@astrale-os/kernel-protocol 0.5.0-beta.67 → 0.5.0-beta.69

package/dist/release/release.js

@@ -0,0 +1,123 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { admitBuild } from './build.js';
+import { admitDigest, sha256Hex } from './digest.js';
+import { fail } from './error.js';
+import { servedUrl } from './issuer.js';
+import { admitServedContent } from './served.js';
+import { deepFreeze, exact, record } from './shape.js';
+/** Path of the release a deployment serves beneath its serving issuer. */
+export const PATH = '/.well-known/astrale/release.json';
+/** Media type of `DomainRelease` v4. */
+export const MEDIA_TYPE = 'application/vnd.astrale.domain-release+json;v=4';
+/** Resolve the canonical release URL beneath one exact HTTP(S) serving issuer, keeping its path. */
+export function url(issuer) {
+    return servedUrl(issuer, PATH);
+}
+const CONTENT_FIELDS = [
+    'format',
+    'version',
+    'origin',
+    'identity',
+    'build',
+    'schema',
+    'requirements',
+    'manifest',
+    'bindings',
+    'routes',
+    'delivery',
+];
+/**
+ * Release digest of canonical release content: SHA-256 of its canonical JSON. The content must be
+ * exactly what `seal` produces, a sealed release without its digest; content that `seal` would
+ * canonicalize or refuse throws `ReleaseError` instead of yielding a digest no decoder accepts.
+ * Authored content gets its digest from `seal(content).digest`.
+ */
+export function digestOf(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(value, CONTENT_FIELDS, 'RELEASE_INVALID');
+    return hash(admitCanonical(value));
+}
+/** Validate release content, canonicalize its View bindings, and set its release digest. */
+export function seal(input) {
+    const authored = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(authored, CONTENT_FIELDS, 'RELEASE_INVALID');
+    const canonical = admitContent(admitContent(authored, 'canonicalize'), 'admit');
+    return release(canonical, hash(canonical));
+}
+/**
+ * Admit one wire release: exact fields at every level, every value in the canonical form `seal`
+ * produces, and a digest matching its content. One release therefore has exactly one wire
+ * document: `encode(accept(input))` is the canonical JSON of `input`.
+ */
+export function accept(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected a DomainRelease object.');
+    exact(value, [...CONTENT_FIELDS, 'digest'], 'RELEASE_INVALID');
+    const { digest: received, ...wire } = value;
+    const content = admitCanonical(wire);
+    const digest = admitDigest(received);
+    if (digest !== hash(content)) {
+        fail('RELEASE_DIGEST_MISMATCH', 'Release digest does not match its canonical content.');
+    }
+    return release(content, digest);
+}
+/** Encode one release as its canonical JSON bytes. */
+export function encode(input) {
+    return portable.json.encode(input);
+}
+function admitContent(value, views) {
+    if (value.format !== 'astrale.domain.release' || value.version !== 4) {
+        fail('RELEASE_INVALID', 'Unsupported release format or version.');
+    }
+    const served = admitServedContent(value, { views });
+    const build = admitBuild(value.build);
+    return deepFreeze({
+        format: 'astrale.domain.release',
+        version: 4,
+        origin: served.origin,
+        identity: served.identity,
+        build,
+        schema: served.schema,
+        requirements: served.requirements,
+        ...(served.manifest === undefined ? {} : { manifest: served.manifest }),
+        bindings: served.bindings,
+        routes: served.routes,
+        ...(served.delivery === undefined ? {} : { delivery: served.delivery }),
+    });
+}
+/** Shared validators normalize legacy values; releases require their exact canonical spelling. */
+function admitCanonical(value) {
+    const content = admitContent(value, 'admit');
+    const canonical = portable.json.serialize(content);
+    let received;
+    try {
+        received = portable.json.serialize(value);
+    }
+    catch (cause) {
+        if (cause instanceof portable.BoundaryError) {
+            return fail('RELEASE_INVALID', 'Release content is not in canonical form.', cause);
+        }
+        throw cause;
+    }
+    if (received !== canonical)
+        fail('RELEASE_INVALID', 'Release content is not in canonical form.');
+    return content;
+}
+function hash(content) {
+    return `sha256:${sha256Hex(portable.json.encode(content))}`;
+}
+function release(content, digest) {
+    return deepFreeze({
+        format: content.format,
+        version: content.version,
+        origin: content.origin,
+        identity: content.identity,
+        digest,
+        build: content.build,
+        schema: content.schema,
+        requirements: content.requirements,
+        ...(content.manifest === undefined ? {} : { manifest: content.manifest }),
+        bindings: content.bindings,
+        routes: content.routes,
+        ...(content.delivery === undefined ? {} : { delivery: content.delivery }),
+    });
+}

package/dist/{publication → release}/requirements.d.ts

@@ -25,10 +25,17 @@ export interface CoreCapabilityRequirement {
     readonly classes?: NonEmpty<ClassCapabilityRequirement>;
     readonly authority?: CapabilityAuthorityRequirements;
 }
-export interface PublicationRequirements {
+export interface Requirements {
     readonly capabilities: CapabilityRequirements;
 }
-/** Admit the exact closed canonical requirements object used by Publication v3. */
-export declare function admitRequirements(input: unknown): PublicationRequirements;
+/**
+ * Admit the exact closed canonical requirements object, the `core` form Publication v3 introduced.
+ */
+export declare function admitRequirements(input: unknown): Requirements;
 /** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
-export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: PublicationRequirements): void;
+export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: Requirements): void;
+/**
+ * Distinct Function, Method and Class Keys, including Core-scoped targets, in code-unit order.
+ * Core subjects and authority operations contribute no Keys. Results may span multiple origins.
+ */
+export declare function capabilityKeys(capabilities: CapabilityRequirements): readonly SemanticKey[];

package/dist/{publication → release}/requirements.js

@@ -2,8 +2,8 @@ import { AuthorityOperationOrder } from '@astrale-os/kernel-core/schema/authorit
 import { acceptDefinitionRef, callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isMethodExecutable } from '@astrale-os/kernel-dsl/v1/language';
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
-import { array, deepFreeze, exact, record, unique } from './content.js';
 import { fail } from './error.js';
+import { array, deepFreeze, exact, record, unique } from './shape.js';
 const KernelIdentityClass = Object.freeze({
     origin: 'kernel.astrale.ai',
     kind: 'class',
@@ -16,24 +16,26 @@ export const ClassOperationOrder = Object.freeze([
     'update',
     'delete',
 ]);
-/** Admit the exact closed canonical requirements object used by Publication v3. */
+/**
+ * Admit the exact closed canonical requirements object, the `core` form Publication v3 introduced.
+ */
 export function admitRequirements(input) {
-    const requirements = record(input, 'PUBLICATION_INVALID', 'Publication requirements are invalid.');
-    exact(requirements, ['capabilities'], 'PUBLICATION_INVALID');
-    const capabilities = record(requirements.capabilities, 'PUBLICATION_INVALID', 'Publication capability requirements are invalid.');
-    exact(capabilities, ['authority', 'classes', 'functions', 'core'], 'PUBLICATION_INVALID');
+    const requirements = record(input, 'RELEASE_INVALID', 'Release requirements are invalid.');
+    exact(requirements, ['capabilities'], 'RELEASE_INVALID');
+    const capabilities = record(requirements.capabilities, 'RELEASE_INVALID', 'Release capability requirements are invalid.');
+    exact(capabilities, ['authority', 'classes', 'functions', 'core'], 'RELEASE_INVALID');
     const functions = capabilities.functions === undefined
         ? undefined
         : nonEmpty(capabilities.functions, 'Function capability requirements').map(admitCallable);
     if (functions !== undefined) {
-        unique(functions, 'PUBLICATION_INVALID', 'Function capability requirement');
+        unique(functions, 'RELEASE_INVALID', 'Function capability requirement');
         canonical(functions, compare, 'Function capability requirements');
     }
     const classes = capabilities.classes === undefined
         ? undefined
         : nonEmpty(capabilities.classes, 'Class capability requirements').map(admitClassRequirement);
     if (classes !== undefined) {
-        unique(classes.map((entry) => classKey(entry.class)), 'PUBLICATION_INVALID', 'Class capability requirement');
+        unique(classes.map((entry) => classKey(entry.class)), 'RELEASE_INVALID', 'Class capability requirement');
         canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Class capability requirements');
     }
     const authority = capabilities.authority === undefined
@@ -43,7 +45,7 @@ export function admitRequirements(input) {
         ? undefined
         : nonEmpty(capabilities.core, 'Core capability requirements').map(admitCoreCapabilityRequirement);
     if (core !== undefined) {
-        unique(core.map(({ subject }) => Key.of(subject)), 'PUBLICATION_INVALID', 'Core capability subject');
+        unique(core.map(({ subject }) => Key.of(subject)), 'RELEASE_INVALID', 'Core capability subject');
         canonical(core, (left, right) => compare(Key.of(left.subject), Key.of(right.subject)), 'Core capability requirements');
     }
     return deepFreeze({
@@ -62,28 +64,28 @@ export function admitRequirements(input) {
     });
 }
 function admitCoreCapabilityRequirement(input) {
-    const requirement = record(input, 'PUBLICATION_INVALID', 'Core capability requirement is invalid.');
-    exact(requirement, ['authority', 'classes', 'functions', 'subject'], 'PUBLICATION_INVALID');
+    const requirement = record(input, 'RELEASE_INVALID', 'Core capability requirement is invalid.');
+    exact(requirement, ['authority', 'classes', 'functions', 'subject'], 'RELEASE_INVALID');
     const subject = admitCoreRef(requirement.subject);
     const functions = requirement.functions === undefined
         ? undefined
         : nonEmpty(requirement.functions, 'Core capability Function requirements').map(admitCallable);
     if (functions !== undefined) {
-        unique(functions, 'PUBLICATION_INVALID', 'Core capability Function requirement');
+        unique(functions, 'RELEASE_INVALID', 'Core capability Function requirement');
         canonical(functions, compare, 'Core capability Function requirements');
     }
     const classes = requirement.classes === undefined
         ? undefined
         : nonEmpty(requirement.classes, 'Core capability Class requirements').map(admitClassRequirement);
     if (classes !== undefined) {
-        unique(classes.map((entry) => classKey(entry.class)), 'PUBLICATION_INVALID', 'Core capability Class requirement');
+        unique(classes.map((entry) => classKey(entry.class)), 'RELEASE_INVALID', 'Core capability Class requirement');
         canonical(classes, (left, right) => compare(classKey(left.class), classKey(right.class)), 'Core capability Class requirements');
     }
     const authority = requirement.authority === undefined
         ? undefined
         : admitAuthorityRequirements(requirement.authority);
     if (functions === undefined && classes === undefined && authority === undefined) {
-        fail('PUBLICATION_INVALID', 'Core capability requirements cannot be empty.');
+        fail('RELEASE_INVALID', 'Core capability requirements cannot be empty.');
     }
     return Object.freeze({
         subject,
@@ -102,14 +104,14 @@ export function validateRequirements(root, closure, requirements) {
     for (const callable of requirements.capabilities.functions ?? []) {
         const dependency = capabilityOwner(root, dependencies, callable, 'Function');
         if (!hasCallable(dependency, callable)) {
-            fail('PUBLICATION_INVALID', 'Function capability requirement names an unknown dependency callable.');
+            fail('RELEASE_INVALID', 'Function capability requirement names an unknown dependency callable.');
         }
     }
     for (const requirement of requirements.capabilities.classes ?? []) {
         const key = Key.of(requirement.class);
         const dependency = capabilityOwner(root, dependencies, key, 'Class');
         if (dependency.classes[requirement.class.name] === undefined) {
-            fail('PUBLICATION_INVALID', 'Class capability requirement names an unknown dependency Class.');
+            fail('RELEASE_INVALID', 'Class capability requirement names an unknown dependency Class.');
         }
     }
     for (const requirement of requirements.capabilities.core ?? []) {
@@ -117,14 +119,14 @@ export function validateRequirements(root, closure, requirements) {
         if (requirement.subject.origin !== root.origin ||
             subject === undefined ||
             !classSatisfies(root, dependencies, subject.class, KernelIdentityClass)) {
-            fail('PUBLICATION_INVALID', 'Core capability subject must name one local Core Identity.');
+            fail('RELEASE_INVALID', 'Core capability subject must name one local Core Identity.');
         }
         for (const callable of requirement.functions ?? []) {
             const owner = Key.origin(callable) === root.origin
                 ? root
                 : capabilityOwner(root, dependencies, callable, 'Function');
             if (!hasCallable(owner, callable)) {
-                fail('PUBLICATION_INVALID', 'Core capability Function requirement names an unknown or non-executable callable.');
+                fail('RELEASE_INVALID', 'Core capability Function requirement names an unknown or non-executable callable.');
             }
         }
         for (const classRequirement of requirement.classes ?? []) {
@@ -133,11 +135,28 @@ export function validateRequirements(root, closure, requirements) {
                 ? root
                 : capabilityOwner(root, dependencies, key, 'Class');
             if (owner.classes[classRequirement.class.name] === undefined) {
-                fail('PUBLICATION_INVALID', 'Core capability Class requirement names an unknown dependency Class.');
+                fail('RELEASE_INVALID', 'Core capability Class requirement names an unknown dependency Class.');
             }
         }
     }
 }
+/**
+ * Distinct Function, Method and Class Keys, including Core-scoped targets, in code-unit order.
+ * Core subjects and authority operations contribute no Keys. Results may span multiple origins.
+ */
+export function capabilityKeys(capabilities) {
+    const keys = new Set(capabilities.functions);
+    for (const requirement of capabilities.classes ?? [])
+        keys.add(Key.of(requirement.class));
+    for (const requirement of capabilities.core ?? []) {
+        for (const callable of requirement.functions ?? [])
+            keys.add(callable);
+        for (const classRequirement of requirement.classes ?? []) {
+            keys.add(Key.of(classRequirement.class));
+        }
+    }
+    return Object.freeze([...keys].sort(compare));
+}
 function classSatisfies(root, dependencies, candidate, expected) {
     const expectedKey = Key.of(expected);
     const visited = new Set();
@@ -161,7 +180,7 @@ function exactDependencyClosure(root, closure) {
         for (const coordinate of Object.values(owner.dependencies)) {
             const dependency = supplied.get(coordinate.origin);
             if (dependency === undefined || revision(dependency) !== coordinate.revision) {
-                fail('PUBLICATION_INVALID', 'Publication Bundle omits an exact dependency.');
+                fail('RELEASE_INVALID', 'Release bundle omits an exact dependency.');
             }
             if (reachable.has(dependency.origin))
                 continue;
@@ -174,21 +193,21 @@ function exactDependencyClosure(root, closure) {
 }
 function admitCallable(input) {
     if (typeof input !== 'string' || !Key.is(input)) {
-        return fail('PUBLICATION_INVALID', 'Function capability reference is invalid.');
+        return fail('RELEASE_INVALID', 'Function capability reference is invalid.');
     }
     try {
         callableAddress(input);
     }
     catch {
-        return fail('PUBLICATION_INVALID', 'Function capability reference must name a Function or Method.');
+        return fail('RELEASE_INVALID', 'Function capability reference must name a Function or Method.');
     }
     return input;
 }
 function admitClassRequirement(input) {
-    const requirement = record(input, 'PUBLICATION_INVALID', 'Class capability requirement is invalid.');
-    exact(requirement, ['class', 'operations'], 'PUBLICATION_INVALID');
+    const requirement = record(input, 'RELEASE_INVALID', 'Class capability requirement is invalid.');
+    exact(requirement, ['class', 'operations'], 'RELEASE_INVALID');
     const operations = nonEmpty(requirement.operations, 'Class capability operations').map((entry) => admitOperation(entry, ClassOperationOrder, 'Class capability operation'));
-    unique(operations, 'PUBLICATION_INVALID', 'Class capability operation');
+    unique(operations, 'RELEASE_INVALID', 'Class capability operation');
     canonical(operations, ordered(ClassOperationOrder), 'Class capability operations');
     return Object.freeze({
         class: admitClassRef(requirement.class),
@@ -196,10 +215,10 @@ function admitClassRequirement(input) {
     });
 }
 function admitAuthorityRequirements(input) {
-    const authority = record(input, 'PUBLICATION_INVALID', 'Authority capability requirements are invalid.');
-    exact(authority, ['grant', 'revoke'], 'PUBLICATION_INVALID');
+    const authority = record(input, 'RELEASE_INVALID', 'Authority capability requirements are invalid.');
+    exact(authority, ['grant', 'revoke'], 'RELEASE_INVALID');
     if (authority.grant === undefined && authority.revoke === undefined) {
-        fail('PUBLICATION_INVALID', 'Authority capability requirements cannot be empty.');
+        fail('RELEASE_INVALID', 'Authority capability requirements cannot be empty.');
     }
     const grant = admitAuthorityOperations(authority.grant, 'grant');
     const revoke = admitAuthorityOperations(authority.revoke, 'revoke');
@@ -212,7 +231,7 @@ function admitAuthorityOperations(input, kind) {
     if (input === undefined)
         return undefined;
     const values = nonEmpty(input, `Authority ${kind} operations`).map((entry) => admitOperation(entry, AuthorityOperationOrder, `Authority ${kind} operation`));
-    unique(values, 'PUBLICATION_INVALID', `authority ${kind} operation`);
+    unique(values, 'RELEASE_INVALID', `authority ${kind} operation`);
     canonical(values, ordered(AuthorityOperationOrder), `Authority ${kind} operations`);
     return Object.freeze(values);
 }
@@ -222,10 +241,10 @@ function admitClassRef(input) {
         value = acceptDefinitionRef(input);
     }
     catch {
-        fail('PUBLICATION_INVALID', 'Class capability reference is invalid.');
+        fail('RELEASE_INVALID', 'Class capability reference is invalid.');
     }
     if (value.kind !== 'class')
-        fail('PUBLICATION_INVALID', 'Class capability reference is invalid.');
+        fail('RELEASE_INVALID', 'Class capability reference is invalid.');
     return value;
 }
 function admitCoreRef(input) {
@@ -234,28 +253,28 @@ function admitCoreRef(input) {
         value = acceptDefinitionRef(input);
     }
     catch {
-        fail('PUBLICATION_INVALID', 'Core capability subject is invalid.');
+        fail('RELEASE_INVALID', 'Core capability subject is invalid.');
     }
     if (value.kind !== 'core') {
-        fail('PUBLICATION_INVALID', 'Core capability subject must be one local Core reference.');
+        fail('RELEASE_INVALID', 'Core capability subject must be one local Core reference.');
     }
     return value;
 }
 function nonEmpty(input, label) {
-    const values = [...array(input, 'PUBLICATION_INVALID')];
+    const values = [...array(input, 'RELEASE_INVALID')];
     if (values.length === 0)
-        fail('PUBLICATION_INVALID', `${label} cannot be empty.`);
+        fail('RELEASE_INVALID', `${label} cannot be empty.`);
     return values;
 }
 function admitOperation(input, vocabulary, label) {
     if (typeof input !== 'string' || !vocabulary.includes(input)) {
-        return fail('PUBLICATION_INVALID', `${label} is unknown.`);
+        return fail('RELEASE_INVALID', `${label} is unknown.`);
     }
     return input;
 }
 function canonical(values, comparator, label) {
     if (values.some((entry, index) => index > 0 && comparator(values[index - 1], entry) >= 0)) {
-        fail('PUBLICATION_INVALID', `${label} must be sorted canonically.`);
+        fail('RELEASE_INVALID', `${label} must be sorted canonically.`);
     }
 }
 function ordered(order) {
@@ -270,10 +289,10 @@ function classKey(input) {
 function capabilityOwner(root, dependencies, key, label) {
     const origin = Key.origin(key);
     if (origin === root.origin)
-        fail('PUBLICATION_INVALID', `${label} capability target cannot be local.`);
+        fail('RELEASE_INVALID', `${label} capability target cannot be local.`);
     const dependency = dependencies.get(origin);
     if (dependency === undefined) {
-        fail('PUBLICATION_INVALID', `${label} capability target must belong to the exact dependency closure.`);
+        fail('RELEASE_INVALID', `${label} capability target must belong to the exact dependency closure.`);
     }
     return dependency;
 }

package/dist/{publication → release}/route.js

@@ -1,31 +1,31 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { admitCallableKey } from './bindings/callable.js';
-import { absoluteHttpUrl, deepFreeze, exact, record } from './content.js';
 import { fail } from './error.js';
+import { absoluteHttpUrl, deepFreeze, exact, record } from './shape.js';
 const ROUTE_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/u;
 export function admitRoute(input, origin) {
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Published HTTP route is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Release HTTP route is invalid.');
     const common = admitRouteCommon(value, origin, 'href');
     return deepFreeze({
         ...common,
-        href: absoluteHttpUrl(value.href, false, 'PUBLICATION_ROUTE_INVALID', true),
+        href: absoluteHttpUrl(value.href, false, 'RELEASE_ROUTE_INVALID', true),
     });
 }
 export function admitRouteDeclaration(input, origin) {
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'HTTP route declaration is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'HTTP route declaration is invalid.');
     const common = admitRouteCommon(value, origin, 'path');
     if (typeof value.path !== 'string' || !value.path.startsWith('/')) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path must be relative to one issuer.');
+        fail('RELEASE_ROUTE_INVALID', 'Route declaration path must be relative to one issuer.');
     }
     let parsed;
     try {
         parsed = new URL(value.path, 'https://placement.invalid');
     }
     catch (cause) {
-        return fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path is invalid.', cause);
+        return fail('RELEASE_ROUTE_INVALID', 'Route declaration path is invalid.', cause);
     }
     if (parsed.origin !== 'https://placement.invalid' || parsed.search !== '' || parsed.hash !== '') {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route declaration path cannot select an origin, query, or fragment.');
+        fail('RELEASE_ROUTE_INVALID', 'Route declaration path cannot select an origin, query, or fragment.');
     }
     return deepFreeze({ ...common, path: value.path });
 }
@@ -42,24 +42,24 @@ function admitRouteCommon(value, origin, location) {
         'headers',
         'body',
         'credential',
-    ], 'PUBLICATION_ROUTE_INVALID');
+    ], 'RELEASE_ROUTE_INVALID');
     if (typeof value.name !== 'string' || !ROUTE_NAME.test(value.name)) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route name is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route name is invalid.');
     }
     const callable = admitCallableKey(value.callable, origin);
     if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE', '*'].includes(value.method)) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route method is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route method is invalid.');
     }
     if (value.default !== undefined && value.default !== true) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route default may only be true.');
+        fail('RELEASE_ROUTE_INVALID', 'Route default may only be true.');
     }
     if (value.requestMethod !== undefined &&
         (typeof value.requestMethod !== 'string' || !patterns.memberName.test(value.requestMethod))) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route request-method mapping is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route request-method mapping is invalid.');
     }
     if (value.receiver !== undefined &&
         (typeof value.receiver !== 'string' || !patterns.memberName.test(value.receiver))) {
-        fail('PUBLICATION_ROUTE_INVALID', 'Route receiver is invalid.');
+        fail('RELEASE_ROUTE_INVALID', 'Route receiver is invalid.');
     }
     const query = stringRecord(value.query);
     const headers = headerRecord(value.headers);
@@ -83,13 +83,13 @@ function admitCredential(input) {
         return undefined;
     const values = Array.isArray(input) ? input : [input];
     if (values.length === 0)
-        fail('PUBLICATION_ROUTE_INVALID', 'Credential source list is empty.');
+        fail('RELEASE_ROUTE_INVALID', 'Credential source list is empty.');
     const admitted = values.map((entry) => {
-        const value = record(entry, 'PUBLICATION_ROUTE_INVALID', 'Credential source is invalid.');
-        exact(value, ['in', 'name'], 'PUBLICATION_ROUTE_INVALID');
+        const value = record(entry, 'RELEASE_ROUTE_INVALID', 'Credential source is invalid.');
+        exact(value, ['in', 'name'], 'RELEASE_ROUTE_INVALID');
         if (value.in === 'header') {
             if (value.name !== undefined && (typeof value.name !== 'string' || value.name.length === 0)) {
-                fail('PUBLICATION_ROUTE_INVALID', 'Credential header name is invalid.');
+                fail('RELEASE_ROUTE_INVALID', 'Credential header name is invalid.');
             }
             return Object.freeze({
                 in: 'header',
@@ -101,14 +101,14 @@ function admitCredential(input) {
             value.name.length > 0) {
             return Object.freeze({ in: value.in, name: value.name });
         }
-        return fail('PUBLICATION_ROUTE_INVALID', 'Credential source is invalid.');
+        return fail('RELEASE_ROUTE_INVALID', 'Credential source is invalid.');
     });
     return Array.isArray(input) ? Object.freeze(admitted) : admitted[0];
 }
 function admitBody(input) {
     if (input === undefined || input === '*')
         return input;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route body mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route body mapping is invalid.');
     const output = {};
     for (const [field, pick] of Object.entries(value)) {
         if (typeof pick === 'string' && pick.length > 0)
@@ -121,7 +121,7 @@ function admitBody(input) {
             output[field] = { as: 'text' };
         }
         else {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route body pick is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route body pick is invalid.');
         }
     }
     return Object.freeze(output);
@@ -129,11 +129,11 @@ function admitBody(input) {
 function headerRecord(input) {
     if (input === undefined)
         return undefined;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route header mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route header mapping is invalid.');
     const output = {};
     for (const [field, pick] of Object.entries(value)) {
         if (typeof pick !== 'string' || pick.length === 0) {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route header pick is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route header pick is invalid.');
         }
         output[field] = pick;
     }
@@ -142,11 +142,11 @@ function headerRecord(input) {
 function stringRecord(input) {
     if (input === undefined)
         return undefined;
-    const value = record(input, 'PUBLICATION_ROUTE_INVALID', 'Route mapping is invalid.');
+    const value = record(input, 'RELEASE_ROUTE_INVALID', 'Route mapping is invalid.');
     const output = {};
     for (const [field, wire] of Object.entries(value)) {
         if (typeof wire !== 'string' || wire.length === 0) {
-            fail('PUBLICATION_ROUTE_INVALID', 'Route wire name is invalid.');
+            fail('RELEASE_ROUTE_INVALID', 'Route wire name is invalid.');
         }
         output[field] = wire;
     }

package/dist/{publication → release}/schema.js

@@ -1,12 +1,12 @@
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { admitBundleDescriptor } from './bundle-descriptor.js';
-import { exact, record } from './content.js';
 import { fail } from './error.js';
+import { exact, record } from './shape.js';
 export function admitSchema(input) {
-    const value = record(input, 'PUBLICATION_INVALID', 'Published schema is invalid.');
-    exact(value, ['revision', 'bundle'], 'PUBLICATION_INVALID');
+    const value = record(input, 'RELEASE_INVALID', 'Release schema is invalid.');
+    exact(value, ['revision', 'bundle'], 'RELEASE_INVALID');
     if (typeof value.revision !== 'string' || !patterns.revision.test(value.revision)) {
-        fail('PUBLICATION_INVALID', 'Published schema revision is invalid.');
+        fail('RELEASE_INVALID', 'Release schema revision is invalid.');
     }
     return Object.freeze({
         revision: value.revision,

package/dist/release/served.d.ts

@@ -0,0 +1,26 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { ServedRelease } from './bundle-admission.js';
+import type { Endpoint as DeliveryEndpoint } from './delivery-endpoint.js';
+import type { Requirements } from './requirements.js';
+/**
+ * Everything a served release document carries besides its format, version, digest and build:
+ * the content a bundle must match, the serving identity, and the optional Delivery endpoint.
+ */
+export interface ServedContent extends ServedRelease {
+    readonly identity: {
+        readonly issuer: IssuerId;
+        readonly subject: string;
+    };
+    readonly delivery?: DeliveryEndpoint;
+}
+export interface ServedOptions {
+    /** `canonicalize` normalizes authored View bindings before sealing; `admit` requires canonical ones. */
+    readonly views: 'canonicalize' | 'admit';
+    /** Reads the requirements coordinate of the document version; canonical `core` by default. */
+    readonly requirements?: (input: unknown) => Requirements;
+}
+/**
+ * Admit the version-neutral content of one served release document. Every document version runs
+ * these checks in this order, so a document of any version admits exactly the same served content.
+ */
+export declare function admitServedContent(value: Readonly<Record<string, unknown>>, options: ServedOptions): ServedContent;