@astrale-os/kernel-protocol 0.5.0-beta.9 → 0.5.0

package/dist/invocation/websocket/binary.js

@@ -14,6 +14,7 @@ export function encodeBinary(response) {
         requestId: response.requestId,
         invocation: response.invocation,
         mediaType: response.mediaType,
+        status: response.status,
         ...(headers === undefined ? {} : { headers }),
     }));
     if (metadata.byteLength > MAXIMUM_METADATA_BYTES)

package/dist/invocation/websocket/index.d.ts

@@ -1,2 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, type Subprotocol, type SubprotocolSelection, } from './subprotocol.js';

package/dist/invocation/websocket/index.js

@@ -1,2 +1,2 @@
 export { decodeBinary, encodeBinary } from './binary.js';
-export { JSON_SUBPROTOCOL, MSGPACK_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';
+export { JSON_SUBPROTOCOL, selectSubprotocol, subprotocolFor, } from './subprotocol.js';

package/dist/invocation/websocket/subprotocol.d.ts

@@ -1,7 +1,6 @@
 import type { Codec } from '../../codecs/index.js';
 export declare const JSON_SUBPROTOCOL: 'astrale.invocation.v2.json';
-export declare const MSGPACK_SUBPROTOCOL: 'astrale.invocation.v2.msgpack';
-export type Subprotocol = typeof JSON_SUBPROTOCOL | typeof MSGPACK_SUBPROTOCOL;
+export type Subprotocol = typeof JSON_SUBPROTOCOL;
 export interface SubprotocolSelection {
     readonly subprotocol: Subprotocol;
     readonly codec: Codec;

package/dist/invocation/websocket/subprotocol.js

@@ -1,12 +1,11 @@
 import { admitSupportedCodecs, codecProfile } from '../binding-codecs.js';
 export const JSON_SUBPROTOCOL = 'astrale.invocation.v2.json';
-export const MSGPACK_SUBPROTOCOL = 'astrale.invocation.v2.msgpack';
 const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
 export function subprotocolFor(codec) {
-    const profile = codecProfile(codec);
-    if (profile === undefined)
+    if (codecProfile(codec) === undefined) {
         throw new TypeError('codec is not a canonical Invocation codec.');
-    return profile === 'json' ? JSON_SUBPROTOCOL : MSGPACK_SUBPROTOCOL;
+    }
+    return JSON_SUBPROTOCOL;
 }
 export function selectSubprotocol(offered, supported) {
     const admitted = admitSupportedCodecs(supported);

package/dist/issuer/claims.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export declare const EXECUTION_CLAIM = "execution";

package/dist/issuer/claims.js

@@ -0,0 +1,7 @@
+/**
+ * Private JWT claim of the self credential a durable step's Domain signs for the Kernel: the id of
+ * the Execution the step belongs to. After a consented issuer change, the Kernel accepts the
+ * replaced issuer past its window only for a credential naming an unfinished run of its Domain
+ * that was in flight at that change.
+ */
+export const EXECUTION_CLAIM = 'execution';

package/dist/issuer/index.d.ts

@@ -1,6 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, type Configuration, type ConfigurationOptions, } from './configuration.js';
 export { DiscoveryError, type DiscoveryErrorCode } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet, type KeySet } from './key-set.js';
 export { paths, type Paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, type WorkflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';

package/dist/issuer/index.js

@@ -1,6 +1,8 @@
+export { EXECUTION_CLAIM } from './claims.js';
 export { acceptConfiguration, configuration, } from './configuration.js';
 export { DiscoveryError } from './error.js';
 export { hosted } from './hosted.js';
 export { acceptKeySet, keySet } from './key-set.js';
 export { paths } from './paths.js';
+export { acceptWorkflowEngine, acceptWorkflowEngineIdentityKey, workflowEngine, } from './workflow-engine.js';
 export * as exchange from './exchange.js';

package/dist/issuer/paths.d.ts

@@ -2,5 +2,7 @@ export interface Paths {
     readonly configuration: string;
     readonly keys: string;
     readonly tokenExchange: string;
+    /** Where Domains discover the workflow engine of a Kernel that drives one. */
+    readonly workflowEngine: string;
 }
 export declare function paths(issuer: string): Paths;

package/dist/issuer/paths.js

@@ -6,5 +6,6 @@ export function paths(issuer) {
         configuration: `${pathname}/.well-known/openid-configuration`,
         keys: `${pathname}/.well-known/jwks.json`,
         tokenExchange: `${pathname}/.well-known/astrale/token`,
+        workflowEngine: `${pathname}/.well-known/astrale/workflow-engine.json`,
     });
 }

package/dist/issuer/workflow-engine.d.ts

@@ -0,0 +1,18 @@
+import type { IssuerId } from '@astrale-os/kernel-core/auth/issuer';
+/**
+ * The workflow engine a Kernel drives, as Domains discover it at
+ * `<issuer>/.well-known/astrale/workflow-engine.json`: the engine signs every request to a Domain with
+ * one of these Restate request identity keys. Several keys let the Host rotate without a gap.
+ */
+export interface WorkflowEngine {
+    readonly issuer: IssuerId;
+    readonly identity_keys: readonly [string, ...string[]];
+}
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export declare function acceptWorkflowEngineIdentityKey(input: unknown): string;
+export declare function workflowEngine(issuer: string, identityKeys: readonly string[]): WorkflowEngine;
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export declare function acceptWorkflowEngine(input: unknown, expectedIssuer?: string): WorkflowEngine;

package/dist/issuer/workflow-engine.js

@@ -0,0 +1,59 @@
+import { fail } from './error.js';
+import { acceptIssuer } from './url.js';
+/** Restate's `publickeyv1_` id: base58btc of a raw Ed25519 public key. */
+const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/u;
+const BASE58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const MAXIMUM_IDENTITY_KEYS = 8;
+/** Admit one Restate request identity key without imposing a key-set policy. */
+export function acceptWorkflowEngineIdentityKey(input) {
+    if (typeof input !== 'string' || !IDENTITY_KEY.test(input) || decodedKeyBytes(input) !== 32) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return input;
+}
+export function workflowEngine(issuer, identityKeys) {
+    return Object.freeze({
+        issuer: acceptIssuer(issuer),
+        identity_keys: acceptIdentityKeys(identityKeys),
+    });
+}
+/**
+ * Admit a discovered engine for the expected issuer. Unlike issuer configuration, unknown fields are
+ * ignored: the Kernel may add some without breaking deployed Domains.
+ */
+export function acceptWorkflowEngine(input, expectedIssuer) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input)) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine discovery is invalid.');
+    }
+    const value = input;
+    const admitted = acceptIssuer(value.issuer);
+    if (expectedIssuer !== undefined && admitted !== acceptIssuer(expectedIssuer)) {
+        fail('ISSUER_DISCOVERY_MISMATCH', 'Workflow engine discovery does not match the issuer.');
+    }
+    return Object.freeze({ issuer: admitted, identity_keys: acceptIdentityKeys(value.identity_keys) });
+}
+function acceptIdentityKeys(input) {
+    if (!Array.isArray(input) ||
+        input.length === 0 ||
+        input.length > MAXIMUM_IDENTITY_KEYS ||
+        new Set(input).size !== input.length) {
+        fail('ISSUER_DISCOVERY_INVALID', 'Workflow engine identity keys are invalid.');
+    }
+    return Object.freeze(Array.from(input, acceptWorkflowEngineIdentityKey));
+}
+/** Base58 leading '1' digits represent zero bytes omitted by the integer value. */
+function decodedKeyBytes(key) {
+    const encoded = key.slice('publickeyv1_'.length);
+    let value = 0n;
+    for (const digit of encoded)
+        value = value * 58n + BigInt(BASE58.indexOf(digit));
+    let bytes = 0;
+    for (; value > 0n; value >>= 8n)
+        bytes++;
+    for (const digit of encoded) {
+        if (digit !== '1')
+            break;
+        bytes++;
+    }
+    return bytes;
+}

package/dist/{publication → release}/bindings/callable.js

@@ -1,10 +1,10 @@
 import { callableAddress, Key } from '@astrale-os/kernel-dsl/v1/addressing';
-import { exact, record } from '../content.js';
 import { fail } from '../error.js';
+import { exact, record } from '../shape.js';
 import { acceptInvocationEndpoints } from './invocation.js';
 export function admitCallableBinding(input, origin) {
-    const value = record(input, 'PUBLICATION_BINDING_INVALID', 'Callable binding is invalid.');
-    exact(value, ['callable', 'endpoint'], 'PUBLICATION_BINDING_INVALID');
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Callable binding is invalid.');
+    exact(value, ['callable', 'endpoint'], 'RELEASE_BINDING_INVALID');
     return Object.freeze({
         callable: admitCallableKey(value.callable, origin),
         endpoint: acceptInvocationEndpoints(value.endpoint),
@@ -17,18 +17,18 @@ export function admitCallableKey(input, origin) {
     }
     catch (cause) {
         if (cause instanceof TypeError) {
-            return fail('PUBLICATION_BINDING_INVALID', 'Callable key is invalid.', cause);
+            return fail('RELEASE_BINDING_INVALID', 'Callable key is invalid.', cause);
         }
         throw cause;
     }
     if (Key.origin(callable) !== origin) {
-        fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
+        fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.');
     }
     try {
         callableAddress(callable);
     }
     catch (cause) {
-        return fail('PUBLICATION_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
+        return fail('RELEASE_BINDING_INVALID', 'Binding must name one callable owned by the root Domain.', cause);
     }
     return callable;
 }

package/dist/release/bindings/invocation.js

@@ -0,0 +1,13 @@
+import { absoluteHttpUrl, absoluteUrl, exact, record } from '../shape.js';
+export function acceptInvocationEndpoints(input) {
+    const value = record(input, 'RELEASE_BINDING_INVALID', 'Invocation endpoints are invalid.');
+    exact(value, ['http', 'websocket'], 'RELEASE_BINDING_INVALID');
+    const http = absoluteHttpUrl(value.http, true, 'RELEASE_BINDING_INVALID');
+    const websocket = value.websocket === undefined
+        ? undefined
+        : absoluteUrl(value.websocket, ['ws:', 'wss:'], true, 'RELEASE_BINDING_INVALID');
+    return Object.freeze({
+        http,
+        ...(websocket === undefined ? {} : { websocket }),
+    });
+}

package/dist/release/bindings/view.d.ts

@@ -0,0 +1,11 @@
+import { type ViewHostRequirements } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+export interface ViewBinding {
+    readonly view: Key.View;
+    readonly href: string;
+    readonly handshake: 'shell' | 'none';
+    readonly host?: ViewHostRequirements;
+}
+export declare function admitViewBinding(input: unknown, origin: string): ViewBinding;
+/** Authoring-only normalization used before a release document is sealed. */
+export declare function canonicalizeViewBinding(input: unknown, origin: string): ViewBinding;

package/dist/release/bindings/view.js

@@ -0,0 +1,54 @@
+import { acceptViewHostRequirements, } from '@astrale-os/kernel-core/schema/kernel/syscalls/view-resolution';
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import { fail } from '../error.js';
+import { absoluteHttpUrl, exact, record } from '../shape.js';
+export function admitViewBinding(input, origin) {
+    return readViewBinding(input, origin, false);
+}
+/** Authoring-only normalization used before a release document is sealed. */
+export function canonicalizeViewBinding(input, origin) {
+    return readViewBinding(input, origin, true);
+}
+function readViewBinding(input, origin, canonicalize) {
+    const value = record(input, 'RELEASE_VIEW_INVALID', 'Release View binding is invalid.');
+    exact(value, ['view', 'href', 'handshake', 'host'], 'RELEASE_VIEW_INVALID');
+    let view;
+    try {
+        view = Key(String(value.view));
+    }
+    catch (cause) {
+        if (cause instanceof TypeError) {
+            return fail('RELEASE_VIEW_INVALID', 'View key is invalid.', cause);
+        }
+        throw cause;
+    }
+    if (Key.origin(view) !== origin || !view.slice(view.indexOf(':') + 1).startsWith('view.')) {
+        fail('RELEASE_VIEW_INVALID', 'View binding must name a root View.');
+    }
+    if (value.handshake !== 'shell' && value.handshake !== 'none') {
+        fail('RELEASE_VIEW_INVALID', 'View handshake is invalid.');
+    }
+    let host;
+    try {
+        host = acceptViewHostRequirements(dataValue(value, 'host'), value.handshake, canonicalize);
+    }
+    catch (cause) {
+        if (cause instanceof TypeError)
+            return fail('RELEASE_VIEW_INVALID', 'View host requirements are invalid.', cause);
+        throw cause;
+    }
+    return Object.freeze({
+        view,
+        href: absoluteHttpUrl(value.href, true, 'RELEASE_VIEW_INVALID'),
+        handshake: value.handshake,
+        ...(host === undefined ? {} : { host }),
+    });
+}
+function dataValue(input, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(input, key);
+    if (descriptor === undefined)
+        return undefined;
+    if (!('value' in descriptor))
+        fail('RELEASE_VIEW_INVALID', 'View requirements must be data fields.');
+    return descriptor.value;
+}

package/dist/release/build.d.ts

@@ -0,0 +1,6 @@
+import type { BuildDigest } from './digest.js';
+/** Identity of the code a release runs: the digest of the bytes its build produced. */
+export interface Build {
+    readonly digest: BuildDigest;
+}
+export declare function admitBuild(input: unknown): Build;

package/dist/release/build.js

@@ -0,0 +1,7 @@
+import { admitDigest } from './digest.js';
+import { exact, record } from './shape.js';
+export function admitBuild(input) {
+    const value = record(input, 'RELEASE_INVALID', 'Release build is invalid.');
+    exact(value, ['digest'], 'RELEASE_INVALID');
+    return Object.freeze({ digest: admitDigest(value.digest) });
+}

package/dist/release/bundle-admission.d.ts

@@ -0,0 +1,21 @@
+import { Key } from '@astrale-os/kernel-dsl/v1/addressing';
+import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import type { CallableBinding, ViewBinding } from './bindings/index.js';
+import type { Manifest } from './manifest.js';
+import type { Requirements } from './requirements.js';
+import type { HttpRoute } from './route.js';
+import type { Schema } from './schema.js';
+/** The served release content one external Schema Bundle must exactly match. */
+export interface ServedRelease {
+    readonly origin: Key.Origin;
+    readonly schema: Schema;
+    readonly requirements: Requirements;
+    readonly manifest?: Manifest;
+    readonly bindings: {
+        readonly callables: readonly CallableBinding[];
+        readonly views: readonly ViewBinding[];
+    };
+    readonly routes: readonly HttpRoute[];
+}
+export declare function acceptBundle(input: ServedRelease, artifact: unknown): dslBundle.Bundle;
+export declare function decodeBundle(input: ServedRelease, bytes: Uint8Array): dslBundle.Bundle;

package/dist/{publication → release}/bundle-admission.js

@@ -1,5 +1,6 @@
 import { Key, MethodKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import * as dslBundle from '@astrale-os/kernel-dsl/v1/bundle';
+import { isMethodExecutable } from '@astrale-os/kernel-dsl/v1/language';
 import { revision } from '@astrale-os/kernel-dsl/v1/schema/revision';
 import { acceptBundleValue, decodeBundleValue, verifyBundleBytes } from './bundle.js';
 import { fail } from './error.js';
@@ -15,32 +16,26 @@ export function decodeBundle(input, bytes) {
     validateInventory(input, decoded);
     return decoded;
 }
-function validateInventory(publication, bundle) {
+function validateInventory(release, bundle) {
     const root = bundle.root;
-    if (root.origin !== publication.origin || revision(root) !== publication.schema.revision) {
-        fail('PUBLICATION_INVALID', 'Bundle root does not match the Publication schema.');
+    if (root.origin !== release.origin || revision(root) !== release.schema.revision) {
+        fail('RELEASE_INVALID', 'Bundle root does not match the release schema.');
     }
-    validateRequirements(root, bundle.closure, publication.requirements);
+    validateRequirements(root, bundle.closure, release.requirements);
     const callables = concreteCallables(root);
-    const publishedCallables = new Set(publication.bindings.callables.map(({ callable }) => callable));
-    if (publishedCallables.size !== callables.size ||
-        [...callables].some((key) => !publishedCallables.has(key))) {
-        fail('PUBLICATION_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
+    const boundCallables = new Set(release.bindings.callables.map(({ callable }) => callable));
+    if (boundCallables.size !== callables.size ||
+        [...callables].some((key) => !boundCallables.has(key))) {
+        fail('RELEASE_BINDING_INVALID', 'Callable bindings must exhaust the root Domain.');
     }
     const views = new Set(Object.keys(root.views).map((name) => Key.of({ origin: root.origin, kind: 'view', name })));
-    const publishedViews = new Set(publication.bindings.views.map(({ view }) => view));
-    if (publishedViews.size !== views.size || [...views].some((key) => !publishedViews.has(key))) {
-        fail('PUBLICATION_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
+    const boundViews = new Set(release.bindings.views.map(({ view }) => view));
+    if (boundViews.size !== views.size || [...views].some((key) => !boundViews.has(key))) {
+        fail('RELEASE_VIEW_INVALID', 'View bindings must exhaust the root Domain.');
     }
-    if (publication.manifest?.entrypoint !== undefined &&
-        (publication.manifest.entrypoint.origin !== root.origin ||
-            publication.manifest.entrypoint.kind !== 'view' ||
-            root.views[publication.manifest.entrypoint.name] === undefined)) {
-        fail('PUBLICATION_INVALID', 'Manifest entrypoint does not exist in the root schema.');
-    }
-    for (const route of publication.routes) {
+    for (const route of release.routes) {
         if (!callables.has(route.callable)) {
-            fail('PUBLICATION_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
+            fail('RELEASE_ROUTE_INVALID', `Route ${route.name} names an unknown callable.`);
         }
     }
 }
@@ -57,7 +52,7 @@ function addClassMethods(result, origin, definitions) {
         if (declaration.kind !== 'node')
             continue;
         for (const [name, method] of Object.entries(declaration.methods)) {
-            if (method.inheritance === 'abstract')
+            if (!isMethodExecutable(declaration, method))
                 continue;
             result.add(MethodKey.of({ origin, kind: 'class', name: owner }, name));
         }

package/dist/{publication → release}/bundle-descriptor.js

@@ -1,19 +1,19 @@
 import * as artifact from '../artifact/index.js';
-import { absoluteHttpUrl, exact, record } from './content.js';
 import { fail } from './error.js';
+import { absoluteHttpUrl, exact, record } from './shape.js';
 export const BUNDLE_MEDIA_TYPE = 'application/vnd.astrale.domain-bundle+json;v=1';
 export function admitBundleDescriptor(input) {
-    const value = record(input, 'PUBLICATION_INVALID', 'Bundle descriptor is invalid.');
-    exact(value, ['href', 'ref'], 'PUBLICATION_INVALID');
+    const value = record(input, 'RELEASE_INVALID', 'Bundle descriptor is invalid.');
+    exact(value, ['href', 'ref'], 'RELEASE_INVALID');
     const ref = artifact.accept(value.ref);
     if (ref.mediaType !== BUNDLE_MEDIA_TYPE) {
-        fail('PUBLICATION_INVALID', 'Bundle media type is unsupported.');
+        fail('RELEASE_INVALID', 'Bundle media type is unsupported.');
     }
     if (ref.size < 1) {
-        fail('PUBLICATION_INVALID', 'Bundle size is invalid.');
+        fail('RELEASE_INVALID', 'Bundle size is invalid.');
     }
     return Object.freeze({
-        href: absoluteHttpUrl(value.href, true, 'PUBLICATION_INVALID'),
+        href: absoluteHttpUrl(value.href, true, 'RELEASE_INVALID'),
         ref: Object.freeze({ ...ref, mediaType: BUNDLE_MEDIA_TYPE }),
     });
 }

package/dist/release/bundle-evidence.d.ts

@@ -0,0 +1,3 @@
+import type { ServedRelease } from './bundle-admission.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export declare function verifyBundleBytes(release: Pick<ServedRelease, 'schema'>, bytes: Uint8Array): void;

package/dist/release/bundle-evidence.js

@@ -0,0 +1,13 @@
+import { sha256Hex } from './digest.js';
+import { fail } from './error.js';
+/** Verify exact artifact bytes without decoding an authored Schema Bundle. */
+export function verifyBundleBytes(release, bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+        fail('RELEASE_INVALID', 'Bundle artifact bytes are invalid.');
+    }
+    const descriptor = release.schema.bundle;
+    if (bytes.byteLength !== descriptor.ref.size ||
+        `sha256:${sha256Hex(bytes)}` !== descriptor.ref.digest) {
+        fail('RELEASE_INVALID', 'Bundle artifact does not match its descriptor.');
+    }
+}

package/dist/{publication → release}/bundle.d.ts

@@ -1,9 +1,12 @@
 import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
+import type { ServedRelease } from './bundle-admission.js';
 import type { BundleDescriptor } from './bundle-descriptor.js';
-import type { Publication } from './publication.js';
+import * as artifact from '../artifact/index.js';
 import { verifyBundleBytes } from './bundle-evidence.js';
+/** Resolve immutable bundle bytes beneath the exact serving issuer. */
+export declare function bundleUrl(issuer: string, ref: artifact.Ref): string;
 export declare function describeBundle(input: bundle.Bundle, href: string): BundleDescriptor;
 export declare function acceptBundleValue(input: unknown): bundle.Bundle;
-export declare function decodeBundleValue(publication: Publication, bytes: Uint8Array): bundle.Bundle;
+export declare function decodeBundleValue(release: Pick<ServedRelease, 'schema'>, bytes: Uint8Array): bundle.Bundle;
 export { verifyBundleBytes };
 export { admitBundleDescriptor, BUNDLE_MEDIA_TYPE, type BundleDescriptor, } from './bundle-descriptor.js';

package/dist/{publication → release}/bundle.js

@@ -2,12 +2,18 @@ import * as bundle from '@astrale-os/kernel-dsl/v1/bundle/transport';
 import * as artifact from '../artifact/index.js';
 import { BUNDLE_MEDIA_TYPE } from './bundle-descriptor.js';
 import { verifyBundleBytes } from './bundle-evidence.js';
-import { absoluteHttpUrl } from './content.js';
 import { fail } from './error.js';
+import { servedUrl } from './issuer.js';
+import { absoluteHttpUrl } from './shape.js';
+/** Resolve immutable bundle bytes beneath the exact serving issuer. */
+export function bundleUrl(issuer, ref) {
+    const digest = ref.digest.slice('sha256:'.length);
+    return servedUrl(issuer, `/.well-known/astrale/bundles/sha256/${digest}.json`);
+}
 export function describeBundle(input, href) {
     const bytes = bundle.encode(input);
     return Object.freeze({
-        href: absoluteHttpUrl(href, true, 'PUBLICATION_INVALID'),
+        href: absoluteHttpUrl(href, true, 'RELEASE_INVALID'),
         ref: Object.freeze({
             ...artifact.identify(bytes, BUNDLE_MEDIA_TYPE),
             mediaType: BUNDLE_MEDIA_TYPE,
@@ -20,22 +26,22 @@ export function acceptBundleValue(input) {
     }
     catch (cause) {
         if (cause instanceof bundle.Error) {
-            return fail('PUBLICATION_INVALID', 'Publication bundle is invalid.', cause);
+            return fail('RELEASE_INVALID', 'Release bundle is invalid.', cause);
         }
         throw cause;
     }
 }
-export function decodeBundleValue(publication, bytes) {
+export function decodeBundleValue(release, bytes) {
     if (!(bytes instanceof Uint8Array)) {
-        fail('PUBLICATION_INVALID', 'Bundle artifact bytes are invalid.');
+        fail('RELEASE_INVALID', 'Bundle artifact bytes are invalid.');
     }
-    verifyBundleBytes(publication, bytes);
+    verifyBundleBytes(release, bytes);
     try {
         return bundle.decode(bytes);
     }
     catch (cause) {
         if (cause instanceof bundle.Error) {
-            return fail('PUBLICATION_INVALID', 'Bundle artifact cannot be decoded.', cause);
+            return fail('RELEASE_INVALID', 'Bundle artifact cannot be decoded.', cause);
         }
         throw cause;
     }

package/dist/{publication → release}/delivery/attestation.d.ts

@@ -1,4 +1,5 @@
 declare const ATTESTATION: unique symbol;
+/** Opaque, bounded attestation text a Delivery carries; Core Auth verifies it. */
 export type Attestation = string & {
     readonly [ATTESTATION]: true;
 };

package/dist/{publication → release}/delivery/claims.d.ts

@@ -1,16 +1,21 @@
 import type { Subject } from '@astrale-os/kernel-core/auth/identity';
 import type { Revision } from '@astrale-os/kernel-dsl/v1/addressing';
 import { type IssuerId } from '@astrale-os/kernel-core/auth/issuer';
-import type { Etag } from '../etag.js';
+import type { ReleaseDigest } from '../digest.js';
 import { PURPOSE } from './limits.js';
+/**
+ * What a verified Delivery v2 attestation asserts: the serving Domain identity delivers the release
+ * with this digest and schema revision to the requesting Kernel, for its challenge nonce.
+ */
 export interface Claims {
     readonly purpose: typeof PURPOSE;
     readonly iss: IssuerId;
     readonly sub: Subject;
     readonly aud: IssuerId;
     readonly nonce: string;
-    readonly etag: Etag;
+    readonly release: ReleaseDigest;
     readonly schemaRevision: Revision;
     readonly exp: number;
 }
+/** Admit the claims of an attestation Core Auth already verified. */
 export declare function acceptClaims(input: unknown): Claims;

package/dist/{publication → release}/delivery/claims.js

@@ -1,15 +1,26 @@
 import { AuthValueError } from '@astrale-os/kernel-core/auth/error';
 import { accept as acceptIssuerId } from '@astrale-os/kernel-core/auth/issuer';
 import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { deepFreeze } from '../shape.js';
 import { fail } from './error.js';
 import { NONCE_MAX_LENGTH, NONCE_MIN_LENGTH, PURPOSE } from './limits.js';
+const FIELDS = [
+    'purpose',
+    'iss',
+    'sub',
+    'aud',
+    'nonce',
+    'release',
+    'schemaRevision',
+    'exp',
+];
+/** Admit the claims of an attestation Core Auth already verified. */
 export function acceptClaims(input) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         fail('DELIVERY_CLAIMS_INVALID', 'Expected delivery claims.');
     }
     const value = input;
-    const expected = ['purpose', 'iss', 'sub', 'aud', 'nonce', 'etag', 'schemaRevision', 'exp'];
-    if (Object.keys(value).some((field) => !expected.includes(field))) {
+    if (Object.keys(value).some((field) => !FIELDS.includes(field))) {
         fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims contain unknown fields.');
     }
     if (value.purpose !== PURPOSE ||
@@ -24,8 +35,8 @@ export function acceptClaims(input) {
     }
     const iss = acceptIssuer(value.iss);
     const aud = acceptIssuer(value.aud);
-    if (typeof value.etag !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(value.etag)) {
-        fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims ETag is invalid.');
+    if (typeof value.release !== 'string' || !/^sha256:[0-9a-f]{64}$/u.test(value.release)) {
+        fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims release digest is invalid.');
     }
     if (typeof value.schemaRevision !== 'string' || !patterns.revision.test(value.schemaRevision)) {
         fail('DELIVERY_CLAIMS_INVALID', 'Schema revision is invalid.');
@@ -36,14 +47,17 @@ export function acceptClaims(input) {
         sub: value.sub,
         aud,
         nonce: value.nonce,
-        etag: value.etag,
+        release: value.release,
         schemaRevision: value.schemaRevision,
         exp: value.exp,
     });
 }
 function acceptIssuer(input) {
+    if (typeof input !== 'string') {
+        fail('DELIVERY_CLAIMS_INVALID', 'Delivery claims issuer is invalid.');
+    }
     try {
-        return acceptIssuerId(String(input));
+        return acceptIssuerId(input);
     }
     catch (cause) {
         if (cause instanceof AuthValueError) {
@@ -52,10 +66,3 @@ function acceptIssuer(input) {
         throw cause;
     }
 }
-function deepFreeze(value) {
-    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
-        return value;
-    for (const nested of Object.values(value))
-        deepFreeze(nested);
-    return Object.freeze(value);
-}

package/dist/release/delivery/delivery.d.ts

@@ -0,0 +1,11 @@
+import type { DomainRelease } from '../release.js';
+import type { Attestation } from './attestation.js';
+/** The challenge-bound envelope carrying the exact `DomainRelease` a Kernel asked for. */
+export interface Delivery {
+    readonly format: 'astrale.domain.delivery';
+    readonly version: 2;
+    readonly release: DomainRelease;
+    readonly attestation: Attestation;
+}
+/** Admit one Delivery v2 envelope: its release is admitted whole, its attestation stays opaque. */
+export declare function accept(input: unknown): Delivery;