@astrale-os/kernel-protocol 0.5.0-beta.6 → 0.5.0-beta.60

package/dist/invocation/service-reason.d.ts

@@ -1,24 +1,28 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
-import type { Revision } from '@astrale-os/kernel-dsl/v1/schema';
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Object as ValueObject } from '@astrale-os/kernel-dsl/value';
-import { type Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { ErrorPayload, ErrorReason } from '../errors/index.js';
+import type { Sha256Digest } from '../publication/index.js';
 import { CODES } from '../errors/index.js';
-export declare const SCHEMA_UPGRADE_REQUIRED: 'SCHEMA_UPGRADE_REQUIRED';
+/** @deprecated Emitted only for the deprecated revision pin; fingerprint pins report CALLABLE_FINGERPRINT_MISMATCH. */
 export declare const SCHEMA_REVISION_MISMATCH: 'SCHEMA_REVISION_MISMATCH';
+export declare const CALLABLE_FINGERPRINT_MISMATCH: 'CALLABLE_FINGERPRINT_MISMATCH';
 export declare const SERVICE_TRUST_REQUIRED: 'SERVICE_TRUST_REQUIRED';
 export declare const SERVICE_UNAVAILABLE: 'SERVICE_UNAVAILABLE';
 export declare const SERVICE_CANDIDATE_INVALID: 'SERVICE_CANDIDATE_INVALID';
-export type SchemaUpgradeRequiredDetails = ValueObject & {
-    readonly origin: Key.Origin;
-    readonly installedRevision: Revision;
-    readonly candidateRevision: Revision;
-};
+/** @deprecated Detail shape of the deprecated revision pin conflict. */
 export type SchemaRevisionMismatchDetails = ValueObject & {
     readonly origin: Key.Origin;
     readonly expectedRevision: Revision;
     readonly installedRevision: Revision;
 };
+export type CallableFingerprintMismatchDetails = ValueObject & {
+    readonly origin: Key.Origin;
+    readonly callable: Key.Callable;
+    readonly expectedFingerprint: Sha256Digest;
+    readonly installedFingerprint: Sha256Digest;
+};
 export type ServiceTrustRequiredDetails = ValueObject & {
     readonly origin: Key.Origin;
     readonly installedIssuer: IssuerId;
@@ -31,19 +35,19 @@ export type ServiceUnavailableDetails = ValueObject & {
 export type ServiceCandidateInvalidDetails = ValueObject & {
     readonly origin: Key.Origin;
 };
-export type SchemaUpgradeRequiredReason = ErrorReason<typeof SCHEMA_UPGRADE_REQUIRED, SchemaUpgradeRequiredDetails>;
+/** @deprecated Detail shape of the deprecated revision pin conflict. */
 export type SchemaRevisionMismatchReason = ErrorReason<typeof SCHEMA_REVISION_MISMATCH, SchemaRevisionMismatchDetails>;
+export type CallableFingerprintMismatchReason = ErrorReason<typeof CALLABLE_FINGERPRINT_MISMATCH, CallableFingerprintMismatchDetails>;
 export type ServiceTrustRequiredReason = ErrorReason<typeof SERVICE_TRUST_REQUIRED, ServiceTrustRequiredDetails>;
 export type ServiceUnavailableReason = ErrorReason<typeof SERVICE_UNAVAILABLE, ServiceUnavailableDetails>;
 export type ServiceCandidateInvalidReason = ErrorReason<typeof SERVICE_CANDIDATE_INVALID, ServiceCandidateInvalidDetails>;
-export type ServiceReason = SchemaRevisionMismatchReason | SchemaUpgradeRequiredReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason;
+export type ServiceReason = SchemaRevisionMismatchReason | CallableFingerprintMismatchReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason;
 export type ServiceErrorPayload = (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.CONFLICT;
-    readonly data: SchemaRevisionMismatchReason | SchemaUpgradeRequiredReason | ServiceTrustRequiredReason;
+    readonly data: SchemaRevisionMismatchReason | CallableFingerprintMismatchReason | ServiceTrustRequiredReason;
 }) | (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.BACKEND_UNAVAILABLE;
     readonly data: ServiceUnavailableReason | ServiceCandidateInvalidReason;
 });
 /** Recognize only exact outer-code, reason-code, and detail-shape combinations. */
 export declare function serviceErrorOf(input: ErrorPayload): ServiceErrorPayload | undefined;
-//# sourceMappingURL=service-reason.d.ts.map

package/dist/invocation/service-reason.js

@@ -1,9 +1,10 @@
 import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
 import { accept as acceptIssuer } from '@astrale-os/kernel-core/auth/issuer';
-import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { Key, patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { CODES, reasonOf } from '../errors/index.js';
-export const SCHEMA_UPGRADE_REQUIRED = 'SCHEMA_UPGRADE_REQUIRED';
+/** @deprecated Emitted only for the deprecated revision pin; fingerprint pins report CALLABLE_FINGERPRINT_MISMATCH. */
 export const SCHEMA_REVISION_MISMATCH = 'SCHEMA_REVISION_MISMATCH';
+export const CALLABLE_FINGERPRINT_MISMATCH = 'CALLABLE_FINGERPRINT_MISMATCH';
 export const SERVICE_TRUST_REQUIRED = 'SERVICE_TRUST_REQUIRED';
 export const SERVICE_UNAVAILABLE = 'SERVICE_UNAVAILABLE';
 export const SERVICE_CANDIDATE_INVALID = 'SERVICE_CANDIDATE_INVALID';
@@ -17,8 +18,8 @@ export function serviceErrorOf(input) {
             return input.code === CODES.CONFLICT && schemaRevisionMismatchDetails(reason.details)
                 ? input
                 : undefined;
-        case SCHEMA_UPGRADE_REQUIRED:
-            return input.code === CODES.CONFLICT && schemaUpgradeDetails(reason.details)
+        case CALLABLE_FINGERPRINT_MISMATCH:
+            return input.code === CODES.CONFLICT && callableFingerprintMismatchDetails(reason.details)
                 ? input
                 : undefined;
         case SERVICE_TRUST_REQUIRED:
@@ -43,11 +44,14 @@ function schemaRevisionMismatchDetails(input) {
         isRevision(input.expectedRevision) &&
         isRevision(input.installedRevision));
 }
-function schemaUpgradeDetails(input) {
-    return (exact(input, ['origin', 'installedRevision', 'candidateRevision']) &&
+function callableFingerprintMismatchDetails(input) {
+    return (exact(input, ['origin', 'callable', 'expectedFingerprint', 'installedFingerprint']) &&
         isOrigin(input.origin) &&
-        isRevision(input.installedRevision) &&
-        isRevision(input.candidateRevision));
+        typeof input.callable === 'string' &&
+        Key.is(input.callable) &&
+        Key.origin(input.callable) === input.origin &&
+        isDigest(input.expectedFingerprint) &&
+        isDigest(input.installedFingerprint));
 }
 function serviceTrustDetails(input) {
     return (exact(input, ['origin', 'installedIssuer', 'candidateIssuer']) &&
@@ -71,6 +75,9 @@ function isOrigin(input) {
 function isRevision(input) {
     return typeof input === 'string' && patterns.revision.test(input);
 }
+function isDigest(input) {
+    return typeof input === 'string' && /^sha256:[0-9a-f]{64}$/u.test(input);
+}
 function isIssuer(input) {
     if (typeof input !== 'string')
         return false;
@@ -83,4 +90,3 @@ function isIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=service-reason.js.map

package/dist/invocation/stale-route.d.ts

@@ -10,4 +10,3 @@ export interface Stale {
 }
 export declare function decodeStale(input: unknown): Stale;
 export declare function stale(requestId: RequestId, assigned: InvocationId, current: Etag): Stale;
-//# sourceMappingURL=stale-route.d.ts.map

package/dist/invocation/stale-route.js

@@ -17,4 +17,3 @@ export function decodeStale(input) {
 export function stale(requestId, assigned, current) {
     return decodeStale({ kind: 'stale', requestId, invocation: assigned, current });
 }
-//# sourceMappingURL=stale-route.js.map

package/dist/invocation/stream.d.ts

@@ -25,4 +25,3 @@ export interface StreamErrorFrame {
 }
 export type StreamFrame = StreamStartFrame | StreamItemFrame | StreamEndFrame | StreamErrorFrame;
 export declare function decodeStreamFrame(input: unknown): StreamFrame;
-//# sourceMappingURL=stream.d.ts.map

package/dist/invocation/stream.js

@@ -42,4 +42,3 @@ export function decodeStreamFrame(input) {
             return invalid(`unsupported stream frame kind ${JSON.stringify(kind)}`);
     }
 }
-//# sourceMappingURL=stream.js.map

package/dist/invocation/target.d.ts

@@ -1,4 +1,3 @@
-import type { Call } from '@astrale-os/kernel-core/domain';
-export type { Call } from '@astrale-os/kernel-core/domain';
+import { type Call } from '@astrale-os/kernel-core/callable';
+export { Target, targetPath, type Call } from '@astrale-os/kernel-core/callable';
 export declare function acceptCall(input: unknown): Call;
-//# sourceMappingURL=target.d.ts.map

package/dist/invocation/target.js

@@ -1,12 +1,26 @@
-import { exactFields, nodePath, portableObject, required } from './admission.js';
+import { Target } from '@astrale-os/kernel-core/callable';
+import { PathError } from '@astrale-os/kernel-core/path';
+import { exactFields, invalid, nodePath, portableObject, required } from './admission.js';
+export { Target, targetPath } from '@astrale-os/kernel-core/callable';
 const CALL_FIELDS = new Set(['target', 'input']);
 export function acceptCall(input) {
     const object = portableObject(input, 'call');
     exactFields(object, CALL_FIELDS, 'call');
     required(object, ['target', 'input'], 'call');
     return Object.freeze({
-        target: nodePath(object.target, 'call.target'),
+        target: acceptTarget(object.target),
         input: object.input,
     });
 }
-//# sourceMappingURL=target.js.map
+function acceptTarget(input) {
+    if (typeof input === 'string')
+        return nodePath(input, 'call.target');
+    try {
+        return Target(input);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError || cause instanceof PathError)
+            return invalid('call.target must be a canonical NodePath or declaration Target');
+        throw cause;
+    }
+}

package/dist/invocation/trace.d.ts

@@ -7,4 +7,3 @@ export interface Trace {
 }
 /** Admit portable correlation syntax without making it an invocation validity condition. */
 export declare function admitTrace(input: unknown): Trace | undefined;
-//# sourceMappingURL=trace.d.ts.map

package/dist/invocation/trace.js

@@ -84,4 +84,3 @@ function validStateKey(input) {
         return false;
     return TENANT_ID.test(input.slice(0, separator)) && SYSTEM_ID.test(input.slice(separator + 1));
 }
-//# sourceMappingURL=trace.js.map

package/dist/invocation/version.d.ts

@@ -1,3 +1,2 @@
 export declare const VERSION: 2;
 export type Version = typeof VERSION;
-//# sourceMappingURL=version.d.ts.map

package/dist/invocation/version.js

@@ -1,2 +1 @@
 export const VERSION = 2;
-//# sourceMappingURL=version.js.map

package/dist/invocation/websocket/binary.d.ts

@@ -1,4 +1,3 @@
 import type { BinaryResponse } from '../binary.js';
 export declare function encodeBinary(response: BinaryResponse): Uint8Array;
 export declare function decodeBinary(input: Uint8Array): BinaryResponse | undefined;
-//# sourceMappingURL=binary.d.ts.map

package/dist/invocation/websocket/binary.js

@@ -4,7 +4,7 @@ const MAGIC = new Uint8Array([0x41, 0x53, 0x54, 0x42, 0x01]);
 const LENGTH_BYTES = 4;
 const MAXIMUM_METADATA_BYTES = 65_536;
 const encoder = new TextEncoder();
-const decoder = new TextDecoder('utf-8', { fatal: true });
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: false });
 export function encodeBinary(response) {
     const headers = response.headers === undefined
         ? undefined
@@ -14,6 +14,7 @@ export function encodeBinary(response) {
         requestId: response.requestId,
         invocation: response.invocation,
         mediaType: response.mediaType,
+        status: response.status,
         ...(headers === undefined ? {} : { headers }),
     }));
     if (metadata.byteLength > MAXIMUM_METADATA_BYTES)
@@ -69,4 +70,3 @@ function invalid() {
         message: 'WebSocket binary response is invalid.',
     });
 }
-//# sourceMappingURL=binary.js.map

package/dist/invocation/websocket/index.d.ts

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
 export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invocation/websocket/index.js

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
 export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';
-//# sourceMappingURL=index.js.map

package/dist/invocation/websocket/subprotocol.d.ts

@@ -8,4 +8,3 @@ export interface SubprotocolSelection {
 }
 export declare function subprotocolFor(codec: Codec): Subprotocol;
 export declare function selectSubprotocol(offered: string | null, supported: readonly Codec[]): SubprotocolSelection | undefined;
-//# sourceMappingURL=subprotocol.d.ts.map

package/dist/invocation/websocket/subprotocol.js

@@ -27,4 +27,3 @@ export function selectSubprotocol(offered, supported) {
     }
     return undefined;
 }
-//# sourceMappingURL=subprotocol.js.map

package/dist/issuer/configuration.d.ts

@@ -12,4 +12,3 @@ export interface ConfigurationOptions {
 export declare function configuration(issuer: string, algorithms: readonly [string, ...string[]], options?: ConfigurationOptions): Configuration;
 export declare function acceptConfiguration(input: unknown, expectedIssuer?: string): Configuration;
 export declare function acceptAlgorithms(input: unknown): readonly [string, ...string[]];
-//# sourceMappingURL=configuration.d.ts.map

package/dist/issuer/configuration.js

@@ -84,4 +84,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=configuration.js.map

package/dist/issuer/error.d.ts

@@ -5,4 +5,3 @@ export declare class DiscoveryError extends Error {
     constructor(code: DiscoveryErrorCode, message: string, options?: ErrorOptions);
 }
 export declare function fail(code: DiscoveryErrorCode, message: string, cause?: unknown): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/issuer/error.js

@@ -9,4 +9,3 @@ export class DiscoveryError extends Error {
 export function fail(code, message, cause) {
     throw new DiscoveryError(code, message, cause === undefined ? undefined : { cause });
 }
-//# sourceMappingURL=error.js.map

package/dist/issuer/exchange.d.ts

@@ -23,4 +23,3 @@ export declare function acceptResponse(input: unknown): Response;
 export declare function acceptErrorResponse(input: unknown): ErrorResponse;
 export declare function acceptHttpRequest(input: HttpRequest): Request;
 export declare function responseHeaders(): Readonly<Record<string, string>>;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -127,4 +127,3 @@ function nonEmptyText(input, label) {
     }
     return input;
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/hosted.d.ts

@@ -1,3 +1,2 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function hosted(base: string, thumbprint: string): IssuerId | undefined;
-//# sourceMappingURL=hosted.d.ts.map

package/dist/issuer/hosted.js

@@ -5,4 +5,3 @@ export function hosted(base, thumbprint) {
         return undefined;
     return acceptIssuer(`${acceptIssuer(base)}/iss/${thumbprint}`);
 }
-//# sourceMappingURL=hosted.js.map

package/dist/issuer/index.d.ts

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -4,4 +4,3 @@ export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/key-set.d.ts

@@ -4,4 +4,3 @@ export interface KeySet {
 }
 export declare function keySet(keys: readonly JsonWebKey[], algorithms: readonly [string, ...string[]]): KeySet;
 export declare function acceptKeySet(input: unknown, algorithms: readonly [string, ...string[]]): KeySet;
-//# sourceMappingURL=key-set.d.ts.map

package/dist/issuer/key-set.js

@@ -46,4 +46,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=key-set.js.map

package/dist/issuer/paths.d.ts

@@ -4,4 +4,3 @@ export interface Paths {
     readonly tokenExchange: string;
 }
 export declare function paths(issuer: string): Paths;
-//# sourceMappingURL=paths.d.ts.map

package/dist/issuer/paths.js

@@ -8,4 +8,3 @@ export function paths(issuer) {
         tokenExchange: `${pathname}/.well-known/astrale/token`,
     });
 }
-//# sourceMappingURL=paths.js.map

package/dist/issuer/url.d.ts

@@ -1,3 +1,2 @@
 import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function acceptIssuer(input: unknown): IssuerId;
-//# sourceMappingURL=url.d.ts.map

package/dist/issuer/url.js

@@ -32,4 +32,3 @@ export function acceptIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=url.js.map

package/dist/publication/bindings/callable.d.ts

@@ -6,4 +6,3 @@ export interface CallableBinding {
 }
 export declare function admitCallableBinding(input: unknown, origin: string): CallableBinding;
 export declare function admitCallableKey(input: unknown, origin: string): Key.Callable;
-//# sourceMappingURL=callable.d.ts.map

package/dist/publication/bindings/callable.js

@@ -1,4 +1,4 @@
-import { Key, Ref } from '@astrale-os/kernel-dsl/v1/addressing';
+import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { exact, record } from '../content.js';
 import { fail } from '../error.js';
 import { acceptInvocationEndpoints } from './invocation.js';
@@ -21,12 +21,14 @@ export function admitCallableKey(input, origin) {
         }
         throw cause;
     }
-    const reference = Key.ref(callable);
-    if (Key.origin(callable) !== origin ||
-        (!Ref.isDefinition(reference) && !Ref.isMethod(reference)) ||
-        (!reference.startsWith('function.') && !Ref.isMethod(reference))) {
+    if (Key.origin(callable) !== origin) {
         fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
+    try {
+        callableAddress(callable);
+    }
+    catch (cause) {
+        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+    }
     return callable;
 }
-//# sourceMappingURL=callable.js.map

package/dist/publication/bindings/index.d.ts

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey, type CallableBinding } from './callable.js';
 export { acceptInvocationEndpoints, type InvocationEndpoints } from './invocation.js';
-export { admitViewBinding, type ViewBinding } from './view.js';
-//# sourceMappingURL=index.d.ts.map
+export { admitViewBinding, type IframeRequirements, type ViewBinding } from './view.js';

package/dist/publication/bindings/index.js

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey } from './callable.js';
 export { acceptInvocationEndpoints } from './invocation.js';
 export { admitViewBinding } from './view.js';
-//# sourceMappingURL=index.js.map

package/dist/publication/bindings/invocation.d.ts

@@ -3,4 +3,3 @@ export interface InvocationEndpoints {
     readonly websocket?: string;
 }
 export declare function acceptInvocationEndpoints(input: unknown): InvocationEndpoints;
-//# sourceMappingURL=invocation.d.ts.map

package/dist/publication/bindings/invocation.js

@@ -11,4 +11,3 @@ export function acceptInvocationEndpoints(input) {
         ...(websocket === undefined ? {} : { websocket }),
     });
 }
-//# sourceMappingURL=invocation.js.map

package/dist/publication/bindings/view.d.ts

@@ -1,8 +1,16 @@
+import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 export interface ViewBinding {
     readonly view: Key.View;
     readonly href: string;
     readonly handshake: 'shell' | 'none';
+    readonly iframe?: IframeRequirements;
+    readonly host?: ViewHostRequirements;
+}
+export interface IframeRequirements {
+    readonly sandbox?: readonly string[];
+    readonly allow?: readonly string[];
 }
 export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
-//# sourceMappingURL=view.d.ts.map
+/** Authoring-only normalization used before a Publication receives its canonical ETag. */
+export declare function canonicalizeViewBinding(input: unknown, origin: string): ViewBinding;

package/dist/publication/bindings/view.js

@@ -1,9 +1,18 @@
+import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { absoluteHttpUrl, exact, record } from '../content.js';
 import { fail } from '../error.js';
+const TOKEN = /^[a-z][a-z0-9-]*$/u;
 export function admitViewBinding(input, origin) {
+    return readViewBinding(input, origin, false);
+}
+/** Authoring-only normalization used before a Publication receives its canonical ETag. */
+export function canonicalizeViewBinding(input, origin) {
+    return readViewBinding(input, origin, true);
+}
+function readViewBinding(input, origin, canonicalize) {
     const value = record(input, 'PUBLICATION_VIEW_INVALID', 'Published View binding is invalid.');
-    exact(value, ['view', 'href', 'handshake'], 'PUBLICATION_VIEW_INVALID');
+    exact(value, ['view', 'href', 'handshake', 'iframe', 'host'], 'PUBLICATION_VIEW_INVALID');
     let view;
     try {
         view = Key(String(value.view));
@@ -14,16 +23,126 @@ export function admitViewBinding(input, origin) {
         }
         throw cause;
     }
-    if (Key.origin(view) !== origin || !Key.ref(view).startsWith('view.')) {
+    if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
         fail('PUBLICATION_VIEW_INVALID', 'View binding must name a root View.');
     }
     if (value.handshake !== 'shell' && value.handshake !== 'none') {
         fail('PUBLICATION_VIEW_INVALID', 'View handshake is invalid.');
     }
+    const iframe = admitIframeRequirements(dataValue(value, 'iframe'), value.handshake, canonicalize);
+    let host;
+    try {
+        host = acceptViewHostRequirements(dataValue(value, 'host'), value.handshake, canonicalize);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            return fail('PUBLICATION_VIEW_INVALID', 'View host requirements are invalid.', cause);
+        throw cause;
+    }
     return Object.freeze({
         view,
         href: absoluteHttpUrl(value.href, true, 'PUBLICATION_VIEW_INVALID'),
         handshake: value.handshake,
+        ...(iframe === undefined ? {} : { iframe }),
+        ...(host === undefined ? {} : { host }),
+    });
+}
+function admitIframeRequirements(input, handshake, canonicalize) {
+    if (input === undefined)
+        return undefined;
+    const value = plainRecord(input);
+    exactOwnKeys(value, ['sandbox', 'allow']);
+    if (!canonicalize && (!Object.hasOwn(value, 'sandbox') || !Object.hasOwn(value, 'allow'))) {
+        invalid();
+    }
+    const sandbox = tokens(dataValue(value, 'sandbox'), canonicalize);
+    const allow = tokens(dataValue(value, 'allow'), canonicalize);
+    assertRelationships(sandbox);
+    const baselineSandbox = handshake === 'shell' ? ['allow-same-origin', 'allow-scripts'] : ['allow-scripts'];
+    const baselineAllow = handshake === 'shell' ? ['clipboard-write'] : [];
+    if (!canonicalize &&
+        (sandbox.some((token) => baselineSandbox.includes(token)) ||
+            allow.some((feature) => baselineAllow.includes(feature)))) {
+        invalid();
+    }
+    const canonicalSandbox = canonicalize
+        ? sandbox.filter((token) => !baselineSandbox.includes(token))
+        : sandbox;
+    const canonicalAllow = canonicalize
+        ? allow.filter((feature) => !baselineAllow.includes(feature))
+        : allow;
+    if (!canonicalize && canonicalSandbox.length === 0 && canonicalAllow.length === 0)
+        invalid();
+    if (canonicalSandbox.length === 0 && canonicalAllow.length === 0)
+        return undefined;
+    return Object.freeze({
+        sandbox: Object.freeze(canonicalSandbox),
+        allow: Object.freeze(canonicalAllow),
     });
 }
-//# sourceMappingURL=view.js.map
+function plainRecord(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        invalid();
+    const prototype = Object.getPrototypeOf(input);
+    if (prototype !== Object.prototype && prototype !== null)
+        invalid();
+    return input;
+}
+function exactOwnKeys(input, allowed) {
+    const keys = new Set(allowed);
+    if (Reflect.ownKeys(input).some((key) => typeof key !== 'string' || !keys.has(key)))
+        invalid();
+}
+function dataValue(input, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor === undefined)
+        return undefined;
+    if (!('value' in descriptor))
+        invalid();
+    return descriptor.value;
+}
+function tokens(input, canonicalize) {
+    if (input === undefined)
+        return [];
+    if (!Array.isArray(input))
+        invalid();
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    const values = [];
+    for (let index = 0; index < input.length; index += 1) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === undefined || !('value' in descriptor))
+            invalid();
+        if (typeof descriptor.value !== 'string' || !TOKEN.test(descriptor.value))
+            invalid();
+        values.push(descriptor.value);
+    }
+    for (const key of Reflect.ownKeys(descriptors)) {
+        if (key === 'length')
+            continue;
+        if (typeof key !== 'string' || !/^(0|[1-9][0-9]*)$/u.test(key) || Number(key) >= input.length) {
+            invalid();
+        }
+    }
+    if (canonicalize)
+        return [...new Set(values)].sort();
+    for (let index = 1; index < values.length; index += 1) {
+        if (values[index - 1] >= values[index])
+            invalid();
+    }
+    return values;
+}
+function assertRelationships(sandbox) {
+    const tokens = new Set(sandbox);
+    if (tokens.has('allow-popups-to-escape-sandbox') && !tokens.has('allow-popups'))
+        invalid();
+    if (tokens.has('allow-top-navigation') && tokens.has('allow-top-navigation-by-user-activation')) {
+        invalid();
+    }
+    if (tokens.has('allow-top-navigation-to-custom-protocols') &&
+        (tokens.has('allow-top-navigation') || tokens.has('allow-popups'))) {
+        invalid();
+    }
+}
+function invalid() {
+    return fail('PUBLICATION_VIEW_INVALID', 'View iframe requirements are invalid.');
+}

package/dist/publication/bundle-admission.d.ts

@@ -2,4 +2,3 @@ import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
 import type { Publication } from './publication.js';
 export declare function acceptBundle(input: Publication, artifact: unknown): dslBundle.Bundle;
 export declare function decodeBundle(input: Publication, bytes: Uint8Array): dslBundle.Bundle;
-//# sourceMappingURL=bundle-admission.d.ts.map