@astrale-os/kernel-protocol 0.5.0-beta.67 → 0.5.0-beta.69

package/dist/invocation/schema.js

@@ -1,20 +1,13 @@
-import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { digest, exactFields, invalid, portableObject } from './admission.js';
-const FIELDS = new Set(['target', 'revision', 'fingerprint']);
+const FIELDS = new Set(['target', 'fingerprint']);
 export function acceptSchemaTarget(input) {
     const object = portableObject(input, 'schema target');
     exactFields(object, FIELDS, 'schema target');
     if ([...FIELDS].filter((field) => Object.hasOwn(object, field)).length !== 1) {
-        invalid('schema target must contain exactly one of target, revision or fingerprint');
+        invalid('schema target must contain exactly one of target or fingerprint');
     }
     if (Object.hasOwn(object, 'target')) {
         return Object.freeze({ target: digest(object.target, 'schema target.target') });
     }
-    if (Object.hasOwn(object, 'fingerprint')) {
-        return Object.freeze({ fingerprint: digest(object.fingerprint, 'schema target.fingerprint') });
-    }
-    if (typeof object.revision !== 'string' || !patterns.revision.test(object.revision)) {
-        invalid('schema target.revision must be a Schema revision');
-    }
-    return Object.freeze({ revision: object.revision });
+    return Object.freeze({ fingerprint: digest(object.fingerprint, 'schema target.fingerprint') });
 }

package/dist/invocation/service-reason.d.ts

@@ -3,20 +3,14 @@ import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { Object as ValueObject } from '@astrale-os/kernel-dsl/value';
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import type { ErrorPayload, ErrorReason } from '../errors/index.js';
-import type { Sha256Digest } from '../publication/index.js';
+import type { ReleaseDigest, Sha256Digest } from '../release/digest.js';
 import { CODES } from '../errors/index.js';
-/** @deprecated Emitted only for the deprecated revision pin; fingerprint pins report CALLABLE_FINGERPRINT_MISMATCH. */
-export declare const SCHEMA_REVISION_MISMATCH: 'SCHEMA_REVISION_MISMATCH';
 export declare const CALLABLE_FINGERPRINT_MISMATCH: 'CALLABLE_FINGERPRINT_MISMATCH';
 export declare const SERVICE_TRUST_REQUIRED: 'SERVICE_TRUST_REQUIRED';
 export declare const SERVICE_UNAVAILABLE: 'SERVICE_UNAVAILABLE';
 export declare const SERVICE_CANDIDATE_INVALID: 'SERVICE_CANDIDATE_INVALID';
-/** @deprecated Detail shape of the deprecated revision pin conflict. */
-export type SchemaRevisionMismatchDetails = ValueObject & {
-    readonly origin: Key.Origin;
-    readonly expectedRevision: Revision;
-    readonly installedRevision: Revision;
-};
+/** A deployment answers that it no longer serves: it runs no other code in its place. */
+export declare const DEPLOYMENT_RETIRED: 'DEPLOYMENT_RETIRED';
 export type CallableFingerprintMismatchDetails = ValueObject & {
     readonly origin: Key.Origin;
     readonly callable: Key.Callable;
@@ -35,19 +29,25 @@ export type ServiceUnavailableDetails = ValueObject & {
 export type ServiceCandidateInvalidDetails = ValueObject & {
     readonly origin: Key.Origin;
 };
-/** @deprecated Detail shape of the deprecated revision pin conflict. */
-export type SchemaRevisionMismatchReason = ErrorReason<typeof SCHEMA_REVISION_MISMATCH, SchemaRevisionMismatchDetails>;
+export type DeploymentRetiredDetails = ValueObject & {
+    readonly deployment: IssuerId;
+    readonly release?: ReleaseDigest;
+};
 export type CallableFingerprintMismatchReason = ErrorReason<typeof CALLABLE_FINGERPRINT_MISMATCH, CallableFingerprintMismatchDetails>;
 export type ServiceTrustRequiredReason = ErrorReason<typeof SERVICE_TRUST_REQUIRED, ServiceTrustRequiredDetails>;
 export type ServiceUnavailableReason = ErrorReason<typeof SERVICE_UNAVAILABLE, ServiceUnavailableDetails>;
 export type ServiceCandidateInvalidReason = ErrorReason<typeof SERVICE_CANDIDATE_INVALID, ServiceCandidateInvalidDetails>;
-export type ServiceReason = SchemaRevisionMismatchReason | CallableFingerprintMismatchReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason;
+export type DeploymentRetiredReason = ErrorReason<typeof DEPLOYMENT_RETIRED, DeploymentRetiredDetails>;
+export type ServiceReason = CallableFingerprintMismatchReason | ServiceTrustRequiredReason | ServiceUnavailableReason | ServiceCandidateInvalidReason | DeploymentRetiredReason;
 export type ServiceErrorPayload = (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.CONFLICT;
-    readonly data: SchemaRevisionMismatchReason | CallableFingerprintMismatchReason | ServiceTrustRequiredReason;
+    readonly data: CallableFingerprintMismatchReason | ServiceTrustRequiredReason;
 }) | (Omit<ErrorPayload, 'code' | 'data'> & {
     readonly code: typeof CODES.BACKEND_UNAVAILABLE;
     readonly data: ServiceUnavailableReason | ServiceCandidateInvalidReason;
+}) | (Omit<ErrorPayload, 'code' | 'data'> & {
+    readonly code: typeof CODES.NOT_FOUND;
+    readonly data: DeploymentRetiredReason;
 });
 /** Recognize only exact outer-code, reason-code, and detail-shape combinations. */
 export declare function serviceErrorOf(input: ErrorPayload): ServiceErrorPayload | undefined;

package/dist/invocation/service-reason.js

@@ -2,22 +2,18 @@ import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
 import { accept as acceptIssuer } from '@astrale-os/kernel-core/auth/issuer';
 import { Key, patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { CODES, reasonOf } from '../errors/index.js';
-/** @deprecated Emitted only for the deprecated revision pin; fingerprint pins report CALLABLE_FINGERPRINT_MISMATCH. */
-export const SCHEMA_REVISION_MISMATCH = 'SCHEMA_REVISION_MISMATCH';
 export const CALLABLE_FINGERPRINT_MISMATCH = 'CALLABLE_FINGERPRINT_MISMATCH';
 export const SERVICE_TRUST_REQUIRED = 'SERVICE_TRUST_REQUIRED';
 export const SERVICE_UNAVAILABLE = 'SERVICE_UNAVAILABLE';
 export const SERVICE_CANDIDATE_INVALID = 'SERVICE_CANDIDATE_INVALID';
+/** A deployment answers that it no longer serves: it runs no other code in its place. */
+export const DEPLOYMENT_RETIRED = 'DEPLOYMENT_RETIRED';
 /** Recognize only exact outer-code, reason-code, and detail-shape combinations. */
 export function serviceErrorOf(input) {
     const reason = reasonOf(input.data);
     if (reason === undefined)
         return undefined;
     switch (reason.code) {
-        case SCHEMA_REVISION_MISMATCH:
-            return input.code === CODES.CONFLICT && schemaRevisionMismatchDetails(reason.details)
-                ? input
-                : undefined;
         case CALLABLE_FINGERPRINT_MISMATCH:
             return input.code === CODES.CONFLICT && callableFingerprintMismatchDetails(reason.details)
                 ? input
@@ -34,16 +30,14 @@ export function serviceErrorOf(input) {
             return input.code === CODES.BACKEND_UNAVAILABLE && candidateInvalidDetails(reason.details)
                 ? input
                 : undefined;
+        case DEPLOYMENT_RETIRED:
+            return input.code === CODES.NOT_FOUND && deploymentRetiredDetails(reason.details)
+                ? input
+                : undefined;
         default:
             return undefined;
     }
 }
-function schemaRevisionMismatchDetails(input) {
-    return (exact(input, ['origin', 'expectedRevision', 'installedRevision']) &&
-        isOrigin(input.origin) &&
-        isRevision(input.expectedRevision) &&
-        isRevision(input.installedRevision));
-}
 function callableFingerprintMismatchDetails(input) {
     return (exact(input, ['origin', 'callable', 'expectedFingerprint', 'installedFingerprint']) &&
         isOrigin(input.origin) &&
@@ -65,6 +59,13 @@ function serviceUnavailableDetails(input) {
 function candidateInvalidDetails(input) {
     return exact(input, ['origin']) && isOrigin(input.origin);
 }
+function deploymentRetiredDetails(input) {
+    return Object.hasOwn(input, 'release')
+        ? exact(input, ['deployment', 'release']) &&
+            isIssuer(input.deployment) &&
+            isDigest(input.release)
+        : exact(input, ['deployment']) && isIssuer(input.deployment);
+}
 function exact(input, fields) {
     return (Object.keys(input).length === fields.length &&
         fields.every((field) => Object.hasOwn(input, field)));

package/dist/invocation/stale-route.d.ts

@@ -1,4 +1,4 @@
-import type { Etag } from '../publication/index.js';
+import type { Etag } from '../release/legacy/etag.js';
 import type { RequestId } from './correlation.js';
 import type { InvocationId } from './identity.js';
 /** Reserved pre-handler routing control; never an application ErrorResponse. */

package/dist/invocation/target.d.ts

@@ -1,3 +1,6 @@
+import type { Value } from '@astrale-os/kernel-dsl/value';
 import { type Call } from '@astrale-os/kernel-core/callable';
 export { Target, targetPath, type Call } from '@astrale-os/kernel-core/callable';
 export declare function acceptCall(input: unknown): Call;
+/** Package-private: consume the detached portable subtree captured by request admission. */
+export declare function callFromSnapshot(input: Value): Call;

package/dist/invocation/target.js

@@ -4,7 +4,14 @@ import { exactFields, invalid, nodePath, portableObject, required } from './admi
 export { Target, targetPath } from '@astrale-os/kernel-core/callable';
 const CALL_FIELDS = new Set(['target', 'input']);
 export function acceptCall(input) {
-    const object = portableObject(input, 'call');
+    return callFromSnapshot(portableObject(input, 'call'));
+}
+/** Package-private: consume the detached portable subtree captured by request admission. */
+export function callFromSnapshot(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('call must be an object');
+    }
+    const object = input;
     exactFields(object, CALL_FIELDS, 'call');
     required(object, ['target', 'input'], 'call');
     return Object.freeze({

package/dist/invocation/websocket/index.d.ts

@@ -1,2 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';

package/dist/invocation/websocket/index.js

@@ -1,2 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';

package/dist/invocation/websocket/subprotocol.d.ts

@@ -1,7 +1,6 @@
 import type { Codec } from '../../codecs/index.js';
 export declare const JSON_SUBPROTOCOL: 'astrale.invocation.v2.json';
-export declare const MSGPACK_SUBPROTOCOL: 'astrale.invocation.v2.msgpack';
-export type Subprotocol = typeof JSON_SUBPROTOCOL | typeof MSGPACK_SUBPROTOCOL;
+export type Subprotocol = typeof JSON_SUBPROTOCOL;
 export interface SubprotocolSelection {
     readonly subprotocol: Subprotocol;
     readonly codec: Codec;

package/dist/invocation/websocket/subprotocol.js

@@ -1,12 +1,11 @@
 import { admitSupportedCodecs, codecProfile } from '../binding-codecs.js';
 export const JSON_SUBPROTOCOL = 'astrale.invocation.v2.json';
-export const MSGPACK_SUBPROTOCOL = 'astrale.invocation.v2.msgpack';
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
 export function subprotocolFor(codec) {
-    const profile = codecProfile(codec);
-    if (profile === undefined)
+    if (codecProfile(codec) === undefined) {
         throw new TypeError('codec is not a canonical Invocation codec.');
-    return profile === 'json' ? JSON_SUBPROTOCOL : MSGPACK_SUBPROTOCOL;
+    }
+    return JSON_SUBPROTOCOL;
 }
 export function selectSubprotocol(offered, supported) {
     const admitted = admitSupportedCodecs(supported);

package/dist/issuer/claims.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export declare const EXECUTION_CLAIM = "execution";

package/dist/issuer/claims.js

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export const EXECUTION_CLAIM = 'execution';

package/dist/issuer/index.d.ts

@@ -1,6 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, type Configuration, type ConfigurationOptions, } from './configuration.js';
 export { DiscoveryError, type DiscoveryErrorCode } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, type WorkflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';

package/dist/issuer/index.js

@@ -1,6 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, } from './configuration.js';
 export { DiscoveryError } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';

package/dist/issuer/paths.d.ts

@@ -2,5 +2,7 @@ export interface Paths {
     readonly configuration: string;
     readonly keys: string;
     readonly tokenExchange: string;
+    /** Where Domains discover the workflow engine of a Kernel that drives one. */
+    readonly workflowEngine: string;
 }
 export declare function paths(issuer: string): Paths;

package/dist/issuer/paths.js

@@ -6,5 +6,6 @@ export function paths(issuer) {
         configuration: `${pathname}/.well-known/openid-configuration`,
         keys: `${pathname}/.well-known/jwks.json`,
         tokenExchange: `${pathname}/.well-known/astrale/token`,
+        workflowEngine: `${pathname}/.well-known/astrale/workflow-engine.json`,
     });
 }

package/dist/issuer/workflow-engine.d.ts

@@ -0,0 +1,18 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+/**
+ * The workflow engine a Kernel drives, as Domains discover it at
+ * `<issuer>/.well-known/astrale/workflow-engine.json`: the engine signs every request to a Domain with
+ * one of these Restate request identity keys. Several keys let the Host rotate without a gap.
+ */
+export interface WorkflowEngine {
+    readonly issuer: IssuerId;
+    readonly identity_keys: readonly [string, ...string[]];
+}
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export declare function acceptWorkflowEngineIdentityKey(input: unknown): string;
+export declare function workflowEngine(issuer: string, identityKeys: readonly string[]): WorkflowEngine;
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export declare function acceptWorkflowEngine(input: unknown, expectedIssuer?: string): WorkflowEngine;

package/dist/issuer/workflow-engine.js

@@ -0,0 +1,59 @@
+import { fail } from './error.js';
+import { acceptIssuer } from './url.js';
+/** Restate's `publickeyv1_` id: base58btc of a raw Ed25519 public key. */
+const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/u;
+const BASE58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const MAXIMUM_IDENTITY_KEYS = 8;
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export function acceptWorkflowEngineIdentityKey(input) {
+    if (typeof input !== 'string' || !IDENTITY_KEY.test(input) || decodedKeyBytes(input) !== 32) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return input;
+}
+export function workflowEngine(issuer, identityKeys) {
+    return Object.freeze({
+        issuer: acceptIssuer(issuer),
+        identity_keys: acceptIdentityKeys(identityKeys),
+    });
+}
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export function acceptWorkflowEngine(input, expectedIssuer) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine discovery is invalid.');
+    }
+    const value = input;
+    const admitted = acceptIssuer(value.issuer);
+    if (expectedIssuer !== undefined && admitted !== acceptIssuer(expectedIssuer)) {
+        fail('ISSUER_DISCOVERY_MISMATCH', 'Workflow engine discovery does not match the issuer.');
+    }
+    return Object.freeze({ issuer: admitted, identity_keys: acceptIdentityKeys(value.identity_keys) });
+}
+function acceptIdentityKeys(input) {
+    if (!Array.isArray(input) ||
+        input.length === 0 ||
+        input.length > MAXIMUM_IDENTITY_KEYS ||
+        new Set(input).size !== input.length) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return Object.freeze(Array.from(input, acceptWorkflowEngineIdentityKey));
+}
+/** Base58 leading '1' digits represent zero bytes omitted by the integer value. */
+function decodedKeyBytes(key) {
+    const encoded = key.slice('publickeyv1_'.length);
+    let value = 0n;
+    for (const digit of encoded)
+        value = value * 58n + BigInt(BASE58.indexOf(digit));
+    let bytes = 0;
+    for (; value > 0n; value >>= 8n)
+        bytes++;
+    for (const digit of encoded) {
+        if (digit !== '1')
+            break;
+        bytes++;
+    }
+    return bytes;
+}

package/dist/{publication → release}/bindings/callable.js

@@ -1,10 +1,10 @@
 import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
-import { exact, record } from '../content.js';
 import { fail } from '../error.js';
+import { exact, record } from '../shape.js';
 import { acceptInvocationEndpoints } from './invocation.js';
 export function admitCallableBinding(input, origin) {
-    const value = record(input, 'PUBLICATION_BINDING_INVALID', 'Callable binding is invalid.');
-    exact(value, ['callable', 'endpoint'], 'PUBLICATION_BINDING_INVALID');
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Callable binding is invalid.');
+    exact(value, ['callable', 'endpoint'], 'RELEASE_BINDING_INVALID');
     return Object.freeze({
         callable: admitCallableKey(value.callable, origin),
         endpoint: acceptInvocationEndpoints(value.endpoint),
@@ -17,18 +17,18 @@ export function admitCallableKey(input, origin) {
     }
     catch (cause) {
         if (cause instanceof TypeError) {
-            return fail('PUBLICATION_BINDING_INVALID', 'Callable key is invalid.', cause);
+            return fail('RELEASE_BINDING_INVALID', 'Callable key is invalid.', cause);
         }
         throw cause;
     }
     if (Key.origin(callable) !== origin) {
-        fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
+        fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
     try {
         callableAddress(callable);
     }
     catch (cause) {
-        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+        return fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
     }
     return callable;
 }

package/dist/release/bindings/invocation.js

@@ -0,0 +1,13 @@
+import { absoluteHttpUrl, absoluteUrl, exact, record } from '../shape.js';
+export function acceptInvocationEndpoints(input) {
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Invocation endpoints are invalid.');
+    exact(value, ['http', 'websocket'], 'RELEASE_BINDING_INVALID');
+    const http = absoluteHttpUrl(value.http, true, 'RELEASE_BINDING_INVALID');
+    const websocket = value.websocket === undefined
+        ? undefined
+        : absoluteUrl(value.websocket, ['ws:', 'wss:'], true, 'RELEASE_BINDING_INVALID');
+    return Object.freeze({
+        http,
+        ...(websocket === undefined ? {} : { websocket }),
+    });
+}

package/dist/{publication → release}/bindings/view.d.ts

@@ -12,5 +12,5 @@ export interface IframeRequirements {
     readonly allow?: readonly string[];
 }
 export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
-/** Authoring-only normalization used before a Publication receives its canonical ETag. */
+/** Authoring-only normalization used before a release document is sealed. */
 export declare function canonicalizeViewBinding(input: unknown, origin: string): ViewBinding;

package/dist/{publication → release}/bindings/view.js

@@ -1,33 +1,33 @@
 import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
 import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
-import { absoluteHttpUrl, exact, record } from '../content.js';
 import { fail } from '../error.js';
+import { absoluteHttpUrl, exact, record } from '../shape.js';
 const TOKEN = /^[a-z][a-z0-9-]*$/u;
 export function admitViewBinding(input, origin) {
     return readViewBinding(input, origin, false);
 }
-/** Authoring-only normalization used before a Publication receives its canonical ETag. */
+/** Authoring-only normalization used before a release document is sealed. */
 export function canonicalizeViewBinding(input, origin) {
     return readViewBinding(input, origin, true);
 }
 function readViewBinding(input, origin, canonicalize) {
-    const value = record(input, 'PUBLICATION_VIEW_INVALID', 'Published View binding is invalid.');
-    exact(value, ['view', 'href', 'handshake', 'iframe', 'host'], 'PUBLICATION_VIEW_INVALID');
+    const value = record(input, 'RELEASE_VIEW_INVALID', 'Release View binding is invalid.');
+    exact(value, ['view', 'href', 'handshake', 'iframe', 'host'], 'RELEASE_VIEW_INVALID');
     let view;
     try {
         view = Key(String(value.view));
     }
     catch (cause) {
         if (cause instanceof TypeError) {
-            return fail('PUBLICATION_VIEW_INVALID', 'View key is invalid.', cause);
+            return fail('RELEASE_VIEW_INVALID', 'View key is invalid.', cause);
         }
         throw cause;
     }
     if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
-        fail('PUBLICATION_VIEW_INVALID', 'View binding must name a root View.');
+        fail('RELEASE_VIEW_INVALID', 'View binding must name a root View.');
     }
     if (value.handshake !== 'shell' && value.handshake !== 'none') {
-        fail('PUBLICATION_VIEW_INVALID', 'View handshake is invalid.');
+        fail('RELEASE_VIEW_INVALID', 'View handshake is invalid.');
     }
     const iframe = admitIframeRequirements(dataValue(value, 'iframe'), value.handshake, canonicalize);
     let host;
@@ -36,12 +36,12 @@ function readViewBinding(input, origin, canonicalize) {
     }
     catch (cause) {
         if (cause instanceof TypeError)
-            return fail('PUBLICATION_VIEW_INVALID', 'View host requirements are invalid.', cause);
+            return fail('RELEASE_VIEW_INVALID', 'View host requirements are invalid.', cause);
         throw cause;
     }
     return Object.freeze({
         view,
-        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_VIEW_INVALID'),
+        href: absoluteHttpUrl(value.href, true, 'RELEASE_VIEW_INVALID'),
         handshake: value.handshake,
         ...(iframe === undefined ? {} : { iframe }),
         ...(host === undefined ? {} : { host }),
@@ -144,5 +144,5 @@ function assertRelationships(sandbox) {
     }
 }
 function invalid() {
-    return fail('PUBLICATION_VIEW_INVALID', 'View iframe requirements are invalid.');
+    return fail('RELEASE_VIEW_INVALID', 'View iframe requirements are invalid.');
 }

package/dist/release/build.d.ts

@@ -0,0 +1,6 @@
+import type { BuildDigest } from './digest.js';
+/** Identity of the code a release runs: the digest of the bytes its build produced. */
+export interface Build {
+    readonly digest: BuildDigest;
+}
+export declare function admitBuild(input: unknown): Build;

package/dist/release/build.js

@@ -0,0 +1,7 @@
+import { admitDigest } from './digest.js';
+import { exact, record } from './shape.js';
+export function admitBuild(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Release build is invalid.');
+    exact(value, ['digest'], 'RELEASE_INVALID');
+    return Object.freeze({ digest: admitDigest(value.digest) });
+}

package/dist/release/bundle-admission.d.ts

@@ -0,0 +1,21 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import type { CallableBinding, ViewBinding } from './bindings/index.js';
+import type { Manifest } from './manifest.js';
+import type { Requirements } from './requirements.js';
+import type { HttpRoute } from './route.js';
+import type { Schema } from './schema.js';
+/** The served release content one external Schema Bundle must exactly match. */
+export interface ServedRelease {
+    readonly origin: Key.Origin;
+    readonly schema: Schema;
+    readonly requirements: Requirements;
+    readonly manifest?: Manifest;
+    readonly bindings: {
+        readonly callables: readonly CallableBinding[];
+        readonly views: readonly ViewBinding[];
+    };
+    readonly routes: readonly HttpRoute[];
+}
+export declare function acceptBundle(input: ServedRelease, artifact: unknown): dslBundle.Bundle;
+export declare function decodeBundle(input: ServedRelease, bytes: Uint8Array): dslBundle.Bundle;

package/dist/{publication → release}/bundle-admission.js

@@ -16,32 +16,32 @@ export function decodeBundle(input, bytes) {
     validateInventory(input, decoded);
     return decoded;
 }
-function validateInventory(publication, bundle) {
+function validateInventory(release, bundle) {
     const root = bundle.root;
-    if (root.origin !== publication.origin || revision(root) !== publication.schema.revision) {
-        fail('PUBLICATION_INVALID', 'Bundle root does not match the Publication schema.');
+    if (root.origin !== release.origin || revision(root) !== release.schema.revision) {
+        fail('RELEASE_INVALID', 'Bundle root does not match the release schema.');
     }
-    validateRequirements(root, bundle.closure, publication.requirements);
+    validateRequirements(root, bundle.closure, release.requirements);
     const callables = concreteCallables(root);
-    const publishedCallables = new Set(publication.bindings.callables.map(({ callable }) => callable));
-    if (publishedCallables.size !== callables.size ||
-        [...callables].some((key) => !publishedCallables.has(key))) {
-        fail('PUBLICATION_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
+    const boundCallables = new Set(release.bindings.callables.map(({ callable }) => callable));
+    if (boundCallables.size !== callables.size ||
+        [...callables].some((key) => !boundCallables.has(key))) {
+        fail('RELEASE_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
     }
     const views = new Set(Object.keys(root.views).map((name) => Key.of({ origin: root.origin, kind: 'view', name })));
-    const publishedViews = new Set(publication.bindings.views.map(({ view }) => view));
-    if (publishedViews.size !== views.size || [...views].some((key) => !publishedViews.has(key))) {
-        fail('PUBLICATION_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
+    const boundViews = new Set(release.bindings.views.map(({ view }) => view));
+    if (boundViews.size !== views.size || [...views].some((key) => !boundViews.has(key))) {
+        fail('RELEASE_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
     }
-    if (publication.manifest?.entrypoint !== undefined &&
-        (publication.manifest.entrypoint.origin !== root.origin ||
-            publication.manifest.entrypoint.kind !== 'view' ||
-            root.views[publication.manifest.entrypoint.name] === undefined)) {
-        fail('PUBLICATION_INVALID', 'Manifest entrypoint does not exist in the root schema.');
+    if (release.manifest?.entrypoint !== undefined &&
+        (release.manifest.entrypoint.origin !== root.origin ||
+            release.manifest.entrypoint.kind !== 'view' ||
+            root.views[release.manifest.entrypoint.name] === undefined)) {
+        fail('RELEASE_INVALID', 'Manifest entrypoint does not exist in the root schema.');
     }
-    for (const route of publication.routes) {
+    for (const route of release.routes) {
         if (!callables.has(route.callable)) {
-            fail('PUBLICATION_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
+            fail('RELEASE_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
         }
     }
 }

package/dist/{publication → release}/bundle-descriptor.js

@@ -1,19 +1,19 @@
 import * as artifact from '../artifact/index.js';
-import { absoluteHttpUrl, exact, record } from './content.js';
 import { fail } from './error.js';
+import { absoluteHttpUrl, exact, record } from './shape.js';
 export const BUNDLE_MEDIA_TYPE = 'application/vnd.astrale.domain-bundle+json;v=1';
 export function admitBundleDescriptor(input) {
-    const value = record(input, 'PUBLICATION_INVALID', 'Bundle descriptor is invalid.');
-    exact(value, ['href', 'ref'], 'PUBLICATION_INVALID');
+    const value = record(input, 'RELEASE_INVALID', 'Bundle descriptor is invalid.');
+    exact(value, ['href', 'ref'], 'RELEASE_INVALID');
     const ref = artifact.accept(value.ref);
     if (ref.mediaType !== BUNDLE_MEDIA_TYPE) {
-        fail('PUBLICATION_INVALID', 'Bundle media type is unsupported.');
+        fail('RELEASE_INVALID', 'Bundle media type is unsupported.');
     }
     if (ref.size < 1) {
-        fail('PUBLICATION_INVALID', 'Bundle size is invalid.');
+        fail('RELEASE_INVALID', 'Bundle size is invalid.');
     }
     return Object.freeze({
-        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_INVALID'),
+        href: absoluteHttpUrl(value.href, true, 'RELEASE_INVALID'),
         ref: Object.freeze({ ...ref, mediaType: BUNDLE_MEDIA_TYPE }),
     });
 }

package/dist/release/bundle-evidence.d.ts

@@ -0,0 +1,3 @@
+import type { ServedRelease } from './bundle-admission.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export declare function verifyBundleBytes(release: Pick<ServedRelease, 'schema'>, bytes: Uint8Array): void;

package/dist/release/bundle-evidence.js

@@ -0,0 +1,13 @@
+import { sha256Hex } from './digest.js';
+import { fail } from './error.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export function verifyBundleBytes(release, bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+        fail('RELEASE_INVALID', 'Bundle artifact bytes are invalid.');
+    }
+    const descriptor = release.schema.bundle;
+    if (bytes.byteLength !== descriptor.ref.size ||
+        `sha256:${sha256Hex(bytes)}` !== descriptor.ref.digest) {
+        fail('RELEASE_INVALID', 'Bundle artifact does not match its descriptor.');
+    }
+}

package/dist/{publication → release}/bundle.d.ts

@@ -1,12 +1,12 @@
 import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
+import type { ServedRelease } from './bundle-admission.js';
 import type { BundleDescriptor } from './bundle-descriptor.js';
-import type { Publication } from './publication.js';
 import * as artifact from '../artifact/index.js';
 import { verifyBundleBytes } from './bundle-evidence.js';
 /** Resolve immutable bundle bytes beneath the exact serving issuer. */
 export declare function bundleUrl(issuer: string, ref: artifact.Ref): string;
 export declare function describeBundle(input: bundle.Bundle, href: string): BundleDescriptor;
 export declare function acceptBundleValue(input: unknown): bundle.Bundle;
-export declare function decodeBundleValue(publication: Publication, bytes: Uint8Array): bundle.Bundle;
+export declare function decodeBundleValue(release: Pick<ServedRelease, 'schema'>, bytes: Uint8Array): bundle.Bundle;
 export { verifyBundleBytes };
 export { admitBundleDescriptor, BUNDLE_MEDIA_TYPE, type BundleDescriptor, } from './bundle-descriptor.js';