
+import { type JsonWebKey } from '@astrale-os/kernel-core/auth/jwk';
 export interface KeySet {
     readonly keys: readonly JsonWebKey[];
 }
 export declare function keySet(keys: readonly JsonWebKey[], algorithms: readonly [string, ...string[]]): KeySet;
 export declare function acceptKeySet(input: unknown, algorithms: readonly [string, ...string[]]): KeySet;
-//# sourceMappingURL=key-set.d.ts.map

package/dist/issuer/key-set.js

@@ -1,4 +1,5 @@
-import { AuthValueError, jwk } from '@astrale-os/kernel-core/auth';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { acceptPublic } from '@astrale-os/kernel-core/auth/jwk';
 import { acceptAlgorithms } from './configuration.js';
 import { fail } from './error.js';
 export function keySet(keys, algorithms) {
@@ -22,7 +23,7 @@ export function acceptKeySet(input, algorithms) {
 function admitKey(input, algorithms) {
     let accepted;
     try {
-        accepted = jwk.acceptPublic(input);
+        accepted = acceptPublic(input);
     }
     catch (cause) {
         if (cause instanceof AuthValueError) {
@@ -45,4 +46,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=key-set.js.map

package/dist/issuer/paths.d.ts

@@ -4,4 +4,3 @@ export interface Paths {
     readonly tokenExchange: string;
 }
 export declare function paths(issuer: string): Paths;
-//# sourceMappingURL=paths.d.ts.map

package/dist/issuer/paths.js

@@ -8,4 +8,3 @@ export function paths(issuer) {
         tokenExchange: `${pathname}/.well-known/astrale/token`,
     });
 }
-//# sourceMappingURL=paths.js.map

package/dist/issuer/url.d.ts

@@ -1,3 +1,2 @@
-import { type IssuerId } from '@astrale-os/kernel-core/auth';
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function acceptIssuer(input: unknown): IssuerId;
-//# sourceMappingURL=url.d.ts.map

package/dist/issuer/url.js

@@ -1,4 +1,5 @@
-import { AuthValueError, issuer } from '@astrale-os/kernel-core/auth';
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import { fail } from './error.js';
 export function acceptIssuer(input) {
     if (typeof input !== 'string') {
@@ -22,7 +23,7 @@ export function acceptIssuer(input) {
         fail('ISSUER_DISCOVERY_INVALID', 'Issuer must be HTTP(S) without credentials, query, or fragment.');
     }
     try {
-        return issuer.accept(input.replace(/\/+$/u, ''));
+        return acceptIssuerId(input.replace(/\/+$/u, ''));
     }
     catch (cause) {
         if (cause instanceof AuthValueError) {
@@ -31,4 +32,3 @@ export function acceptIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=url.js.map

package/dist/publication/bindings/callable.d.ts

@@ -1,4 +1,4 @@
-import { Key } from '@astrale-os/kernel-dsl/v1';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { InvocationEndpoints } from './invocation.js';
 export interface CallableBinding {
     readonly callable: Key.Callable;
@@ -6,4 +6,3 @@ export interface CallableBinding {
 }
 export declare function admitCallableBinding(input: unknown, origin: string): CallableBinding;
 export declare function admitCallableKey(input: unknown, origin: string): Key.Callable;
-//# sourceMappingURL=callable.d.ts.map

package/dist/publication/bindings/callable.js

@@ -1,4 +1,4 @@
-import { Key, Ref } from '@astrale-os/kernel-dsl/v1';
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { exact, record } from '../content.js';
 import { fail } from '../error.js';
 import { acceptInvocationEndpoints } from './invocation.js';
@@ -21,12 +21,14 @@ export function admitCallableKey(input, origin) {
         }
         throw cause;
     }
-    const reference = Key.ref(callable);
-    if (Key.origin(callable) !== origin ||
-        (!Ref.isDefinition(reference) && !Ref.isMethod(reference)) ||
-        (!reference.startsWith('function.') && !Ref.isMethod(reference))) {
+    if (Key.origin(callable) !== origin) {
         fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
+    try {
+        callableAddress(callable);
+    }
+    catch (cause) {
+        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+    }
     return callable;
 }
-//# sourceMappingURL=callable.js.map

package/dist/publication/bindings/index.d.ts

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey, type CallableBinding } from './callable.js';
 export { acceptInvocationEndpoints, type InvocationEndpoints } from './invocation.js';
-export { admitViewBinding, type ViewBinding } from './view.js';
-//# sourceMappingURL=index.d.ts.map
+export { admitViewBinding, type IframeRequirements, type ViewBinding } from './view.js';

package/dist/publication/bindings/index.js

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey } from './callable.js';
 export { acceptInvocationEndpoints } from './invocation.js';
 export { admitViewBinding } from './view.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/bindings/invocation.d.ts

@@ -3,4 +3,3 @@ export interface InvocationEndpoints {
     readonly websocket?: string;
 }
 export declare function acceptInvocationEndpoints(input: unknown): InvocationEndpoints;
-//# sourceMappingURL=invocation.d.ts.map

package/dist/publication/bindings/invocation.js

@@ -11,4 +11,3 @@ export function acceptInvocationEndpoints(input) {
         ...(websocket === undefined ? {} : { websocket }),
     });
 }
-//# sourceMappingURL=invocation.js.map

package/dist/publication/bindings/view.d.ts

@@ -1,8 +1,14 @@
-import { Key } from '@astrale-os/kernel-dsl/v1';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 export interface ViewBinding {
     readonly view: Key.View;
     readonly href: string;
     readonly handshake: 'shell' | 'none';
+    readonly iframe?: IframeRequirements;
+}
+export interface IframeRequirements {
+    readonly sandbox?: readonly string[];
+    readonly allow?: readonly string[];
 }
 export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
-//# sourceMappingURL=view.d.ts.map
+/** Authoring-only normalization used before a Publication receives its canonical ETag. */
+export declare function canonicalizeViewBinding(input: unknown, origin: string): ViewBinding;