@astrale-os/kernel-protocol 0.5.0-beta.8 → 0.5.0

package/dist/{publication → release}/delivery-declaration.d.ts

@@ -2,4 +2,3 @@ import type { DeliveryDeclaration } from './declaration.js';
 import type { Endpoint } from './delivery-endpoint.js';
 /** Place one provider-neutral Delivery declaration beneath an exact serving issuer. */
 export declare function placeDelivery(input: DeliveryDeclaration, issuer: string, bundleHref: string): Endpoint;
-//# sourceMappingURL=delivery-declaration.d.ts.map

package/dist/{publication → release}/delivery-declaration.js

@@ -3,24 +3,23 @@ import { fail } from './error.js';
 /** Place one provider-neutral Delivery declaration beneath an exact serving issuer. */
 export function placeDelivery(input, issuer, bundleHref) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
-        fail('PUBLICATION_INVALID', 'Delivery declaration is invalid.');
+        fail('RELEASE_INVALID', 'Delivery declaration is invalid.');
     }
     if (Reflect.ownKeys(input).some((key) => key !== 'path' && key !== 'authentication') ||
         typeof input.path !== 'string' ||
         !input.path.startsWith('/')) {
-        fail('PUBLICATION_INVALID', 'Delivery declaration is invalid.');
+        fail('RELEASE_INVALID', 'Delivery declaration is invalid.');
     }
     let href;
     try {
         const url = new URL(input.path, issuer);
         if (url.origin !== new URL(issuer).origin || url.search !== '' || url.hash !== '') {
-            fail('PUBLICATION_INVALID', 'Delivery declaration must be one relative path.');
+            fail('RELEASE_INVALID', 'Delivery declaration must be one relative path.');
         }
         href = url.href;
     }
     catch (cause) {
-        return fail('PUBLICATION_INVALID', 'Delivery declaration path is invalid.', cause);
+        return fail('RELEASE_INVALID', 'Delivery declaration path is invalid.', cause);
     }
     return admitEndpoint({ href, method: 'POST', authentication: input.authentication }, bundleHref);
 }
-//# sourceMappingURL=delivery-declaration.js.map

package/dist/{publication → release}/delivery-endpoint.d.ts

@@ -9,4 +9,3 @@ export interface Endpoint {
     readonly authentication: Authentication;
 }
 export declare function admitEndpoint(input: unknown, publicUrl: string): Endpoint | undefined;
-//# sourceMappingURL=delivery-endpoint.d.ts.map

package/dist/release/delivery-endpoint.js

@@ -0,0 +1,22 @@
+import { fail } from './error.js';
+import { absoluteHttpUrl, exact, record } from './shape.js';
+export function admitEndpoint(input, publicUrl) {
+    if (input === undefined)
+        return undefined;
+    const value = record(input, 'RELEASE_INVALID', 'Delivery endpoint is invalid.');
+    exact(value, ['href', 'method', 'authentication'], 'RELEASE_INVALID');
+    const href = absoluteHttpUrl(value.href, true, 'RELEASE_INVALID');
+    if (new URL(href).origin !== new URL(publicUrl).origin || value.method !== 'POST') {
+        fail('RELEASE_INVALID', 'Delivery endpoint must be same-origin POST.');
+    }
+    const authentication = record(value.authentication, 'RELEASE_INVALID', 'Delivery authentication is invalid.');
+    exact(authentication, ['kind'], 'RELEASE_INVALID');
+    if (authentication.kind !== 'public' && authentication.kind !== 'bearer') {
+        fail('RELEASE_INVALID', 'Delivery authentication kind is invalid.');
+    }
+    return Object.freeze({
+        href,
+        method: 'POST',
+        authentication: Object.freeze({ kind: authentication.kind }),
+    });
+}

package/dist/release/digest.d.ts

@@ -0,0 +1,13 @@
+export type Sha256Digest = `sha256:${string}`;
+/**
+ * Digest of one canonical `DomainRelease`: its build, its addresses and issuer, and through the
+ * address the variables frozen at deploy. One per deployment.
+ */
+export type ReleaseDigest = Sha256Digest;
+/**
+ * Hash of the bytes one build produced (modules, assets, schema, requirements). An address, key or
+ * secret never enters those bytes, so the same build has the same digest in every environment.
+ */
+export type BuildDigest = Sha256Digest;
+export declare function admitDigest(input: unknown): Sha256Digest;
+export declare function sha256Hex(input: Uint8Array): string;

package/dist/{publication/etag.js → release/digest.js}

@@ -1,16 +1,11 @@
-import * as portable from '@astrale-os/kernel-dsl/value';
 import { fail } from './error.js';
 const DIGEST = /^sha256:[0-9a-f]{64}$/u;
 export function admitDigest(input) {
     if (typeof input !== 'string' || !DIGEST.test(input)) {
-        fail('PUBLICATION_INVALID', 'Digest is invalid.');
+        fail('RELEASE_INVALID', 'Digest is invalid.');
     }
     return input;
 }
-export function computeEtag(input) {
-    const bytes = portable.json.encode(input);
-    return `sha256:${sha256Hex(bytes)}`;
-}
 export function sha256Hex(input) {
     const bitLength = input.length * 8;
     const paddedLength = Math.ceil((input.length + 9) / 64) * 64;
@@ -77,4 +72,3 @@ const ROUND = new Uint32Array([
     0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
     0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
 ]);
-//# sourceMappingURL=etag.js.map

package/dist/release/error.d.ts

@@ -0,0 +1,7 @@
+export type ReleaseErrorCode = 'RELEASE_INVALID' | 'RELEASE_DIGEST_MISMATCH' | 'RELEASE_BINDING_INVALID' | 'RELEASE_ROUTE_INVALID' | 'RELEASE_VIEW_INVALID';
+export declare class ReleaseError extends Error {
+    readonly code: ReleaseErrorCode;
+    readonly name = "ReleaseError";
+    constructor(code: ReleaseErrorCode, message: string, options?: ErrorOptions);
+}
+export declare function fail(code: ReleaseErrorCode, message: string, cause?: unknown): never;

package/dist/release/error.js

@@ -0,0 +1,11 @@
+export class ReleaseError extends Error {
+    code;
+    name = 'ReleaseError';
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+    }
+}
+export function fail(code, message, cause) {
+    throw new ReleaseError(code, message, cause === undefined ? undefined : { cause });
+}

package/dist/release/index.d.ts

@@ -0,0 +1,17 @@
+export { MEDIA_TYPE, PATH, accept, digestOf, encode, seal, url, type Content, type DomainRelease, } from './release.js';
+export type { Build } from './build.js';
+export { acceptReference, compareReferences, matchesReference, reference, type ReleaseRef, type ReleaseReferenceRelation, } from './reference.js';
+export { acceptBundle, decodeBundle, type ServedRelease } from './bundle-admission.js';
+export { BUNDLE_MEDIA_TYPE, bundleUrl, describeBundle, type BundleDescriptor } from './bundle.js';
+export { verifyBundleBytes } from './bundle-evidence.js';
+export type { Declaration, DeliveryDeclaration } from './declaration.js';
+export { placeDelivery } from './delivery-declaration.js';
+export type { Authentication as DeliveryAuthentication, Endpoint as DeliveryEndpoint, } from './delivery-endpoint.js';
+export type { BuildDigest, ReleaseDigest, Sha256Digest } from './digest.js';
+export { ReleaseError, type ReleaseErrorCode } from './error.js';
+export type { Manifest } from './manifest.js';
+export { ClassOperationOrder, admitRequirements, capabilityKeys, validateRequirements, type CapabilityAuthorityRequirements, type CoreCapabilityRequirement, type CapabilityRequirements, type ClassCapabilityRequirement, type ClassOperation, type NonEmpty, type Requirements, } from './requirements.js';
+export type { BodyPick, CredentialSource, HttpMethod, HttpRoute, HttpRouteDeclaration, RouteBody, RouteHeaders, SingleCredentialSource, } from './route.js';
+export type { Schema } from './schema.js';
+export { acceptInvocationEndpoints, type CallableBinding, type InvocationEndpoints, type ViewBinding, } from './bindings/index.js';
+export * as delivery from './delivery/index.js';

package/dist/release/index.js

@@ -0,0 +1,10 @@
+export { MEDIA_TYPE, PATH, accept, digestOf, encode, seal, url, } from './release.js';
+export { acceptReference, compareReferences, matchesReference, reference, } from './reference.js';
+export { acceptBundle, decodeBundle } from './bundle-admission.js';
+export { BUNDLE_MEDIA_TYPE, bundleUrl, describeBundle } from './bundle.js';
+export { verifyBundleBytes } from './bundle-evidence.js';
+export { placeDelivery } from './delivery-declaration.js';
+export { ReleaseError } from './error.js';
+export { ClassOperationOrder, admitRequirements, capabilityKeys, validateRequirements, } from './requirements.js';
+export { acceptInvocationEndpoints, } from './bindings/index.js';
+export * as delivery from './delivery/index.js';

package/dist/release/issuer.d.ts

@@ -0,0 +1,5 @@
+import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+/** Admit the exact serving issuer a served release document names. */
+export declare function admitIssuer(input: unknown): IssuerId;
+/** Resolve one served path beneath one exact HTTP(S) serving issuer, keeping its complete path. */
+export declare function servedUrl(issuer: string, path: `/${string}`): string;

package/dist/release/issuer.js

@@ -0,0 +1,34 @@
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import { fail } from './error.js';
+/** Admit the exact serving issuer a served release document names. */
+export function admitIssuer(input) {
+    try {
+        return acceptIssuerId(String(input));
+    }
+    catch (cause) {
+        if (cause instanceof AuthValueError) {
+            return fail('RELEASE_INVALID', 'Release issuer is invalid.', cause);
+        }
+        throw cause;
+    }
+}
+/** Resolve one served path beneath one exact HTTP(S) serving issuer, keeping its complete path. */
+export function servedUrl(issuer, path) {
+    const admitted = admitIssuer(issuer);
+    let value;
+    try {
+        value = new URL(admitted);
+    }
+    catch (cause) {
+        return fail('RELEASE_INVALID', 'Release issuer is not an HTTP(S) URL.', cause);
+    }
+    if ((value.protocol !== 'https:' && value.protocol !== 'http:') ||
+        value.username !== '' ||
+        value.password !== '' ||
+        value.search !== '' ||
+        value.hash !== '') {
+        fail('RELEASE_INVALID', 'Release issuer is not an HTTP(S) URL.');
+    }
+    return `${admitted.replace(/\/+$/u, '')}${path}`;
+}

package/dist/release/manifest.d.ts

@@ -0,0 +1,6 @@
+export interface Manifest {
+    readonly logo?: string;
+}
+/** The root Schema owns the Domain name and entrypoint in every release. */
+export declare function assertAuthoredManifest(input: unknown): void;
+export declare function admitManifest(input: unknown): Manifest | undefined;

package/dist/release/manifest.js

@@ -0,0 +1,22 @@
+import { fail } from './error.js';
+import { exact, record } from './shape.js';
+/** The root Schema owns the Domain name and entrypoint in every release. */
+export function assertAuthoredManifest(input) {
+    if (input === null || typeof input !== 'object')
+        return;
+    for (const removed of ['title', 'entrypoint']) {
+        if (Object.hasOwn(input, removed)) {
+            fail('RELEASE_INVALID', `Manifest ${removed} is removed: the root schema declares the Domain name and entrypoint.`);
+        }
+    }
+}
+export function admitManifest(input) {
+    if (input === undefined)
+        return undefined;
+    const value = record(input, 'RELEASE_INVALID', 'Manifest is invalid.');
+    exact(value, ['logo'], 'RELEASE_INVALID');
+    if (value.logo !== undefined && typeof value.logo !== 'string') {
+        fail('RELEASE_INVALID', 'Manifest logo must be a string.');
+    }
+    return Object.freeze(value.logo === undefined ? {} : { logo: value.logo });
+}

package/dist/release/reference.d.ts

@@ -0,0 +1,26 @@
+import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
+import { type Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { ReleaseDigest } from './digest.js';
+import type { DomainRelease } from './release.js';
+/** Compact untrusted projection that witnesses one exact `DomainRelease`. */
+export interface ReleaseRef {
+    readonly origin: Key.Origin;
+    readonly identity: DomainRelease['identity'];
+    readonly revision: Revision;
+    readonly digest: ReleaseDigest;
+}
+/**
+ * Relation between two `ReleaseRef`s. A release digest commits to identity, schema and build, so
+ * within one origin anything but the exact reference designates another release.
+ */
+export type ReleaseReferenceRelation = 'exact' | 'release-drift' | 'origin-drift';
+export declare function reference(input: DomainRelease): ReleaseRef;
+export declare function acceptReference(input: unknown): ReleaseRef;
+/**
+ * Classify a received reference against the expected one. A different origin is origin drift.
+ * Within one origin the reference is exact only when every coordinate equals the expected one: for
+ * references of admitted releases that is digest equality, and a received reference that names
+ * the expected digest beside any other coordinate witnesses no release, so it is release drift.
+ */
+export declare function compareReferences(input: ReleaseRef, expected: ReleaseRef): ReleaseReferenceRelation;
+export declare function matchesReference(input: DomainRelease, expected: ReleaseRef): boolean;

package/dist/release/reference.js

@@ -0,0 +1,70 @@
+import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
+import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { admitDigest } from './digest.js';
+import { fail } from './error.js';
+import { deepFreeze, exact, record } from './shape.js';
+export function reference(input) {
+    return deepFreeze({
+        origin: input.origin,
+        identity: { ...input.identity },
+        revision: input.schema.revision,
+        digest: input.digest,
+    });
+}
+export function acceptReference(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Release reference is invalid.');
+    exact(value, ['origin', 'identity', 'revision', 'digest'], 'RELEASE_INVALID');
+    if (typeof value.origin !== 'string' || !patterns.origin.test(value.origin)) {
+        fail('RELEASE_INVALID', 'Release reference origin is invalid.');
+    }
+    const origin = value.origin;
+    const identity = record(value.identity, 'RELEASE_INVALID', 'Release reference identity is invalid.');
+    exact(identity, ['issuer', 'subject'], 'RELEASE_INVALID');
+    const issuer = acceptIssuer(identity.issuer);
+    if (identity.subject !== origin) {
+        fail('RELEASE_INVALID', 'Release reference subject must equal its root origin.');
+    }
+    if (typeof value.revision !== 'string' || !patterns.revision.test(value.revision)) {
+        fail('RELEASE_INVALID', 'Release reference revision is invalid.');
+    }
+    return deepFreeze({
+        origin,
+        identity: { issuer, subject: origin },
+        revision: value.revision,
+        digest: admitDigest(value.digest),
+    });
+}
+/**
+ * Classify a received reference against the expected one. A different origin is origin drift.
+ * Within one origin the reference is exact only when every coordinate equals the expected one: for
+ * references of admitted releases that is digest equality, and a received reference that names
+ * the expected digest beside any other coordinate witnesses no release, so it is release drift.
+ */
+export function compareReferences(input, expected) {
+    if (input.origin !== expected.origin)
+        return 'origin-drift';
+    return input.digest === expected.digest &&
+        input.revision === expected.revision &&
+        input.identity.issuer === expected.identity.issuer &&
+        input.identity.subject === expected.identity.subject
+        ? 'exact'
+        : 'release-drift';
+}
+export function matchesReference(input, expected) {
+    return compareReferences(reference(input), expected) === 'exact';
+}
+function acceptIssuer(input) {
+    if (typeof input !== 'string') {
+        fail('RELEASE_INVALID', 'Release reference issuer is invalid.');
+    }
+    try {
+        return acceptIssuerId(input);
+    }
+    catch (cause) {
+        if (cause instanceof AuthValueError) {
+            return fail('RELEASE_INVALID', 'Release reference issuer is invalid.', cause);
+        }
+        throw cause;
+    }
+}

package/dist/release/release.d.ts

@@ -0,0 +1,60 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+import type { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import type { CallableBinding, ViewBinding } from './bindings/index.js';
+import type { Build } from './build.js';
+import type { Endpoint as DeliveryEndpoint } from './delivery-endpoint.js';
+import type { ReleaseDigest } from './digest.js';
+import type { Manifest } from './manifest.js';
+import type { Requirements } from './requirements.js';
+import type { HttpRoute } from './route.js';
+import type { Schema } from './schema.js';
+/** Path of the release a deployment serves beneath its serving issuer. */
+export declare const PATH: '/.well-known/astrale/release.json';
+/** Media type of `DomainRelease` v4. */
+export declare const MEDIA_TYPE: 'application/vnd.astrale.domain-release+json;v=4';
+/** Resolve the canonical release URL beneath one exact HTTP(S) serving issuer, keeping its path. */
+export declare function url(issuer: string): string;
+/**
+ * Immutable deployment document pinned by the Kernel. Its digest covers the schema, serving
+ * identity and code through the build digest; `version` identifies the document format.
+ */
+export interface DomainRelease {
+    readonly format: 'astrale.domain.release';
+    readonly version: 4;
+    readonly origin: Key.Origin;
+    readonly identity: {
+        readonly issuer: IssuerId;
+        /** Always the root origin. */
+        readonly subject: string;
+    };
+    readonly digest: ReleaseDigest;
+    readonly build: Build;
+    readonly schema: Schema;
+    readonly requirements: Requirements;
+    readonly manifest?: Manifest;
+    readonly bindings: {
+        readonly callables: readonly CallableBinding[];
+        readonly views: readonly ViewBinding[];
+    };
+    readonly routes: readonly HttpRoute[];
+    readonly delivery?: DeliveryEndpoint;
+}
+/** Content of a release before its digest is computed. */
+export type Content = Omit<DomainRelease, 'digest'>;
+/**
+ * Release digest of canonical release content: SHA-256 of its canonical JSON. The content must be
+ * exactly what `seal` produces, a sealed release without its digest; content that `seal` would
+ * canonicalize or refuse throws `ReleaseError` instead of yielding a digest no decoder accepts.
+ * Authored content gets its digest from `seal(content).digest`.
+ */
+export declare function digestOf(input: Content): ReleaseDigest;
+/** Validate release content, canonicalize its View bindings, and set its release digest. */
+export declare function seal(input: Content): DomainRelease;
+/**
+ * Admit one wire release: exact fields at every level, every value in the canonical form `seal`
+ * produces, and a digest matching its content. One release therefore has exactly one wire
+ * document: `encode(accept(input))` is the canonical JSON of `input`.
+ */
+export declare function accept(input: unknown): DomainRelease;
+/** Encode one release as its canonical JSON bytes. */
+export declare function encode(input: DomainRelease): Uint8Array;

package/dist/release/release.js

@@ -0,0 +1,125 @@
+import * as portable from '@astrale-os/kernel-dsl/value';
+import { admitBuild } from './build.js';
+import { admitDigest, sha256Hex } from './digest.js';
+import { fail } from './error.js';
+import { servedUrl } from './issuer.js';
+import { assertAuthoredManifest } from './manifest.js';
+import { admitServedContent } from './served.js';
+import { deepFreeze, exact, record } from './shape.js';
+/** Path of the release a deployment serves beneath its serving issuer. */
+export const PATH = '/.well-known/astrale/release.json';
+/** Media type of `DomainRelease` v4. */
+export const MEDIA_TYPE = 'application/vnd.astrale.domain-release+json;v=4';
+/** Resolve the canonical release URL beneath one exact HTTP(S) serving issuer, keeping its path. */
+export function url(issuer) {
+    return servedUrl(issuer, PATH);
+}
+const CONTENT_FIELDS = [
+    'format',
+    'version',
+    'origin',
+    'identity',
+    'build',
+    'schema',
+    'requirements',
+    'manifest',
+    'bindings',
+    'routes',
+    'delivery',
+];
+/**
+ * Release digest of canonical release content: SHA-256 of its canonical JSON. The content must be
+ * exactly what `seal` produces, a sealed release without its digest; content that `seal` would
+ * canonicalize or refuse throws `ReleaseError` instead of yielding a digest no decoder accepts.
+ * Authored content gets its digest from `seal(content).digest`.
+ */
+export function digestOf(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(value, CONTENT_FIELDS, 'RELEASE_INVALID');
+    return hash(admitCanonical(value));
+}
+/** Validate release content, canonicalize its View bindings, and set its release digest. */
+export function seal(input) {
+    const authored = record(input, 'RELEASE_INVALID', 'Expected release content.');
+    exact(authored, CONTENT_FIELDS, 'RELEASE_INVALID');
+    assertAuthoredManifest(authored.manifest);
+    const canonical = admitContent(admitContent(authored, 'canonicalize'), 'admit');
+    return release(canonical, hash(canonical));
+}
+/**
+ * Admit one wire release: exact fields at every level, every value in the canonical form `seal`
+ * produces, and a digest matching its content. One release therefore has exactly one wire
+ * document: `encode(accept(input))` is the canonical JSON of `input`.
+ */
+export function accept(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Expected a DomainRelease object.');
+    exact(value, [...CONTENT_FIELDS, 'digest'], 'RELEASE_INVALID');
+    const { digest: received, ...wire } = value;
+    const content = admitCanonical(wire);
+    const digest = admitDigest(received);
+    if (digest !== hash(content)) {
+        fail('RELEASE_DIGEST_MISMATCH', 'Release digest does not match its canonical content.');
+    }
+    return release(content, digest);
+}
+/** Encode one release as its canonical JSON bytes. */
+export function encode(input) {
+    return portable.json.encode(input);
+}
+function admitContent(value, views) {
+    if (value.format !== 'astrale.domain.release' || value.version !== 4) {
+        fail('RELEASE_INVALID', 'Unsupported release format or version.');
+    }
+    const served = admitServedContent(value, { views });
+    const build = admitBuild(value.build);
+    return deepFreeze({
+        format: 'astrale.domain.release',
+        version: 4,
+        origin: served.origin,
+        identity: served.identity,
+        build,
+        schema: served.schema,
+        requirements: served.requirements,
+        ...(served.manifest === undefined ? {} : { manifest: served.manifest }),
+        bindings: served.bindings,
+        routes: served.routes,
+        ...(served.delivery === undefined ? {} : { delivery: served.delivery }),
+    });
+}
+/** Shared validators normalize legacy values; releases require their exact canonical spelling. */
+function admitCanonical(value) {
+    const content = admitContent(value, 'admit');
+    const canonical = portable.json.serialize(content);
+    let received;
+    try {
+        received = portable.json.serialize(value);
+    }
+    catch (cause) {
+        if (cause instanceof portable.BoundaryError) {
+            return fail('RELEASE_INVALID', 'Release content is not in canonical form.', cause);
+        }
+        throw cause;
+    }
+    if (received !== canonical)
+        fail('RELEASE_INVALID', 'Release content is not in canonical form.');
+    return content;
+}
+function hash(content) {
+    return `sha256:${sha256Hex(portable.json.encode(content))}`;
+}
+function release(content, digest) {
+    return deepFreeze({
+        format: content.format,
+        version: content.version,
+        origin: content.origin,
+        identity: content.identity,
+        digest,
+        build: content.build,
+        schema: content.schema,
+        requirements: content.requirements,
+        ...(content.manifest === undefined ? {} : { manifest: content.manifest }),
+        bindings: content.bindings,
+        routes: content.routes,
+        ...(content.delivery === undefined ? {} : { delivery: content.delivery }),
+    });
+}

package/dist/release/requirements.d.ts

@@ -0,0 +1,41 @@
+import type { AuthorityOperation } from '@astrale-os/kernel-core/schema/authority/operation';
+import type { schema as schemaLanguage } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef, Key as SemanticKey } from '@astrale-os/kernel-dsl/v1/addressing';
+export type NonEmpty<Value> = readonly [Value, ...Value[]];
+export declare const ClassOperationOrder: readonly ["create", "read", "traverse", "update", "delete"];
+export type ClassOperation = (typeof ClassOperationOrder)[number];
+export interface ClassCapabilityRequirement {
+    readonly class: ClassRef;
+    readonly operations: NonEmpty<ClassOperation>;
+}
+export interface CapabilityAuthorityRequirements {
+    readonly grant?: NonEmpty<AuthorityOperation>;
+    readonly revoke?: NonEmpty<AuthorityOperation>;
+}
+export interface CapabilityRequirements {
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
+    readonly core?: NonEmpty<CoreCapabilityRequirement>;
+}
+/** Installation-owned authority materialized onto one local Core Identity. */
+export interface CoreCapabilityRequirement {
+    readonly subject: CoreRef;
+    readonly functions?: NonEmpty<SemanticKey.Callable>;
+    readonly classes?: NonEmpty<ClassCapabilityRequirement>;
+    readonly authority?: CapabilityAuthorityRequirements;
+}
+export interface Requirements {
+    readonly capabilities: CapabilityRequirements;
+}
+/**
+ * Admit the exact closed canonical Release requirements object.
+ */
+export declare function admitRequirements(input: unknown): Requirements;
+/** Bind explicit capability targets to exact functional dependencies in the bundle closure. */
+export declare function validateRequirements(root: schemaLanguage.DomainSchema, closure: readonly schemaLanguage.DomainSchema[], requirements: Requirements): void;
+/**
+ * Distinct Function, Method and Class Keys, including Core-scoped targets, in code-unit order.
+ * Core subjects and authority operations contribute no Keys. Results may span multiple origins.
+ */
+export declare function capabilityKeys(capabilities: CapabilityRequirements): readonly SemanticKey[];