@astrale-os/kernel-protocol 0.5.0-beta.8 → 1.0.0-beta.1

package/dist/invocation/service-reason.js

@@ -1,24 +1,21 @@
 import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
 import { accept as acceptIssuer } from '@astrale-os/kernel-core/auth/issuer';
-import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { Key, patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { CODES, reasonOf } from '../errors/index.js';
-export const SCHEMA_UPGRADE_REQUIRED = 'SCHEMA_UPGRADE_REQUIRED';
-export const SCHEMA_REVISION_MISMATCH = 'SCHEMA_REVISION_MISMATCH';
+export const CALLABLE_FINGERPRINT_MISMATCH = 'CALLABLE_FINGERPRINT_MISMATCH';
 export const SERVICE_TRUST_REQUIRED = 'SERVICE_TRUST_REQUIRED';
 export const SERVICE_UNAVAILABLE = 'SERVICE_UNAVAILABLE';
 export const SERVICE_CANDIDATE_INVALID = 'SERVICE_CANDIDATE_INVALID';
+/** A deployment answers that it no longer serves: it runs no other code in its place. */
+export const DEPLOYMENT_RETIRED = 'DEPLOYMENT_RETIRED';
 /** Recognize only exact outer-code, reason-code, and detail-shape combinations. */
 export function serviceErrorOf(input) {
     const reason = reasonOf(input.data);
     if (reason === undefined)
         return undefined;
     switch (reason.code) {
-        case SCHEMA_REVISION_MISMATCH:
-            return input.code === CODES.CONFLICT && schemaRevisionMismatchDetails(reason.details)
-                ? input
-                : undefined;
-        case SCHEMA_UPGRADE_REQUIRED:
-            return input.code === CODES.CONFLICT && schemaUpgradeDetails(reason.details)
+        case CALLABLE_FINGERPRINT_MISMATCH:
+            return input.code === CODES.CONFLICT && callableFingerprintMismatchDetails(reason.details)
                 ? input
                 : undefined;
         case SERVICE_TRUST_REQUIRED:
@@ -33,21 +30,22 @@ export function serviceErrorOf(input) {
             return input.code === CODES.BACKEND_UNAVAILABLE && candidateInvalidDetails(reason.details)
                 ? input
                 : undefined;
+        case DEPLOYMENT_RETIRED:
+            return input.code === CODES.NOT_FOUND && deploymentRetiredDetails(reason.details)
+                ? input
+                : undefined;
         default:
             return undefined;
     }
 }
-function schemaRevisionMismatchDetails(input) {
-    return (exact(input, ['origin', 'expectedRevision', 'installedRevision']) &&
+function callableFingerprintMismatchDetails(input) {
+    return (exact(input, ['origin', 'callable', 'expectedFingerprint', 'installedFingerprint']) &&
         isOrigin(input.origin) &&
-        isRevision(input.expectedRevision) &&
-        isRevision(input.installedRevision));
-}
-function schemaUpgradeDetails(input) {
-    return (exact(input, ['origin', 'installedRevision', 'candidateRevision']) &&
-        isOrigin(input.origin) &&
-        isRevision(input.installedRevision) &&
-        isRevision(input.candidateRevision));
+        typeof input.callable === 'string' &&
+        Key.is(input.callable) &&
+        Key.origin(input.callable) === input.origin &&
+        isDigest(input.expectedFingerprint) &&
+        isDigest(input.installedFingerprint));
 }
 function serviceTrustDetails(input) {
     return (exact(input, ['origin', 'installedIssuer', 'candidateIssuer']) &&
@@ -61,6 +59,13 @@ function serviceUnavailableDetails(input) {
 function candidateInvalidDetails(input) {
     return exact(input, ['origin']) && isOrigin(input.origin);
 }
+function deploymentRetiredDetails(input) {
+    return Object.hasOwn(input, 'release')
+        ? exact(input, ['deployment', 'release']) &&
+            isIssuer(input.deployment) &&
+            isDigest(input.release)
+        : exact(input, ['deployment']) && isIssuer(input.deployment);
+}
 function exact(input, fields) {
     return (Object.keys(input).length === fields.length &&
         fields.every((field) => Object.hasOwn(input, field)));
@@ -71,6 +76,9 @@ function isOrigin(input) {
 function isRevision(input) {
     return typeof input === 'string' && patterns.revision.test(input);
 }
+function isDigest(input) {
+    return typeof input === 'string' && /^sha256:[0-9a-f]{64}$/u.test(input);
+}
 function isIssuer(input) {
     if (typeof input !== 'string')
         return false;
@@ -83,4 +91,3 @@ function isIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=service-reason.js.map

package/dist/invocation/stale-route.d.ts

@@ -1,4 +1,4 @@
-import type { Etag } from '../publication/index.js';
+import type { ReleaseDigest } from '../release/digest.js';
 import type { RequestId } from './correlation.js';
 import type { InvocationId } from './identity.js';
 /** Reserved pre-handler routing control; never an application ErrorResponse. */
@@ -6,8 +6,7 @@ export interface Stale {
     readonly kind: 'stale';
     readonly requestId: RequestId;
     readonly invocation: InvocationId;
-    readonly current: Etag;
+    readonly current: ReleaseDigest;
 }
 export declare function decodeStale(input: unknown): Stale;
-export declare function stale(requestId: RequestId, assigned: InvocationId, current: Etag): Stale;
-//# sourceMappingURL=stale-route.d.ts.map
+export declare function stale(requestId: RequestId, assigned: InvocationId, current: ReleaseDigest): Stale;

package/dist/invocation/stale-route.js

@@ -17,4 +17,3 @@ export function decodeStale(input) {
 export function stale(requestId, assigned, current) {
     return decodeStale({ kind: 'stale', requestId, invocation: assigned, current });
 }
-//# sourceMappingURL=stale-route.js.map

package/dist/invocation/stream.d.ts

@@ -25,4 +25,3 @@ export interface StreamErrorFrame {
 }
 export type StreamFrame = StreamStartFrame | StreamItemFrame | StreamEndFrame | StreamErrorFrame;
 export declare function decodeStreamFrame(input: unknown): StreamFrame;
-//# sourceMappingURL=stream.d.ts.map

package/dist/invocation/stream.js

@@ -42,4 +42,3 @@ export function decodeStreamFrame(input) {
             return invalid(`unsupported stream frame kind ${JSON.stringify(kind)}`);
     }
 }
-//# sourceMappingURL=stream.js.map

package/dist/invocation/target.d.ts

@@ -1,4 +1,6 @@
-import type { Call } from '@astrale-os/kernel-core/callable';
-export type { Call } from '@astrale-os/kernel-core/callable';
+import type { Value } from '@astrale-os/kernel-dsl/value';
+import { type Call } from '@astrale-os/kernel-core/callable';
+export { Target, targetPath, type Call } from '@astrale-os/kernel-core/callable';
 export declare function acceptCall(input: unknown): Call;
-//# sourceMappingURL=target.d.ts.map
+/** Package-private: consume the detached portable subtree captured by request admission. */
+export declare function callFromSnapshot(input: Value): Call;

package/dist/invocation/target.js

@@ -1,12 +1,33 @@
-import { exactFields, nodePath, portableObject, required } from './admission.js';
+import { Target } from '@astrale-os/kernel-core/callable';
+import { PathError } from '@astrale-os/kernel-core/path';
+import { exactFields, invalid, nodePath, portableObject, required } from './admission.js';
+export { Target, targetPath } from '@astrale-os/kernel-core/callable';
 const CALL_FIELDS = new Set(['target', 'input']);
 export function acceptCall(input) {
-    const object = portableObject(input, 'call');
+    return callFromSnapshot(portableObject(input, 'call'));
+}
+/** Package-private: consume the detached portable subtree captured by request admission. */
+export function callFromSnapshot(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        invalid('call must be an object');
+    }
+    const object = input;
     exactFields(object, CALL_FIELDS, 'call');
     required(object, ['target', 'input'], 'call');
     return Object.freeze({
-        target: nodePath(object.target, 'call.target'),
+        target: acceptTarget(object.target),
         input: object.input,
     });
 }
-//# sourceMappingURL=target.js.map
+function acceptTarget(input) {
+    if (typeof input === 'string')
+        return nodePath(input, 'call.target');
+    try {
+        return Target(input);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError || cause instanceof PathError)
+            return invalid('call.target must be a canonical NodePath or declaration Target');
+        throw cause;
+    }
+}

package/dist/invocation/trace.d.ts

@@ -7,4 +7,3 @@ export interface Trace {
 }
 /** Admit portable correlation syntax without making it an invocation validity condition. */
 export declare function admitTrace(input: unknown): Trace | undefined;
-//# sourceMappingURL=trace.d.ts.map

package/dist/invocation/trace.js

@@ -84,4 +84,3 @@ function validStateKey(input) {
         return false;
     return TENANT_ID.test(input.slice(0, separator)) && SYSTEM_ID.test(input.slice(separator + 1));
 }
-//# sourceMappingURL=trace.js.map

package/dist/invocation/version.d.ts

@@ -1,3 +1,2 @@
 export declare const VERSION: 2;
 export type Version = typeof VERSION;
-//# sourceMappingURL=version.d.ts.map

package/dist/invocation/version.js

@@ -1,2 +1 @@
 export const VERSION = 2;
-//# sourceMappingURL=version.js.map

package/dist/invocation/websocket/binary.d.ts

@@ -1,4 +1,3 @@
 import type { BinaryResponse } from '../binary.js';
 export declare function encodeBinary(response: BinaryResponse): Uint8Array;
 export declare function decodeBinary(input: Uint8Array): BinaryResponse | undefined;
-//# sourceMappingURL=binary.d.ts.map

package/dist/invocation/websocket/binary.js

@@ -14,6 +14,7 @@ export function encodeBinary(response) {
         requestId: response.requestId,
         invocation: response.invocation,
         mediaType: response.mediaType,
+        status: response.status,
         ...(headers === undefined ? {} : { headers }),
     }));
     if (metadata.byteLength > MAXIMUM_METADATA_BYTES)
@@ -69,4 +70,3 @@ function invalid() {
         message: 'WebSocket binary response is invalid.',
     });
 }
-//# sourceMappingURL=binary.js.map

package/dist/invocation/websocket/index.d.ts

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';
-//# sourceMappingURL=index.d.ts.map
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';

package/dist/invocation/websocket/index.js

@@ -1,3 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';
-//# sourceMappingURL=index.js.map
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';

package/dist/invocation/websocket/subprotocol.d.ts

@@ -1,11 +1,9 @@
 import type { Codec } from '../../codecs/index.js';
 export declare const JSON_SUBPROTOCOL: 'astrale.invocation.v2.json';
-export declare const MSGPACK_SUBPROTOCOL: 'astrale.invocation.v2.msgpack';
-export type Subprotocol = typeof JSON_SUBPROTOCOL | typeof MSGPACK_SUBPROTOCOL;
+export type Subprotocol = typeof JSON_SUBPROTOCOL;
 export interface SubprotocolSelection {
     readonly subprotocol: Subprotocol;
     readonly codec: Codec;
 }
 export declare function subprotocolFor(codec: Codec): Subprotocol;
 export declare function selectSubprotocol(offered: string | null, supported: readonly Codec[]): SubprotocolSelection | undefined;
-//# sourceMappingURL=subprotocol.d.ts.map

package/dist/invocation/websocket/subprotocol.js

@@ -1,12 +1,11 @@
 import { admitSupportedCodecs, codecProfile } from '../binding-codecs.js';
 export const JSON_SUBPROTOCOL = 'astrale.invocation.v2.json';
-export const MSGPACK_SUBPROTOCOL = 'astrale.invocation.v2.msgpack';
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
 export function subprotocolFor(codec) {
-    const profile = codecProfile(codec);
-    if (profile === undefined)
+    if (codecProfile(codec) === undefined) {
         throw new TypeError('codec is not a canonical Invocation codec.');
-    return profile === 'json' ? JSON_SUBPROTOCOL : MSGPACK_SUBPROTOCOL;
+    }
+    return JSON_SUBPROTOCOL;
 }
 export function selectSubprotocol(offered, supported) {
     const admitted = admitSupportedCodecs(supported);
@@ -27,4 +26,3 @@ export function selectSubprotocol(offered, supported) {
     }
     return undefined;
 }
-//# sourceMappingURL=subprotocol.js.map

package/dist/issuer/claims.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export declare const EXECUTION_CLAIM = "execution";

package/dist/issuer/claims.js

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export const EXECUTION_CLAIM = 'execution';

package/dist/issuer/configuration.d.ts

@@ -12,4 +12,3 @@ export interface ConfigurationOptions {
 export declare function configuration(issuer: string, algorithms: readonly [string, ...string[]], options?: ConfigurationOptions): Configuration;
 export declare function acceptConfiguration(input: unknown, expectedIssuer?: string): Configuration;
 export declare function acceptAlgorithms(input: unknown): readonly [string, ...string[]];
-//# sourceMappingURL=configuration.d.ts.map

package/dist/issuer/configuration.js

@@ -84,4 +84,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=configuration.js.map

package/dist/issuer/error.d.ts

@@ -5,4 +5,3 @@ export declare class DiscoveryError extends Error {
     constructor(code: DiscoveryErrorCode, message: string, options?: ErrorOptions);
 }
 export declare function fail(code: DiscoveryErrorCode, message: string, cause?: unknown): never;
-//# sourceMappingURL=error.d.ts.map

package/dist/issuer/error.js

@@ -9,4 +9,3 @@ export class DiscoveryError extends Error {
 export function fail(code, message, cause) {
     throw new DiscoveryError(code, message, cause === undefined ? undefined : { cause });
 }
-//# sourceMappingURL=error.js.map

package/dist/issuer/exchange.d.ts

@@ -23,4 +23,3 @@ export declare function acceptResponse(input: unknown): Response;
 export declare function acceptErrorResponse(input: unknown): ErrorResponse;
 export declare function acceptHttpRequest(input: HttpRequest): Request;
 export declare function responseHeaders(): Readonly<Record<string, string>>;
-//# sourceMappingURL=exchange.d.ts.map

package/dist/issuer/exchange.js

@@ -127,4 +127,3 @@ function nonEmptyText(input, label) {
     }
     return input;
 }
-//# sourceMappingURL=exchange.js.map

package/dist/issuer/hosted.d.ts

@@ -1,3 +1,2 @@
 import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function hosted(base: string, thumbprint: string): IssuerId | undefined;
-//# sourceMappingURL=hosted.d.ts.map

package/dist/issuer/hosted.js

@@ -5,4 +5,3 @@ export function hosted(base, thumbprint) {
         return undefined;
     return acceptIssuer(`${acceptIssuer(base)}/iss/${thumbprint}`);
 }
-//# sourceMappingURL=hosted.js.map

package/dist/issuer/index.d.ts

@@ -1,7 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, type Configuration, type ConfigurationOptions, } from './configuration.js';
 export { DiscoveryError, type DiscoveryErrorCode } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, type WorkflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/issuer/index.js

@@ -1,7 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, } from './configuration.js';
 export { DiscoveryError } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';
-//# sourceMappingURL=index.js.map

package/dist/issuer/key-set.d.ts

@@ -4,4 +4,3 @@ export interface KeySet {
 }
 export declare function keySet(keys: readonly JsonWebKey[], algorithms: readonly [string, ...string[]]): KeySet;
 export declare function acceptKeySet(input: unknown, algorithms: readonly [string, ...string[]]): KeySet;
-//# sourceMappingURL=key-set.d.ts.map

package/dist/issuer/key-set.js

@@ -46,4 +46,3 @@ function deepFreeze(input) {
         deepFreeze(value);
     return Object.freeze(input);
 }
-//# sourceMappingURL=key-set.js.map

package/dist/issuer/paths.d.ts

@@ -2,6 +2,7 @@ export interface Paths {
     readonly configuration: string;
     readonly keys: string;
     readonly tokenExchange: string;
+    /** Where Domains discover the workflow engine of a Kernel that drives one. */
+    readonly workflowEngine: string;
 }
 export declare function paths(issuer: string): Paths;
-//# sourceMappingURL=paths.d.ts.map

package/dist/issuer/paths.js

@@ -6,6 +6,6 @@ export function paths(issuer) {
         configuration: `${pathname}/.well-known/openid-configuration`,
         keys: `${pathname}/.well-known/jwks.json`,
         tokenExchange: `${pathname}/.well-known/astrale/token`,
+        workflowEngine: `${pathname}/.well-known/astrale/workflow-engine.json`,
     });
 }
-//# sourceMappingURL=paths.js.map

package/dist/issuer/url.d.ts

@@ -1,3 +1,2 @@
 import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
 export declare function acceptIssuer(input: unknown): IssuerId;
-//# sourceMappingURL=url.d.ts.map

package/dist/issuer/url.js

@@ -32,4 +32,3 @@ export function acceptIssuer(input) {
         throw cause;
     }
 }
-//# sourceMappingURL=url.js.map

package/dist/issuer/workflow-engine.d.ts

@@ -0,0 +1,18 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+/**
+ * The workflow engine a Kernel drives, as Domains discover it at
+ * `<issuer>/.well-known/astrale/workflow-engine.json`: the engine signs every request to a Domain with
+ * one of these Restate request identity keys. Several keys let the Host rotate without a gap.
+ */
+export interface WorkflowEngine {
+    readonly issuer: IssuerId;
+    readonly identity_keys: readonly [string, ...string[]];
+}
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export declare function acceptWorkflowEngineIdentityKey(input: unknown): string;
+export declare function workflowEngine(issuer: string, identityKeys: readonly string[]): WorkflowEngine;
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export declare function acceptWorkflowEngine(input: unknown, expectedIssuer?: string): WorkflowEngine;

package/dist/issuer/workflow-engine.js

@@ -0,0 +1,59 @@
+import { fail } from './error.js';
+import { acceptIssuer } from './url.js';
+/** Restate's `publickeyv1_` id: base58btc of a raw Ed25519 public key. */
+const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/u;
+const BASE58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const MAXIMUM_IDENTITY_KEYS = 8;
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export function acceptWorkflowEngineIdentityKey(input) {
+    if (typeof input !== 'string' || !IDENTITY_KEY.test(input) || decodedKeyBytes(input) !== 32) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return input;
+}
+export function workflowEngine(issuer, identityKeys) {
+    return Object.freeze({
+        issuer: acceptIssuer(issuer),
+        identity_keys: acceptIdentityKeys(identityKeys),
+    });
+}
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export function acceptWorkflowEngine(input, expectedIssuer) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine discovery is invalid.');
+    }
+    const value = input;
+    const admitted = acceptIssuer(value.issuer);
+    if (expectedIssuer !== undefined && admitted !== acceptIssuer(expectedIssuer)) {
+        fail('ISSUER_DISCOVERY_MISMATCH', 'Workflow engine discovery does not match the issuer.');
+    }
+    return Object.freeze({ issuer: admitted, identity_keys: acceptIdentityKeys(value.identity_keys) });
+}
+function acceptIdentityKeys(input) {
+    if (!Array.isArray(input) ||
+        input.length === 0 ||
+        input.length > MAXIMUM_IDENTITY_KEYS ||
+        new Set(input).size !== input.length) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return Object.freeze(Array.from(input, acceptWorkflowEngineIdentityKey));
+}
+/** Base58 leading '1' digits represent zero bytes omitted by the integer value. */
+function decodedKeyBytes(key) {
+    const encoded = key.slice('publickeyv1_'.length);
+    let value = 0n;
+    for (const digit of encoded)
+        value = value * 58n + BigInt(BASE58.indexOf(digit));
+    let bytes = 0;
+    for (; value > 0n; value >>= 8n)
+        bytes++;
+    for (const digit of encoded) {
+        if (digit !== '1')
+            break;
+        bytes++;
+    }
+    return bytes;
+}

package/dist/{publication → release}/bindings/callable.d.ts

@@ -6,4 +6,3 @@ export interface CallableBinding {
 }
 export declare function admitCallableBinding(input: unknown, origin: string): CallableBinding;
 export declare function admitCallableKey(input: unknown, origin: string): Key.Callable;
-//# sourceMappingURL=callable.d.ts.map

package/dist/{publication → release}/bindings/callable.js

@@ -1,10 +1,10 @@
 import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
-import { exact, record } from '../content.js';
 import { fail } from '../error.js';
+import { exact, record } from '../shape.js';
 import { acceptInvocationEndpoints } from './invocation.js';
 export function admitCallableBinding(input, origin) {
-    const value = record(input, 'PUBLICATION_BINDING_INVALID', 'Callable binding is invalid.');
-    exact(value, ['callable', 'endpoint'], 'PUBLICATION_BINDING_INVALID');
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Callable binding is invalid.');
+    exact(value, ['callable', 'endpoint'], 'RELEASE_BINDING_INVALID');
     return Object.freeze({
         callable: admitCallableKey(value.callable, origin),
         endpoint: acceptInvocationEndpoints(value.endpoint),
@@ -17,19 +17,18 @@ export function admitCallableKey(input, origin) {
     }
     catch (cause) {
         if (cause instanceof TypeError) {
-            return fail('PUBLICATION_BINDING_INVALID', 'Callable key is invalid.', cause);
+            return fail('RELEASE_BINDING_INVALID', 'Callable key is invalid.', cause);
         }
         throw cause;
     }
     if (Key.origin(callable) !== origin) {
-        fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
+        fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
     try {
         callableAddress(callable);
     }
     catch (cause) {
-        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+        return fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
     }
     return callable;
 }
-//# sourceMappingURL=callable.js.map

package/dist/{publication → release}/bindings/index.d.ts

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey, type CallableBinding } from './callable.js';
 export { acceptInvocationEndpoints, type InvocationEndpoints } from './invocation.js';
 export { admitViewBinding, type ViewBinding } from './view.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/{publication → release}/bindings/index.js

@@ -1,4 +1,3 @@
 export { admitCallableBinding, admitCallableKey } from './callable.js';
 export { acceptInvocationEndpoints } from './invocation.js';
 export { admitViewBinding } from './view.js';
-//# sourceMappingURL=index.js.map

package/dist/{publication → release}/bindings/invocation.d.ts

@@ -3,4 +3,3 @@ export interface InvocationEndpoints {
     readonly websocket?: string;
 }
 export declare function acceptInvocationEndpoints(input: unknown): InvocationEndpoints;
-//# sourceMappingURL=invocation.d.ts.map

package/dist/release/bindings/invocation.js

@@ -0,0 +1,13 @@
+import { absoluteHttpUrl, absoluteUrl, exact, record } from '../shape.js';
+export function acceptInvocationEndpoints(input) {
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Invocation endpoints are invalid.');
+    exact(value, ['http', 'websocket'], 'RELEASE_BINDING_INVALID');
+    const http = absoluteHttpUrl(value.http, true, 'RELEASE_BINDING_INVALID');
+    const websocket = value.websocket === undefined
+        ? undefined
+        : absoluteUrl(value.websocket, ['ws:', 'wss:'], true, 'RELEASE_BINDING_INVALID');
+    return Object.freeze({
+        http,
+        ...(websocket === undefined ? {} : { websocket }),
+    });
+}

package/dist/release/bindings/view.d.ts

@@ -0,0 +1,11 @@
+import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+export interface ViewBinding {
+    readonly view: Key.View;
+    readonly href: string;
+    readonly handshake: 'shell' | 'none';
+    readonly host?: ViewHostRequirements;
+}
+export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
+/** Authoring-only normalization used before a release document is sealed. */
+export declare function canonicalizeViewBinding(input: unknown, origin: string): ViewBinding;

package/dist/release/bindings/view.js

@@ -0,0 +1,54 @@
+import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { fail } from '../error.js';
+import { absoluteHttpUrl, exact, record } from '../shape.js';
+export function admitViewBinding(input, origin) {
+    return readViewBinding(input, origin, false);
+}
+/** Authoring-only normalization used before a release document is sealed. */
+export function canonicalizeViewBinding(input, origin) {
+    return readViewBinding(input, origin, true);
+}
+function readViewBinding(input, origin, canonicalize) {
+    const value = record(input, 'RELEASE_VIEW_INVALID', 'Release View binding is invalid.');
+    exact(value, ['view', 'href', 'handshake', 'host'], 'RELEASE_VIEW_INVALID');
+    let view;
+    try {
+        view = Key(String(value.view));
+    }
+    catch (cause) {
+        if (cause instanceof TypeError) {
+            return fail('RELEASE_VIEW_INVALID', 'View key is invalid.', cause);
+        }
+        throw cause;
+    }
+    if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
+        fail('RELEASE_VIEW_INVALID', 'View binding must name a root View.');
+    }
+    if (value.handshake !== 'shell' && value.handshake !== 'none') {
+        fail('RELEASE_VIEW_INVALID', 'View handshake is invalid.');
+    }
+    let host;
+    try {
+        host = acceptViewHostRequirements(dataValue(value, 'host'), value.handshake, canonicalize);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            return fail('RELEASE_VIEW_INVALID', 'View host requirements are invalid.', cause);
+        throw cause;
+    }
+    return Object.freeze({
+        view,
+        href: absoluteHttpUrl(value.href, true, 'RELEASE_VIEW_INVALID'),
+        handshake: value.handshake,
+        ...(host === undefined ? {} : { host }),
+    });
+}
+function dataValue(input, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor === undefined)
+        return undefined;
+    if (!('value' in descriptor))
+        fail('RELEASE_VIEW_INVALID', 'View requirements must be data fields.');
+    return descriptor.value;
+}

package/dist/release/build.d.ts

@@ -0,0 +1,6 @@
+import type { BuildDigest } from './digest.js';
+/** Identity of the code a release runs: the digest of the bytes its build produced. */
+export interface Build {
+    readonly digest: BuildDigest;
+}
+export declare function admitBuild(input: unknown): Build;